BLUETOOTH HACKING

Bluetooth Security

● Link manager security
● All security routines are inside the Bluetooth chip
● Nothing is transmitted in “plain text”
● Host stack security
● Interface for link manager security routines
● Part of the HCI specification
● Easy interface
● No further encryption of pin codes or keys

Security Modes

● Security mode 1
● No active security enforcement
● Security mode 2
● Service level security
● On device level no difference to mode 1
● Security mode 3
● Device level security
● Enforce security for every low-level connection

Linux and Bluetooth

# hciconfig -a
hci0: Type: USB
BD Address: 00: 02: 5B: A1: 88: 52 ACL MTU: 384: 8 SCO MTU: 64: 8
UP RUNNING PSCAN ISCAN
RX bytes: 9765 acl: 321 sco: 0 events: 425 errors: 0
TX bytes: 8518 acl: 222 sco: 0 commands: 75 errors: 0
Features: 0xff 0xff 0x8b 0xfe 0x9b 0xf9 0x00 0x80
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy: RSWITCH HOLD SNIFF PARK
Link mode: SLAVE ACCEPT
Name: ' Casira BC3- MM'
Class: 0x1e0100
Service Classes: Networking, Rendering, Capturing, Obj ect Transfer
Device Class: Computer, Uncategorized
HCI Ver: 1. 2 ( 0x2) HCI Rev: 0x529 LMP Ver: 1. 2 ( 0x2) LMP Subver: 0x529
Manufacturer: Cambridge Silicon Radio ( 10)
# hcitool scan
Scanning . . .
00: 04: 0E: 21: 06: FD AVM BlueFRITZ! AP- DSL
00: 01: EC: 3A: 45: 86 HBH- 10
00: 04: 76: 63: 72: 4D Aficio AP600N
00: A0: 57: AD: 22: 0F ELSA Vianect Blue ISDN
00: E0: 03: 04: 6D: 36 Nokia 6210
00: 80: 37: 06: 78: 92 Ericsson T39m
00: 06: C6: C4: 08: 27 Anycom LAN Access Point

Sniffing with hcidump
● Recording of HCI packets
– Commands, events, ACL and SCO data packets
● Only for local connections
● Decoding of higher layer protocols
– HCI and L2CAP
– SDP, RFCOMM, BNEP, CMTP, HIDP, HCRP and AVDTP
– OBEX and CAPI
● No sniffing of baseband or radio traffic

Security Commands
● HCI_Create_New_Unit_Key
● HCI_{Read|Write}_Pin_Type
● HCI_{Read|Write|Delete}_Stored_Link_Key
● HCI_{Read|Write}_Authentication_Enable
● HCI_{Read|Write}_Encryption_Mode
● HCI_Authentication_Requested
● HCI_Set_Connection_Encryption
● HCI_Change_Local_Link_Key
● HCI_Master_Link_Key

Pairing Functions
● Events
● HCI_Link_Key_Notification
● HCI_Link_Key_Request
● HCI_Pin_Code_Request
● Commands
● HCI_Link_Key_Request_Reply
● HCI_Link_Key_Request_Negative_Reply
● HCI_Pin_Code_Request_Reply
● HCI_Pin_Code_Request_Negative_Reply

How Pairing Works
● First connection
(1) HCI_Pin_Code_Request
(2) HCI_Pin_Code_Request_Reply
(3) HCI_Link_Key_Notification
● Further connections
(1) HCI_Link_Key_Request
(2) HCI_Link_Key_Request_Reply
(3) HCI_Link_Key_Notification (optional)

BlueSnarf
● Trivial OBEX PUSH channel attack
– obexapp (FreeBSD)
– PULL known objects instead of PUSH
– No authentication
● Infrared Data Association
– IrMC (Specifications for Ir Mobile Communications)
● e.g. telecom/pb.vcf
● Ericsson R520m, T39m, T68
● Sony Ericsson T68i, T610, Z1010
● Nokia 6310, 6310i, 8910, 8910i

HeloMoto
● Requires entry in 'Device History'
● OBEX PUSH to create entry
● Connect RFCOMM to Handsfree or Headset
– No Authentication required
– Full AT command set access
● Motorola V80, V5xx, V6xx and E398

BlueBug History (1)
● First presentation in February 2004
– FH Salzburg 'Forum IKT 2004'
– Spicing up a presentation about Wardriving
● Got inspired from Adam's BlueSnarf which has
been written about on slashdot
● Tried to figure out how Adam did it (no purposebuilt tools available)
● Found BlueBug
– Based on AT Commands -> not OBEX

BlueBug History (2)
● Fieldtrial at CeBIT 2004
– Booth close to the restrooms -> many people there
– Even Policemen ;)
● Got on slashdot at the end of March 2004
● Teamed up with Adam in April 2004
● Various media citations
● Presentation at Blackhat and DEFCON in August
2004
● Full Disclosure at 21C3 in December 2004 (now!)

BlueBug Facts (1)
● As mentioned earlier...
– BlueBug is based on AT Commands (ASCII Terminal)
– Very common for the configuration and control of
telecommunications devices
– High level of control...
● Call control (turning phone into a bug)
● Sending/Reading/Deleting SMS
● Reading/Writing Phonebook Entries
● Setting Forwards
●
-> causing costs on the vulnerable phones!

BlueBug Facts (2)
● How come!?
– Various Manufacturers poorly implemented the
Bluetooth security mechanisms
– Unpublished services on RFCOMM channels
● Not announced via SDP
● Connecting to unpublished HS service without
pairing!
– Nokia has quite a lot of models (6310, 6310i, 8910,
8910i,...)
– Sony Ericsson T86i, T610, ...
– Motorola has similar problems (see HeloMoto)

Bluetooone
● Enhancing the range
of a Bluetooth dongle
by connecting a directional
antenna -> as done in the
Long Distance Attack
● Original idea from Mike
Outmesguine (Author of
Book: “Wi-Fi Toys”)
● Step by Step instruction on
trifinite.org

Long-Distance Attacking (BlueSniper)
● Beginning of August 2004
(right after DEFCON 12)
● Experiment in
Santa Monica California
● Modified Class-1 Dongle
Snarfing/Bugging Class-2
device (Nokia 6310i)
from a distance of
1,78 km (1.01 miles)

Blooover -What is it?
● Blooover - Bluetooth Wireless Technology Hoover
● Proof-of-Concept Application
● Educational Purposes only
● Phone Auditing Tool
● Running on Java
● J2ME MIDP 2.0
● Implemented JSR-82 (Bluetooth API)
● Nokia 6600, Nokia 7610, Nokia 6670, ... Series 60
Siemens S65
SonyEricsson P900 ...

Blooover- What does it do?
● Blooover is performing the BlueBug attack
– Reading phonebooks
– Writing phonebook entries
– Reading/decoding SMS stored on the device (buggy..)
– Setting Call forward (predef. Number) +49 1337 7001
– Initiating phone call (predef. Number) 0800 2848283
● Not working well on Nokia phones :( but on some T610
● Please use this application responsibly!
– For research purposes only!
– With permission of owner

Blueprinting – What is it?
● Blueprinting is fingerprinting Bluetooth Wireless
Technology interfaces of devices
● This work has been started by Collin R. Mulliner
and Martin Herfurt
● Relevant to all kinds of applications
– Security auditing
– Device Statistics
– Automated Application Distribution
● Released paper and tool at 21C3 in December
2004 in Berlin (again, now!)

Blueprinting - How
● Hashing Information from Profile Entries
– RecordHandle
– RFCOMM channel number
– Adding it all up (RecHandle
1*Channel1)+
(RecHandle
2*Channel2)+...+(RecHandlen*Channeln)
● Bluetooth Device Address
– First three bytes refer to manufacturer (IEEE OUI)
● Example of Blueprint
00: 60: 57@2621543

BlueSmack
● Using L2CAP echo feature
– Signal channel request/response
– L2CAP signal MTU is unknown
– No open L2CAP channel needed
● Buffer overflow
● Denial of service attack

BlueSmack
< HCI Command: Create Connection ( 0x01| 0x0005) plen 13
0000: b6 1e 33 6d 0e 00 18 cc 02 00 00 00 01 . . 2m. . . . . . . . .
> HCI Event: Command Status ( 0x0f) plen 4
0000: 00 01 05 04 . . . .
> HCI Event: Connect Complete ( 0x03) plen 11
0000: 00 29 00 b6 1d 32 6d 0e 00 01 00 . ) . . . 2m. . . .
< ACL data: handle 0x0029 flags 0x02 dlen 28
L2CAP( s) : Echo req: dlen 20
0000: 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 EFGHIJKLMNOPQRST
0010: 55 56 57 58 UVWX
> HCI Event: Number of Completed Packets ( 0x13) plen 5
0000: 01 29 00 01 00 . ) . . .
> ACL data: handle 0x0029 flags 0x02 dlen 28
L2CAP( s) : Echo rsp: dlen 20
0000: 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 EFGHIJKLMNOPQRST
0010: 55 56 57 58 UVWX
< HCI Command: Disconnect ( 0x01| 0x0006) plen 3
0000: 29 00 13 ) . .
> HCI Event: Command Status ( 0x0f) plen 4
0000: 00 01 06 04 . . . .
> HCI Event: Disconn Complete ( 0x05) plen 4
0000: 00 29 00 16 . ) . .

HOW TO MAKE A KEY GENERATOR .....

 HOW TO MAKE A  Key Generators

Tools!
For tools you need a minimum of debugger like SoftIce for Windows (hence WinIce), and a C compiler
with Dos libraries.
Content!
In this tutorial I will show how to make a key-gen for Ize and Swiftsearch. The protection that these
programs use is the well known Enter-Name-and-Registration-Number method. After selecting 'register',
a window pops up where you can enter your name and your registration number. The strategy here is to
find out where in memory the data you enter is stored and then to find out what is done with it. Before you
go on make sure you configure the SoftIce dat file according to the PWD tutorial #1.
Part 1: Scanline S wiftsearch 2.0!
Swiftsearch is a useful little program that you can use to search on the web. I will explain step by step how
to crack it.
step 1. Start the program :)
step 2: Choose register from the menus. You will now get a window where you can enter your name and your
registration number.
step 3: Enter SoftIce (ctrl-d)
step 4: We will now set a breakpoint on functions like GetWindowText(a) and GetDlgItemText(a) to find out
where in memory the data that we just entered is stored. The function that is used by this program is
GetDlgItemTexta (trial and error, just try yourself :) so, in SoftIce type BPX GetDlgItemTexta and exit
SoftIce with the g command.
step 5: Now type a name and a registration number (I used razzia and 12345) and press OK, this will put you back
in SoftIce. Since you are now inside the GetDlgItemTexta function press F11 to get out of it. You should
see the following code:
  lea eax, [ebp-2C] :<--- we are looking for this location
 push eax
 push 00000404
 push [ebp+08]
 call [USER32!GetDlgItemTextA]
 mov edi, eax :<--- eax has the length of the string
 and is stored in edi for later usage.
We see that EAX is loaded with a memory address and then pushed to the stack as a parameter for
the function GetDlgItemTextA. Since the function GetDlgItemTextA is already bee n run we can look at
EBP-2c (with ED EDP-2c) and see that the name we entered is there. Now we know where the name is
stored in memory, normally it would be wise to write that address down, but we will see that in this case it
wont be necessary.
So, what next? Now we have to allow the program to read the registration number we entered. Just
type g and return and when back in SoftIce press F11. You should see the following code:
 push 0000000B
 lea ecx, [ebp-18] : <--So, ebp-18 is where the reg. number
 push ecx : is stored.
 push 0000042A
 push [ebp+08]
 call [USER32!GetDlgItemTextA]
 mov ebx, eax : <--save the lenght of string in EBX
 test edi, edi : <--remember EDI had the lenght of the
 jne 00402FBF : name we entered?
 We see that the registration number is stored at location EBP-18 , check it with ED EBP-18.
Again, normally it would be wise to note that address down. Also we see that it is checked if the length of
the name we gave was not zero. If it is not zero the program will continue.
Step 6: Ok, now we know where the data we entered is stored in memory. What next?
 Now we have to find out what is DONE with it. Usually it would we wise to put breakpoints on those
memory locations and find out where in the program they are read. But in this case the answer is just a few
F10's away. Press F10 until you see the following code :
 cmp ebx, 0000000A :<--remember EPX had the length of the
 je 00402FDE : registration code we entered?
 These two lines are important. They check if the length of the registration code we entered is
equal to 10. If not the registration number will be considered wrong already. The program wont even
bother to check it. Modify EBX or the FLAG register in the register window to allow the jump. Continue
Pressing F10 until you get to the following code (note that the adresses you will see could be different) :
:00402FDE xor esi, esi :<-- Clear ESI
:00402FE0 xor eax, eax :<-- Clear EAX
:00402FE2 test edi, edi
:00402FE4 jle 00402FF2
:00402FE6 movsx byte ptr ecx, [ebp + eax - 2C] :<-- ECX is loaded with a letter of the name
we entered.
:00402FEB add esi, ecx :<-- Add the letter to ESI
:00402FED inc eax :<-- Increment EAX to get next letter
:00402FEE cmp eax, edi :<-- Did we reach the end of the string?
:00402FF0 jl 00402FE6 :<-- If not, go get the next letter.
 Well, we see that the program adds together all the letters of the name we entered. Knowing
that ESI contains the sum of the letters, lets continue and find out what the program does with that value :
:00402FF2 push 0000000A
:00402FF4 lea eax, [ebp-18] :<-- Load EAX with the address of the reg. number we entered
:00402FF7 push 00000000
:00402FF9 push eax :<-- Push EAX (as a parameter for the following function)
:00402FFA call 00403870 :<-- Well, what do you think this function does? :)
:00402FFF add esp, 0000000C
:00403002 cmp eax, esi :<-- Hey!
:00403004 je 00403020
  We see that a function is called and when RETurned ESI is compared with EAX. Hmm, lets look at
what's in EAX. A '? EAX' reveals :
 00003039 0000012345 "09"
 Bingo. That's what we entered as the regis tration number. It should have been what's inside
ESI. And we know what's inside ESI, the sum of the letters of the name we entered!
Step 7: Now we know how the program computes the registration code we can make a key -gen.
 But we should not forget that the program checks also that the registration number has 10
 digits.
 A simple C code that will compute the registration number for this program could look like this:
#include <stdio.h>
#include <string.h>
main()
{
char Name[100];
int NameLength,Offset;
long int Reg = 0, Dummy2 = 10;
int Dummy = 0;
int LengtDummy = 1;
int Lengt , Teller;
printf("Scanline SwiftSearch 2.0 crack by raZZia. \n");
printf("Enter your name: ");
 gets(Name);
 NameLength=strlen(Name);
/* the for lus calculates the sum of the letters in Name */
/* and places that value in Reg */
 for (Offset=0;Offset<NameLength;Offset=Offset+1)
 {
 Reg=Reg+Name[Offset];
 }
/* the while lus calculates the lenght of the figure in */
/* Reg and places it in Lengt */
 while (Dummy != 1)
 {
 if ( Reg < Dummy2 )
 { Lengt = LengtDummy ; Dummy =1;
 }
 else
 { LengtDummy=LengtDummy + 1; Dummy2=Dummy2*10;
 }
 };
 printf(" \nYour registration number is : " );
/* First print 10-Lengt times a 0  */
 Lengt=10-Lengt;
 for (Teller=1;Teller<=Lengt;Teller=Teller+1) printf("0");
/* Then print the registration number */
 printf("%lu\n",Reg);
}
 Case 2 Ize 2.04 from Gadgetware
Ize from Gadgetware is a cute little program that will put a pair of eyes on your screen which will
follow your mousepointer. It has a register function where you can enter your name and a registration
number. The strategy in this case is still the same : Find out where in memory the entered information
is stored and then find out what is done with that information.
Step 1: Start Ize. Chose register and enter a name and a number. I used 'razzia' and '12345'.
Sterp 2: Enter (CTRL-D) Softice and set a breakpoint on GetDlgItemTextA.
Step 3: Leave SoftIce and press OK. This will put you back in Softice. You will be inside the GetDlgItemTextA
 function. To get out of it press F11. You should see the following code :
 mov esi, [esp + 0C]
 push 00000064
 push 0040C3A0 :<--On this memory location the NAME we entered will be stored.
 mov edi, [USER32!GetDlgItemTextA] :<--Load edi with adress of GetDlgItemTextA
push 00004EE9
push esi
call edi :<-- Call GetDlgItemTextA
push 00000064  :<-- (you should be here now)
push 0040C210 :<--On this memory location the NUMBER we entered will be stored
push 00004EEA
push esi
call edi  :<-- Call GetDlgItemTextA
We see that the function GetDlgItemTextA is called twice in this code fragment. The first call has
already happened. With ED 40C3A0 we can check that the name we entered is stored on that location.
To allow the program to read in the number we entered we type G and enter. Now we are inside the GetDlgItemTextA function again and we press f11 to get out of it. We check memory location 40C210 and
 we see the number we entered is stored there.
 Now we know the locations were the name and the number are stored,we note those down!
Step 4: Ok, what next? We now know where in memory the name and the number are stored. We need to find out
what the program does with those values. In order to do that we co uld set breakpoints on those memory
 locations to see where they are read. But in this case it wont be necessary. The answer is right after the
above code :
push 0040C210 :<--save the location of the number we entered (as a parameter for the next call)
call 00404490 :<-- call this unknown function
add esp, 00000004
mov edi, eax :<-- save EAX (hmmmm)
We see a function being called with the number-location as a parameter. We could trace into the
function and see what it does, but that is not needed. With your experience of the Swiftsearch
example you should be able to guess what this function does. It calculates the numerical value of the
registration number and puts it in EAX. To be sure we step further using F10 untill we are past the call
and check the contents of EAX (with ? EAX). In my case it showed : 00003039 0000012345 " 09".
 Knowing that EDI contains our registration number we proceed:
 push 0040C3A0 : <-- save the location of the name we entered (as a parameter for the next call)
 push 00409080 : <-- save an unknown memory-location (as a parameter for the next call)
 call 004043B0 :<--call to an unknown function
add esp, 00000008
cmp edi, eax :<--compare EDI (reg # we entered) with EAX (unknown, since the previous call
 changed it)
jne 004018A1 :<--jump if not equal
We see that a function is called with two parameters. One of the parameters is the location of the name
we entered. The other we dont know, but we can find out with ED 409080. We see the text 'Ize'.
This function calculates the right registration number using those two parameters. If you just want to
crack this program, you can place a breakpoint right after the call and check the contents of EAX. It will
contain the right registration number. But since we want to know HOW the reg. # is calculated we will
trace inside the function (using T). We will then try to find out HOW the contents of EAX got in there.
Step 5: Once inside the interesting function you will see that we are dealing with a rather long function. It wont
be necessary for me to include the complete listing of this function, because we wont need all of it to
make our key-gen.
 But in order find out which part of the code is essential for the computation of the right registration
number, you have to trace STEP by STEP and figure out what EXACTLY is going on!
Afther doing this i found out that the first part of the function computes some kind of "key". Then this
"key" is stored in memory and in that way passed on to the second part of the function.
  The second part of the function then computes the right registration number, based on this "key"
AND
the name we entered.
The code that is essential and that we need for our key-gen is the following:
  ( Note that before the following code starts, the registers that are used will have the following values:
 EBX will point to the first letter of the name we entered,
 EDX will be zero,
 EBP will be zero,
The "key" that we talked about earlier is stored in memory location 0040B828 and will
 have 0xA4CC as its initial value. )
:00404425 movsx byte ptr edi, [ebx + edx] :<-- Put first letter of the name in EDI
:00404429 lea esi, [edx+01] :<-- ESI gets the "letter-number"
:0040442C call 00404470  :<-- Call function
:00404431 imul edi, eax  :<-- EDI=EDI*EAX (eax is the return value of the the previous call)
:00404434 call 00404470  :<-- Call function
:00404439 mov edx, esi
:0040443B mov ecx, FFFFFFFF
:00404440 imul edi, eax  :<-- EDI=EDI*EAX (eax is the return value of the previous call)
:00404443 imul edi, esi  :<-- EDI=EDI*ESI ( esi is the number of the letter position)
:00404446 add ebp, edi  :<-- EBP=EBP+EDI (beware that EBP will finally contain the right reg#)
:00404448 mov edi, ebx :<--these lines compute the lenght of the name we entered
:0040444A sub eax, eax :<--these lines compute the lenght of the name we entered
:0040444C repnz :<--these lines compute the lenght of the name we entered
:0040444D scasb :<--these lines compute the lenght of the name we entered
:0040444E not ecx :<--these lines compute the lenght of the name we entered
:00404450 dec ecx :<-- ECX now contains the lenght of the name
:00404451 cmp ecx, esi
:00404453 ja 00404425 :<-- If its not the end of the name , go do the same with the next letter
:00404455 mov eax, ebp :<-- SAVE EBP TO EAX !!!!
:00404457 pop ebp
:00404458 pop edi
:00404459 pop esi
:0040445A pop ebx
:0040445B ret
 _____
:00404470 mov eax, [0040B828] :<-- Put "key" in EAX
:00404475 mul eax, eax, 015A4E35 :<-- EAX=EAX * 15A4E35
:0040447B inc eax :<-- EAX=EAX + 1
:0040447C mov [0040B828], eax :<-- Replace the "key" with the new value of EAX
:00404481 and eax, 7FFF0000 :<-- EAX=EAX && 7FFF0000
:00404486 shr eax, 10 :<-- EAX=EAX >>10
:00404489 ret
The above code consists of a loop that goes trough all the letters of the name we entered. With each
letter some value is calculated, all these values are added up together (in EBP). Then this value is stored
in EAX and the function RETurns. And that was what we were looking for, we wanted to know how EAX
got its value!
Step 6: Now to make a key-gen we have to translate the above method of calculating the right reg# into a
c program. It could be done in the following way :
 (Note : I am a bad c programmer :)
#include <stdio.h>
#include <string.h>
main()
{
char Name[100];
int NameLength,Offset;
unsigned long Letter,DummyA;
unsigned long Key = 0xa4cc;
unsigned long Number = 0;
 printf("Ize 2.04 crack by razzia\n");
printf("Enter your name: ");
 gets(Name);
 NameLength=strlen(Name);
 for (Offset=0;Offset<NameLength;Offset=Offset+1)
 {
 Letter=Name[Offset];
 DummyA=Key;
 DummyA=DummyA*0x15a4e35;
 DummyA=DummyA+1;
 Key=DummyA;
 DummyA=DummyA & 0x7fff0000;
 DummyA=DummyA >> 0x10;
 Letter=Letter*DummyA;
 DummyA=Key;
 DummyA=DummyA*0x15a4e35;
 DummyA=DummyA+1;
 Key=DummyA;
 DummyA=DummyA & 0x7fff0000;
 DummyA=DummyA >> 0x10;
 Letter=Letter*DummyA;
 Letter=Letter*(Offset+1);
 Number=Number+Letter;
 } 
 printf(" \nYour registration number is : %lu\n",Number);
}

THANKS FOR READING ,....

SOCIAL ENGINEERING

Social Engineering 

Social engineering – Social engineering is a technique used by attackers to take advantage of the
natural trusting nature of most human beings. Criminals often pose as an
insider or other trusted person to gain information they otherwise wouldn’t
be able to access

Passive test –   the passive test is  way of getting the information from the network by the use of search engine ..

So here are some queries  you can directly search from a search engine –

site: your~public~host~name/IP keywords to search for

Look for keywords such as wireless, address, SSID, password, .xls (Excel
spreadsheets), .doc (Word documents), .ppt (Power Point slides), .ns1
(Network Stumbler files), .vsd (Visio drawings), .pkt (sniffer packet captures), and so on.

 site: your~public~host~name/IP filetype:ns1 ns1
This searches for Network Stumbler files that contain wireless network
configuration information. You can perform this query on any type of
file, such as .vsd, .doc, and so on.

 site: your~public~host~name/IP inurl:”h_wireless_11g.html”
or inurl:”ShowEvents.shm”

This searches publicly accessible APs  such as D-Link and Cisco
Aironet for wireless setup pages and event logs,

But you will be surprised out of the information you will get out of it ….

Google is an amazing tool to get the information for different servers , so you must know how to use it for your benefit

Now if you are like me .. You would like more automated tools .. So here is one

www.foundstone.com/resources/freetools.htm

This site allow us to run various prepackage queries  .. And help to know the information

Active tests –  active test is more of a in personal way of hacking rather technical .. As you  try to get the information through the personal contact through phone , email or in person  ..

In hacking it is not just about getting the password but also any other type of information .. So think of it as finding a way to get these files ..

HACKING TUTORIAL CLASS 2( IMPORTANT CONCEPTS IN WIRELESS HACKING )

IMPORTANT CONCEPTS IN WIRELESS HACKING

COMPUTER NETWORK

A computer network is a group of two or more computers linked together so the
communication between individual computers can be made possible.

types of computer networks :

Local Area Network (LAN)

This is a type of computer network where interconnected computers which are situated very close to each other say , inside the same building or same room.

Wide Area Network (WAN)

This is a type of computer network where interconnected computers are separated by a large distance (a few km to few hundreds of km)

Internet

The Internet is the largest network which interconnects various LAN and WAN. It is a global system of various interconnected computer networks belonging to individual , government or private organizations.

NETWORK HOST

A network host (or  host) can be any computer or network device connected to the computer network. This computer can be a terminal or a web server offering services to its clients.

NETWORK PROTOCOL

A network protocol (or just referred to as protocol) is a set of rules and conventions that
are necessary for the communication between two network devices. For example, two
computers on a network can communicate only if they agree to follow the protocols.
The following are some of the most widely referred network protocols:
Internet Protocol (IP Address)
An Internet Protocol address (IP address) is a unique number assigned to each computer
or device (such as printer) so that each of them can be uniquely identified on the network.

Types of IP Address:

Private IP Address: A private IP address is the one that is assigned to a computer on the Local Area Network (LAN).

EXAMPLE -- 192.168.0.2

Public IP Address: A public IP address is the one that is assigned to a computer

connected to the Internet.
EXAMPLE -- 59.93.115.125

computer gets connected to the ISP ( INTERNET SERVICE PROVIDER ) network using a private IP. ISP ( INTERNET SERVICE PROVIDER ) network it will be assigned a public IP address using which the communication with the Internet is made possible.

How to Find the IP Address of a Computer?

Finding your public IP is extremely simple. Just type “what is my IP” on Google to see your public IP address displayed in search results.
In order to find your private IP, just open the command prompt window (type cmd in the
“Run” box) and enter the following command:
ipconfig/all

This will display a long list of details about your computer’s network devices and their configuration. To see your private IP address, just scroll down to find something as “IPv4 Address” which is nothing but your private IP.

Hyper Text Transfer Protocol (HTTP)

The Hyper Text Transfer Protocol provides a standard for communication between web browsers and the server. It is one of the most widely used protocol on the Internet for requesting documents such as web pages and images.
Example: http://www.example.com

File Transfer Protocol (FTP)

The File Transfer Protocol provides a standard for transferring files between two
computers on the network. FTP is most widely used in carrying out upload/download operations between a server and a workstation.
Example:ftp://www.example.com

Simple Main Transfer Protocol (SMTP)

The Simple Mail Transfer Protocol provides a standard for sending e-mails from one server to another. Most e-mail systems that send mail over the Internet use SMTP to exchange messages between the server.

HACKING TUTORIAL CLASS 4 ( FOOTPRINTING)

WHAT IS FOOTPRINTING?

Footprinting refers to the process of gathering information about a specific computer

system or a network environment and the company it belongs to. This is the preparatory

phase for the hacker where he gathers as much information as he can so as to find ways to

intrude into the target. Footprinting can reveal the vulnerabilities of the target system and

improve the ways in which they can be exploited.

Footprinting has to be done in a slow and methodological manner where the hacker spends

90% of his time in blueprinting the security profile of the target and only 10% in

launching the attack. Footprinting can actually help hacker decide on the type of attack

that is most suitable for the target.

INFORMATION GATHERING METHODOLOGY

Suppose if a hacker decides to break into a target-company, he can only do so after

blueprinting the target and assessing the possible vulnerabilities. Based on this

information, the hacker can carry out possible attacks such as breaking into the company’s

database, hacking its website or causing denial of service. The following are some of the

different types of information that a hacker could gather before actually carrying out the

attack:

Obtaining the Domain Name Information

Various background information about the target website (domain name) such as the name

of its owner and registrar, date of its registration, expiry date, name servers associated,

contact details associated with it such as email, phone and address can be found out by

performing a Whois lookup. The following are some of the popular websites where you

can perform Whois lookup on any domain to uncover its background information:

http://www.whois.com/whois/

https://who.is/

http://whois.domaintools.com/

Finding IP Address and Hosting Provider

Information such as the IP address of the website and its hosting provider can be very crucial. This can be easily found out using the following website:
WhoIsHostingThis: http://www.whoishostingthis.com/

Finding IP Address Location

Finding out the physical location of the IP address is very simple. Just visit the following
website and enter the target IP address to reveal its physical location:
IP2Location: http://www.ip2location.com/demo
A snapshot of sample query for the IP address 173.252.120.6 on ip2location.com

Finding IP Address Range

While small websites may have a single IP address, big players such as Google, Facebook
and Microsoft have a range of IP addresses allocated to their company for hosting
additional websites and servers. This range of information can be obtained from the
official website of American Registry for Internet Numbers (ARIN). The URL for the
ARIN website is listed below:
ARIN Website: https://www.arin.net/
Visit the above URL and insert the IP address of any given website in the “Search
Whois” box found at the top right corner of the web page

Traceroute

Traceroute is a network diagnostic tool to identify the actual path (route) that the
information (packets) takes to travel from source to destination. The source will be your
own computer called localhost. The destination can be any host or server on the local
network or Internet.
The traceroute tool is available on both Windows and Linux. The command syntax for
Windows is as follows:
tracert target-domain-or-IP
The command syntax for Linux is as follows:
traceroute target-domain-or-IP

Usually, the transfer of information from one computer to another will not happen in a
single jump. It involves a chain of several computers and network devices called hops to
transmit information from source to destination. Traceroute identifies each hop on that list
and the amount of time it takes to travel from one hop to another

As shown in the above snapshot, the traceroute tool identifies all the hops present in the
path traversed by packets from source to destination. Here 192.168.0.1 is the private IP
and 117.192.208.1 is the public IP of the source (my computer). 74.125.236.66 is the
destination IP address (Google’s server). All the remaining IP addresses shown in between
the source and the destination belong to computers that assist in carrying the information.

Obtaining Archive of the Target Website

Getting access to the archive of the target website will let you know how the website was
during the time of its launch and how it got advanced and changed over time. You will
also see all the updates made to the website, including the nature of updates and their
dates. You can use the WayBackMachine tool to access the this information.
WayBackMachine: http://archive.org/web/

HOW TO HACK A COLA MACHINE ....

How To 'Hack' a Coca Cola Machine

Ok... Lets go, It is possible to get ur 'soda' (r0fl) for free
1. WHICH MACHINES WORK?
There's a very strict list of vending machines that have the debug menu. First off,
they're all COCA-COLA product vending machines. This means the giant, unmissable picture on the front must show any of the following: Coke, Dasani (Water),
Barq'sRoot Beer, Vanilla Coke, Cherry Coke, Sprite, Evlan (water), Fanta, Fresca,
Frutopia, Hi-C, Sprite Remix, Mad River, Mello Yello, Minute Maid, Nestea, Odwalla,
Mr. Pibb/Pibb Xtra, Planet Java, Power Ade, Seagram's Ginger Ale, Simply Orange,
Sparkletts, or Tab. Of course anything Diet or Caffeine free works too.
The machine must have an LED screen. Some of the older ones just allow the LED
to be set to a price amount and won't have the debug menu.
You're safer if the little LED is telling you something.
Usually it will scroll a little message like "Ice Cold Cokes". Newer machines are more
likely candidates.
2. ACCESSING THE MENU
To enter the menu, there's a button combination.
HERE'S THE ONLY THING YOU HAVE TO REALLY REMEMBER:
[4]-[2]-[3]-[1]
The buttons are numbered depending on how they are positioned. They will either be
vertical (more likely), or in horizontal rows of 4 buttons per row. If it is
vertical, the first button is #1, the one below it is #2, and so forth. If the
buttons are in horizontal rows, the first button is #1, and the one to the right of
it is #2. The numbers work like a type writer after that. In rows of 4, the first
button of row 2 will be button #5.
So, to review, getting in to the debug menu looks like this:
COKE MACHINE::::::
£1.00 -------
-------------
[ Coke ] <-- Hit this button last
[ Coke ] <-- Hit this button second
[ Diet Coke ] <-- Hit this button third
[ Sprite ] <-- Hit this button first
[ And so on ]
-------------
Some text should show up on the LED (probably the word "Error", we'll explain what
it means next sections). If nothing happens, your machine doesn't have the debug
menu.
3. Options and Errors
NAVIGATION
To navigate from option to option (What they are is next section), remember the
numberings we gave the buttons. They work as follows:
Button [ 1 ] - Exit/Back
Button [ 2 ] - Up
Button [ 3 ] - Down
Button [ 4 ] - Select
OPTIONS
Depending on the age of the machine, you will get a varying amount of default
options available.
On older machines: SALE, VER, EROR, and RTN
On newer machines: CASH, SALE, EROR, and RTN
CASH - Machine Earnings Display
The CASH option will display how much money is in the machine currently. It
generally takes a second or two to load. From here, you can scroll up and down
through 12 or 16 different options, depending on the machine age. These other
options display how much money was spent on each individual item, classified
through its button (or slot, as I like to call it) number.
A neat side note about the slot numbers is that there are more slot numbers than
there are actual slot, so usually the last 4 buttons contain zero money. This could
be so that the same OS could be used on bigger machines, but the newer machines
have even more slot numbers.
SALE - Total Sale Count
The SALE option displays how many drinks have been sold out of the machine. This
tends to be cumulative, but not on all machines. The stock guy is probably supposed
to reset this each time he re-stocks. Also, this has the same sub-options as the
CASH option, where you can scroll up and down and see how many drinks have
been sold from each slot.
VER - System/Machine Version?
This option will cause a large alphanumeric string to scroll across the LCD. The
number looks very much like a serial number, but doesn't vary from machine to
machine. It is most likely the OS or machine version number, but of the older
machines that have the option, I haven't seen one that doesn't have the same
number.
EROR - Error Log
There are 8 different types of errors - COLJ (Column Jams), VEnd (Vend
Mechanism),
door (Door Switch), sels (Select Switch), CHAR (Changer Errors), acce (Acceptor
Errors), StS (Space-to-sales errors), and bVal (Bill Validators). The separate
types and actual errors are useless, as you assumably can't get inside the machine,
BUT(! you can clear the errors. Hold the enter (Number 4) button down for about 2
seconds, and it should clear the error.
RTN - Return
This is simply the return option. Selecting this will exit the debug menu. On newer
machines, pressing the BACK button at the main menu will not exit, and RTN must
be
selected.
A side note: The menu can also be exited by pressing the coin return button.
EXTRAS
By holding in the coin return button and not releasing, on the newer "big-button"
machines, this will display the internal temperature in Fahrenheit, as in "42F".
**Update**
There are many more menu options that are only accessible if they've either been
enabled from the computer inside the machine, or on the internal computer behind
the door (Probably not feasible for you to access).
CPO - Coin Payout Mode
You can dump coins from the coin mechanism, and the various menu options allow
you to choose which type of coins are dumped.
tVFL - Tube Fill Mode
This is useless to you. This allows you to load coins into the coin tubes, which
you can't do from the outside.
TEST - Test Routines
This allows you to test the following various routines:
SE Allows you to test the buttons. Will give you number
of button when you press it
SP Sold-out paddle test. Not quite sure, most likely internal function.
Su Sold-out switch test. Same as paddle.
CO Motor test. Will run various column motors.
Cn Coin test. Put in a coin and it will tell you what kind of
coin it is.
nA Note acceptor test. Same as Cn, but for bills.
dSP Display test. Will illuminate various LEDs.
vErS Rattles off version number.
RELY - Relay test
This tests the relay electronic control of various parts. Do not do, as it will
cause damage if various internal parts are not unplugged before usage.
PASS - Password
This is not normally accessible, but allows you to change the menu password from
the 4-2-3-1. Whoo!
PrIC - Price Setting
Used to set the price for a drink. Not sure how to work it, but it seems simple
enough.
StOS - Space-to-sales routine
Lets you change the STS routine and other options. This means that various buttons
will all mean the same thing, i.e. the 6 coke buttons don't actually vend from 6
different columns, but vend from one (changing when one runs out of course).
COn - Machine Configuration/Permissions
This is the machine config menu that decides what of these options you are allowed
to access through the outside panel. This is probably only accessible with the door
open. I won't go into detail, but I'll list the Config numbers and what each do: C1
sets price menu on, C2 sets special (manufacturer) options on), C3 disables the
"ICE COLD COKE" message. C4 is autoviewing of menu when door is opened, C5 is
door switch status, C6 is mysteriously reserved for "future use", C7 determines
whether your money credit stays in for 5 minutes or indefinitely, C8 is Force Vend,
C9
allows multiple vends without putting in more money (i.e put in a 5 and get 3 cokes
and then your change), and C10 is Escrow Inhibit.
CCoC - Correct Change Only Control
Adjusts Correct Change only rule to your liking.
TIME - Time Adjustment
Allows you to set the machine's local time.
LANG - Language Selection
Not sure how many languages are supported, but there are apparently more than just
English.
Its possible to get free drinks (unlimited), changes prices etc etc
Give it a try, it really works with the big red machines ^^
-----------------------------------------------------------------------------------------------

HACKING TUTORIAL CLASS 3 ( DOMAIN NAME SYSTEM (DNS) How DNS Works? FIREWALL How Firewall Works? PROXY SERVER)

DOMAIN NAME SYSTEM (DNS)

A Domain Name System or Domain Name Service (DNS) is a network protocol whose job
is to map domain names such as “gohacking.com” to its corresponding IP address like
“104.28.6.51”.

Since Internet is the mother of millions of computers each having a unique IP address, it
becomes impossible for people to remember the IP address of each and every computer
they want to access. So, in order to make this process simpler the concept of domain
names was introduced. As a result users can easily access any website just by typing their
domain names in the browser’s address bas such as “google.com” or “yahoo.com” without
having to remember their actual IP addresses.
However, since the network protocol understands only the IP address and not the domain
names, it is necessary to translate the domain name back to its corresponding IP address
before establishing a connection with the target server. This is where DNS comes in
handy.
Your Internet Service Provider has a DNS server which maintains a huge record of
existing domain names and their corresponding IP addresses. Each time you type the URL
such as “http://www.google.com” on your browser’s address bar, your computer will use
the DNS server from the ISP and translates the domain name “google.com” to its
corresponding IP address to make a connection with the Google’s server. All this process
will happen in a split second behind the scenes and hence goes unnoticed.

How DNS Works?

Let us understand the working of Domain Name System using the following example:
Whenever you type a URL such as “http://www.gohacking.com” on your browser’s
address bar, your computer will send a request to the local name server (the ISP DNS
server) to resolve the domain name to its corresponding IP address. This request is often
referred to as a DNS query.
The local name server will receive the query to find out whether it contains the matching
name and IP address in its database. If found, the corresponding IP address (response) is
returned. If not, the query is automatically passed on to another DNS server that is in the
next higher level of DNS hierarchy. This process continues until the query reaches the
DNS server that contains the matching name and IP address. The IP address (response)
then flows back the chain in the reverse order to your computer. The following figure 2.4
illustrates the above process.

FIREWALL

Firewalls are basically a barrier between your computer (or a network) and the Internet
(outside world). A firewall can be simply compared to a security guard who stands at the
entrance of your house and filters the visitors coming to your place. He may allow some
visitors to enter while deny others whom he suspects of being intruders. Similarly a
firewall is a software program or a hardware device that filters the information
(packets) coming through the Internet to your personal computer or a computer network.

How Firewall Works?

Firewalls may decide to allow or block network traffic between devices based on the rules
that are pre-configured or set by the firewall administrator. Most personal firewalls such as
Windows firewall operate on a set of pre-configured rules which are most suitable under
normal circumstances, so that the user need not worry much about configuring the
firewall.
Personal firewalls are easy to install and use and hence preferred by end-users to secure
their personal computers. However, in order to meet customized needs large networks and
companies prefer those firewalls that have plenty of options to configure.
For example, a company may set up different firewall rules for FTP servers, telnet
servers and web servers. In addition, the company can even control how the employees
connect to the Internet by blocking access to certain websites and restricting the transfer of
files to other networks. Thus, in addition to security, a firewall can give the company a
tremendous control over how people use their network.

Firewalls use one or more of the following methods to control the incoming and outgoing
traffic in a network:
1. Packet Filtering: In this method, packets (small chunks of data) are analyzed against
a set of filters. Packet filters has a set of rules that come with accept and deny actions
which are pre-configured or can be configured manually by the firewall
administrator. If the packet manages to make it through these filters then it is allowed
to reach the destination; otherwise it is discarded.
2. Stateful Inspection: This is a newer method that doesn’t analyze the contents of the
packets. Instead, it compares certain key aspects of each packet to a database of
trusted source. Both incoming and outgoing packets are compared against this
database and if the comparison yields a reasonable match, then the packets are
allowed to travel further. Otherwise they are discarded. Firewall Configuration:

Firewalls can be configured by adding one or more filters based on several conditions as
mentioned below:

1. IP addresses: In any case, if an IP address outside the network is said to be
unfavourable, then it is possible to set filter to block all the traffic to and from
that IP address. For example, if a certain IP address is found to be making too
many connections to a server, the administrator may decide to block
traffic from this IP using the firewall.

2. Domain names: Since it is difficult to remember the IP addresses, it is an
easier and smarter way to configure the firewalls by adding filters based on
domain names. By setting up a domain filter, a company may decide to block all
access to certain domain names, or may provide access only to a list of
selected domain names.

3. Ports/Protocols: If the services running on a given port is intended for the
public or network users, they are usually kept open. Otherwise they are blocked
using the firewall so as to prevent intruders from using the open ports for
making unauthorized connections.

4. Specific words or phrases: A firewall can be configured to filter one or more
specific words or phrases so that both the incoming and outgoing packets are
scanned for the words in the filter.

For example, you may set up a firewall rule to filter any packet that
contains an offensive term or a phrase that you may decide to block from
entering or leaving your network.

Hardware vs. Software Firewall:

Hardware firewalls provide higher level of security and hence preferred for servers where
security has the top most priority. The software firewalls on the other hand are less
expensive and hence preferred in home computers and laptops.
Hardware firewalls usually come as an in-built unit of a router and provide maximum
security as it filters each packet at the hardware level itself even before it manages to enter
your computer. A good example is the Linksys Cable/DSL router.

PROXY SERVER

In a computer network, a proxy server is any computer system offering a service that acts
as an intermediary between the two communicating parties, the client and the server.
In the presence of a proxy server, there is no direct communication between the client and
the server. Instead, the client connects to the proxy server and sends requests for resources
such as a document, web page or a file that resides on a remote server. The proxy server
handles this request by fetching the required resources from the remote server and
forwarding the same to the client.

How Proxy Server Works?

An illustration of how a proxy server works is shown in the --
As shown in the below example, whenever the client connects to a web proxy server and
makes a request for the resources (in this case, “Sample.html”) that reside on a remote
server (in this case, xyz.com), the proxy server forwards this request to the target server on
behalf of the client so as to fetch the requested resource and deliver it back to the client.

A proxy server is most widely used to conceal the IP address or the origin of the Internet
users during their activity. Since it the proxy server which handles the requests between
the client and the target, only the IP address of the proxy server is exposed to the outside
world and not the actual one. Therefore, most hackers use a proxy server during the
attacks on their target so that it would be hard to trace back to them.