Showing posts with label desktoppishing. Show all posts

Oracle intros Exadata Database Machine

Sunday, August 28, 2011 // by Hacking Beast Editor // Labels: android, Cyber News, Cyber Security, database, desktoppishing, exploit, New Releases, servers, softwares, tech news, technology, tips and tricks // 0 comments

With this release, customers can take advantage of the mission-critical reliability, scalability, and security of Oracle Solaris to run their online transaction processing (OLTP), data warehousing and consolidated workloads on the x86-based Oracle Exadata systems, said a press release.

Also read: Oracle intros SQL Developer 3.0 for developers DBA

"Customers have eagerly awaited Oracle Exadata running Oracle Solaris," said Tim Shetler, vice president of Product Management, Oracle.

He further added that customers running Oracle Solaris environments can take advantage of Oracle Exadata in conjunction with their deep expertise and knowledge of Oracle Solaris systems to deliver extreme data warehousing and OLTP application performance.

Also read: Oracle announces opensource NetBeans IDE

According to the release, the combination of Oracle Exadata running Oracle Solaris offers customers:

* Continuous uptime with Oracle Solaris Predictive Self-Healing to diagnose, isolate, and help to recover from hardware and application faults;

* The ability to safely analyze, tune, and troubleshoot applications on production systems with little or no performance impact with Oracle Solaris DTrace;

* Up to 10x faster system updating and rebooting to help reduce planned downtime;

* Extremely fast transaction response times and high throughput with Oracle Exadata Smart Flash Cache for caching frequently accessed 'hot' data; and,

* Dramatically improved performance and concurrency of queries by processing queries at the storage layer using Oracle Exadata Smart Scan to return only relevant rows and columns to the database server.

The content on Hacking Beast like Hacking Articles, Cyber News etc are provided by many sources ( email,messages,internet etc) , we do not take any responsibility of your activities. The news provided by us on this site is gathered from various sources. if any person have some FAQ's in their mind they can Contact Us. and you can also read our Disclamier for more info. Thank You !

If you enjoyed Hacking Beast Articles , Make sure you subscribe to our RSS feed. Stay Updated about latest Hacking News, Tips and Tricks,and Cyber News.! and recieve all our emails and latest posts directly in your inbox to enjoy fast and easy reading . Thank You!

Art of Exploit Writing and Penetration Testing

Monday, August 8, 2011 // by Hacking Beast Editor // Labels: Cyber News, Cyber Security, database, desktoppishing, exploit, hacking, knodledge, website hacking // 0 comments

Hi friends, I wanna share my views on one of the favorite topic "Art of Exploit Writing and Penetration Testing " first of all lets define "Exploits",as "A tool developed by hackers that is used to perform malicious attacks on computer systems. They are usually scripts that are designed to exploit weaknessness in software over a network, most commonly the Internet. Zero-Day is a common type of exploit."

And "Penetration Testing" can be defined as, "A penetration test, occasionally pentest, is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source, known as a Black Hat Hacker, or Cracker. The process involves an active analysis of the system for any potential vulnerabilities that could result from poor or improper system configuration, both known and unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures."

Make the Exploit Stable
It is a good idea to ask yourself a series of questions once you’ve got the exploit working, so that you can determine whether you need to keep working to make it more stable. Although for some readers it may be enough to be able to point at a single working example of an exploit, if you’re actually going to use it in a production environment, you should be aiming for industrial- strength exploits that will work anywhere and won’t change the target host in any undesirable ways. This is a good idea in general, but also helps cut over all development time; if you do a good job the first time, you won’t have to keep revising your exploit every time a problem occurs.

Here is a quick list, you might want to add more of your own questions:

Can you run your exploit against a host more than once?
If you script your exploit and repeatedly run it against a single host, does it fail at some point? Why?
Can you run multiple copies of your exploit against a host simultaneously?
If you have a Windows exploit, does it work across all service packs of the target OS?
Does it work across other Windows OSes? NT/2000/XP/2003?
If you have a Linux exploit, does it work across multiple distributions? Without needing to specify offsets/versions
If you require users to enter a set of offsets in order for your exploit to work, consider hard coding a set of common platform offsets in your exploit and allowing the user to select based on a friendly name. Even better, use a technique that makes the exploit more platform independent, such as deriving the addresses of Load Library and Get Proc Address from the PE header in Windows, or not relying on distribution-specific behaviours in Linux.
What happens if the target host has a well-configured firewall script?
Does your exploit hang the target daemon if IP Tables or (on Windows) an IPSec filter rule set blocks the connection?
What logs does it leave, and how can you clean them up?

Methodology behind Exploit writing and Penetration Testing: -

Sometimes security researchers can get lucky when auditing an application without following any concrete plan. They might just happen to read the right piece of code at the right time and see something that has gone unnoticed before. If however, your goal is to find a definite vulnerability in a particular application or to attempt to find all bugs in one application (as is the case in any professional source code audit), then a more well-defined methodology is needed. What that methodology turns out to be depends on your goals and the types of vulnerabilities you are looking for. Some possible ways to audit source code are outlined here. Vulnerability research can sometimes be a frustrating task, but at other times it is a lot of fun. As an auditor, you will be searching for something that may not actually exist; you must have great determination in order to find anything worthwhile. Luck can help, of course, but consistent vulnerability research usually means hours of pain staking auditing and documentation. Time has proven repeatedly that every major software package has exploitable security vulnerabilities. Enjoy auditing : D

The idea behind our approach is to simplify the researcher’s view of the system, allowing him or her to focus on the structure and behaviour of the system from a technical security perspective rather than being led along some predefined path by vendor documentation or source code. It is more of an attitude and an approach than a specific technique, although you will need some basic skills. Our experience has been that this approach leads to the discovery of bugs that were “not thought possible” by the development teams —because they were too obvious, or obscured by the source code (for example, complex C macro definitions), or because an interaction between components of the system had simply not been thought about. Throwing away the rulebook, so to speak, is a liberating thing.

The approach can best be summarized as follows:

Attempt to understand the system without referencing its documentation and source code.
Investigate likely areas of weakness. During the investigation, make use of system tracing tools to learn more about the behavior of the system and take note of where behaviours diverge—these points may not be obvious.
Where differing behaviors are observed, attempt common forms of attack and observe the response.\
Continue until you've covered all the behaviors. Perhaps a concrete example would clarify the process.

The process of discovering vulnerabilities can be time consuming and extremely tedious. We can save time and increase our efficiency by developing and maintaining a toolkit specifically designed to discover flaws in targeted software packages. This toolkit should consist of utilities and technologies that will allow us to audit an application’s source code and its compiled machine code. We should also include tools that allow us to audit an application while it is operating. This category of tools includes aggressive auditing technologies such as fuzzers or etc, as well as miscellaneous passive monitoring tools. Each of our tools allows us to examine the security of an application from a different perspective. The technology within each of our tools has its benefits as well as its weaknesses. By combining several of these technologies, we can eliminate many of their weaknesses while retaining their individual strengths.

What is TCP/IP & UDP Attacks ?

Sunday, August 7, 2011 // by Hacking Beast Editor // Labels: database, ddos, desktoppishing, exploit, hacking, knodledge, servers, shell codeing, technology, tips and tricks // 0 comments

Hello, Lets explain "TCP/IP & UDP Attacks", Most common and effective Web attacks...Lets Know abt its basic and types...

TCP/IP Attacks
1. TCP SYN or TCP ACK Flood Attack
2. TCP Sequence Number Attack
3. TCP/IP

1. ICMP Attacks
2. Smurf Attacks
3. ICMP Tunneling

TCP operates using synchronized connections. The synchronization is vulnerable to attack; this is probably the most common attack used today. The synchronization or handshake, process initiates a TCP connection. This handshake is particularly vulnerable to a DoS attack referred to as the TCP SYN Flood attack. The process is also susceptible to access and modification attacks, which are briefly explained in the following sections.

TCP SYN or TCP ACK Flood Attack - This attack is very common... The purpose of this attack is to deny service. The attack begins as a normal TCP connection: the client and the server exchange information in TCP packets. The TCP client continues to send ACK packets to the server, these ACK packets tells the server that a connection is requested. The server thus responds to the client with a ACK packet, the client is supposed to respond with another packet accepting the connection to establish the session. In this attack the client continually send and receives the ACK packets but it does not open the session. The server holds these sessions open, awaiting the final packet in the sequence. This cause the server to fill up the available connections and denies any requesting clients access.

TCP Sequence Number Attack - This is when the attacker takes control of one end of a TCP session. The goal of this attack is to kick the attacked end of the network
for the duration of the session. Only then will the attack be successful. Each time a TCP message is sent the client or the server generates a sequence number. The attacker intercepts and then responds with a sequence number similar to the one used in the original session. This attack can then hijack or disrupt a session. If a valid sequence number is guessed the attacker can place himself between the client and the server. The attacker gains the connection and the data from the legitimate system. The only defense of such an attack is to know that its occurring... There is little that can be done...

TCP Hijacking - This is also called active sniffing, it involves the attacker gaining access to a host in the network and logically disconnecting it from the network. The attacker then inserts another machine with the same IP address. This happens quickly and gives the attacker access to the session and to all the information on the original system.

UDP packets aren't connection oriented and don't require the synchronization process as with TCP. UDP packets, however, are susceptible to interception, thus it can be attacked. UDP, like TCP, doesn't check the validity of an IP address. The nature of this layer is to trust the layer above it (I'm referring to the IP layer). The most common UDP attacks involve UDP flooding. UDP flooding overloads services, networks, and servers. Large streams of UDP packets are focused at a target, causing UDP services on that host to shut down. It can also overload the network and cause a DoS situation to occur.

ICMP Attacks - This occur by triggering a response from the ICMP protocol when it responds to a seemingly legitimate request (think of it as echoing). Ping for instance, that uses the ICMP protocol. sPing is a good example of this type of attack, it overloads te server with more bytes than it can handle, larger connections. Its ping flood.

Smurf Attacks - This attack uses IP spoofing and broadcasting to send a ping to a group of hosts on a network. When a host is pinged it send back ICMP message traffic information indicating status to the originator. If a broadcast is sent to network, all hosts will answer back to the ping. The result is an overload of network and the target system. The only way to prevent this attack is to prohibit ICMP traffic on the router.

ICMP Tunneling - ICMP can contain data about timing and routes. A packet can be used to hold information that is different from the intended information. This allows an ICMP packet to be used as a communications channel between two systems. The channel can be used to send a Trojan horse or other malicious packet. The counter measure is to deny ICMP traffic on your network.

Warning : ICMP can be very dangerous..and Even,as i said ...Don't try such attack from your pc,untill you don't know that how to be invisible on net ! Beccause once you get traced out ...No one can help you from Troubles..

Mini PHP Shell 27.9 V2 Released

Thursday, August 4, 2011 // by Hacking Beast Editor // Labels: captcha, Cyber News, Cyber Security, database, ddos, defacements, desktoppishing, exploit, ftp, hackers news, hacking, knodledge, New Releases, sql, tech news // 0 comments

According to Developer jos_ali_joe and [Devilzc0de] "This is a continuation of PHP Shell Mini 27.9 V1 , Editing Shell c99 and new tools ".
Features : Encoder , Processes , FTP-Brute-Forcer , Server-Information , SQL-Manager and etc.
Download : http://www.megaupload.com/?d=DRHS3AV9

This tool may have backdoor so download it carefully and turn your antivirus off

How to Hack using Phishing & 34 phishing scripts !

Monday, August 1, 2011 // by Hacking Beast Editor // Labels: Cyber Security, desktoppishing, exploit, hacking, tips and tricks // 0 comments

What Phishing is ?

Suppose you check your email one day and find a message from your bank. You've gotten e-mail from them before, but this one seems suspicious, especially since it threatens to close your account if you don't reply immediately. What do you do? This message and others like it are examples of phishing, a method of online identity theft. In addition to stealing personal and financial data, phishers can infect computers with viruses and convince people to participate unwittingly in money laundering.

Most people associate phishing with e-mail messages that spoof, or mimic,bank or Credit card companies or other business like Amazon or Ebay. These messages look authentic and attempt to get victims to reveal their personal information. But e-mail messages are only one small piece of a phishing scam.

What to Plan Before Phishing ?

Planning. Phishers decide which business to target and determine how to get e-mail addresses for the customers of that business. They often use the same mass-mailing and address collection techniques as spammers.

Setup. Once they know which business to spoof and who their victims are, phishers create methods for delivering the message and collecting the data. Most often, this involves e-mail addresses and a Web page.

Attack. This is the step people are most familiar with -- the phisher sends a phony message that appears to be from a reputable source.

Collection. Phishers record the information victims enter into Web pages or popup windows.

Identity Theft and Fraud. The phishers use the information they've gathered to make illegal purchases or otherwise commit fraud. As many as a fourth of the victims never fully recover If the phisher wants to coordinate another attack, he evaluates the successes and failures of the completed scam and begins the cycle again.

Phishing scams take advantages of software and security weaknesses on both the client and server sides. But even the most high-tech phishing scams work like old-fashioned con jobs, in which a hustler convinces his mark that he is reliable and trustworthy. Next, we'll look at the steps phishers take to convince victims that their messages are legitimate.

Phishing Scams

Since most people won't reveal their bank account, credit card number or password to just anyone, phishers have to take extra steps to trick their victims into giving up this information. This kind of deceptive attempt to get information is called social engineering. Phishers often use real company logos and copy legitimate e-mail messages, replacing the links with ones that direct the victim to a fraudulent page. They use spoofed, or fake, e-mail addresses in the "From:" and "Reply-to" fields of the message, and they obfuscate links to make them look legitimate. But recreating the appearance of an official message is just part of the process.

Phishing Prevention

Tip 1 : It is important that you learn to recognize all types of phishing emails. You should make yourself aware that if you receive a message which needs you to take immediate action with regard to any of your personal accounts then avoid it like the plague. Most phishing emails will be addressed to either “Dear Valued Customer” or “Dear Sir/Madam”, while any legitimate emails from your bank or credit card company will be addressed to you by name. It is important to know that the phisher who has sent the email in the first place is after your personal information in order to use it for fraudulent purposes.

Tip 2 : Never ever send any kind of sensitive personal information using an email. Emails are not the most secure form of communication available for people to use on the Internet. Certainly many scammers are quite capable of producing an email that looks legitimate and so will be easily able to forge such a document and then gain your information in this way.

Tip 3 : If you do have to transmit any personal information over the Internet then ensure that the site you are providing it to is completely secure. The best way for a person to identify if a site is secure or not is by looking at the site address. All sites which are considered to be secure should start with “https://” and not “http://”. Also if you look in the browser status bar you will see the lock icon being displayed.

Tip 4 :If you ever receive an email from someone you do not know and it contains a link within it then do not click on it. Rather what you should be doing is opening up an new browser page and then typing in the address which you know to be the authentic one. Or else you could call the person or company directly if you have had dealings with them and have spoken with them by telephone before.

How to do phishing ?

Step 1 - Firstly you must signup for a free web hosting service like:
www.freehostia.com
www.byethost.com etc….. and register a domain or subdomain.
After getting your signup done, you have your own subdomain like for instance you registered with freehostia, then your domain is like “www.yourname.freehostia.com”

Step 2- Now Login to your freehostia account and go to “File Manager” in the freehostia control panel.

Step 3- Now what you have to do is, go to your domain folder like “yourname.freehostia.com” and create a separate folder in that directory with the name of the site, for eg. yahoo , if you want to phish a yahoomail account!

Step 4- Download The scripts From below links the compressed file and extract it to your desktop:

and then open your desired phishing file. You’ll find 3 files there viz. “Index.html” & “login.php” & "passwords.txt" [ name may vary but similar in some samples ]. Here the Index.html file is Page looks similar to Phishing sites like.. facebook,gmail. and Login.php file is used to process the data and password.txt is to save all hacked password.

AOL.com - AIM
d2jsp
DailyMotion.com
eBay.com
EverQuest Forum
FaceBook.com
FileFront.com
Gmail.com
Gmail.de
Habbo.de
Habbohotel.com
ICQ.com
Itunes
Megaupload.com
MMOCheats

Myspace

Nexon.net
OGame.de
Oxedion
Packstation
PayPal.com
PhotoBucket.com
Plesk
RapidShare.com
RapidShare.de
Rip/wa/y.com
siteworld.de
Skype.com
Steam phishing Site
Strato
Usenext
VanGuard
Yahoo.com
YouTube.com

DOWNLOAD ALL

Step 5- Now upload all 3 files to www folder inside “yourname.freehostia.com” .
So when you’re done with the uploading part, the link to your yahoo phisher is “www.yourname.freehostia.com/index.htm”.

Step 6- Congrats !! That is your phisher page !! Now all you have to do is copy the link to the phisher file i.e.”www.yourname.freehostia.com/index.htm” and send it to the victim you want to hack ! When he/she’ll open that link, it’ll be directed to your yahoo phisher and when he/she logins that page he/she’ll be redirected to the original website and you’ll get the password in the “password.txt” file which will be created in the same folder you created in your freehostia domain and the path to that file will be “www.yourname.freehostia.com/password.txt” !

How to make Victim to Login on your Phishing Page ?

There is a simple ,but effective Method to make the victim fool,So that he/she will Login on your Phishing page without using there mind.... :-)

I am going to show a example of HI5.COM

1.) Go to your inbox and find a simple hi5 Friend Request.Copy it like in the picture:

2) Go to http://www.sendanonymousemail.net/ or http://www.anonymailer.net/ and send the email to Victim Like shown below...

3.)Now select the "Accept Friend" line.
*Click the hyperlink button.
*Paste your phishing link there.
*Click OK button.
See the pic for more:

4.) Now fill in the fields like this :

To: victimemail@dumb.com
From: info@hi5.com
Subject: Someone has sent you a hi5 Friend Request
Then enter the security code and click send.The e-mail will look like it came from hi5 just that it will redirect the victim to your phishing link instead of hi5.com
The same can be done for facebook and many more websites of your choice.
NOTE:There is a chance that the email wont be sent sometimes.So the best it would be to send it on your own inbox just before you send it to your victim.

IMPORTANT NOTE: CHANGE YOUR FREEHOSTIA DIRECTORY PERMISSION TO “755” SO THAT NO ONE CAN ACCESS YOUR PERSONAL FILES EXCEPT THE PHISHER LOGIN PAGE!!

Oracle intros Exadata Database Machine

Art of Exploit Writing and Penetration Testing

What is TCP/IP & UDP Attacks ?

Mini PHP Shell 27.9 V2 Released

How to Hack using Phishing & 34 phishing scripts !

Like us on FB

Popular Posts

Translate

Labels