ANDROID VULNERABLE TO HACKING

 It’s been reported that nearly all smartphones which run Google’s Android operating system could potentially be hacked, particularly when connected to an unencrypted WiFi network. From research carried out by technology experts at the University of Ulm, hackers can easily break into an Android smartphone, and gather login details for Google applications such as Google Docs and Calendar. In short all Google accounts.

What’s even more worrying is there is a freely available ‘sniffer program’ which hackers can use to gain access to a person’s device. They don’t have to physically hold the handset either as everything can be done over the air.

Speaking with the Daily Telegraph, one of research team members said: “…the adversary can gain full access to the calendar, contacts information, or private web albums of the respective Google user.” The expert added: “This means that the adversary can view, modify, or delete any contacts, calendar events, or private pictures. This is not limited to items currently being synced but affects all items of that user.”

Also worrying is the fact that while users are sent an encrypted file called an Authentication Token, which is basically vulnerable data such as passwords etc, researchers have found these tokens are sent to a smartphone in the form of a text file. This means anyone can read them.

Google is aware of the problem, and has now included a patch it its latest update for Android, namely version 2.3.4. Nevertheless, for those using an Android smartphone it is something that should be of concern, particularly since mobile phones are not automatically updated.

HOW TO DEFACE WEBSITES USING SQL & PHP SCRIPTING

Now we will Discuss on an exciting topic " How to Deface Websites using the SQL injection and PHP shell code Scripting".. Today I will show you the 100% working method for Hacking Websites and then Defacing them...

FIRST OF ALL YOU SHOULD KNOW WHAT IS DEFACEMENT??

Defacing a website simply means that we replace the index.html file of a site by our file. Now all the Users that open it will see our Page(i.e being uploaded by us).
For Defacing a website, three things that you need Most are:
1. SQL Injection(For analyzing website loops)
2. Admin Password
3. Shell Script (for getting Admin Controls)

Now I'll explain what is SQL Injection :

SQL Injection is a Type of security exploit in which the attacker "injects" Structured Query Language through (SQL) code through a web form input box, to gain access to resources or make changes to data


 Its a technique of injecting SQL commands to exploit non-validated input vulnerabilities in a web application database backend

Programmers use sequential commands with user input, making it easier for attackers to inject commands

Attackers can execute arbitary SQL commands through the web application.

Now Lets Start the Tutorial:

  
You must lookup to one of the famous SQL injection a site http://www.milw0rm.com/ If you have any doubts I will clear them....

 What Should  You Look For

Try to look for pages that allow a user to submit data, for example : a log in page,search page,feedback,etc

Look for HTML pages that use POST or GET commands

If POST is used you cannot see the parameters in the URL 

Check the source code of the HTML to get information

For example, to check whether it is using POST or GET, look for the <Form> tag in the source code

<Form action =search.asp method=post >

<input type = hidden name=X value=Z> 

</Form> 

    

Here Now You Can Perform Your Penetration Testing Using The Following Tools & Instructions :

1) Exploit scanner (this will find vulnerable websites)
Code:

http://rapidshare.com/files/24802790...oitscanner.zip

2) SQLi helpper (this tool will do all the injecting job and get you the pass or hash)
Code:

http://rapidshare.com/files/24802907...elperV.2.7.rar

 

In some websites you can directly see the password but most of the websites encrypt them using MD5. so u hav to crack the hash to get the password. 
 

To crack the password there are three ways

 
1) Check the net whether this hash is cracked before:
Download:

http://www.md5decrypter.co.uk

2) Crack the password with the help of a site:
Download::

http://www.milw0rm.com/cracker/insert.php 

http://passcracking.com/index.php

3) Use a MD5 cracking software:
Download:

http://rapidshare.com/files/13696796...CF_2.10_2b.rar
Password = OwlsNest

2) DEFACING THE WEBSITE

After getting the password you can login as the admin of the site. But first you have to find the admin login page for the site. there r three methods to find the admin panel.

1) You can use an admin finder website:
Code:

http://4dm1n.houbysoft.com/

2) You can use an admin finder software:  

Code:

http://rapidshare.com/files/248020485/adminfinder.rar

After logging in as the admin you can upload photos to the site. so now you are going to upload a shell into the site using this upload facility.

Dowload the shell here:

http://rapidshare.com/files/248023722/c99.rar  

Extract it you will get a c99.php upload it.
Some sites wont allow you to upload a php file. so rename it as c99.php.gif
Then upload it.

After that go to http://www.site.com/images (in most sites images are saved in this dir but if you cant find c99 there then you have to guess the dir)

find the c99.php.gif and click it..

Now you can see a big control pannel....
Now you can do what ever you want to do...
Search for the index.html file and replace it with your own file. 
So if any one goes to that site they will see your page....

THERE IS ONE MORE METHOD TO FIND THE VULNERABILITY AND EXPLOIT IT  :

One of the popular tools is Havij, Havij is an advanced SQL injection tool which makes SQL Injection very easy for you, Along with SQL injection it has a built in admin page finder which makes it very effective

Supported Databases With Havij

• MsSQL 2000/2005 with error.

• MsSQL 2000/2005 no error union based

• MySQL union based

• MySQL Blind

• MySQL error based

• MySQL time based

• Oracle union based

• MsAccess union based

• Sybase (ASE)

Demonstration :

Now i will Show you step by step the process of SQL injection.
 
Step1: Find SQL injection Vulnerability in tour site and insert the string (like http://www.target.com/index.asp?id=123) of it in Havij as show below.

Step3: Now click on the Analyse button as shown below.

Now if the your Server is Vulnerable the information about the target will appear and the columns will appear like shown in picture below:

Step4: Now click on the Tables button and then click Get Tables button from below column as shown below:

Step5: Now select the Tables with sensitive information and click Get Columns button.After that select the Username and Password Column to get the Username and Password and click on the Get Table button.

Countermeasures: 

Here are some of the countermeasures you can take to reduce the risk of SQL Injection

1.Renaming the admin page will make it difficult for a hacker to locate it

3.Use a Intrusion detection system and compose the signatures for popular SQL injection strings

4. One of the best method to protect your website against SQL Injection attacks is to disallow special characters in the admin form, though this will make your passwords more vulnerable to bruteforce attacks but you can implement a capcha to prevent these types of attack.

How to Create a Computer Virus

Virus Software: How to make Virus/Create Virus

I have previously posted about How to Create a Fake and Harmless Virus. In this article i want to show you how to create a real virus using Virus Software. I compiled a list of some great virus maker softwares. Now you don't have to know any programming or coding to make virus. Simply use one of these Virus softwares and you can easily make virus for yourself. These virus softwares provides you with various options which you can use to make virus according to your preferences. The virus programs are tested to well working on all Windows systems.

Here is the list of the softwares that allows you to make Virus:

1. In Shadow Batch Virus Generator

1. First of all download the virus maker from here

2. Run "In Shadow Batch Virus Generator.exe" application to see something like this:


3. You can use various options to make virus to suit your needs. You can:

• Infect files of various extensions
• Insert virus in startup menu, Kill various processes.
• Disable all security services like Windows Defender, Antivirus, Firewall.
• Rename file extensions, spread virus via file sharing.
• Create new admin account, change user account password.
• Block various websites, download trojan files to victim computer, shutdown victim computer and much more.

4. After selecting various options, move on to "Creating Options" tab and hit on "Save as Bat". Assign name to the virus and hit on Save.

5. Now, you have your virus ready to hack your victim. This virus maker is undetectable by the most antiviruses.

I am not responsible for any action performed by you. Also, do not try this virus on your own computer. This virus software is one of the most efficient virus software used today.


2. JPS Virus Maker


This is also a great virus maker with many features in it. Check all the features of JPS Virus maker here.


3. TeraBIT Virus Maker


A powerful virus maker for you

Download JPS Virus Maker and TeraBit Virus Maker.

These two virus makers are detected as a viruses by the most anti-virus softwares, but they won't harm your pc in any way. Before you run these virus makers disable your anti-virus temporarily.

If you know other virus makers i want to hear your suggestions.

How to Make a Trojan Undetectable by Antivirus Software

It's very simple to make a trojan/keylogger, but to make it undetectable by the antiviruses is the hard part. Nowadays crypting trojan don't give a good result if you use use a public crypter, otherwise you need to buy a private edition or to hex it. Here i am going to show you how to make your trojan, keylogger, or RAT almost FUD (Fully Undetectable) by any anti-virus software.

We gonna need a Privacy Protection Software. This kind of software is used by program creators to protect their creation from cracking and reverse engineering. We gonna do the same to a trojan and you are going to see the result.

1. First of all you need to download the program: PC Guard for Win32

2. Open the program, and in the "Application filename" browse your server's location.


2. Click on the "General" tab, and check the options like on the image below.


3. Now do the same with the "Security & Encryption" tab. Look at the image below to see what options to check.


4. At the end choose "Protection Methods", and select the following options:


We are done!


The Scan Results:

Poison Ivy server:

Bifrost server:



Do you have questions, comments, or suggestions? Feel free to post a comment!

How To Control Your Computer with Your Cell Phone

Remotely Control Your PC from Anywhere with Your Cell Phone!

Have you ever been away from your desktop and needed some information that was on it? Have you ever needed to shutdown your computer or do something underhanded while away? In this post I am going to show you how to control your PC from your Cell Phone.

There is a program called CellPC that allows you to perform operations on your home/work PC via your cell phone or wireless device quickly and easily. Imagine being able to shutdown, restart, or logoff your PC remotely... search files on your computer and then send them to your cell phone... view a realtime screenshot of your computer at anytime... lockdown your computer... send a message/note/reminder to your computer... and much more!

CellPC Top Features:

• Perform Shutdowns, Restarts, Logoffs
• View a Screenshot of your Computer
• Search for and Retrieve Files
• View and Close Open Windows
• Customizable Commands Editing
• Be Alerted when your Computer is Used View and Close Open Applications
• Send Messages to your Computer
• Lock and Unlock your Computer
• Secure Command Execution
• Log all Access Attempts and Commands
• Disable/Enable Commands at will

How does CellPC Work?



Will CellPC Work for Me?

CellPC can work with any Windows computer as long as it has a steady internet connection while the software is running.

If you want to verify that CellPC will work with your device, contact the CellPC support team so you can send them a test message from your phone.

Click Here To Download CellPC

Do you have questions, comments, or suggestions? Feel free to post a comment!

How to Track the location of an IP address

Lookup details about an IP address including location, ISP, hostname, type, proxy, blacklist status and more. Trace, Track and Locate an IP address.


In this post i want to show you some useful tips to find out the exact location of an IP address. For example, if you pick up a proxy from a proxy list (like SamAir.ru), you get only the country where the proxy is located. To find out the exact location of the IP you should perform a location lookup. There are many sites/services that can do this. My favourites and also the best ones (in my opinion) are GeoBytes IP Locator and IP2Location.


 GeoBytes shows a Google map of city, along with a bunch of other information (country, city, latitude, longitude, distance to nearby cities, etc.) about the location itself.


IP2Location also offers the name of the ISP (Internet Service Provider).


If you want more information on an IP address, you can do a WHOIS search also. ARIN WHOIS Database gives you information on who hosts a certain IP address and their registration information