introduction To DDOS attack (HD) - how to hack server

Introduction To DDOS attack video tutorial   OR distributed denial-of-service attack (explanation with demo) this attack is almost undetectable over the web so recent news "Google announced it had built "Project Shield" to help small websites stay online during DDoS (distributed denial of service) strikes" so we need to know what this ddos do and how it work u will learn all in this tut. for more visitn 

How to become anonymous on Internet and access any block site

Hotspot Shield protects your entire web surfing session; securing your connection at both your home Internet network & Public Internet networks (both wired and wireless). Hotspot Shield protects your identity by ensuring that all web transactions (shopping, filling out forms, downloads) are secured through HTTPS. Hotspot Shield also makes you private online making your identity invisible to third party websites and ISP’s. Unless you choose to sign into a certain site, you will be anonymous for your entire web session with Hotspot Shield. We love the web because of the freedom that it creates to explore, organize, and communicate. 
Hotspot Shield enables access to all information online, providing freedom to access all web content freely and securely. Secure your entire web session and ensure your privacy online; your passwords, credit card numbers, and all of your data is secured with Hotspot Shield. Standard antivirus software protects your computer, but not your web activities.
That's why Anchor Free is pleased to offer Hotspot Shield. Our application keeps your Internet connection secure, private, and anonymous.

100% Security Through a VPN

Hotspot Shield creates a virtual private network (VPN) between your laptop or iPhone and our Internet gateway. This impenetrable tunnel prevents snoopers, hackers, ISP’s, from viewing your web browsing activities, instant messages, downloads, credit card information or anything else you send over the network. Hotspot Shield security application is free to download, employs the latest VPN technology, and is easy to install and use.

Hotspot Shield runs on:

• Windows 7
• Windows XP
• Windows 2000
• Windows Vista
• Mac OS X (10.5 Leopard)
• Mac OS X (10.6 Snow Leopard)
• Mac OS X (10.7 Lion)

You will be able to download this software on given link DOWNLOAD NOW

NOTE: - This tutorial is only for learning purpose and i am not responsible for any type of harm.

Basic of Password Cracking for Beginner

Password cracking is the process of recovering secret passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password.


Most passwords can be cracked by using following techniques :
1) Hashing :- 

Here we will refer to the one way function (which may be either an encryption function or cryptographic hash) employed as a hash and its output as a hashed password.
If a system uses a reversible function to obscure stored passwords, exploiting that weakness can recover even 'well-chosen' passwords.
One example is the LM hash that Microsoft Windows uses by default to store user passwords that are less than 15 characters in length.
LM hash breaks the password into two 7-character fields which are then hashed separately, allowing each half to be attacked separately.

Hash functions like SHA-512, SHA-1, and MD5 are considered impossible to invert when used correctly.

2) Guessing :- 

Many passwords can be guessed either by humans or by sophisticated cracking programs armed with dictionaries (dictionary based) and the user's personal information.

Not surprisingly, many users choose weak passwords, usually one related to themselves in some way. Repeated research over some 40 years has demonstrated that around 40% of user-chosen passwords are readily guessable by programs. Examples of insecure choices include:

* blank (none)
* the word "password", "passcode", "admin" and their derivatives
* the user's name or login name
* the name of their significant other or another person (loved one)
* their birthplace or date of birth
* a pet's name
* a dictionary word in any language
* automobile licence plate number
* a row of letters from a standard keyboard layout (eg, the qwerty keyboard -- qwerty itself, asdf, or qwertyuiop)
* a simple modification of one of the preceding, such as suffixing a digit or reversing the order of the letters.
and so on....

In one survery of MySpace passwords which had been phished, 3.8 percent of passwords were a single word found in a dictionary, and another 12 percent were a word plus a final digit; two-thirds of the time that digit was.
A password containing both uppercase & lowercase characters, numbers and special characters too; is a strong password and can never be guessed.

Check Your Password Strength

3) Default Passwords :- 

A moderately high number of local and online applications have inbuilt default passwords that have been configured by programmers during development stages of software. There are lots of applications running on the internet on which default passwords are enabled. So, it is quite easy for an attacker to enter default password and gain access to sensitive information. A list containing default passwords of some of the most popular applications is available on the internet.
Always disable or change the applications' (both online and offline) default username-password pairs.

4) Brute Force :- 

If all other techniques failed, then attackers uses brute force password cracking technique. Here an automatic tool is used which tries all possible combinations of available keys on the keyboard. As soon as correct password is reached it displays on the screen.This techniques takes extremely long time to complete, but password will surely cracked.
Long is the password, large is the time taken to brute force it.

5) Phishing :- 

This is the most effective and easily executable password cracking technique which is generally used to crack the passwords of e-mail accounts, and all those accounts where secret information or sensitive personal information is stored by user such as social networking websites, matrimonial websites, etc.
Phishing is a technique in which the attacker creates the fake login screen and send it to the victim, hoping that the victim gets fooled into entering the account username and password. As soon as victim click on "enter" or "login" login button this information reaches to the attacker using scripts or online form processors while the user(victim) is redirected to home page of e-mail service provider.


Never give reply to the messages which are demanding for your username-password, urging to be e-mail service provider.

It is possible to try to obtain the passwords through other different methods, such as social engineering, wiretapping, keystroke logging, login spoofing, dumpster diving, phishing, shoulder surfing, timing attack, acoustic cryptanalysis, using a Trojan Horse or virus, identity management system attacks (such as abuse of Self-service password reset) and compromising host security.
However, cracking usually designates a guessing attack.

Top 10 Password Cracking tool

1. Cainand Abel : The toppassword recovery toolfor Windows UNIX users often smuglyassert that the best freesecurity tools supporttheir platform first, andWindows ports are often

an afterthought. They are usually right, but Cain &Abel is a glaringexception. This Windows-only password recoverytool handles an enormousvariety of tasks. It can recover passwords bysniffing the network,cracking encryptedpasswords usingDictionary, Brute-Forceand Cryptanalysis attacks, recording VoIPconversations, decodingscrambled passwords,revealing passwordboxes, uncovering cachedpasswords and analyzing routing protocols

2. John theRipper : Apowerful, flexible, andfast multi-platformpassword hash cracker Johnthe Ripper is a fast password cracker,currently available formany flavors of Unix (11are officially supported,not counting differentarchitectures), DOS, Win32, BeOS, and OpenVMS. Itsprimary purpose is todetect weak Unixpasswords. It supportsseveral crypt(3) passwordhash types which are most commonly found onvarious Unix flavors, aswell as Kerberos AFS andWindows NT/2000/XP LMhashes

3. THC Hydra : A Fastnetwork authentication cracker which supportmany different services Whenyou need to bruteforce crack a remoteauthentication service,Hydra is often the tool of choice. It can performrapid dictionary attacksagainst more then 30protocols, including telnet,ftp, http, https, smb,several databases, and much more

4. Aircrack : Thefastestavailable WEP/WPAcracking tool Aircrack is a suiteof toolsfor 802.11a/b/g WEP and WPA cracking. It canrecover a 40 through 512-bit WEP key once enoughencrypted packets have beengathered. It can alsoattack WPA 1 or 2 networks using advancedcryptographic methods orby brute force. The suiteincludes airodump (an 802.11packet captureprogram), aireplay (an 802.11 packet injectionprogram), aircrack (staticWEP and WPA-PSKcracking), and airdecap(decrypts WEP/WPAcapture files)

5. L0phtcrack : Windowspassword auditing andrecovery applicationL0phtCrack, also knownas LC5, attempts to crackWindows passwords from hashes which it canobtain (given properaccess) from stand-aloneWindows NT/2000workstations, networkedservers, primary domain controllers, or ActiveDirectory. In some cases itcan sniff the hashes off thewire. It also hasnumerous methods ofgenerating password guesses (dictionary, bruteforce, etc). LC5 wasdiscontinued by Symantec in2006, but you can stillfind the LC5 installerfloating around. The free trial only lasts 15 days,and Symantec won't sellyou a key, so you'll eitherhave to cease using it orfind a key generator.Since it is no longer maintained, you areprobably better offtrying Cain and Abel, John theRipper, or Ophcrackinstead.

6. Airsnort : 802.11WEP Encryption Cracking ToolAirSnort is a wireless LAN(WLAN) tool thatrecovers encryption keys.It was developed by theShmoo Group and operates by passivelymonitoring transmissions,computing the encryptionkey when enoughpackets have beengathered. You may also be interested in the similarAircrack.

7. SolarWinds : Aplethoraof network discovery/monitoring/attack toolsSolarWinds has created and sells dozens of special-purpose tools targeted atsystems administrators.Security-related toolsinclude many networkdiscovery scanners, an SNMP brute-force cracker,router passworddecryption, a TCPconnection reset program,one of the fastest and easiestrouter config download/uploadapplications available andmore.

8. Pwdump : A windowpassword recovery toolPwdump is able to extractNTLM and LanMan hashes from a Windows target,regardless of whetherSyskey is enabled. It isalso capable of displayingpassword histories if theyare available. It outputs the data in L0phtcrack-compatible form, and canwrite to an output file.

9.RainbowCrack : AnInnovative PasswordHash Cracker The RainbowCrack tool isa hash cracker that makesuse of a large-scale time-memory trade-off. Atraditional brute forcecracker tries all possible plaintexts one by one,which can be timeconsuming for complexpasswords.RainbowCrack uses atime-memory trade-off to do all the cracking-timecomputation in advanceand store the results in so-called "rainbow tables". Itdoes take a long time toprecompute the tables but RainbowCrack can behundreds of times fasterthan a brute force crackeronce the precomputationis finished.

10 Brutus : Anetwork brute-force authenticationcracker This Windows-onlycracker bangs againstnetwork services ofremote systems trying toguess passwords by using a dictionary and permutationsthereof. Itsupports HTTP, POP3, FTP,SMB, TELNET, IMAP, NTP,and more. No source codeis available. UNIX users should take a look at THCHydra.

WiFiSlax v4.3 Final (WiFi Hack BootCD) | 551 Mb

WiFiSlax v4.3 Final (WiFi Hack BootCD) | 551 Mb

WifiSlax is a type of Slax OS made exclusively for wireless hacking. It comes with a bunch of wireless tools preloaded into it. These include Aircrack, Airsnort, kismet, madwifi drivers and many more…
Features
- Focused on Wireless Audit
- Latest tools for Wireless Audit
- Drivers of the most common chipsets in our laptops (innovating with packet injection support)
- Ease of use for the uninitiated in GNU/Linux
- Launchers and GUI tools
- GNU/Linux distribution
- Debian Stable based
- Nowadays, not only Wireless Security: /NETWORK VULNERABILITY & PENTESTING /BLUETOOTH /RFID /IRDA /SERIAL PORT /CRACKING /REVERSING /FORENSIC
- Compatible with other system
- GRUB as boot loader
- Live CD/DVD/USB
- Kernel 2.6.32.5 SMP
- KDE 3.5.10|KDE 4? Compiz Fusion included Drivers ATI / Drivers NVIDIA
- Automount new drives RO/RW over NTFS, HFS and NAS
- Automount new devices Wireless devices / mouse / etc
- Ease of use regardless of driver
- Launch GUI: Broadcom bcm43xx Intel IPW2200, IPW3945, IPW4965 Ralink rt2570, rt73 Prism, Prism2 Realtek rt8180/rt8185, rt8187 Atheros mode managed, monitor, master
- Problems with your chipset? usbview, lsusb, lspci, dmesg, etc…
- Audit & security tools
- Wireless chipsets for auditing & pentesting
- Wireless tools Kismet, machanger, aircrack-ng, aircrack-ptw, etc
- Cryptanalysis tools (WEP/WPA/WPA2, cookie entropy, etc)

Basic Instructions:
1)Boot from cd
2)Get the wep key
3)Write it down
4)Reboot into windows
5)Connect using wep key.

Download Links:

Part 1             

  Part 2

 

Hacking Facebook Account with just a text message

Can you ever imagine that a single text message is enough to hack any Facebook account without user interaction or without using any other malicious stuff like Trojans, phishing, keylogger etc. ?

Today we are going to explain you that how a UK based Security Researcher, "fin1te" is able to hack any Facebook account within a minute by doing one SMS.

Because 90% of us are Facebook user too, so we know that there is an option of linking your mobile number with your account, which allows you to receive Facebook account updates via SMS directly to your mobile and also you can login into your account using that linked number rather than your email address or username.

According to hacker, the loophole was in phone number linking process, or in technical terms, at file /ajax/settings/mobile/confirm_phone.php

This particular webpage works in background when user submit his phone number and verification code, sent by Facebook to mobile. That submission form having two main parameters, one for verification code, and second is profile_id, which is the account to link the number to.

As attacker, follow these steps to execute hack: 

1. Change value of profile_id to the Victim's profile_id value by tampering the parameters.
2. Send the letter F to 32665, which is Facebook’s SMS shortcode in the UK. You will receive an 8 character verification code back

 

 

3.Enter that code in the box or as confirmation_code parameter value and Submit the form.

 

 

Facebook will accept that confirmation code and attacker's mobile number will be linked to victim's Facebook profile.

In next step hacker just need to go to Forgot password option and initiate the password reset request against of victim's account.

Attacker now can get password recovery code to his own mobile number which is linked to victim's account using above steps. Enter the code and Reset the password!

Facebook no longer accepting the profile_id parameter from the user end after receiving the bug report from the hacker.

In return, Facebook paying $20,000 to fin1te as Bug Bounty.

List of Free VPN Service Providers

Why You Need VPN ?

• To protect privacy, either on a LAN or a public hotspot.
• Anonymous Internet Surfing
• Full anonymity by hiding your real IP address.
• Bypass geographical blocks from certain websites
• Unlike a proxy, you get secured connection for all programs you are using
• Quality Network ensures your VPN service will be fast wherever you are in the world
• Protection against your ISP
• Bypass ISP Blocking for VOIP Applications like Skype

1. UltraVPN

It is a free VPN client/server SSL VPN solution based on OpenVPN. It encrypts and anonymizes your network connection making your connection safe and secure.

You need to download nad install the client and create a (username, password) to use this service.

2. AloneWeb

AloneWeb is a completely free VPN service thru which you can access your favorite sites which are blocked by system admin or someone. If you use Internet in unsecured Wi-Fi area, then you can use these VPN services to hide your IP address and access sites securely. This is a free of charge service which is also reliable.

3. FreeVPN

With FreeVPN, you can access Sites from USA, UK, Canada, Germany, Italy, Sweden, France, China without any issue. Access blocked sites like hulu.com, pandora.com, ABC.com, BB.co.uk and much more even when you are in other country. Blocked sites are accessible without any problem.

4. CyberGhost

CyberGhost offers 1 GB per month free access of Internet, even for blocked sites. You can try CyberGhost because 1 GB is also good amount of traffic space. You can upgrade to premium version which stats from 14.26 USD.

5. Hotspot

Hotspot Shield is a free VPN service which can be used for accessing Internet even by hiding your own IP address. It is available for PC (Windows XP, Vista, Windows 7) as well as Mac. For anonymous use of Internet, you can use Hotspot Shield VPN service.

6. JAP aka JonDo

Jap is a research project which offers free VPN service. You can use this service to connect thru Internet and access your favorite sites. The service is not much reliable but you can use this one in case other doesn’t work.

7. GPass

Another great yet free VPN service. GPass is a really cool VPN where you can stream audio/video, email, instant messaging line Window messenger etc without any problem. Even you can use Download Manager to download stuffs from your favorite place.

8. LogMeIn Hamachi

LogMeIn is a well known remote desktop support provider. They also offer free VPN service under Hamachi name thru which you can access blocked sites from your office area or blocked area. Use this VPN service in Wi-Fi area to access sites securely.

9. Its Hidden

Another free VPN service provider. You don’t need any software to install. Use the secured connection on Its Hidden to access your favorite sites without any issue. They offer

10. Packetix.NET

This VPN technology is developed by SoftEther Corporation. You can use this test server for free access of your favorite sites and blocked sites in different geographic locations. You can access Internet from Unsecured locations like Wi-Fi enabled Hotels, Airports and even on untrustworthy ISPs.

11. HideipVPN

It is a free VPN service for US / UK sites. You can stat browsing anonymously by using this free service. HideipVPN offers limited number of free accounts every month. Currently they are offering 100 free accounts every month starting from 1’st of each month at 10:00AM GMT+2. So get ready to have a free account on 1‘st of this month.
Do you use VPN clients for Internet access or accessing your favorite sites blocked on certain locations? Share your favorite free VPN service which you use frequently.

12. Your Freedoom

This one is basically not a VPN service but its performs almost the same function with great ease, hence i included this in this list.

It provides both a free and paid service. Free service limits to six hours of usage per day (up to 18 hours per week). You need to install a client on your system and a user name & password to use this.

13. Loki Network Project

Loki Network Project is free VPN service and SSL based free VPN server. It is an opportunity to protect your private data (IP address, e-mail/FTP/HTTP passwords, web-sites visited, uploaded/downloaded files and etc…) and bypass certain Internet access limitations you may have at your location.

You need to download and install its free VPN Client software to create your own security schema.

14. ACEVPN

Ace VPN allows you to privately and securely surf and download on the internet without leaving a trace and/or being tracked. Ace VPN is the lowest cost VPN service provider allowing access to the gateway servers in multiple locations at no extra cost.

15. SecurityKiss

SecurityKiss is a tunnel service which ensures security and privacy once your data leaves your computer. It redirects all your traffic through an impenetrable tunnel to our security gateway. Everything in the tunnel is encrypted.

16. USA IP

For free user, you don’t need to register, just download the USAIP.pbk file, and then double-click on the file and select one of the USAIP PPTP connections. After that, you can access the USA IP free VPN services with the username demo and the password demo. But you will need to reconnect the USA IP network after every 7 minutes.

17. MacroVPN

A new player in the VPN field. MacroVPN does provide a Free VPN service, but it is more like an extended trial. There is a limit of 2GB traffic and 256kbps speed.
Do you know any other Free VPN service? Do share it by commenting below. If you see that any of the above services is down or closed, do let us know.

18. FREEDUR

19. LINKIDEO

Just a word of caution for everyone here. The free VPN services may not be as good as the paid ones. You may experience slow speed, downtimes etc. But its all like, you dont need them everytime. Just check them out and leave your feedback here. I would love to hear from you.

intro to Dictionary Attacks

  Dictionary Attacks

A dictionary attack is when a text file full of commonly used passwords, or a list of every word from the dictionary is used against a password database. Strong passwords usually aren’t vulnerable to this kind of attack. In the following example, I will use Brutus, a very common password cracker, to show a dictionary attack against an ftp server. Brutus is a Windows only program, but at the end of this chapter I will list a couple more password crackers, some of which are made for Mac, Windows, and Linux.
Dictionary Attacks

Before I get into the example, you must first know what an FTP server is. FTP stands for File Transfer Protocol. FTP is a simple way to exchange files over the internet. If a hacker got FTP access to my website, he could delete/upload anything he wants on my server. An FTP address looks similar to a website address except it uses the prefix ftp:// instead of http://. I set up an FTP server on my computer so I could demonstrate. You can get Brutus at http://www.hoobie.net/brutus/

1. First the hacker would choose a target. In this case it’s my home computer and the IP address for your home computer is 127.0.0.1 .
2. By going to ftp://127.0.0.1 I get a pop-up box asking for a username and password. 

3. Next the hacker would launch a program similar to Brutus and attempt to crack the password.

4. In the target you put the IP address of the website and to the right select the appropriate option, which in this case is FTP.
5. The default port is 21 but some websites change this to make them a little more secure. If you find out that the port isn’t 21, you can find the right one by doing a port scan. We will get into this later in the book.
6. If you don’t know any of the usernames for the FTP server, then you will have to get a list of the most common usernames.
7. For a dictionary attack you will have to choose the pass mode Word List and browse and select the file containing your word list. You can get some good password lists at http://packetstormsecurity.org/Crackers/wordlists/ .

8 .Once you hit Start the program will attempt to connect to the server and begin to try all the possible combinations from your lists.

9.If you’re lucky, eventually it’ll get the right Username:Password combination. As you can see below, it got the correct combination of username – admin and password – password.

10. A smarter hacker would use a proxy when using a program like this. What a proxy does is cloaks your IP address by sending your connection request through another computer before going to the target. This is a smart idea because as you will see in the image below, Brutus leaves a huge log of your presence on the target server.

Introduction to Social Engineering world

What is Social Engineering?

Social engineering is the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques.[1] While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access; in most cases the attacker never comes face-to-face with the victim.


"Social engineering" as an act of psychological manipulation was popularized by hacker-turned-consultant Kevin Mitnick. The term had previously been associated with the social sciences, but its usage has caught on among computer professionals.
Example 1: You receive an e-mail where the sender and the manager or someone on behalf of the support department of your bank.

In the message he says that the Internet Banking service is presenting a problem and that this problem can be corrected if you run the application attached to this message.

The implementation of this application presents a screen similar the one you use to access bank account, waiting for you to type your password. In fact, this application is prepared to steal your password to access the bank account and sends it to the attacker.



Some Examples
Example 1: You receive an e-mail where the sender and the manager or someone on behalf of the support department of your bank.

In the message he says that the Internet Banking service is presenting a problem and that this problem can be corrected if you run the application attached to this message.

The implementation of this application presents a screen similar the one you use to access bank account, waiting for you to type your password. In fact, this application is prepared to steal your password to access the bank account and sends it to the attacker

Example 2: You receive an e-mail saying that your computer is infected by a virus. The message suggests that you install a tool available on an Internet site, to eliminate the virus from your computer.

The real function of this tool and does not eliminate a virus, but I give someone access to your computer and all data stored on it.

Example 3: a stranger calls your house and says it is the technical support of your ISP.
In this connection he says that his connection to the Internet is presenting a problem and then, ask your password to fix it. If you give your password, this so-called technical can perform a multitude of malicious activities, using your access account
Internet and therefore such activities relating to its name.

Practical Examples:

Retail Paging Systems
---------------------
Wal-Mart store phones have clearly marked buttons for the paging system. Wal-Mart is
the exception, not the rule. So how do you get on the paging system to have a little
fun when you're bored out of your mind shopping with your girlfriend? Social
engineering, my whipped friend. Find a phone and dial an extension, preferably the
store op. The key here is to become a harried employee, saying something similar
to..."This is Bill in shoes. What's the paging extension?" More often than not,
you'll get the extension without another word. Now, get some by saying something
sweet over the intercom.

Airport White Courtesy Phones
-----------------------------
Imagine you've already been stripped searched and you're waiting for your delayed
flight. Naturally, you gravitate to a phone. Is it white? Then you've got a free
call right in front of you. Just pick up to get the op. "This is Bill at Southwest,
Gate A5. We're swamped and our phones are tied. Can I get an outside line?" If
the phone does not have DTMF, or the op wants to dial the call for you, do not call
a number related to you.

Hotels
------
Hotels hold such promise. Some hotels have voice mail for each room, guests
receiving a PIN when they check in. Hotels also have "guest" phones; phones outside
of rooms that connect only to rooms or the front desk. Pick up a guest phone, make
like a friendly guest and say, "I forgot my PIN. Could I get it again? Room XXX."
Knowing the registered name of the target room helps, for the Hotel and Restaurant
Management Degree Program graduate may ask for it.

Do not follow through with the next social engineering example. Or, like the author,
try it on a friend. Go to the front desk and tell the attendant that you've locked
your key (card) in the laundromat, in your room, lost it, etc. Do not try this with
the attendant that checked you in. And again, do not enter someone's room without
permission.


Calling Technical Support
-------------------------
So you've found a new-fangled computerized phone and you want to learn more about it.
Do the same thing you do when you have trouble with your AOL - call tech support.
First, do a little planning (after getting the tech support number off of the phone
or the web). Get some info on the phone, like phone number, model number, other
identifying numbers, etc. Also, know the name of the facility in which the phone is
located. Now that you've got some ammo, you're ready to make the call. Posing as an
employee of the facility, call tech support and make up a problem for the phone
you've identified. Act a little dumb and be apologetic, acting like you don't want
to waste their time. All the while, pumping them for information - "I hate to bug
you for this, but <insert problem here>." <You'll get some info from tech support
here.> <Build on what you've learned and curiously ask another question.> And so
on until you reach the point where you can feel that it's time to end the call.
Occasionally acting amazed at their knowledge may be helpful.

Methods of Social Engineering

Phishing
Phishing is a technique of fraudulently obtaining private information. Typically, the phisher sends an e-mail that appears to come from a legitimate business — a bank, or credit card company — requesting "verification" of information and warning of some dire consequence if it is not provided. The e-mail usually contains a link to a fraudulent web page that seems legitimate — with company logos and content — and has a form requesting everything from a home address to an ATM card's PIN.

For example, 2003 saw the proliferation of a phishing scam in which users received e-mails supposedly from eBay claiming that the user's account was about to be suspended unless a link provided was clicked to update a credit card (information that the genuine eBay already had). Because it is relatively simple to make a Web site resemble a legitimate organization's site by mimicking the HTML code, the scam counted on people being tricked into thinking they were being contacted by eBay and subsequently, were going to eBay's site to update their account information. By spamming large groups of people, the "phisher" counted on the e-mail being read by a percentage of people who already had listed credit card numbers with eBay legitimately, who might respond.

Vishing or Phone Phishing:
This technique uses an Interactive Voice Response (IVR) system to recreate a legit sounding copy of a bank or other institution's IVR system. The slave is prompted to call in to the "bank" via a phone number provided in order to "verify" information.

Baiting
Baiting is like the real-world Trojan Horse that uses physical media and relies on the curiosity or greed of the slave. In this attack, the attacker leaves a malware infected floppy disc, CD ROM, or USB flash drive in a location sure to be found, gives it a legitimate looking and curiosity-piquing label, and simply waits for the slave to use the device.

Quid pro quo
Quid pro quo means something for something:

* An attacker calls random numbers at a company claiming to be calling back from technical support. Eventually they will hit someone with a legitimate problem, grateful that someone is calling back to help them. The attacker will "help" solve the problem and in the process have the user type commands that give the attacker access or launch malware.

* In a 2003 information security survey, 90% of office workers gave researchers what they claimed was their password in answer to a survey question in exchange for a cheap pen. Similar surveys in later years obtained similar results using chocolates and other cheap lures, although they made no attempt to validate the passwords.

How to create a Super Hidden folder using command prompt

How to create a Super Hidden folder using command prompt

How To Hack Using Man In The Middle Attack | SSL Hacking

Hello hacker Friends this is one of the most common attack that most hacker do to amaze people and i am gonna make it simple for you all so that you can enjoy it and try to learn this is attack so are you all ready so lets start . every one know about http attack but this is SSL means https attack nice trick  so lets begin .. :D u can watch my video on youtube ;) 

Tools Needed:

 SSL strip: You can search Google for SSL strip it comes both in windows and Linux versions . I will be using the windows version in this tutorial

 Ettercap to carry out mitm attacks..

Steps to Perform MITM Attack

1. Open SSL strip and fill in all the required information for arpsoof, network ,ssl strip, change data .If you don’t know what to enter simply click auto check . remember to check if HTTPS to HTTP is included in Change data , finally click ok 

2.Now select the victim’s IP and click open

3. Now open ettercap go to sniff -unsniffed sniffing and select your network interface and click ok 

4. Now select hosts-scan hosts .Once scanning is completed .Open host list from hosts tab .Now select the IP address of the router as target 1 and the victims IP as target 2

5. Now select mitm-arp poisoning and click ok as shown 

 6. Finally select start-start sniffing .Now when the victim logs into gmail he will be using HTTP and not HTTPS Hence we are able to get the User id ,passwords 

way2h security steps:-
1. whenever you perform an online transaction such as Credit card payment, Bank login or Email login always ensure that you Use HTTPS 

2. Always check the SSL certificate before doing an online transaction

Stay Safe.Enjoy !!
For Educational Purpose Only

SMAC : THE MAC ADDRESS CHANGER

SMAC : THE MAC ADDRESS CHANGER 

 

SMAC is a powerful and easy to use MAC Address Changer (Spoofer) for Windows systems, regardless of whether the network card manufacturers allow this option or not. Its features include:

• Automatically Activate new MAC Address after changing it
• Show the manufacturer of the MAC Address 
• Randomly Generate any New MAC Address or based on a selected manufacturer
• Pre-load MAC Addresses List and choose the new MAC address from the list.
• IPConfig button - click to show network adapter (IPConfig) info to confirm changes
• User-friendly GUI

Download here:

http://download.cnet.com/SMAC-MAC-Address-Changer/3000-2085_4-10536535.html

 

Ultimate hack pack 2:

Ultimate hack pack 2:
Apache Hacking TooLz Directory:
Apache Chunked Scanner
Apache Hacker Tool v 2.0
Apache H4x0r Script

Remote File Inclusion And Remote Command Execution Directory :
IIS 5 Dav Scanner & Exploiter
PHP Attacker
PHP Injection Scanner & Exploiter
XML-RPC Scanner & Exploiter

Databases & SQL Injection & XSS TooLz Directory:
Casi 4.0
ForceSQL
Mssql BruteForce TooL
SQL Ping 2
SQL Recon
SQL Vuln Scanner
SQL & XSS TooL

PHP Shells:
rootshell v2.0
c99shell #16
Backdoor php v0.1
r57shell
ajan
casus15
cmd (asp)
CyberEye (asp)
CyberSpy5 (asp)
Indexer (asp)
Ntdaddy (asp)
News Remote PHP Shell Injection
PHP Shell
phpRemoteView
nstview php shellb

http://uploading.com/files/d6b672f7/%20Ultimate_H4ack_p4ck_2.rar/

EMAIL SPAMMER

I though it would be interesting to share it here with you guys.

And use these email bombers in your dirty job:

I FOUND THIS FKING LIST OF BOMBER SO PLEASE SKIP THE ADD  ITS NOT MY OWN LINK SORRY FOR THAT 

1st Mass Mailer 4.2
This tool will help you to mass spam emails. Little bit complicated but very very effective.
Serial: "18935379480889"
Download

1st Mass Mailer 6.4
This tool will help you to mass spam emails. Little bit complicated but very very effective.
Thanks to elvinguitar for the serial
Download

Mess Bomber
This is also a spammer bot. Same as the previous one , can be used to spam any email you want quickly and easily.
Download

Fill-er-up collection
This 3 softwares are spammers. you can use these tools to spam any email you want very quickly and in only few steps. Ability to attach a file and to stop any time you want. Very effective. All credit go to Nathan72389
Download

Bomb Them!
This is also a spammer bot. Same as the previous one , can be used to spam any email you want quickly and easily. Ability to attach a file and to stop any time you want. All credit go to Nathan72389
Download

72389 Email Bomber
This tool will help you to spam any email you want. This one is special because you have the ability to spam from different email at the same time. All credit go to Nathan72389
Download

Vallen emailer
This tool will help you to spam the emails you want. Ability to choose between a rich text or an html text. Also you can attack files to the message. Try it from here
Download

BOMB MOBILE PHONE WITH SMS : BEAVER'S SMS BOMBER PRO | way2hackintosh

BOMB MOBILE PHONE WITH SMS : BEAVER'S SMS BOMBER PRO

note:- I AM NOT RESPONSIBLE FOR ANY KIND OF DAMAGE U MAKE 

This program will bomb the victim's mobile phone with tons of SMS. It supports all major networks around the world. But if your network is not in the list, then don't worry, you can also add the carrier network with the help of "custom" option. You can also load list of multiple victims and bomb them simultaneously. The improvement that Beaver has made in this version over his previous SMS Bomber is that you can spoof the email address from which you are bombing the victim's mobile phone. For Example, If there was an error sending the message, it will ask you if you wanna change the E-mail/Password you are using. All credits to Beaver for this nice program.

Download here 

JUST CLICK HERE AND FINE IT

or
http://www.mediafire.com/?oyicf11y9n11y9v 

comment for broken link 

Website Hacking Tools Collection

Includes:
- Easy SQL Injection Tool
- MySQLi Dumper v1.4 Alpha
- Server Attack
- Shell upload video
- SQLi Helper v2.5
- Super Scan 4
- Link to web-page that finds the admin log-in page of any site
- c100 shell (php file)
- Cain and Abel
- SQL Injection detailed tutorial. Watch it together with Mathias's SQL Injection tutorial, and you'll master it in no time!
- Nessus
- Nmap
- WhoIs
- Ethereal v0.99

 FileFactory Mirror:

Code:

http://www.filefactory.com/file/agh3488/n/_Website_hacking_7z

TurboUpload Mirror:

Code:

http://www.turboupload.com/yf1fukydnu3r/^^_Website_hacking.7z.html

Password:

Code:

"gamefreak" or maybe its "Gamefreak"

Enjoy!

 

Hack a WiFi Network In 8 Easy Steps.( Using Windows)

It takes about 5-6 hours if the password is weak a high signal of the WiFi network you are going to hack and you have sometimes 10-12 for more complicated passwords and if the WiFi signal of the Network is weak .The time taken also changes if the WiFi network you are going to hack has many other clients already accessing it .  

those who know how to hack using backtrack please don't laugh its for beginner 
Tools needed :

Packet sniffer:
* Commview for WiFi ( check it website and see if ur wifi card is supported https://www.tamos.com/

products/commwifi/adapterlist.php )
{ get the 30 day trial or use the free full version available on net from other sites.) (i recomment the 30 day trial because it will be the latest ) after it expires y can always go to other means.

You will use this tool for capturing the packets sent and recieved through the Access Point you are going to hack .The more packets you capture the better chances of cracking the password .You will need more than 1,00,000 minium packets to crack the password .The packets will be captured in the .ncp format .You will use this tool to convert the .ncp to .cap .

NOT MANY NETWORK CARDS ARE SUPPORTED SO PLEASE CHECK YOUR NETWORK ADAPTER IN DEVICE MANAGER. IF it is not supported then there is no other option then to use backtrack with extra hardware.

Decrypter :

* Aircrack suite (http://www.aircrack-ng.org/)
You will use this tool to crack the password of the Access Point using the . Cap files you obtained from the Commview application .

NOTE  :
You will need a packet sniffing program (we will use Commview for WiFi) and not airodump-ng ( already integrated in aircrack suite).

Or if YOU can get another packet sniffer that support your card then use it instead of commonview.

Now Get Ready to Hack :

Step 1 : Install CommView for WiFi . It doesnt matter whether you install it in VoIP mode or Standard mode . I used VoIP . It automatically installs the necessary drivers . Allow it to install .

Note :- You will not be able to connect to any Network using WiFi when using CommView .

Step 2 : Click on the PLAY ICON in the Left First .

Step 3 : (Choosing the Network (a) ) : A new window should pop up now. Click on the START SCANNING button .

 

 

Step 4 : (Choosing the Network (b) ) : Click on the WiFi network you want to hack in the Right Coulumn and Click on CAPTURE.

Note :- This tutorial is only for WEP protected networks .

 

 Step 5 : (Capturing the Packets) : The windows should close now and you should see that CommView has started Capturing Packets .

 Step 6 : (Saving the Packets ) : Now that the Packets are getting captured you need to Save them. Click on Settings->Options->Memory Usage Change Maximum Packets in buffer to 20000.

 

 

 

 

Click on the LOGGING Tab .

Check AUTO-SAVING
In the Maximum Directory Size : 5000
Average Log File Size : 50

 

 

Now CommView will automatically Start Saving packets in the .ncp format at a size of 20MB each in the specified directory .

Step 7 : ( Concatenating the Logs ) : Since you are capturing a lot of logs you will need to concatenate them into once file . To do this go to Logging and click on CONCATENATE LOGS Choose all the files that have been saved in your specified folder and Concatenate them .

Now you will have one .ncf file .

Step 8 : (Converting .ncf to .cap ) : Now that you have one file with all the packets you need to Convert it into .cap file for AIRCRACK to crack .

Click on File->Log Viewer->Load Commview Logs-> Choose the .ncf file. Now File->Export->Wireshark/TCP dump format .

Aircrack Part :

Now for the Second Part Cracking this is very simple . Just open the Aircrack Folder->Bin->Aircrack-ng GUI.exe Choose the .cap file and you should be able to do the others .

 Also select the encryption(WEP or others) and Key size (64). Press launch and the key will be revealed.

or try other settings if not working.