BLUETOOTH HACKING

Bluetooth Security

● Link manager security
● All security routines are inside the Bluetooth chip
● Nothing is transmitted in “plain text”
● Host stack security
● Interface for link manager security routines
● Part of the HCI specification
● Easy interface
● No further encryption of pin codes or keys

Security Modes

● Security mode 1
● No active security enforcement
● Security mode 2
● Service level security
● On device level no difference to mode 1
● Security mode 3
● Device level security
● Enforce security for every low-level connection

Linux and Bluetooth

# hciconfig -a
hci0: Type: USB
BD Address: 00: 02: 5B: A1: 88: 52 ACL MTU: 384: 8 SCO MTU: 64: 8
UP RUNNING PSCAN ISCAN
RX bytes: 9765 acl: 321 sco: 0 events: 425 errors: 0
TX bytes: 8518 acl: 222 sco: 0 commands: 75 errors: 0
Features: 0xff 0xff 0x8b 0xfe 0x9b 0xf9 0x00 0x80
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy: RSWITCH HOLD SNIFF PARK
Link mode: SLAVE ACCEPT
Name: ' Casira BC3- MM'
Class: 0x1e0100
Service Classes: Networking, Rendering, Capturing, Obj ect Transfer
Device Class: Computer, Uncategorized
HCI Ver: 1. 2 ( 0x2) HCI Rev: 0x529 LMP Ver: 1. 2 ( 0x2) LMP Subver: 0x529
Manufacturer: Cambridge Silicon Radio ( 10)
# hcitool scan
Scanning . . .
00: 04: 0E: 21: 06: FD AVM BlueFRITZ! AP- DSL
00: 01: EC: 3A: 45: 86 HBH- 10
00: 04: 76: 63: 72: 4D Aficio AP600N
00: A0: 57: AD: 22: 0F ELSA Vianect Blue ISDN
00: E0: 03: 04: 6D: 36 Nokia 6210
00: 80: 37: 06: 78: 92 Ericsson T39m
00: 06: C6: C4: 08: 27 Anycom LAN Access Point

Sniffing with hcidump
● Recording of HCI packets
– Commands, events, ACL and SCO data packets
● Only for local connections
● Decoding of higher layer protocols
– HCI and L2CAP
– SDP, RFCOMM, BNEP, CMTP, HIDP, HCRP and AVDTP
– OBEX and CAPI
● No sniffing of baseband or radio traffic

Security Commands
● HCI_Create_New_Unit_Key
● HCI_{Read|Write}_Pin_Type
● HCI_{Read|Write|Delete}_Stored_Link_Key
● HCI_{Read|Write}_Authentication_Enable
● HCI_{Read|Write}_Encryption_Mode
● HCI_Authentication_Requested
● HCI_Set_Connection_Encryption
● HCI_Change_Local_Link_Key
● HCI_Master_Link_Key

Pairing Functions
● Events
● HCI_Link_Key_Notification
● HCI_Link_Key_Request
● HCI_Pin_Code_Request
● Commands
● HCI_Link_Key_Request_Reply
● HCI_Link_Key_Request_Negative_Reply
● HCI_Pin_Code_Request_Reply
● HCI_Pin_Code_Request_Negative_Reply

How Pairing Works
● First connection
(1) HCI_Pin_Code_Request
(2) HCI_Pin_Code_Request_Reply
(3) HCI_Link_Key_Notification
● Further connections
(1) HCI_Link_Key_Request
(2) HCI_Link_Key_Request_Reply
(3) HCI_Link_Key_Notification (optional)

BlueSnarf
● Trivial OBEX PUSH channel attack
– obexapp (FreeBSD)
– PULL known objects instead of PUSH
– No authentication
● Infrared Data Association
– IrMC (Specifications for Ir Mobile Communications)
● e.g. telecom/pb.vcf
● Ericsson R520m, T39m, T68
● Sony Ericsson T68i, T610, Z1010
● Nokia 6310, 6310i, 8910, 8910i

HeloMoto
● Requires entry in 'Device History'
● OBEX PUSH to create entry
● Connect RFCOMM to Handsfree or Headset
– No Authentication required
– Full AT command set access
● Motorola V80, V5xx, V6xx and E398

BlueBug History (1)
● First presentation in February 2004
– FH Salzburg 'Forum IKT 2004'
– Spicing up a presentation about Wardriving
● Got inspired from Adam's BlueSnarf which has
been written about on slashdot
● Tried to figure out how Adam did it (no purposebuilt tools available)
● Found BlueBug
– Based on AT Commands -> not OBEX

BlueBug History (2)
● Fieldtrial at CeBIT 2004
– Booth close to the restrooms -> many people there
– Even Policemen ;)
● Got on slashdot at the end of March 2004
● Teamed up with Adam in April 2004
● Various media citations
● Presentation at Blackhat and DEFCON in August
2004
● Full Disclosure at 21C3 in December 2004 (now!)

BlueBug Facts (1)
● As mentioned earlier...
– BlueBug is based on AT Commands (ASCII Terminal)
– Very common for the configuration and control of
telecommunications devices
– High level of control...
● Call control (turning phone into a bug)
● Sending/Reading/Deleting SMS
● Reading/Writing Phonebook Entries
● Setting Forwards
●
-> causing costs on the vulnerable phones!

BlueBug Facts (2)
● How come!?
– Various Manufacturers poorly implemented the
Bluetooth security mechanisms
– Unpublished services on RFCOMM channels
● Not announced via SDP
● Connecting to unpublished HS service without
pairing!
– Nokia has quite a lot of models (6310, 6310i, 8910,
8910i,...)
– Sony Ericsson T86i, T610, ...
– Motorola has similar problems (see HeloMoto)

Bluetooone
● Enhancing the range
of a Bluetooth dongle
by connecting a directional
antenna -> as done in the
Long Distance Attack
● Original idea from Mike
Outmesguine (Author of
Book: “Wi-Fi Toys”)
● Step by Step instruction on
trifinite.org

Long-Distance Attacking (BlueSniper)
● Beginning of August 2004
(right after DEFCON 12)
● Experiment in
Santa Monica California
● Modified Class-1 Dongle
Snarfing/Bugging Class-2
device (Nokia 6310i)
from a distance of
1,78 km (1.01 miles)

Blooover -What is it?
● Blooover - Bluetooth Wireless Technology Hoover
● Proof-of-Concept Application
● Educational Purposes only
● Phone Auditing Tool
● Running on Java
● J2ME MIDP 2.0
● Implemented JSR-82 (Bluetooth API)
● Nokia 6600, Nokia 7610, Nokia 6670, ... Series 60
Siemens S65
SonyEricsson P900 ...

Blooover- What does it do?
● Blooover is performing the BlueBug attack
– Reading phonebooks
– Writing phonebook entries
– Reading/decoding SMS stored on the device (buggy..)
– Setting Call forward (predef. Number) +49 1337 7001
– Initiating phone call (predef. Number) 0800 2848283
● Not working well on Nokia phones :( but on some T610
● Please use this application responsibly!
– For research purposes only!
– With permission of owner

Blueprinting – What is it?
● Blueprinting is fingerprinting Bluetooth Wireless
Technology interfaces of devices
● This work has been started by Collin R. Mulliner
and Martin Herfurt
● Relevant to all kinds of applications
– Security auditing
– Device Statistics
– Automated Application Distribution
● Released paper and tool at 21C3 in December
2004 in Berlin (again, now!)

Blueprinting - How
● Hashing Information from Profile Entries
– RecordHandle
– RFCOMM channel number
– Adding it all up (RecHandle
1*Channel1)+
(RecHandle
2*Channel2)+...+(RecHandlen*Channeln)
● Bluetooth Device Address
– First three bytes refer to manufacturer (IEEE OUI)
● Example of Blueprint
00: 60: 57@2621543

BlueSmack
● Using L2CAP echo feature
– Signal channel request/response
– L2CAP signal MTU is unknown
– No open L2CAP channel needed
● Buffer overflow
● Denial of service attack

BlueSmack
< HCI Command: Create Connection ( 0x01| 0x0005) plen 13
0000: b6 1e 33 6d 0e 00 18 cc 02 00 00 00 01 . . 2m. . . . . . . . .
> HCI Event: Command Status ( 0x0f) plen 4
0000: 00 01 05 04 . . . .
> HCI Event: Connect Complete ( 0x03) plen 11
0000: 00 29 00 b6 1d 32 6d 0e 00 01 00 . ) . . . 2m. . . .
< ACL data: handle 0x0029 flags 0x02 dlen 28
L2CAP( s) : Echo req: dlen 20
0000: 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 EFGHIJKLMNOPQRST
0010: 55 56 57 58 UVWX
> HCI Event: Number of Completed Packets ( 0x13) plen 5
0000: 01 29 00 01 00 . ) . . .
> ACL data: handle 0x0029 flags 0x02 dlen 28
L2CAP( s) : Echo rsp: dlen 20
0000: 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 EFGHIJKLMNOPQRST
0010: 55 56 57 58 UVWX
< HCI Command: Disconnect ( 0x01| 0x0006) plen 3
0000: 29 00 13 ) . .
> HCI Event: Command Status ( 0x0f) plen 4
0000: 00 01 06 04 . . . .
> HCI Event: Disconn Complete ( 0x05) plen 4
0000: 00 29 00 16 . ) . .

HOW TO MAKE A KEY GENERATOR .....

 HOW TO MAKE A  Key Generators

Tools!
For tools you need a minimum of debugger like SoftIce for Windows (hence WinIce), and a C compiler
with Dos libraries.
Content!
In this tutorial I will show how to make a key-gen for Ize and Swiftsearch. The protection that these
programs use is the well known Enter-Name-and-Registration-Number method. After selecting 'register',
a window pops up where you can enter your name and your registration number. The strategy here is to
find out where in memory the data you enter is stored and then to find out what is done with it. Before you
go on make sure you configure the SoftIce dat file according to the PWD tutorial #1.
Part 1: Scanline S wiftsearch 2.0!
Swiftsearch is a useful little program that you can use to search on the web. I will explain step by step how
to crack it.
step 1. Start the program :)
step 2: Choose register from the menus. You will now get a window where you can enter your name and your
registration number.
step 3: Enter SoftIce (ctrl-d)
step 4: We will now set a breakpoint on functions like GetWindowText(a) and GetDlgItemText(a) to find out
where in memory the data that we just entered is stored. The function that is used by this program is
GetDlgItemTexta (trial and error, just try yourself :) so, in SoftIce type BPX GetDlgItemTexta and exit
SoftIce with the g command.
step 5: Now type a name and a registration number (I used razzia and 12345) and press OK, this will put you back
in SoftIce. Since you are now inside the GetDlgItemTexta function press F11 to get out of it. You should
see the following code:
  lea eax, [ebp-2C] :<--- we are looking for this location
 push eax
 push 00000404
 push [ebp+08]
 call [USER32!GetDlgItemTextA]
 mov edi, eax :<--- eax has the length of the string
 and is stored in edi for later usage.
We see that EAX is loaded with a memory address and then pushed to the stack as a parameter for
the function GetDlgItemTextA. Since the function GetDlgItemTextA is already bee n run we can look at
EBP-2c (with ED EDP-2c) and see that the name we entered is there. Now we know where the name is
stored in memory, normally it would be wise to write that address down, but we will see that in this case it
wont be necessary.
So, what next? Now we have to allow the program to read the registration number we entered. Just
type g and return and when back in SoftIce press F11. You should see the following code:
 push 0000000B
 lea ecx, [ebp-18] : <--So, ebp-18 is where the reg. number
 push ecx : is stored.
 push 0000042A
 push [ebp+08]
 call [USER32!GetDlgItemTextA]
 mov ebx, eax : <--save the lenght of string in EBX
 test edi, edi : <--remember EDI had the lenght of the
 jne 00402FBF : name we entered?
 We see that the registration number is stored at location EBP-18 , check it with ED EBP-18.
Again, normally it would be wise to note that address down. Also we see that it is checked if the length of
the name we gave was not zero. If it is not zero the program will continue.
Step 6: Ok, now we know where the data we entered is stored in memory. What next?
 Now we have to find out what is DONE with it. Usually it would we wise to put breakpoints on those
memory locations and find out where in the program they are read. But in this case the answer is just a few
F10's away. Press F10 until you see the following code :
 cmp ebx, 0000000A :<--remember EPX had the length of the
 je 00402FDE : registration code we entered?
 These two lines are important. They check if the length of the registration code we entered is
equal to 10. If not the registration number will be considered wrong already. The program wont even
bother to check it. Modify EBX or the FLAG register in the register window to allow the jump. Continue
Pressing F10 until you get to the following code (note that the adresses you will see could be different) :
:00402FDE xor esi, esi :<-- Clear ESI
:00402FE0 xor eax, eax :<-- Clear EAX
:00402FE2 test edi, edi
:00402FE4 jle 00402FF2
:00402FE6 movsx byte ptr ecx, [ebp + eax - 2C] :<-- ECX is loaded with a letter of the name
we entered.
:00402FEB add esi, ecx :<-- Add the letter to ESI
:00402FED inc eax :<-- Increment EAX to get next letter
:00402FEE cmp eax, edi :<-- Did we reach the end of the string?
:00402FF0 jl 00402FE6 :<-- If not, go get the next letter.
 Well, we see that the program adds together all the letters of the name we entered. Knowing
that ESI contains the sum of the letters, lets continue and find out what the program does with that value :
:00402FF2 push 0000000A
:00402FF4 lea eax, [ebp-18] :<-- Load EAX with the address of the reg. number we entered
:00402FF7 push 00000000
:00402FF9 push eax :<-- Push EAX (as a parameter for the following function)
:00402FFA call 00403870 :<-- Well, what do you think this function does? :)
:00402FFF add esp, 0000000C
:00403002 cmp eax, esi :<-- Hey!
:00403004 je 00403020
  We see that a function is called and when RETurned ESI is compared with EAX. Hmm, lets look at
what's in EAX. A '? EAX' reveals :
 00003039 0000012345 "09"
 Bingo. That's what we entered as the regis tration number. It should have been what's inside
ESI. And we know what's inside ESI, the sum of the letters of the name we entered!
Step 7: Now we know how the program computes the registration code we can make a key -gen.
 But we should not forget that the program checks also that the registration number has 10
 digits.
 A simple C code that will compute the registration number for this program could look like this:
#include <stdio.h>
#include <string.h>
main()
{
char Name[100];
int NameLength,Offset;
long int Reg = 0, Dummy2 = 10;
int Dummy = 0;
int LengtDummy = 1;
int Lengt , Teller;
printf("Scanline SwiftSearch 2.0 crack by raZZia. \n");
printf("Enter your name: ");
 gets(Name);
 NameLength=strlen(Name);
/* the for lus calculates the sum of the letters in Name */
/* and places that value in Reg */
 for (Offset=0;Offset<NameLength;Offset=Offset+1)
 {
 Reg=Reg+Name[Offset];
 }
/* the while lus calculates the lenght of the figure in */
/* Reg and places it in Lengt */
 while (Dummy != 1)
 {
 if ( Reg < Dummy2 )
 { Lengt = LengtDummy ; Dummy =1;
 }
 else
 { LengtDummy=LengtDummy + 1; Dummy2=Dummy2*10;
 }
 };
 printf(" \nYour registration number is : " );
/* First print 10-Lengt times a 0  */
 Lengt=10-Lengt;
 for (Teller=1;Teller<=Lengt;Teller=Teller+1) printf("0");
/* Then print the registration number */
 printf("%lu\n",Reg);
}
 Case 2 Ize 2.04 from Gadgetware
Ize from Gadgetware is a cute little program that will put a pair of eyes on your screen which will
follow your mousepointer. It has a register function where you can enter your name and a registration
number. The strategy in this case is still the same : Find out where in memory the entered information
is stored and then find out what is done with that information.
Step 1: Start Ize. Chose register and enter a name and a number. I used 'razzia' and '12345'.
Sterp 2: Enter (CTRL-D) Softice and set a breakpoint on GetDlgItemTextA.
Step 3: Leave SoftIce and press OK. This will put you back in Softice. You will be inside the GetDlgItemTextA
 function. To get out of it press F11. You should see the following code :
 mov esi, [esp + 0C]
 push 00000064
 push 0040C3A0 :<--On this memory location the NAME we entered will be stored.
 mov edi, [USER32!GetDlgItemTextA] :<--Load edi with adress of GetDlgItemTextA
push 00004EE9
push esi
call edi :<-- Call GetDlgItemTextA
push 00000064  :<-- (you should be here now)
push 0040C210 :<--On this memory location the NUMBER we entered will be stored
push 00004EEA
push esi
call edi  :<-- Call GetDlgItemTextA
We see that the function GetDlgItemTextA is called twice in this code fragment. The first call has
already happened. With ED 40C3A0 we can check that the name we entered is stored on that location.
To allow the program to read in the number we entered we type G and enter. Now we are inside the GetDlgItemTextA function again and we press f11 to get out of it. We check memory location 40C210 and
 we see the number we entered is stored there.
 Now we know the locations were the name and the number are stored,we note those down!
Step 4: Ok, what next? We now know where in memory the name and the number are stored. We need to find out
what the program does with those values. In order to do that we co uld set breakpoints on those memory
 locations to see where they are read. But in this case it wont be necessary. The answer is right after the
above code :
push 0040C210 :<--save the location of the number we entered (as a parameter for the next call)
call 00404490 :<-- call this unknown function
add esp, 00000004
mov edi, eax :<-- save EAX (hmmmm)
We see a function being called with the number-location as a parameter. We could trace into the
function and see what it does, but that is not needed. With your experience of the Swiftsearch
example you should be able to guess what this function does. It calculates the numerical value of the
registration number and puts it in EAX. To be sure we step further using F10 untill we are past the call
and check the contents of EAX (with ? EAX). In my case it showed : 00003039 0000012345 " 09".
 Knowing that EDI contains our registration number we proceed:
 push 0040C3A0 : <-- save the location of the name we entered (as a parameter for the next call)
 push 00409080 : <-- save an unknown memory-location (as a parameter for the next call)
 call 004043B0 :<--call to an unknown function
add esp, 00000008
cmp edi, eax :<--compare EDI (reg # we entered) with EAX (unknown, since the previous call
 changed it)
jne 004018A1 :<--jump if not equal
We see that a function is called with two parameters. One of the parameters is the location of the name
we entered. The other we dont know, but we can find out with ED 409080. We see the text 'Ize'.
This function calculates the right registration number using those two parameters. If you just want to
crack this program, you can place a breakpoint right after the call and check the contents of EAX. It will
contain the right registration number. But since we want to know HOW the reg. # is calculated we will
trace inside the function (using T). We will then try to find out HOW the contents of EAX got in there.
Step 5: Once inside the interesting function you will see that we are dealing with a rather long function. It wont
be necessary for me to include the complete listing of this function, because we wont need all of it to
make our key-gen.
 But in order find out which part of the code is essential for the computation of the right registration
number, you have to trace STEP by STEP and figure out what EXACTLY is going on!
Afther doing this i found out that the first part of the function computes some kind of "key". Then this
"key" is stored in memory and in that way passed on to the second part of the function.
  The second part of the function then computes the right registration number, based on this "key"
AND
the name we entered.
The code that is essential and that we need for our key-gen is the following:
  ( Note that before the following code starts, the registers that are used will have the following values:
 EBX will point to the first letter of the name we entered,
 EDX will be zero,
 EBP will be zero,
The "key" that we talked about earlier is stored in memory location 0040B828 and will
 have 0xA4CC as its initial value. )
:00404425 movsx byte ptr edi, [ebx + edx] :<-- Put first letter of the name in EDI
:00404429 lea esi, [edx+01] :<-- ESI gets the "letter-number"
:0040442C call 00404470  :<-- Call function
:00404431 imul edi, eax  :<-- EDI=EDI*EAX (eax is the return value of the the previous call)
:00404434 call 00404470  :<-- Call function
:00404439 mov edx, esi
:0040443B mov ecx, FFFFFFFF
:00404440 imul edi, eax  :<-- EDI=EDI*EAX (eax is the return value of the previous call)
:00404443 imul edi, esi  :<-- EDI=EDI*ESI ( esi is the number of the letter position)
:00404446 add ebp, edi  :<-- EBP=EBP+EDI (beware that EBP will finally contain the right reg#)
:00404448 mov edi, ebx :<--these lines compute the lenght of the name we entered
:0040444A sub eax, eax :<--these lines compute the lenght of the name we entered
:0040444C repnz :<--these lines compute the lenght of the name we entered
:0040444D scasb :<--these lines compute the lenght of the name we entered
:0040444E not ecx :<--these lines compute the lenght of the name we entered
:00404450 dec ecx :<-- ECX now contains the lenght of the name
:00404451 cmp ecx, esi
:00404453 ja 00404425 :<-- If its not the end of the name , go do the same with the next letter
:00404455 mov eax, ebp :<-- SAVE EBP TO EAX !!!!
:00404457 pop ebp
:00404458 pop edi
:00404459 pop esi
:0040445A pop ebx
:0040445B ret
 _____
:00404470 mov eax, [0040B828] :<-- Put "key" in EAX
:00404475 mul eax, eax, 015A4E35 :<-- EAX=EAX * 15A4E35
:0040447B inc eax :<-- EAX=EAX + 1
:0040447C mov [0040B828], eax :<-- Replace the "key" with the new value of EAX
:00404481 and eax, 7FFF0000 :<-- EAX=EAX && 7FFF0000
:00404486 shr eax, 10 :<-- EAX=EAX >>10
:00404489 ret
The above code consists of a loop that goes trough all the letters of the name we entered. With each
letter some value is calculated, all these values are added up together (in EBP). Then this value is stored
in EAX and the function RETurns. And that was what we were looking for, we wanted to know how EAX
got its value!
Step 6: Now to make a key-gen we have to translate the above method of calculating the right reg# into a
c program. It could be done in the following way :
 (Note : I am a bad c programmer :)
#include <stdio.h>
#include <string.h>
main()
{
char Name[100];
int NameLength,Offset;
unsigned long Letter,DummyA;
unsigned long Key = 0xa4cc;
unsigned long Number = 0;
 printf("Ize 2.04 crack by razzia\n");
printf("Enter your name: ");
 gets(Name);
 NameLength=strlen(Name);
 for (Offset=0;Offset<NameLength;Offset=Offset+1)
 {
 Letter=Name[Offset];
 DummyA=Key;
 DummyA=DummyA*0x15a4e35;
 DummyA=DummyA+1;
 Key=DummyA;
 DummyA=DummyA & 0x7fff0000;
 DummyA=DummyA >> 0x10;
 Letter=Letter*DummyA;
 DummyA=Key;
 DummyA=DummyA*0x15a4e35;
 DummyA=DummyA+1;
 Key=DummyA;
 DummyA=DummyA & 0x7fff0000;
 DummyA=DummyA >> 0x10;
 Letter=Letter*DummyA;
 Letter=Letter*(Offset+1);
 Number=Number+Letter;
 } 
 printf(" \nYour registration number is : %lu\n",Number);
}

THANKS FOR READING ,....

SOCIAL ENGINEERING

Social Engineering 

Social engineering – Social engineering is a technique used by attackers to take advantage of the
natural trusting nature of most human beings. Criminals often pose as an
insider or other trusted person to gain information they otherwise wouldn’t
be able to access

Passive test –   the passive test is  way of getting the information from the network by the use of search engine ..

So here are some queries  you can directly search from a search engine –

site: your~public~host~name/IP keywords to search for

Look for keywords such as wireless, address, SSID, password, .xls (Excel
spreadsheets), .doc (Word documents), .ppt (Power Point slides), .ns1
(Network Stumbler files), .vsd (Visio drawings), .pkt (sniffer packet captures), and so on.

 site: your~public~host~name/IP filetype:ns1 ns1
This searches for Network Stumbler files that contain wireless network
configuration information. You can perform this query on any type of
file, such as .vsd, .doc, and so on.

 site: your~public~host~name/IP inurl:”h_wireless_11g.html”
or inurl:”ShowEvents.shm”

This searches publicly accessible APs  such as D-Link and Cisco
Aironet for wireless setup pages and event logs,

But you will be surprised out of the information you will get out of it ….

Google is an amazing tool to get the information for different servers , so you must know how to use it for your benefit

Now if you are like me .. You would like more automated tools .. So here is one

www.foundstone.com/resources/freetools.htm

This site allow us to run various prepackage queries  .. And help to know the information

Active tests –  active test is more of a in personal way of hacking rather technical .. As you  try to get the information through the personal contact through phone , email or in person  ..

In hacking it is not just about getting the password but also any other type of information .. So think of it as finding a way to get these files ..

HACKING TUTORIAL CLASS 2( IMPORTANT CONCEPTS IN WIRELESS HACKING )

IMPORTANT CONCEPTS IN WIRELESS HACKING

COMPUTER NETWORK

A computer network is a group of two or more computers linked together so the
communication between individual computers can be made possible.

types of computer networks :

Local Area Network (LAN)

This is a type of computer network where interconnected computers which are situated very close to each other say , inside the same building or same room.

Wide Area Network (WAN)

This is a type of computer network where interconnected computers are separated by a large distance (a few km to few hundreds of km)

Internet

The Internet is the largest network which interconnects various LAN and WAN. It is a global system of various interconnected computer networks belonging to individual , government or private organizations.

NETWORK HOST

A network host (or  host) can be any computer or network device connected to the computer network. This computer can be a terminal or a web server offering services to its clients.

NETWORK PROTOCOL

A network protocol (or just referred to as protocol) is a set of rules and conventions that
are necessary for the communication between two network devices. For example, two
computers on a network can communicate only if they agree to follow the protocols.
The following are some of the most widely referred network protocols:
Internet Protocol (IP Address)
An Internet Protocol address (IP address) is a unique number assigned to each computer
or device (such as printer) so that each of them can be uniquely identified on the network.

Types of IP Address:

Private IP Address: A private IP address is the one that is assigned to a computer on the Local Area Network (LAN).

EXAMPLE -- 192.168.0.2

Public IP Address: A public IP address is the one that is assigned to a computer

connected to the Internet.
EXAMPLE -- 59.93.115.125

computer gets connected to the ISP ( INTERNET SERVICE PROVIDER ) network using a private IP. ISP ( INTERNET SERVICE PROVIDER ) network it will be assigned a public IP address using which the communication with the Internet is made possible.

How to Find the IP Address of a Computer?

Finding your public IP is extremely simple. Just type “what is my IP” on Google to see your public IP address displayed in search results.
In order to find your private IP, just open the command prompt window (type cmd in the
“Run” box) and enter the following command:
ipconfig/all

This will display a long list of details about your computer’s network devices and their configuration. To see your private IP address, just scroll down to find something as “IPv4 Address” which is nothing but your private IP.

Hyper Text Transfer Protocol (HTTP)

The Hyper Text Transfer Protocol provides a standard for communication between web browsers and the server. It is one of the most widely used protocol on the Internet for requesting documents such as web pages and images.
Example: http://www.example.com

File Transfer Protocol (FTP)

The File Transfer Protocol provides a standard for transferring files between two
computers on the network. FTP is most widely used in carrying out upload/download operations between a server and a workstation.
Example:ftp://www.example.com

Simple Main Transfer Protocol (SMTP)

The Simple Mail Transfer Protocol provides a standard for sending e-mails from one server to another. Most e-mail systems that send mail over the Internet use SMTP to exchange messages between the server.

HACKING TUTORIAL CLASS 4 ( FOOTPRINTING)

WHAT IS FOOTPRINTING?

Footprinting refers to the process of gathering information about a specific computer

system or a network environment and the company it belongs to. This is the preparatory

phase for the hacker where he gathers as much information as he can so as to find ways to

intrude into the target. Footprinting can reveal the vulnerabilities of the target system and

improve the ways in which they can be exploited.

Footprinting has to be done in a slow and methodological manner where the hacker spends

90% of his time in blueprinting the security profile of the target and only 10% in

launching the attack. Footprinting can actually help hacker decide on the type of attack

that is most suitable for the target.

INFORMATION GATHERING METHODOLOGY

Suppose if a hacker decides to break into a target-company, he can only do so after

blueprinting the target and assessing the possible vulnerabilities. Based on this

information, the hacker can carry out possible attacks such as breaking into the company’s

database, hacking its website or causing denial of service. The following are some of the

different types of information that a hacker could gather before actually carrying out the

attack:

Obtaining the Domain Name Information

Various background information about the target website (domain name) such as the name

of its owner and registrar, date of its registration, expiry date, name servers associated,

contact details associated with it such as email, phone and address can be found out by

performing a Whois lookup. The following are some of the popular websites where you

can perform Whois lookup on any domain to uncover its background information:

http://www.whois.com/whois/

https://who.is/

http://whois.domaintools.com/

Finding IP Address and Hosting Provider

Information such as the IP address of the website and its hosting provider can be very crucial. This can be easily found out using the following website:
WhoIsHostingThis: http://www.whoishostingthis.com/

Finding IP Address Location

Finding out the physical location of the IP address is very simple. Just visit the following
website and enter the target IP address to reveal its physical location:
IP2Location: http://www.ip2location.com/demo
A snapshot of sample query for the IP address 173.252.120.6 on ip2location.com

Finding IP Address Range

While small websites may have a single IP address, big players such as Google, Facebook
and Microsoft have a range of IP addresses allocated to their company for hosting
additional websites and servers. This range of information can be obtained from the
official website of American Registry for Internet Numbers (ARIN). The URL for the
ARIN website is listed below:
ARIN Website: https://www.arin.net/
Visit the above URL and insert the IP address of any given website in the “Search
Whois” box found at the top right corner of the web page

Traceroute

Traceroute is a network diagnostic tool to identify the actual path (route) that the
information (packets) takes to travel from source to destination. The source will be your
own computer called localhost. The destination can be any host or server on the local
network or Internet.
The traceroute tool is available on both Windows and Linux. The command syntax for
Windows is as follows:
tracert target-domain-or-IP
The command syntax for Linux is as follows:
traceroute target-domain-or-IP

Usually, the transfer of information from one computer to another will not happen in a
single jump. It involves a chain of several computers and network devices called hops to
transmit information from source to destination. Traceroute identifies each hop on that list
and the amount of time it takes to travel from one hop to another

As shown in the above snapshot, the traceroute tool identifies all the hops present in the
path traversed by packets from source to destination. Here 192.168.0.1 is the private IP
and 117.192.208.1 is the public IP of the source (my computer). 74.125.236.66 is the
destination IP address (Google’s server). All the remaining IP addresses shown in between
the source and the destination belong to computers that assist in carrying the information.

Obtaining Archive of the Target Website

Getting access to the archive of the target website will let you know how the website was
during the time of its launch and how it got advanced and changed over time. You will
also see all the updates made to the website, including the nature of updates and their
dates. You can use the WayBackMachine tool to access the this information.
WayBackMachine: http://archive.org/web/

HOW TO HACK A COLA MACHINE ....

How To 'Hack' a Coca Cola Machine

Ok... Lets go, It is possible to get ur 'soda' (r0fl) for free
1. WHICH MACHINES WORK?
There's a very strict list of vending machines that have the debug menu. First off,
they're all COCA-COLA product vending machines. This means the giant, unmissable picture on the front must show any of the following: Coke, Dasani (Water),
Barq'sRoot Beer, Vanilla Coke, Cherry Coke, Sprite, Evlan (water), Fanta, Fresca,
Frutopia, Hi-C, Sprite Remix, Mad River, Mello Yello, Minute Maid, Nestea, Odwalla,
Mr. Pibb/Pibb Xtra, Planet Java, Power Ade, Seagram's Ginger Ale, Simply Orange,
Sparkletts, or Tab. Of course anything Diet or Caffeine free works too.
The machine must have an LED screen. Some of the older ones just allow the LED
to be set to a price amount and won't have the debug menu.
You're safer if the little LED is telling you something.
Usually it will scroll a little message like "Ice Cold Cokes". Newer machines are more
likely candidates.
2. ACCESSING THE MENU
To enter the menu, there's a button combination.
HERE'S THE ONLY THING YOU HAVE TO REALLY REMEMBER:
[4]-[2]-[3]-[1]
The buttons are numbered depending on how they are positioned. They will either be
vertical (more likely), or in horizontal rows of 4 buttons per row. If it is
vertical, the first button is #1, the one below it is #2, and so forth. If the
buttons are in horizontal rows, the first button is #1, and the one to the right of
it is #2. The numbers work like a type writer after that. In rows of 4, the first
button of row 2 will be button #5.
So, to review, getting in to the debug menu looks like this:
COKE MACHINE::::::
£1.00 -------
-------------
[ Coke ] <-- Hit this button last
[ Coke ] <-- Hit this button second
[ Diet Coke ] <-- Hit this button third
[ Sprite ] <-- Hit this button first
[ And so on ]
-------------
Some text should show up on the LED (probably the word "Error", we'll explain what
it means next sections). If nothing happens, your machine doesn't have the debug
menu.
3. Options and Errors
NAVIGATION
To navigate from option to option (What they are is next section), remember the
numberings we gave the buttons. They work as follows:
Button [ 1 ] - Exit/Back
Button [ 2 ] - Up
Button [ 3 ] - Down
Button [ 4 ] - Select
OPTIONS
Depending on the age of the machine, you will get a varying amount of default
options available.
On older machines: SALE, VER, EROR, and RTN
On newer machines: CASH, SALE, EROR, and RTN
CASH - Machine Earnings Display
The CASH option will display how much money is in the machine currently. It
generally takes a second or two to load. From here, you can scroll up and down
through 12 or 16 different options, depending on the machine age. These other
options display how much money was spent on each individual item, classified
through its button (or slot, as I like to call it) number.
A neat side note about the slot numbers is that there are more slot numbers than
there are actual slot, so usually the last 4 buttons contain zero money. This could
be so that the same OS could be used on bigger machines, but the newer machines
have even more slot numbers.
SALE - Total Sale Count
The SALE option displays how many drinks have been sold out of the machine. This
tends to be cumulative, but not on all machines. The stock guy is probably supposed
to reset this each time he re-stocks. Also, this has the same sub-options as the
CASH option, where you can scroll up and down and see how many drinks have
been sold from each slot.
VER - System/Machine Version?
This option will cause a large alphanumeric string to scroll across the LCD. The
number looks very much like a serial number, but doesn't vary from machine to
machine. It is most likely the OS or machine version number, but of the older
machines that have the option, I haven't seen one that doesn't have the same
number.
EROR - Error Log
There are 8 different types of errors - COLJ (Column Jams), VEnd (Vend
Mechanism),
door (Door Switch), sels (Select Switch), CHAR (Changer Errors), acce (Acceptor
Errors), StS (Space-to-sales errors), and bVal (Bill Validators). The separate
types and actual errors are useless, as you assumably can't get inside the machine,
BUT(! you can clear the errors. Hold the enter (Number 4) button down for about 2
seconds, and it should clear the error.
RTN - Return
This is simply the return option. Selecting this will exit the debug menu. On newer
machines, pressing the BACK button at the main menu will not exit, and RTN must
be
selected.
A side note: The menu can also be exited by pressing the coin return button.
EXTRAS
By holding in the coin return button and not releasing, on the newer "big-button"
machines, this will display the internal temperature in Fahrenheit, as in "42F".
**Update**
There are many more menu options that are only accessible if they've either been
enabled from the computer inside the machine, or on the internal computer behind
the door (Probably not feasible for you to access).
CPO - Coin Payout Mode
You can dump coins from the coin mechanism, and the various menu options allow
you to choose which type of coins are dumped.
tVFL - Tube Fill Mode
This is useless to you. This allows you to load coins into the coin tubes, which
you can't do from the outside.
TEST - Test Routines
This allows you to test the following various routines:
SE Allows you to test the buttons. Will give you number
of button when you press it
SP Sold-out paddle test. Not quite sure, most likely internal function.
Su Sold-out switch test. Same as paddle.
CO Motor test. Will run various column motors.
Cn Coin test. Put in a coin and it will tell you what kind of
coin it is.
nA Note acceptor test. Same as Cn, but for bills.
dSP Display test. Will illuminate various LEDs.
vErS Rattles off version number.
RELY - Relay test
This tests the relay electronic control of various parts. Do not do, as it will
cause damage if various internal parts are not unplugged before usage.
PASS - Password
This is not normally accessible, but allows you to change the menu password from
the 4-2-3-1. Whoo!
PrIC - Price Setting
Used to set the price for a drink. Not sure how to work it, but it seems simple
enough.
StOS - Space-to-sales routine
Lets you change the STS routine and other options. This means that various buttons
will all mean the same thing, i.e. the 6 coke buttons don't actually vend from 6
different columns, but vend from one (changing when one runs out of course).
COn - Machine Configuration/Permissions
This is the machine config menu that decides what of these options you are allowed
to access through the outside panel. This is probably only accessible with the door
open. I won't go into detail, but I'll list the Config numbers and what each do: C1
sets price menu on, C2 sets special (manufacturer) options on), C3 disables the
"ICE COLD COKE" message. C4 is autoviewing of menu when door is opened, C5 is
door switch status, C6 is mysteriously reserved for "future use", C7 determines
whether your money credit stays in for 5 minutes or indefinitely, C8 is Force Vend,
C9
allows multiple vends without putting in more money (i.e put in a 5 and get 3 cokes
and then your change), and C10 is Escrow Inhibit.
CCoC - Correct Change Only Control
Adjusts Correct Change only rule to your liking.
TIME - Time Adjustment
Allows you to set the machine's local time.
LANG - Language Selection
Not sure how many languages are supported, but there are apparently more than just
English.
Its possible to get free drinks (unlimited), changes prices etc etc
Give it a try, it really works with the big red machines ^^
-----------------------------------------------------------------------------------------------

HACKING TUTORIAL CLASS 3 ( DOMAIN NAME SYSTEM (DNS) How DNS Works? FIREWALL How Firewall Works? PROXY SERVER)

DOMAIN NAME SYSTEM (DNS)

A Domain Name System or Domain Name Service (DNS) is a network protocol whose job
is to map domain names such as “gohacking.com” to its corresponding IP address like
“104.28.6.51”.

Since Internet is the mother of millions of computers each having a unique IP address, it
becomes impossible for people to remember the IP address of each and every computer
they want to access. So, in order to make this process simpler the concept of domain
names was introduced. As a result users can easily access any website just by typing their
domain names in the browser’s address bas such as “google.com” or “yahoo.com” without
having to remember their actual IP addresses.
However, since the network protocol understands only the IP address and not the domain
names, it is necessary to translate the domain name back to its corresponding IP address
before establishing a connection with the target server. This is where DNS comes in
handy.
Your Internet Service Provider has a DNS server which maintains a huge record of
existing domain names and their corresponding IP addresses. Each time you type the URL
such as “http://www.google.com” on your browser’s address bar, your computer will use
the DNS server from the ISP and translates the domain name “google.com” to its
corresponding IP address to make a connection with the Google’s server. All this process
will happen in a split second behind the scenes and hence goes unnoticed.

How DNS Works?

Let us understand the working of Domain Name System using the following example:
Whenever you type a URL such as “http://www.gohacking.com” on your browser’s
address bar, your computer will send a request to the local name server (the ISP DNS
server) to resolve the domain name to its corresponding IP address. This request is often
referred to as a DNS query.
The local name server will receive the query to find out whether it contains the matching
name and IP address in its database. If found, the corresponding IP address (response) is
returned. If not, the query is automatically passed on to another DNS server that is in the
next higher level of DNS hierarchy. This process continues until the query reaches the
DNS server that contains the matching name and IP address. The IP address (response)
then flows back the chain in the reverse order to your computer. The following figure 2.4
illustrates the above process.

FIREWALL

Firewalls are basically a barrier between your computer (or a network) and the Internet
(outside world). A firewall can be simply compared to a security guard who stands at the
entrance of your house and filters the visitors coming to your place. He may allow some
visitors to enter while deny others whom he suspects of being intruders. Similarly a
firewall is a software program or a hardware device that filters the information
(packets) coming through the Internet to your personal computer or a computer network.

How Firewall Works?

Firewalls may decide to allow or block network traffic between devices based on the rules
that are pre-configured or set by the firewall administrator. Most personal firewalls such as
Windows firewall operate on a set of pre-configured rules which are most suitable under
normal circumstances, so that the user need not worry much about configuring the
firewall.
Personal firewalls are easy to install and use and hence preferred by end-users to secure
their personal computers. However, in order to meet customized needs large networks and
companies prefer those firewalls that have plenty of options to configure.
For example, a company may set up different firewall rules for FTP servers, telnet
servers and web servers. In addition, the company can even control how the employees
connect to the Internet by blocking access to certain websites and restricting the transfer of
files to other networks. Thus, in addition to security, a firewall can give the company a
tremendous control over how people use their network.

Firewalls use one or more of the following methods to control the incoming and outgoing
traffic in a network:
1. Packet Filtering: In this method, packets (small chunks of data) are analyzed against
a set of filters. Packet filters has a set of rules that come with accept and deny actions
which are pre-configured or can be configured manually by the firewall
administrator. If the packet manages to make it through these filters then it is allowed
to reach the destination; otherwise it is discarded.
2. Stateful Inspection: This is a newer method that doesn’t analyze the contents of the
packets. Instead, it compares certain key aspects of each packet to a database of
trusted source. Both incoming and outgoing packets are compared against this
database and if the comparison yields a reasonable match, then the packets are
allowed to travel further. Otherwise they are discarded. Firewall Configuration:

Firewalls can be configured by adding one or more filters based on several conditions as
mentioned below:

1. IP addresses: In any case, if an IP address outside the network is said to be
unfavourable, then it is possible to set filter to block all the traffic to and from
that IP address. For example, if a certain IP address is found to be making too
many connections to a server, the administrator may decide to block
traffic from this IP using the firewall.

2. Domain names: Since it is difficult to remember the IP addresses, it is an
easier and smarter way to configure the firewalls by adding filters based on
domain names. By setting up a domain filter, a company may decide to block all
access to certain domain names, or may provide access only to a list of
selected domain names.

3. Ports/Protocols: If the services running on a given port is intended for the
public or network users, they are usually kept open. Otherwise they are blocked
using the firewall so as to prevent intruders from using the open ports for
making unauthorized connections.

4. Specific words or phrases: A firewall can be configured to filter one or more
specific words or phrases so that both the incoming and outgoing packets are
scanned for the words in the filter.

For example, you may set up a firewall rule to filter any packet that
contains an offensive term or a phrase that you may decide to block from
entering or leaving your network.

Hardware vs. Software Firewall:

Hardware firewalls provide higher level of security and hence preferred for servers where
security has the top most priority. The software firewalls on the other hand are less
expensive and hence preferred in home computers and laptops.
Hardware firewalls usually come as an in-built unit of a router and provide maximum
security as it filters each packet at the hardware level itself even before it manages to enter
your computer. A good example is the Linksys Cable/DSL router.

PROXY SERVER

In a computer network, a proxy server is any computer system offering a service that acts
as an intermediary between the two communicating parties, the client and the server.
In the presence of a proxy server, there is no direct communication between the client and
the server. Instead, the client connects to the proxy server and sends requests for resources
such as a document, web page or a file that resides on a remote server. The proxy server
handles this request by fetching the required resources from the remote server and
forwarding the same to the client.

How Proxy Server Works?

An illustration of how a proxy server works is shown in the --
As shown in the below example, whenever the client connects to a web proxy server and
makes a request for the resources (in this case, “Sample.html”) that reside on a remote
server (in this case, xyz.com), the proxy server forwards this request to the target server on
behalf of the client so as to fetch the requested resource and deliver it back to the client.

A proxy server is most widely used to conceal the IP address or the origin of the Internet
users during their activity. Since it the proxy server which handles the requests between
the client and the target, only the IP address of the proxy server is exposed to the outside
world and not the actual one. Therefore, most hackers use a proxy server during the
attacks on their target so that it would be hard to trace back to them.

(HACKING INTERNET USERS,HACKING TECHNIQUES)

HACKING INTERNET USERS

Due to a rapid increase in the number of Internet users in the recent years, malicious
hackers have now started to target individual users for their attack. Numerous client side
vulnerabilities such as browser flaws and lack of security awareness among the Internet
users has made them an easy target for hackers. In this chapter let us look at some of the
popular ways to hack Internet users and also the countermeasures to prevent them.
Objectives of Hacking Internet Users
Hackers target individual users for a wide variety of reasons as mentioned below:
For gaining access to confidential information such as credit cards details, bank
login, account information etc.
To take control of user’s online accounts such as Email, Facebook and other social
network accounts.
To earn advertising revenue by forcefully driving users to online advertisements such
as banners and pop-ups.
To use individual users for attacking other systems such as causing a DDoS attack.
Sometimes even for fun or to show-off talent among the hacker’s community.

 COMMON HACKING TECHNIQUES

Techniques to hack individual users on the
Internet:

Session Hijacking (Cookie Hijacking)

Since web pages have no memories, they have to use a means to identify and authenticate
individual users accessing web pages. Especially when people are accessing restricted
pages or secure area which require password authentication, the website needs a means to
remember users individually after their successful login. For example, when people log
into their Facebook account (by entering password), they may access several different
pages until they finally sign out. It would be impractical to ask users to re-enter password
each time they access a different page.
Session Cookies
Therefore, in order to remember individual users, websites store a small file called session
cookie on the client side (in the user’s browser) which contains unique authentication
information about the user’s active session. These cookies help identify individual users
throughout the website. When the user hits the log out button or closes the browser, the
session is said to expire.

So, when a hacker manages to steal the cookies of an active session he may inject them to
his browser to gain unauthorized to any online account such as emails, social media
accounts and so on. This technique is known as session hijacking (also referred to as
cookie hijacking or cookie stealing).

Session Hijacking Demo
Here is an example of typical session hijacking performed on a sample facebook hack ...

Click here to see the example 

Session Hijacking Countermeasures

The following are some of the countermeasures to prevent session hijacking on your
computer:
Use encryption standards such as SSL (HTTPS) to prevent cookie hijacks via packet
sniffing.
Use an up-to-date browser program to prevent browser exploits.
Configure browser to stop running unverified scripts and also avoid using browser
plug-ins from untrusted sources.



Other Ways to Hack Internet Users

The following are some of the other hacking methods that are common in practice:

JavaScript: Since most client-side applications are written in JavaScript, it also
makes a wonderful tool for hackers to write malicious programs for exploiting
browser vulnerabilities. Due to lack of security awareness among users, they can
easily be fooled into entering sensitive information or navigating to malicious
websites. It can also be used to carry out other attacks such as cross-site scripting and
phishing.

Malware: Using malware is another popular way of hacking Internet users. Hackers
make use of malware programs like virus and Trojan horses to accomplish their task
by affecting large number of people. A popular example of such attack is the use of
“DNSChanger” Trojan which affected millions of Internet users by hijacking their
DNS servers.

Instant Messaging: Attackers can also target IM users by sending them unsolicited
offers in the form of files and links. This may mislead the users into installing
malware or navigating to malicious websites.

WHAT IS TELNET, SSH (Secure Shell) , NETWORK PORT

 

Telnet

Telnet is a network protocol that allows you to connect to remote hosts on the Internet or on a local network. It requires a telnet client software to implement the protocol using which the connection is established with the remote computer.

In most cases telnet requires you to have a username and a password to establish

connection with the remote host. Occasionally, some hosts also allow users to make connection as a guest or public.

After the connection is made, one can use text based commands to communicate with the
remote host. The syntax for using the telnet command is as follows:

telnet <hostname or IP> port

Example:telnet 127.0.0.1 25

SSH (Secure Shell)

SSH is a protocol similar to telnet which also facilitates connection to remote hosts for communication. However, SSH has an upper hand over telnet in terms of security. Telnet was primarily designed to operate within the local network and hence does not take care of security. On the other hand SSH manages to offer total security while connecting to remote hosts on a remote network or Internet.

Akin to telnet SSH also uses a client software and requires a username and password to establish connection with the remote host.

NETWORK PORT

A computer may be running several services on it like HTTP (web server), SMTP, FTP and so on. Each of these services are uniquely identified by a number called network port (or simply referred to as port). If a computer wants to avail a specific service from another computer, it has to establish a connection to it on the exact port number where the intended service is running.

For example, if a terminal is to request a web document from a remote server using HTTP, it has to first establish a connection with the remote server on port 80 (HTTP service runs on port 80) before placing the request.

In simple words, port numbers can be compared to door numbers where each door grants access to a specific service on a computer. The following table shows a list of popular services and their default port numbers:

OS FINGERPRINTING & CONCEALING YOUR IDENTITY

 

OS FINGERPRINTING

OS fingerprinting is the process of detecting the operating system of the target host or a
network. The following are some of the commonly used OS fingerprinting methods.

Active Fingerprinting

Active fingerprinting is the method in which specially crafted packets are sent to the
target system and the response is noted. Since different operating systems respond to
source packets in different ways, this response can be analyzed to determine the target OS.
One of the simple example is the use of Nmap tool as discussed in the previous section
which employs active fingerprinting method to determine the target OS.

Banner Grabbing

Another commonly used method of active fingerprinting is called banner grabbing. This
can be done using a simple tool called telnet. Telnet is readily available on Windows XP
and previous versions. For Windows Vista, 7 and 8 machines you need to activate the inbuilt telnet tool before you can use it. Just search for “how to enable telnet on windows”
on Google to find detailed instructions for enabling telnet client on your computer.
Once you have enabled the telnet client on your computer, banner grabbing is pretty
simple. Just type the following command in the command prompt to detect the operating
system running on the target:

telnet target-domain-or-IP 80

This will open the connection with the target. Next type the text exactly as follows HEAD
/ HTTP/1.1 and hit the Enter key twice. This should fetch results where there is a
possibility of the target OS


Passive Fingerprinting

Passive fingerprinting is a technique that uses indirect methods to determine the target
operating system. Unlike active fingerprinting which sends packets to the target, passive
fingerprinting on the other hand uses sniffing technique to analyze the target network
traffic and determine the operating system. It is less accurate than active fingerprinting.

You can use online tools like Netcraft to perform passive fingerprinting.

Netcraft Tool: http://toolbar.netcraft.com/site_report

Just visit the above link to access the Netcraft tool and enter the target domain or IP
address to know the target operating system, possible vulnerabilities, its risk rating and
other useful information.

CONCEALING YOUR IDENTITY

Concealing you true identity during the processes like footprinting and scanning is very
much necessary as there is a real chance of the target tracing back to you. Some of the
methods that you can employ to conceal your identity are discussed below.

Using a Proxy

A proxy server can be used to conceal your real IP address while performing scanning and
hack attempts on the target. Since the IP address tells everything about you, concealing it
using a proxy can be highly effective in hiding your origin.

Even though there are different types of proxies available, I recommend using a VPN
proxy service to hide your IP address. VPN services are fast and provide reliable ways not
only to hide your IP address but also to protect your data and identity over the Internet.

Here are a few popular VPN services that you can try:

HideMyAss Proxy

VyprVPN Proxy

Alternatively you can also use a chain of public proxies to further enhance your stealth
operation using free tools like Proxifier and SocksChain. Please note that using public
proxies can slow down your speed and hence VPN proxies are more recommended as they
best serve the purpose.

The other way to hide your identity is by using online tools for pinging and scanning the
target. During the use of online tools, the IP address of the server hosting the tools is
exposed to the target and not the one that belongs to the actual attacker.

Once you have gathered a long list of information about the target through footprinting
and scanning, it is time to analyze them for possible vulnerabilities in the operating
system, technologies or services running on the target. You can make use of the following
websites to find information about latest vulnerabilities and exploits:

1. http://www.securiteam.com

2. http://www.zone-h.org

3. http://www.securityfocus.com

4. http://www.packetstormsecurity.com

HOW TO CRACK A ROUTER OR MODEM PASSWORD ...

 Hello friends i have just get to know about this amazing software for cracking the modem and router codes .. my modem was causing some configuration problems lately . so i decided to resolve them but then i found out that i have forgotten my modem's hardware password .. and so i was having a hard time figuring it out ..

Then  a magic  Happens . I've got the software called security exploded router password kracker .. It is an amazing software for cracking router and modem password ..

Really easy to use .. 

 Here are 5 steps to crack the router or modem password ....

1. Install the router password kracker ..

2. The ip address of your router, modem 

3. enter modem , router username

4. Now select the password dictionary file 

. Download link for the password dictionary file 

 5. Now click on start crack. Then your password

 will be generated in the form of a report on report button to get the password.. 

HACKING TUTORIAL CLASS 5 ( SCANNING)

SCANNING

After gathering a variety of information about the target through footprinting, it is time to
move on to the next step called scanning. Scanning is the second step in the intelligence
gathering process of a hacker where information about specific IP addresses, operating
systems, their architecture and services running on computers can be obtained. Unlike
footprinting which gathers information passively from various third party sources,
scanning involves actively engaging with the target to obtain information.

DETECTING LIVE SYSTEMS

The first step in the process of scanning is to determine whether the target is alive or not.
This can be done using the ping tool that is readily available on both Windows and Linux
computers. Just open the command prompt if you are on Windows or terminal window if
you are on Linux and type ping followed by the target IP address as shown below:
ping 173.252.120.6
If the target is alive and online, you should get a reply from the target or you if the target is
not alive you will get a response saying “ping request cannot find the host”.
Angry IP Scanner
You can even ping a range of IP addresses all at once using a nice tool called “Angry IP
Scanner”. It is an open-source cross-platform network scanner tool packed with several
useful features.
All you need to do is enter the starting and the ending IP of the range that you want to
ping and click on the “Start” button 

Angry IP Scanner is available for both Windows and Linux operating systems and can be
downloaded from the link below:
Angry IP Scanner: http://angryip.org/download/
Online Ping Tool
If you would like to ping the target using a third party computer instead of yours, you can
do so using online tools like Just-Ping which pings the target from 90 different geo
locations worldwide. You can access Just-Ping tool from the link below:
Just-Ping: http://cloudmonitor.ca.com/en/ping.php

TYPES OF SCANNING

Port Scanning

Port scanning involves sending a series of messages to the target computer to discover
the types of network services running on it. Since each service is associated with a “well
known” port number, performing a port scan on the target will reveal the ports that are
open. So, when a port is said to be open the service associated with it is said to be active
and running, thereby opening up the opportunity for the attacker to break into it.
For example, if a port scan on the target shows that port 80 and port 25 are open, that
means the target computer has a HTTP service (web server) and an SMTP service (email
service) running on it respectively.

Network Scanning

Network scanning is a procedure for identifying active hosts on the target network either
for the purpose of attacking them or for security assessment. In this way it would be
possible for the hacker to make a list of vulnerable hosts for direct attack or to use them
indirectly to attack other hosts.

Vulnerability Scanning

Vulnerability scanning involves the use of automated tools known as vulnerability
scanners to proactively identify security vulnerabilities of computer systems in a network.
These tools will scan the target to find out the presence of known flaws that are
susceptible to exploits.

TOOLS FOR SCANNING

Nmap

Nmap is a popular open-source tool for network discovery and security auditing that
works on different platforms like Linux, Windows and Mac. It basically comes in the form
of a command line interface; however, to facilitate the ease of use it is also available in a
GUI format called Zenmap. For Windows machines, you can install the “self-installer”
version of Nmap that comes in the “.exe” format. The download link for the same in
available below:
Nmap Download: http://nmap.org/download.html
After installing the tool, run the desktop shortcut to open the Zenmap window which
typically

The “Target” box needs to be filled with the target IP address or domain name on which
you want to perform the scan. It also comes pre loaded with 10 different scan profiles that
you can select from.

Intense Scan
This scan type should be reasonably quick as it only scans TCP ports. Additionally, it
makes an attempt to detect the OS type, various services and their version numbers that
are running on the target machine.

Intense Scan Plus UDP
It is the same Intense scan as described above but also includes scanning of UDP ports.

Intense Scan, all TCP Ports
Unlike the normal Intense scan which only scans a list of 1000 most common ports, the
“Intense scan, all TCP ports” scans all available 65535 ports.

Intense Scan, No Ping
This option will exclude pinging the target from the Intense scan. You may use this option
when you already know that the target is up or is blocking ping requests.

Ping Scan
This option will only ping the target but does not perform port scanning of any type.

Quick Scan
Scans faster than the Intense scan by limiting the number of TCP ports scanned to only the
top 100 most common TCP ports.

Quick Scan Plus
Quick scan plus adds OS detection and a bit of version detection features to Quick scan.

Quick Traceroute
This option will show you the route that the packets take to reach the target starting with
the localhost (source or your own computer).

Regular Scan
This will perform the ping and TCP port scan of 1000 default ports on the target.

Slow Comprehensive Scan

This scan will try all possible options to uncover as much information as it can about the
target. It uses three different protocols: TCP, UDP and SCTP in order to detect hosts.
Out of all the 10 scanning options, I reckon Intense Scan to be appropriate under most
conditions. Just fill the “Target” box, select the “Intense scan” profile and hit the “Scan”
button. Let us now analyze the Nmap result output by running it on a sample target.
After the scan is completed the “Nmap Output” tab displays the raw output of all the scan
operations such as the date and time it was performed, the results from ping scan,
discovered open ports, target OS and traceroute results

The other tabs split the same results into an organized manner so as to display them in a
more user friendly manner using GUI interface. The “Ports/Hosts” tab will display a list of
discovered ports, their status as to whether they are closed or open, the protocol associated
and the services running on them

The “Topology” tab displays the result of traceroute command in a graphical manner
showing each hop involved in the path.

The “Host Details” tab shows the status of the host, its name, number of ports scanned,
uptime, last boot time, type of operating system running including its version number and
many other details

NetScanTools Pro
NetScanTools Pro is another wonderful program for Windows that has a powerful set of
over 50 network tools including both automated and manual ways to retrieve information
from the target.

You can use the “Automated Tools” to quickly perform port scan and grab vital
information about the target such as DNS records, Whois data, Traceroute details all from
a single place. On the other hand the “Manual Tools” section contains individual tools
specially crafted to give more control in the scanning process for advanced users.
Online Tools
You can also make use of online tools to perform port scan and discover important
information about the target. The following are some of the links useful online network
tools that are worth considering:
PenTest-Tools
YouGetSignal

Other Popular Tools

Here is a list of some of the other popular tools that you may want to explore:
SuperScan
ipEye

HOW TO CRACK PASSWORDS ...

Cracking OR Hacking Passwords

Password hacking is one of the hottest and most widely discussed topics in the field of
computer hacking. In today’s world, passwords alone play a key role in deciding the
security of a web server or any other computer system. As a result, hacking the password
is one of the easiest and sometimes the only way to gain access to the system. In this
chapter, you will be introduced to various password hacking techniques that are frequently
used in the hacking industry.

To begin with, I will let you know some of the obvious, simple yet effective techniques to
hack passwords:

1. Social Engineering: This type of technique involves psychological manipulation of
people into performing actions that lead to the disclosure of their confidential
information. In other words, social engineering is just a trick played by the hacker to
gain the trust of people so that they reveal the password by themselves.

Scenario-1: The hacker may call the target person by pretending himself as a bank
official and ask him to confirm his password stating that this has to be done as a part
of an ongoing verification program. In most cases, the target person on the other end
believes this and reveals his password to the hacker.

Scenario-2: In order to avoid suspicion, instead of directly asking the victim to
reveal the password, the hacker may obtain other vital information such as the “Date
of Birth”, “Place of Birth”, “High School Details” etc. from the target person. Using
these details, the hacker can easily reset the password and gain unauthorized access.
Even though social engineering seems simple, it is proven that most people
would easily fall victim to this attack. Lack of awareness among people is the
prime reason for the success behind this trick.

2. Guessing: As most people are known to use easy to remember words such as their
“pet’s name”, “phone number”, “child’s name” etc. as their passwords, it is often
possible for the hacker to easily guess the password.

3. Shoulder surfing: It is the act of spying on one’s keyboard from behind the
shoulders as a person types his/her password. This technique works well particularly
in crowded areas such as cyber cafes and ATMs where people are usually unaware of
what is happening behind their shoulders.

After understanding some of the simple password hacking techniques, it is time to move
on to the next level. Now, let us jump into some of the serious methods that hackers use to
crack passwords:

DICTIONARY ATTACK

A dictionary attack is a type of password cracking technique where a long list of words
from the dictionary is repeatedly tried against the target until the right match is found. This
technique can be used to crack passwords that contain words found in the dictionary.
Generally, the success of a dictionary attack is based on the fact that most people have a
tendency to use easy to remember passwords that are found in the dictionary. However, if
one uses a strong password with a combination of alphabets and numbers or introducing a
slight variation to the actual spelling would make it impossible for the dictionary attack to
crack such passwords.

One of my favourite tool to carry out the dictionary attack is Brutus. It is a remote online
password cracker that works on Windows platform and can be downloaded from the
following link:
Brutus Download: http://www.hoobie.net/brutus/
NOTE: Some antivirus programs are known to have conflict with the Brutus application.
So, it is recommend that you temporarily disable your antivirus before running the Brutus
application.

Now,how to use Brutus. Here is a step-by-step
procedure:

1. After downloading the tool from the above link, unzip the package into a new empty
folder.
2. Run the “BrutusA2.exe” file to open the application
3. Enter the IP address (or domain name) of the target server in the “Target” field
Select the type of password that you want to crack from the “Type” field or enter
your own custom port number in the “Port” field”.
4. If you know the username for which you want hack the password for, then check the
“Single User” option and enter the username in the “UserID” field. Otherwise leave
the default settings to work as it is so that the username list is loaded from the
“users.txt” file.
5. In the “Pass Mode” field select the option “Word List”. The list of words will be
loaded from the “words.txt” file by default which contains around 800+ words. If
you’ve a .TXT file that contains more words, then you can use that by selecting the
“Browse” option. The more bigger the list is, better the chances of cracking the
password.
6. Now, hit the “Start” button to begin the cracking process. Brutus will try every word
in the password list for each of the usernames present in the username list. It will
take a while for the process to complete and if you’re lucky, you should get a positive
authentication response and the cracked password .

NOTE: It is always a smart idea to use a proxy before attempting this hacking process.
This will prevent your real IP address from being stored in the logs of remote server and
thus reduces the chances of being traced back.

BRUTE-FORCE ATTACK

Unlike the dictionary attack which tries only those words present in the list, the brute
force attack on the other hand tries every possible permutation of alphabets, numbers and
even special characters until the right password if found.
In theory, it is possible to crack any password using this approach, but here’s the catch!
Brute force attack takes a long time to crack passwords. The time actually depends on the
speed of the computer and the complexity of the password.
For example, if the target password is small and doesn’t contain any numbers or special
characters, it is fairly easy to crack such passwords using this approach. However, if the
password is lengthy, contains numbers or even special characters, this approach may take
a long time to complete. For some complex passwords, brute force approach may take up
even years to finish the cracking process as there are billions of permutations to try.

Here is how you can configure the Brutus program to try the brute force approach:

1. Configure the “Target”, “Type” and “Port” in the same way as in case of the
dictionary attack. Under the “Authentication Options”, select the “Pass Mode” as
Brute Force and click on the “Range” button
2. Once you click on “Range” you will see a number of options to select with such as
“Digits only”, “Lowercase Alpha”, “Uppercase Alpha” and so on. You can also set
the Min Length and Max Length to narrow your brute force attack options
3. Once your range selection is over, click “OK” and hit the “Start” button. The brute
force cracking attempt will begin and will take anywhere from a few minutes to a
couple of hours to complete. If the crack attempt is successful, you should see the
username and its corresponding password displayed on the Brutus window!

RAINBOW TABLE

A rainbow table is a pre-computed table that contains a long list of password hashes for
dictionary words as well as alphanumeric permutation of words. The hacker initially
generates a long list of password hashes and stores them in a rainbow table for later use.
Although generating a rainbow table initially takes a long time and utilizes more storage
space, once computed it can greatly reduce the time taken for the password cracking
process.

Any computer system that requires password authentication will maintain a table of
usernames and passwords in its database. In case if the hacker manages to steal this table
from the database, he would easily be in a position to gain access to a large number of
accounts on the target system. In order to prevent this from happening, most systems store
the passwords in a cryptographic hash format as opposed to plain text.
For example, when a user completes the sign-up process on an online portal, the system
may convert his password to MD5 hash format and store it in its database table. Suppose if
the user has his password as goldfish, its MD5 hash would be as follows:
MD5 Hash: 861836f13e3d627dfa375bdb8389214e
Thereafter whenever the user tries to log into the portal, his password gets converted to the
MD5 hash format on the fly and is compared against the existing hash in the database
table. If both the hashes match, access is granted to the user.
Now, even if the hacker manages to gain access to the database and steal the password
table, he would only see a long list of cryptographic hashes and not the actual password.
This is where rainbow tables come in handy. The hacker can use the rainbow tables to
compare the long list of pre-computed hashes against the stolen list of password hashes. If
the hashes match, the password would be the one that was initially used to generate the
hash.
Unlike a brute force approach where the hash is computed on every attempt, the rainbow
table approach on the other hand utilizes a pre-computed list of hashes to directly compare
them against an existing password hash. As the time required to compute the hash on
every attempt is cut down, the rainbow table approach takes significantly less time to
complete the cracking process.
A practical example of rainbow table approach will be discussed in the next chapter where
we take up the topic of cracking Windows passwords.

PHISHING ATTACK

Phishing is a form of social engineering technique used by hackers to gather sensitive
information such as usernames, passwords and credit card details by posing as
a trustworthy person or organization.

Phishing scams usually sends an email message to users requesting for their personal
information, or redirects them to a website where they are required to enter their personal
information.

In most cases, a phishing email directs the victims to follow a link leading to a website
where they will have to enter their login details or other confidential information. In
reality this website is a fake one created by the hacker (often referred to as spoofed
website) which is an exact replica of the original or appears similar. When the victim
enters his/her login details on a spoofed page they are actually stolen away by the hacker.

For example, the hacker may send an email that pretends to have been appearing from the
bank where the victim maintains an account and ask him/her to update the login details by
following the link present in the email. The email further mentions that this update process
is mandatory and failing to do so will result in the bank account being locked. As a
response, the victim clicks on the link where he/she will be taken to the fake login page
that looks similar to the original one. However, when the login details are entered, they are
recorded and stored on the website for later access by the hacker. The victim remains
unaware of the entire process but the hacker skilfully manages to hack the password.

IMPORTANT NOTICE – All the information provided in this blog is strictly for educational purpose only, and any illegal or unethical use of this information will not be the responsibility of the blog  .. And  as your well wisher in would say “ please use them carefully and ethically “ it will keep you out of many troubles  ..

HOW TO HACK INTO WINDOWS OPERATING SYSTEM

HACKING WINDOWS

GAINING ACCESS TO THE SYSTEM

Gaining access to a password protected user account especially the one with
“administrator privileges” forms the key element in hacking Windows. The following are
the two important techniques using which you can gain access to any protected account on
Windows without actually knowing the password.

Resetting the Windows Password

If you wish to gain access to a Windows computer whose account is password protected,
resetting the password is an easy option. Windows stores all its account information and
encrypted passwords in a file called “SAM”. By modifying the “SAM” file it is possible to
reset the password of any user account including that of the “administrator”. You can
accomplish this task using a small open-source tool known as Offline NT Password &
Registry Editor. This utility works offline, that means you need to shut down and boot up
the target computer using a CD or USB device such as thumb drive. The tool has the
following features:
You do not need to know the old password to set a new one.
This tool will allow you to reset the password of any user account.
This tool can also detect and unlock locked or disabled out user accounts.
You can download the tool from the link below:
Download: http://pogostick.net/~pnh/ntpasswd/
Resources to create a bootable CD and bootable USB device are available for download
separately. Both works similarly and is a matter of your convenience. However, in this
book I will give a demonstration of the USB version to reset the existing password. To
create a bootable USB drive, download and unzip the USB version of the tool from the
above link by following the simple instructions given in the readme.txt file.
Once you have the bootable USB device in your hand, plug-in the device and boot from it.
Make sure that you have enabled the USB boot option and set the top boot priority for
your USB device in BIOS. Step-by-step instructions to complete the password reset
process is given below:

Once the tool is running from your USB device, you should see the screen similar to the
one shown above. Just follow the screen instructions and the tool will automatically detect
the partition on which the Windows is installed. Usually the right options are preloaded in
the square bracket as shown in the below snapshot. So, just pressing Enter key should
work.

In the next step, you will be asked to “select which part of the registry to load”. You need
to select the option-1 that is “Password rest [sam]” which is preloaded by default as shown
below. So just press Enter to proceed.

In the next step, select the option-1 which is “Edit user data and passwords” as shown
below and hit Enter.

Now, you should see a list of “Usernames” and their “Admin” status being displayed.

Select the user who has administrator privilege and hit Enter.

In the next screen you will be asked to select from a list of options that you may want to
perform on the selected user. Here, just select the option-1 which is “Clear (blank) user
password” and hit Enter.

This should reset the password for the user account to make it go blank, so that the next
time you reboot your Windows you should be able to login automatically as if there was
no password set for that user account.

Now quit editing user by pressing q and hit Enter until you proceed to the screen where
you will be asked to confirm “writing back changes” to the SAM file. This step is very
important where you need to press y and hit Enter as shown in the snapshot below. If you
accidentally press Enter keeping the default option which is n, the reset process will fail
and the whole procedure will have to be repeated again from the beginning. So, changing
the default option from n to y before pressing Enter is very important.

This will complete the reset process where the existing password will be removed and set
to blank. Disconnect the USB device and press CTRL+ALT+DEL to reboot the
computer. Now, the Windows should let you login to the system without insisting to enter
the password.

Restoring the Password After Breach

Resetting the password is a wonderful option to easily gain access to the password
protected accounts. However, this method has a clear drawback as the password reset
process is permanent. The administrator of the target machine will easily come to know
about the security breach as thereafter no password will be asked during the login process.
To overcome this drawback, we will have to device a means to restore everything back to
normal once the purpose of breach is completed. For this we will have to take a backup of
the original SAM file before modifying it in the password reset process and safely restore
it back to make everything look normal.

The SAM file is located in the drive where the Windows is installed (usually C:) under the
following path: \windows\system32\config. You can easily access this location by booting
up the computer from your live Kali Linux DVD. Once the Kali DVD is loaded, doubleclick the “Computer Icon” present on the desktop to open up the explorer window. Now,
navigate to the above location to find the SAM file and back it up to a different location
such as a different drive or to your own USB device.


Now reboot the system and perform the password reset process as discussed earlier. Once
you are done with your work, reboot the system again with Kali DVD and navigate to the
location of SAM file. Rename the existing file to SAM.OLD and restore the original
SAM file from the backup location. This should bring everything back to normal and
avoid suspicion.

Bypassing the Windows Authentication Process

In the previous section we had discussed on how to reset the password to gain access to
the system. But there is another smart way to gain access to the Windows system by
silently bypassing the authentication process itself. This is done by applying temporary
changes to the Windows kernel on the fly (while booting) to disable the authentication
process. A tool called Kon-Boot allows you to accomplish this task. You can download it
from the link below:
Kon-Boot: http://www.piotrbania.com/all/kon-boot/
Kon-Boot is a handy tool that allows you to enter any password protected Windows user
account without having to enter the password during the log-in process. The tool allows
you to create a bootable CD or a USB drive. Once you boot the target computer from this
bootable device, it will virtually modify parts of Windows kernel to load the operating
system in a special mode where you will not be insisted to enter the password. The
advantage of this tool is that all the changes are temporary and disappear after reboot, so
that everything looks normal thereafter and does not arouse suspicion of a possible
security breach.

DUMPING THE PASSWORD HASHES

After understanding some of the techniques to gain access to the system without knowing
the password, it is time to move on one step further and find out a means to crack the
actual password itself. If it is required to gain access to the target system multiple times
over a period, it is always a good idea to unveil the password by cracking it so that you
can easily login to the system by entering the password thereby eliminating the need to
reset the password each time you want to gain access.
Windows user account passwords are converted into a cryptographic hash format called
NTLM (NT LAN MANAGER) hash. This NTLM hash along with the user profile
details is stored in a special file called Security Accounts Manager or SAM. The SAM
file is further encrypted with the syskey which is stored in a file called SYSTEM. Both
SAM and SYSTEM are located in the drive where the Windows in installed (usually C:)
under the following path: \windows\system32\config.
In order to crack the password, it is necessary to extract the NTLM hash and user
accounts details stored in the SAM file from the target system which is known as
dumping. The dumped details are transferred to the hacker’s computer and the password is
cracked using an offline password cracking tool. The following are the two ways to dump
password hashes:

Dumping Hashes With Administrator Access

If you have administrator access to the system on which you want to dump password
hashes, you can use a handy tool called PWDUMP. This is an open-source command-line
tool to quickly dump password hashes onto a text file. The tool can be downloaded from
the link below:
PWDUMP: http://www.tarasco.org/security/pwdump_7/
This is a very small tool which is less than a MB in size and can be carried to the target
location in a USB thumb drive. To dump the hashes, just open the command prompt with
administrator rights, navigate to the location of the tool (PwDump7.exe) and run the
following command:
PwDump7.exe >> targetfilename.txt
As shown in the below snapshot, I am running the PwDump.exe from my USB thumb
drive (M:) and dumping the hash details in a file called hash.txt. This file should get
created in the same directory from which PwDump.exe is running

The hash.txt file contains a list of existing user accounts on the machine and their
corresponding NTLM hashes

Dumping Hashes Without Administrator Access

The previous section shows how to dump password hashes when you already have
administrator access to the target machine. What if you do not have administrator access?
In this case, you can use your Kali Linux Live DVD to boot up the system and load the
Linux. From here, access the drive on which the Windows OS is installed and navigate to
\windows\system32\config\. From here copy the two files SAM and SYSTEM on to your
USB device so that you can carry them to your computer for offline password cracking

After successfully dumping the password hashes, we can now easily crack them using
different tools and approaches as mentioned below:

Using Rainbow Tables

As discussed in the previous , a rainbow table contains a list of pre-computed
hashes that can be instantly compared against the dumped password hash to crack the
password. This is so far the best and the fasted method to successfully crack the Windows
password. For this we will use an open-source tool called Ophcrack that can be
downloaded from the link below:
Ophcrack Website : http://ophcrack.sourceforge.net/
 From the above link, download the installable version of Ophcrack (not the Live CD
version) and install it on your system. During the installation process, when the option
comes up to download rainbow tables, uncheck them all and just install the program. It is
always better to download the rainbow tables separately.

Once you have it installed on your system, go to the Ophcrack website from the above
link and click on Tables in the navigation menu. Here you should see a list of rainbow
tables you can download.

If you want to crack the passwords of Windows XP and prior operating systems download
the tables from the LM hashes section. For operating systems after XP such as Windows
Vista, 7 and 8 download the tables from the NT hashes section
as the character set increases the size of the table grows
bigger. Bigger the table higher the chance of successful cracking. You can download the
one that best matches your needs. For the purpose of demonstration, I am using the “Vista
proba free” table on my Windows 8 machine with Ophcrack. Here is a step-by-step guide
on how to use this tool to crack passwords.

1. Open the Ophcrack tool by double-clicking the icon on the desktop.
2. From the main Ophcrack window, click on “Tables” button and select the table that
you have downloaded from the list. Now click on “Install” button, load the folder that
contains the downloaded tables and click on “OK”.
3. Next, to load the dumped password hashes, click on “Load” button, select
“PWDUMP file” option and load the hash.txt file obtained by running the
PWDUMP tool on target machine. If you have SAM and SYSTEM files instead of
hash.txt, you can choose the option Encrypted SAM instead of “PWDUMP file”
and select the folder which contains those two files.

When everything is loaded and ready as shown in the above snapshot, click on
“Crack” button and site back patiently. The cracking process will take from anywhere
between few minutes to few hours to complete depending upon the size of the table
and strength of the password. If it is successful, the cracked password will be
displayed along with the time taken to crack ..

If you get unsuccessful in cracking the password, you may try a different rainbow
table that covers more characters and long passwords.

Using Brute-Force Approach

Even though using rainbow tables is by far the fastest and the best approach to crack
passwords, it may not be successful for long and strong passwords as hash tables for such
passwords are hard to find. So, brute-force approach becomes inevitable under these
situations. But remember it may take a very long time ranging from a few hours to few
days to complete the cracking process. Since Ophcrack is not so effective for the bruteforce approach, we will use another powerful tool called L0phtCrack which is available
from the link below:
L0PhtCrack Download: http://www.l0phtcrack.com/download.html
After installing L0phtCrack, Click on “Import hashes” button from the main window to
load the hashes. You have the option to load the hashes from both the “PWDUMP file” as
well as “SAM file”.

Click on the “Session Options” button to further configure different auditing options such
as dictionary and brute-force attacks. You can enable or disable specific attacks and also
customize character set, password length and range options for brute-force approach.
Configuring the auditing options wisely can avoid unnecessary time delay and thereby
speed up the password cracking process.
Once you are done with loading the hashes and configuring the options, click on the
“Begin” button. This will initiate the cracking process and the time consumed to crack the
password depends on various factors like the password strength (length + presence of
alphanumeric + special characters), type of attack (dictionary, hybrid or brute-force) and
the speed of your computer.
If the password cracking process is successful you should see the cracked password next
to the user name in the L0phtCrack window

Sniffing Password Hashes on a Network

If your computer is on a network such as office or school, it is possible to remotely import
the password hashes of other computers on the network without the need to gain physical
access to them. This method is called sniffing and L0phtCrack 6 and above supports this
option.
To sniff password hashes from other computers, just click on the “Import From Sniffer”
button on the main window. If more than one network interface is detected, the “Select
Network Interface” dialog box allows you to choose the interface to sniff on. After
choosing your interface, the “SMB Packet Capture Output” dialog box appears where you
need to click on “Start Sniffing”.
If the hashes are captured, they are immediately displayed in the dialog box after which
you can hit “Stop Sniffing” and click on “Import” button to load the password hashes for
cracking.


IMPORTANT NOTICE – All the information provided in this blog is strictly for educational purpose only, and any illegal or unethical use of this information will not be the responsibility of the blog  .. And  as your well wisher in would say “ please use them carefully and ethically “ it will keep you out of many troubles  ..