Secure Sockets Layer (SSL) - An Introduction

In the OSI model a reference model for effective communication we find a layer named transport layer. Just like a physical layer (where viruses attack normally) transport layer also need some sort of security because transport layer is responsible for transmission of data.

So what actually makes transport layer to make the transmission secure and to protect the data from any intruder.

Have you ever noticed that when you visit some website it starts with http:// and whenever you visit some sort of money transfer and other important websites you find https:// point is clear https means a secure communication it means that your data that transfer from this connection secure by using some cryptography techniques.

SSL or secure sockets layer are cryptographic protocols that provide secure communication over the Internet. So what actually a cryptography is " Cryptography is a science of secrete communication".

SSL uses two keys to encrypt data − a public key known to everyone and a private or secret key known only to the recipient of the message.  

HTTP VS HTTPS 

 

The above picture shows that when ALICE sends the confidential information over insecure channel that there is a chance to sniff this confidential information (it might be a credit card information or may be your password etc). So the point is that an attacker can easily sniff this data and can easily read, understand and use for illegal activities because the data transfer in plain text regardless of any encryption it is simply a HTTP connection. 

Now consider the second picture when an user send some sort of information over secure channel means if someone using HTTPS than the data first encrypt by using cryptography technique than it sends over channel, so in this case if someone sniff this data than he/she not able to understand it. 

The above broad picture has clearly shows that HTTPS is secure, but how HTTPS is secure? Because it uses secure sockets layer (SSL). A website can implement HTTPS by purchasing an SSL Certificate.

Where there's a will there's a way. By following this amazing quote some researcher has discovered some ways to crack/hack SSL certificate too. To hack SSL certificate we will post an article later on.

Read More

Hacking Windows Using Social Engineering Toolkit and Backtrack 5

What is Social Engineering Toolkit ?
The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was designed to be released with the http://www.social-engineer.org launch and has quickly became a standard tool in a penetration testers arsenal. SET was written by David Kennedy (ReL1K) and with a lot of help from the community it has incorporated attacks never before seen in an exploitation toolset. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test.


Actually this hacking method will works perfectly with DNS spoofing or Man in the Middle Attack method. Here in this tutorial I’m only write how-to and step-by-step to perform the basic attack, but for the rest you can modified it with your own imagination.  


In this tutorial we will see how this attack methods can owned your computer in just a few steps…
The success possibility of this attack depend on victim browser. If the victim never update their browser, the possibility can be 85% or more. 


Requirement : 
1.  Backtrack 5 or Backtrack 4


Step By Step : 
1. Change your work directory into /pentest/exploits/set/ 

2. Open Social Engineering Toolkit (SET) ./set and then choose "Website Attack Vectors" because we will attack victim via internet browser. Also in this attack we will attack via website generated by Social Engineering Toolkit to open by victim, so choose "Website Attack Vectors" for this options. 

3. Usually when user open a website, sometimes they don't think that they are opening suspicious website that including malicious script to harm their computer. In this option we will choose "The Metasploit Browser Exploit Method" because we will attack via victim browser. 

4. The next step just choose "Web Templates", because we will use the most famous website around the world that already provided by this Social Engineering Toolkit tools. 

5. There are 4 website templates Ready To Use for this attack methods, such as GMail, Google, Facebook, and Twitter. In this tutorial I will use Google, but if you think Facebook or Twitter more better because it's the most accessed website, just change into what do you want. 

6. For the next step…because we didn't know what kind of vulnerability that successfully attack the victim and what type of browser, etc, in this option we just choose "Metasploit Browser Autopwn" to load all vulnerability Social Engineering Toolkit known. This tools will launch all exploit in Social Engineering Toolkit database. 



7. For payload options selection I prefer the most use Windows Shell Reverse_TCP, but you also can choose the other payload that most comfortable for you. 



8. The next step is set up the Connect back port to attacker computer. In this example I use port 4444, but you can change to 1234, 4321, etc 

9. The next step just wait until all process completed and also wait until the server running. 

10. When the link given to user, the victim will see looks-a-like Google (fake website). When the page loads it also load all malicious script to attack victim computer. 



11. In attacker computer if there's any vulnerability in victim computer browser it will return sessions value that mean the exploit successfully attacking victim computer. In this case the exploit create new fake process named "Notepad.exe". 

12. To view active sessions that already opened by the exploit type "sessions -l" for listing an active sessions. Take a look to the ID…we will use that ID to connect to victim computer. 



13. To interract and connect to victim computer use command "sessions -i ID". ID is numerical value that given when you do sessions -l. For example you can see example in picture below. 

14. Victim computer already owned. I'm practice to create this tutorial using Virtual Machine so it will not harm other computer and also you can doing a lot of experience with your OS.

Read More

Darkcomet Crypter

Add Icon For Fud Result working with all rats and stlrs

File Info

Report date: 2011-04-23 10:12:40 (GMT 1)
File name: darkcomet-crypter-exe
File size: 1167360 bytes
MD5 Hash: 703fd6381d6585a2d5bcb499d8ca7119
SHA1 Hash: cf2d12fd5cb1feb3cede887d3176d00bc1064b62
Detection rate: 4 on 10 (40%)
Status: INFECTED

Detections

Avast -
AVG -
Avira AntiVir - TR/Dropper.Gen
ClamAV -
Comodo -
Emsisoft - HackTool.Win32.VB.jz!IK
F-Prot - W32/VBTrojan.17!Generic
Ikarus - HackTool.Win32.VB.jz
TrendMicro -
Zoner -

Scan report generated by

NoVirusThanks.org

Download

Read More

The Difference Between HTTP and HTTPS

HTTPS : Hyper Text Transfer Protocol Secure HTTPS is combination of Hyper Text Transfer Protocol and Secure Socket Layer protocol(SSL) / Transport Layer Security(TLS) to provide encrypted communication between web server and client. Usually HTTPS used for internet banking, payment transaction, login page, etc. This protocol use port 443 for communication.

Website that already use this protocol is GMail.com, and also other websites such as PayPal, Amazon, etc. 
Let's see the connection between our computer and web server when we made connection using HTTPS using netstat -an. 

As we can see from the picture, client computer opened random local ports and open port 443 on server side.   


Are HTTPS (Hyper Text Transfer Protocol Secure) Secure? 
To answer this question, let's see experiment below. 
In this experiment, there's 2 person in one wireless network BadGuy and NiceGuy. NiceGuy trying to open http://gmail.com then login into it. In different place, BadGuy is in the same wireless network with NiceGuy as shown in the picture below : 

When BadGuy trying to capture all packet data to/from access point, it will be different when NiceGuy using HTTPS for its connection. For more clear description, lets see the image below when NiceGuy Input username and password on GMail login page. 

as you can see in above picture, it's use https:// for connection between client and web server. Then we will see what BadGuy do after NiceGuy using HTTPS for his connection. This BadGuy really like Wireshark, so he try again to capture the data and hope there's something interesting there. 

BadGuy didn't find plain data there, every data send to / send from server is encrypted. The picture above is the login information(maybe) data that has already captured by BadGuy, but I think BadGuy cannot break the encrypted data only in a few days/months/year or maybe we can called "impossible" (we still didn't know when the possible time to break into it).   


HTTPS Conclusion 
Packet data sent using HTTPS is encrypted, anyone cannot see the packet data inside public network. That's why HTTPS usually used for banking or transaction on internet, and also login page or other page need to encrypt the data.

Read More

XtremeRAT v2.7.1

This is a tool that allow you to control your computer from anywhere in world.
With full support to Unicode language, you will never have problem using this software.
Here you can find new updates, informations and tutorials about this software.

Version 2.7 (18/05/2011) Last Update

- Added USB Spreader.
- Added Mouselogger.
- Added upload files and execute directly.
- Webcam function changed.
- Some language corrections.
- Select webcam and desktop capture functions to start automatically.
- New method to identify your servers.
- Corrected some bugs using preview images in File Manager.
- Upload files to FTP server using File Manager.
- Corrected some bugs using grab passwords function.

:scan:

File Info

Report date: 2011-05-20 17:48:33 (GMT 1)
File name: cliente-exe
File size: 3517440 bytes
MD5 Hash: 86a349f2becb28bead0cabcfc4264579
SHA1 Hash: 4bffdda39c1f78edcb4c90a6a03756ca424f7
Detection rate: 1 on 6 (17%)
Status: INFECTED

Detections

AVG -
Avira AntiVir -
ClamAV -
Emsisoft -
TrendMicro -
Zoner - TrojanDownloader.Delf.PYW

Scan report generated by

NoVirusThanks.org

DOWNLOAD

Read More