.:: Dark Site ::.: Security

How to perform CSP Bypass | techniques.

<div dir="ltr" style="text-align: left;" trbidi="on">
 
<div class="MsoNormal">
During one of my recent security testing, I came across a
very interesting scenario where some token was passing using GET requests. Of course
I can sense some interesting things here. For the protection, this application
was having almost all security headers that you will find in modern web
application. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8sGNoxCeo6f-23nZa_KUznBbnlSD__DbaR47eyU_hW6KySgrLSJTlHDra5_26BjJmk14P9hw5yCL7LqCpEv3YS0tCt_P4KnOPWTi1eKLcirbjzPkDsYcDt0cyykWhKerwIVyLJbxnCdX6/s1600/content-security-policy.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="630" data-original-width="1200" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8sGNoxCeo6f-23nZa_KUznBbnlSD__DbaR47eyU_hW6KySgrLSJTlHDra5_26BjJmk14P9hw5yCL7LqCpEv3YS0tCt_P4KnOPWTi1eKLcirbjzPkDsYcDt0cyykWhKerwIVyLJbxnCdX6/s640/content-security-policy.jpg" width="640" /></a></div>
</div>
<div class="separator" style="clear: both; text-align: center;">
 </div>
 
<div class="MsoNormal">
One of the headers that grab my attention was CSP.</div>
<div class="MsoNormal">
 </div>
<div class="MsoNormal">
https://www.xyz.com/upload/content/info/data/csp?parameter=tokens</div>
<div class="MsoNormal">
 </div>
<div class="MsoNormal">
For those who don’t know what is CSP can go through this good
url.</div>
<div class="MsoNormal">
<a href="https://www.netsparker.com/blog/web-security/content-security-policy/">CSP Netsparker Read</a> </div>
<a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP">Mozilla CSP Read</a> 
In simple word, CSP is used to prevent attacks like XSS, mix
content security issues or things that lead to code injection into trusted
resources. 
<div class="MsoNormal">
</div>
<div class="MsoNormal">
 </div>
<div class="MsoNormal">
Talking about in my target I noticed headers like.</div>
<div style="background: whitesmoke; border: solid #CCCCCC 1.0pt; margin-left: 15.0pt; margin-right: 15.0pt; mso-border-alt: solid #CCCCCC .75pt; mso-element: para-border-div; padding: 7.0pt 7.0pt 7.0pt 7.0pt;">
<div class="MsoNormal" style="background: whitesmoke; border: none; line-height: normal; margin-bottom: 22.5pt; mso-border-alt: solid #CCCCCC .75pt; mso-padding-alt: 7.0pt 7.0pt 7.0pt 7.0pt; padding: 0in; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt; word-break: break-all;">
Content-Security-Policy: default-src
'self' https://*.xyz.com https://www.xyz.com 'unsafe-inline';img-src https:
data:;object-src 'none'; report-uri /upload/content/info/data/csp?parameter=tokens</div>
</div>
<div style="background: white;">
Xyz.com we can see it was pulling the token in GET
request and embedding to headers into  report-uri directive of their CSP. So if we inject
anything there it will go into csp part.</div>
<div style="background: white;">
 </div>
<div style="background: white;">
There is a nice write up where I read about a <a href="https://portswigger.net/research/bypassing-csp-with-policy-injection">similar case</a> so I thought of trying something similar .so I
used the semicolon and dash symbol  to
inject into CSP.</div>
<div style="background: whitesmoke; border: solid #CCCCCC 1.0pt; margin-left: 15.0pt; margin-right: 15.0pt; mso-border-alt: solid #CCCCCC .75pt; mso-element: para-border-div; padding: 7.0pt 7.0pt 7.0pt 7.0pt;">
<div class="MsoNormal" style="background: whitesmoke; border: none; line-height: normal; margin-bottom: 22.5pt; mso-border-alt: solid #CCCCCC .75pt; mso-padding-alt: 7.0pt 7.0pt 7.0pt 7.0pt; padding: 0in; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt; word-break: break-all;">
Content-Security-Policy:
default-src 'self' https://*.xyz.com https://www.xyz.com 'unsafe-inline';img-src
https: data:;object-src 'none'; report-uri /upload/content/info/data/csp?parameter=tokens;-abc</div>
</div>
<div style="background: white;">
 </div>
<div style="background: white;">
Now that it's working let's create POC. Chrome by
default ignores invalid directives and we have our injection point is getting
embedded to end of the policy.so let's override the directives. </div>
<div style="background: white;">
Well, many directives needed a hit
and trial approach. Like</div>
<pre style="background: white; margin-bottom: 12.0pt; margin-left: 0in; margin-right: 0in; margin-top: 12.0pt;">directive-name  = "script-src-elem"</pre>
<pre style="background: white; margin-bottom: 12.0pt; margin-left: 0in; margin-right: 0in; margin-top: 12.0pt;">directive-name  = "img-src"</pre>
<pre style="background: white; margin-bottom: 12.0pt; margin-left: 0in; margin-right: 0in; margin-top: 12.0pt;">directive-name  = "object-src"</pre>
<div style="background: white;">
and many checks here </div>
<div style="background: white;">
<a href="https://w3c.github.io/webappsec-csp/#csp-directives">CSP Directives</a></div>
<div style="background: white;">
 </div>
<div style="background: white;">
you can use any directives that work for you.  I used one of 
them script-src-elem.</div>
<div style="background: white;">
The script-src-Elem directive
applies to all script requests and script blocks. Attributes that execute
script (inline event handlers) are controlled via script-src-attr. So as per our desired policy to attack would be.</div>
<div style="background: white;">
 </div>
<div style="background: white;">
Content-Security-Policy: script-src-elem
'none'; script-src-attr 'unsafe-inline'</div>
<div style="-webkit-text-stroke-width: 0px; background: white; box-sizing: border-box; font-variant-caps: normal; font-variant-ligatures: normal; margin: calc(0.5 * var(--spacingbase)) 0; orphans: 2; text-align: start; text-decoration-color: initial; text-decoration-style: initial; widows: 2; word-spacing: 0px;">
<script>alert("Will
be Blocked")</script> 
<img src=X onerror="alert('Can run happily')">demo</a></div>
<div style="background: white;">
 </div>
<div style="background: white;">
This directive overwrite existing script-src (which
most directives behave)so you can bypass CSP easily.</div>
<div style="background: white;">
The interesting thing about this directive is
that it will overwrite existing script-src directives! So you can use it to
bypass CSP provided you have policy injection</div>
<div style="background: white;">
So the payload will be </div>
<div style="background: white;">
 </div>
<div style="background: white;">
<a href="https://www.xyz.com/upload/content/info/data/csp?token=%3b%2dscript-src-elem+*&param=%3cimg+src=%22uploadedserver/xsspayload.js%22%3e%3c/img">https://www.xyz.com/upload/content/info/data/csp?parameter=%3b%2dscript-src-elem+*&param=<img+src="XSS payload"></img</a>></div>
<div style="background: white;">
 </div>
<div style="background: white;">
so just by implementing the security doesn’t always
help to make your product secure, of course, it adds a defense level but not 100%
.hope you liked it.</div>
<div style="background: white;">
 </div>
<div style="background: white;">
Thanks for reading have a nice time ahead.</div>
<div class="MsoNormal">
 </div>
 </div>

How to perform CSP Bypass | techniques.

During one of my recent security testing, I came across a very interesting scenario where some token was passing using GET requests. Of c...

Health Care Malware Kwampirs in Details

<div dir="ltr" style="text-align: left;" trbidi="on">
This post is about kwampirs malware which is targeting health care malware majorly, in this post I will share my recent experience with this malware identification as well as tips to make your system free from this malware. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY_aTwUT2QFIInaSnyJjOCYBGgvQKlq93aH8Vz6gmfrkrBiR7QRnFBu2eOHom5FFl0AwQoguuWYZJolujamYVOudzWlEi2LhXO3p-Xzy8BIlxWaBQmzKL57lrmLuguLcW2OwsNePaEYbUs/s1600/kwampirs.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="510" data-original-width="1181" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY_aTwUT2QFIInaSnyJjOCYBGgvQKlq93aH8Vz6gmfrkrBiR7QRnFBu2eOHom5FFl0AwQoguuWYZJolujamYVOudzWlEi2LhXO3p-Xzy8BIlxWaBQmzKL57lrmLuguLcW2OwsNePaEYbUs/s640/kwampirs.jpg" width="640" /></a></div>
<h2>
About Kwampirs:</h2>
 
Kwampirs is basically a backdoor trojan used by hackers to gain remote access to compromised computers. When executed, the Trojan decrypts and extracts a copy of its main DLL payload. Kwampirs target WMI performance adapter service present in windows and upon infection it makes the service as WMI Performance Adapter Extension (WmiApSrvEx) type autostart.It only targets windows system that doesn't any sort of security prevention mechanism such as the latest antivirus.It doesn't have anything to deal with Linux/Mac environment. 
 
<h2>
How to check for kwampirs infection?</h2>
In your system go run (win+R) type services.msc. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPmx5iTVkIf2lzQVz5-5oZYkn1IdMEy2Yw_RENcmDP5tngITDx0GfligMswUX-AclIUkR0y_kOMk-hwDnV5yTCxSTFMWDfKQh5MmhJ9SPUPWDSOnj-qrFOlvhYBp7tLg6Xd83nrDAFpZOC/s1600/service.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="259" data-original-width="404" height="205" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPmx5iTVkIf2lzQVz5-5oZYkn1IdMEy2Yw_RENcmDP5tngITDx0GfligMswUX-AclIUkR0y_kOMk-hwDnV5yTCxSTFMWDfKQh5MmhJ9SPUPWDSOnj-qrFOlvhYBp7tLg6Xd83nrDAFpZOC/s320/service.jpg" width="320" /></a></div>
 
 
 
 
 
 
 
 
 
 
 
 
 
Check for the service WmiApSrvEx (WMI Performance Adapter Extension) if it is in running /stopped state means it is infected with kwampirs. 
 
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnnklVk02cQF-8LV63hZ1I11KNrgzJHBxXRHM0GIsp-p_cLmVJxioVHqrSxyJj3NQ78ix90WOZcgzvJqMeu0_4Ya5wvR61YzCJijf9AL5njZX_6v5kwtkFV2ZQurA4AcA4SIS-TcyprXHM/s1600/infection.jpg" imageanchor="1"><img border="0" data-original-height="321" data-original-width="593" height="173" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnnklVk02cQF-8LV63hZ1I11KNrgzJHBxXRHM0GIsp-p_cLmVJxioVHqrSxyJj3NQ78ix90WOZcgzvJqMeu0_4Ya5wvR61YzCJijf9AL5njZX_6v5kwtkFV2ZQurA4AcA4SIS-TcyprXHM/s320/infection.jpg" width="320" /></a> 
 
You can also check for the infection using the registry. 
 
Key Path: CurrentControlSet\Services\WmiApSrvEx\ 
Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrvEx 
 
Not only that you can also have a look in system folder such as c:\Windows\System32\ & C:\windows\SYSWOW64 for service name (.exe) 
wmiapsrvce 
wmipsrvce 
wmiapsrvcep 
wmiapsvrce 
etc or dll 
wmiamgmt 
wmiassn 
wmipadp 
 
Also some .PNF files are associated with the malware: 
C:\Windows\inf\mtmndkb32.pnf 
C:\Windows\inf\digirps.pnf 
Etc 
 
<h2>
Target Systems :</h2>
A system with no Antivirus protection. 
Older XP Or server 2000/2008 system which is not managed properly. 
 
<h2>
Steps to Make your network Kwampirs Infection Free:</h2>
Make sure all the system are having the latest antivirus protection. 
If a certain group system such as XP where you can't have antivirus protection make sure they are operated in an isolated network. 
 
Hope these post help you to know details about kwampirs. 
 
Please do provide a view on this, if you have any query i will definitely try my level best to answer.</div>

Health Care Malware Kwampirs in Details

This post is about kwampirs malware which is targeting health care malware majorly, in this post I will share my recent experience with thi...

Learning Security Testing : For Beginners

Hi friends,its been long time since i have't posted some thing so here is some thing that will help you for sure.There are many people out there/students who ask me lot of time i want to learn this security stuff from where i should start. 
 
again let me clearly tell you this web site contains many link pick any one that will be help full to you.now i am making some structured urls from which you can easily learn many things .remember these are all for technical purpose only :). 
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz4qjw9odYn-k6lOCSsH_g0v9c8Nc0Vhe8l7-6tZumiI1rkrzhiJjZVTHlFjgQL4tXcWkTAcQaIeJ326-xadfadlDLmoQ4NaeVof6Z8Yqf3za_HcZM9Imf8lLTtlCRF1pDer22964r0bXn/s1600/Beginner.jpg" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz4qjw9odYn-k6lOCSsH_g0v9c8Nc0Vhe8l7-6tZumiI1rkrzhiJjZVTHlFjgQL4tXcWkTAcQaIeJ326-xadfadlDLmoQ4NaeVof6Z8Yqf3za_HcZM9Imf8lLTtlCRF1pDer22964r0bXn/s320/Beginner.jpg" /></a> 
so here we go for Web application security part. 
Learn the fundamental/primary attacks. 
 
-XSS(cross site scripting ) 
 
<li>Beginners tutorial on XSS :<a href="http://excess-xss.com/">See this link</a> 
<li>Google XSS learning Tutorials: <a href="https://www.google.com/about/appsecurity/learning/xss/">See this link</a> 
<li>Advance attacks bypass XSS Filters/IDS:<a href="https://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf">See this book</a> 
 
-CSRF(Cross Site request Forgery) 
 
Many beginner find this slight difficult to understand so here below link for simple explanation. 
<li>How to find CSRF and Preventing <a href="http://blackhat.com/presentations/bh-usa-06/BH-US-06-Gallagher.pdf">Download this book</a> 
<li>exploiting/attacking with CSRF Vulnerability <a href="http://tipstrickshack.blogspot.com/2012/10/how-to-exploit-csfr-vulnerabilitycsrf.html">See this link</a> 
 
 
-SQL Injection 
 
<li>Introduction to SQL Injection error based sqli: <a href="https://prakharprasad.com/introduction-to-sql-injection-and-exploitation-mysql-5-error-based/">See this link</a> 
<li>MSSQL Injection Complete Tutorial- <a href="https://www.exploit-db.com/papers/12975/">See this link</a> 
<li>Everything you wanted to know about SQL injection - <a href="http://www.troyhunt.com/2013/07/everything-you-wanted-to-know-about-sql.html">See this link</a> 
 
 
Remote Code/Command Execution 
 
<li>How to find RCE in scripts (with examples)- <a href="https://www.exploit-db.com/papers/12885/">See this link</a> 
<li>Yahoo vulnerability LFI Converted to RCE (patched)- <a href="https://soroush.secproject.com/blog/2013/10/yahoo-bug-bounty-program-lfi-reported-and-patched/">See this link</a> 
<li>Remote Code Execution in Elasticsearch - CVE-2015-1427 Deep research <a href="http://jordan-wright.com/blog/2015/03/08/elasticsearch-rce-vulnerability-cve-2015-1427/">See this link</a> 
 
XML external entity attack 
 
<li>How to detect XXE - <a href="http://www.christian-schneider.net/GenericXxeDetection.html">See this link</a> 
<li>XML Out-Of-Band Data Retrieval research Black Hat 2013 - <a href="https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf">Download PDF</a> 
<li>SSRF vs. Business-critical applications: XXE tunneling in SAP - <a href="https://erpscan.com/wp-content/uploads/publications/SSRF-vs-Businness-critical-applications-final-edit.pdf">Download PDF</a> 
<li>What you didn’t know about XXE -<a href="http://2013.appsecusa.org/2013/wp-content/uploads/2013/12/WhatYouDidntKnowAboutXXEAttacks.pdf"> Download PDF</a> 
 
Other few popular attacks on web application 
 
<li>Server side request forgery Attacks - <a href="http://www.slideshare.net/d0znpp/ssrf-attacks-and-sockets-smorgasbord-of-vulnerabilities">Slides</a> 
<li>Cross Site Port Attacks - <a href="http://ibreak.software/2013/05/10/xspa-ssrf-bug-with-facebooks-developer-web-application/">BY Riyaz</a> 
<li>Hunting for Top Bounties - <a href="https://www.youtube.com/watch?v=mQjTgDuLsp4">YouTube link</a> 
<li>How to steal and modify data using Business Logic flaws - <a href="http://www.slideshare.net/fransrosen/how-to-steal-and-modify-data-using-business-logic-flaws-insecure-direct-object-references">Slides Security for developers</a> 
<li>Exploiting CVE-2011-2461 on google.com - <a href="http://blog.mindedsecurity.com/2015/03/exploiting-cve-2011-2461-on-googlecom.html">See the link</a> 
<li><a href="https://pentesterlab.com/exercises/">PentesterLab</a> - - PentesterLab provides vulnerable systems that can be used to test and understand vulnerabilities. (thanks @n0x00) 
<li>InjectX to find XSS - <a href="https://forum.bugcrowd.com/t/tutorial-injectx-to-find-xss/790">See the link</a> thanks @1N3 
 
Of Course there exist bugs in mobile application too so if you are interested on that you will definitely find the link more likable 
 
Android Security learning 
 
<li>Debugging Java Applications Using JDB - <a href="http://www.androidpentesting.com/2014/12/debugging-java-applications-using-jdb.html">See the link to learn</a> 
<li>Learn android security testing - <a href="http://resources.infosecinstitute.com/author/srinivas/">From Srinivas</a> 
 
iOS application testing 
 
<li>Setting Up a Mobile Pentesting Platform - <a href="http://resources.infosecinstitute.com/ios-application-security-part-1-setting-up-a-mobile-pentesting-platform/">Infosec Link</a> 
<li>iOS Application Security -<a href="http://highaltitudehacks.com/">By Prateek Gianchandani</a> 
 
For Advance security researchers you can follow the<a href="https://www.vulnhub.com/"> VULNHUB </a> It s grate source of learning. 
 
Another important website for learning is infosecinstitute that is great place for all type of learner. 
<a href="http://resources.infosecinstitute.com/articles/">Security Articles</a> 
<a href="http://resources.infosecinstitute.com/ebooks/">Security ebook</a> 
<a href="http://resources.infosecinstitute.com/labs/">Lab For practice </a> 
 
Please do comment if you have more useful link and thanks have a nice day keep learning :)

Learning Security Testing : For Beginners

Hi friends,its been long time since i have't posted some thing so here is some thing that will help you for sure.There are many people o...

Downloadable Vulnerable Web Application For Practice Hacking Skills

:Part2: 
In part1 of this post i have listed <a href="http://www.darksite.co.in/2014/01/online-sites-for-practice-hacking-skills.html">Online | Live Sites For Practice Web Application Hacking Skills</a> Now here i will give you links for downloading iso/zip file which you can install and enjoy in best possible way. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL4T9YjlnAEoChIWYLi7c1SyMoAeQ4NcNQy5-M2C0zrgZ_Yos3gKmkOfxBQehu5jlThveQsEiRZ1ClJRFUzaGcbHITlcJx8KryPYZpip4ApR4GusaSVBeOjR0ZCVUKoD69rbLbcS1ieMr0/s1600/offline+hacking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hacking practice vulnerable" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL4T9YjlnAEoChIWYLi7c1SyMoAeQ4NcNQy5-M2C0zrgZ_Yos3gKmkOfxBQehu5jlThveQsEiRZ1ClJRFUzaGcbHITlcJx8KryPYZpip4ApR4GusaSVBeOjR0ZCVUKoD69rbLbcS1ieMr0/s1600/offline+hacking.jpg" /></a></div>with these vulnerable web applications you can test your web hacking knowledge, pen-testing tools, skills, and kung-fu on, with an added bonus... without going to jail :) The vulnerable web applications have been classified in two categories: offline, VMs/ISOs. 
The following list references downloadable vulnerable web applications to play with that can be installed on a standard operating system (Linux, Windows, Mac OS X, etc) using a standard web platform (Apache/PHP, Tomcat/Java, IIS/.NET, etc).i am sure this will sharp your hacking skill,take these as a challenge and i am sure this will be a boost for you. 
<h2>List of offline VM/Isos For Practicing Hacking Skills </h2> 
<li>The BodgeIt Store (Java): <a href="http://code.google.com/p/bodgeit/">http://code.google.com/p/bodgeit/</a> (<a href="http://code.google.com/p/bodgeit/downloads/list">download</a>)</li> 
 
<li>OWASP Bricks (PHP): <a href="http://sechow.com/bricks/index.html">http://sechow.com/bricks/index.html</a> (<a href="http://sechow.com/bricks/download.html">download</a> & <a href="http://sechow.com/bricks/docs/">docs</a>)</li> 
 
<li>The ButterFly Security Project (PHP): <a href="http://sourceforge.net/projects/thebutterflytmp/">http://sourceforge.net/projects/thebutterflytmp/</a> (<a href="http://sourceforge.net/projects/thebutterflytmp/files/">download</a>)</li> 
 
<li>bWAPP - an extremely buggy web application! (PHP): <a href="http://www.itsecgames.com/">http://www.itsecgames.com</a> (<a href="http://sourceforge.net/projects/bwapp/files/">download</a>) (<a href="http://itsecgames.blogspot.be/2013/01/bwapp-installation.html">docs</a>)</li> 
 
<li>Damn Vulnerable Web Application - DVWA (PHP): <a href="http://www.dvwa.co.uk/">http://www.dvwa.co.uk</a> (<a href="http://code.google.com/p/dvwa/downloads/list">download</a>) </li> 
 
<li>Damn Vulnerable Web Services - DVWS (PHP): <a href="http://dvws.secureideas.net/">http://dvws.secureideas.net</a> (<a href="http://dvws.secureideas.net/downloads/files/dvws.tgz">download</a>)</li> 
 
<li>OWASP Hackademic Challenges Project (PHP): <a href="https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project">https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project</a> (<a href="https://code.google.com/p/owasp-hackademic-challenges/">download</a>)</li> 
 
<li>Google Gruyere (Python): <a href="http://google-gruyere.appspot.com/">http://google-gruyere.appspot.com</a> (<a href="http://google-gruyere.appspot.com/gruyere-code.zip">download</a>)</li> 
 
<li>Hacme Bank (.NET): <a href="http://www.mcafee.com/us/downloads/free-tools/hacme-bank.aspx">http://www.mcafee.com/us/downloads/free-tools/hacme-bank.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacme-bank.aspx">download</a>)</li> 
 
<li>Hacme Books (Java): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmebooks.aspx">download</a>)</li> 
 
<li>Hacme Casino (Ruby on Rails): <a href="http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx">http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacme-casino.aspx">download</a>)</li> 
 
<li>Hacme Shipping (ColdFusion): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmeshipping.aspx">download</a>)</li> 
 
<li>Hacme Travel (C++): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmetravel.aspx">download</a>)</li> 
 
<li>OWASP Insecure Web App Project (Java): <a href="https://www.owasp.org/index.php/Category:OWASP_Insecure_Web_App_Project">https://www.owasp.org/index.php/Category:OWASP_Insecure_Web_App_Project</a> (<a href="http://sourceforge.net/projects/insecurewebapp/files/">download</a> - orphaned)</li> 
 
<li>Mutillidae (PHP): <a href="http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10">http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10</a> (<a href="http://www.irongeek.com/mutillidae/">download</a>)</li> 
 
<li>OWASP .NET Goat (C#): <a href="https://owasp.codeplex.com/">https://owasp.codeplex.com</a> (<a href="https://owasp.codeplex.com/SourceControl/list/changesets#">download</a>)</li> 
 
<li>Peruggia (PHP): <a href="http://peruggia.sourceforge.net/">http://peruggia.sourceforge.net</a> (<a href="http://sourceforge.net/projects/peruggia/files/">download</a>)</li> 
 
<li>Puzzlemall (Java): <a href="https://code.google.com/p/puzzlemall/">https://code.google.com/p/puzzlemall/</a> (<a href="https://code.google.com/p/puzzlemall/downloads/list">download</a>) (<a href="https://code.google.com/p/puzzlemall/downloads/list">docs</a>)</li> 
 
<li>Stanford Securibench (Java) & <a href="http://suif.stanford.edu/~livshits/work/securibench-micro/">Micro</a>: <a href="http://suif.stanford.edu/~livshits/securibench/">http://suif.stanford.edu/~livshits/securibench/</a> (<a href="http://suif.stanford.edu/~livshits/securibench/download.html">download</a>)</li> 
 
<li>SQLI-labs (PHP): <a href="https://github.com/Audi-1/sqli-labs">https://github.com/Audi-1/sqli-labs</a> (<a href="https://github.com/Audi-1/sqli-labs/archive/master.zip">download</a>) (<a href="http://dummy2dummies.blogspot.com/">blog</a>)</li> 
 
<li>SQLol (PHP): <a href="https://github.com/SpiderLabs/SQLol">https://github.com/SpiderLabs/SQLol</a> (<a href="https://github.com/SpiderLabs/SQLol/archive/master.zip">download</a>)</li> 
 
<li>OWASP Vicnum Project (Perl & PHP): <a href="https://www.owasp.org/index.php/Category:OWASP_Vicnum_Project">https://www.owasp.org/index.php/Category:OWASP_Vicnum_Project</a> (<a href="http://sourceforge.net/projects/vicnum/files/">download</a>)</li> 
 
<li>VulnApp (.NET): <a href="http://www.nth-dimension.org.uk/blog.php?id=88">http://www.nth-dimension.org.uk/blog.php?id=88</a> (<a href="http://projects.nth-dimension.org.uk/dir?d=VulnApp">CVS download</a> & <a href="http://projects.nth-dimension.org.uk/rptview?rn=6">vulns</a>)</li> 
 
<li>WackoPicko (PHP): <a href="https://github.com/adamdoupe/WackoPicko">https://github.com/adamdoupe/WackoPicko</a> (<a href="https://github.com/adamdoupe/WackoPicko/zipball/master">download</a>) (<a href="http://cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf">whitepaper</a>)</li> 
 
<li>OWASP WebGoat (Java): <a href="https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project">https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project</a> (<a href="http://code.google.com/p/webgoat/downloads/list">download</a>) (<a href="https://www.owasp.org/index.php/WebGoat_User_and_Install_Guide_Table_of_Contents">guide</a>)</li> 
 
<li>OWASP ZAP WAVE - Web Application Vulnerability Examples (Java): <a href="http://code.google.com/p/zaproxy/downloads/list">http://code.google.com/p/zaproxy/downloads/list</a></li> 
 
<li>Wavsep - Web Application Vulnerability Scanner Evaluation Project (Java): <a href="https://code.google.com/p/wavsep/">https://code.google.com/p/wavsep/</a> (<a href="https://code.google.com/p/wavsep/downloads/list">download</a>) (<a href="https://code.google.com/p/wavsep/downloads/list">docs</a>)</li> 
 
<li>WIVET - Web Input Vector Extractor Teaser: <a href="https://code.google.com/p/wivet/">https://code.google.com/p/wivet/</a> (<a href="http://www.webguvenligi.org/projeler/wivet">download</a>) (<a href="https://code.google.com/p/wivet/downloads/list?can=1&q=">tests</a>)</li> 
 
<h2>Virtual Machines (VMs) or ISO images</h2> 
The following list references pre-installed and ready to use virtual machines (VMs) or ISO images that contain one or multiple vulnerable web applications to play with. 
<li>BadStore (ISO): <a href="http://www.badstore.net/">http://www.badstore.net</a> (<a href="http://www.badstore.net/register.htm">download</a> - registration required)</li> 
 
<li>Bee-Box (bWAPP VMware): <a href="http://sourceforge.net/projects/bwapp/files/bee-box/">http://sourceforge.net/projects/bwapp/files/bee-box/</a></li> 
 
<li>OWASP BWA - Broken Web Applications Project (VMware - <a href="http://code.google.com/p/owaspbwa/wiki/ProjectSummary">list</a>): <a href="https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project">https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project</a> (<a href="http://code.google.com/p/owaspbwa/wiki/Downloads">download</a>)</li> 
 
<li>Drunk Admin Web Hacking Challenge (VMware): <a href="https://bechtsoudis.com/work-stuff/challenges/drunk-admin-web-hacking-challenge/">https://bechtsoudis.com/work-stuff/challenges/drunk-admin-web-hacking-challenge/</a> (<a href="http://bechtsoudis.com/data/challenges/drunk_admin_hacking_challenge.zip">download</a>) </li> 
 
<li>Exploit.co.il Vuln Web App (VMware): <a href="http://exploit.co.il/projects/vuln-web-app/">http://exploit.co.il/projects/vuln-web-app/</a> (<a href="http://sourceforge.net/projects/exploitcoilvuln/files/">download</a>)</li> 
 
<li>GameOver (VMware): <a href="http://sourceforge.net/projects/null-gameover/">http://sourceforge.net/projects/null-gameover/</a> (<a href="http://sourceforge.net/projects/null-gameover/files/">download</a>)</li> 
 
<li>Hackxor (VMware): <a href="http://hackxor.sourceforge.net/cgi-bin/index.pl">http://hackxor.sourceforge.net/cgi-bin/index.pl</a> (<a href="http://sourceforge.net/projects/hackxor/files/">download</a>) (<a href="http://hackxor.sourceforge.net/cgi-bin/hints.pl">hints&tips</a>)</li> 
 
<li>Hacme Bank Prebuilt VM (VMware): <a href="http://ninja-sec.com/index.php/hacme-bank-prebuilt-vmware-image-ninja-sec-com/">http://ninja-sec.com/index.php/hacme-bank-prebuilt-vmware-image-ninja-sec-com/</a> (<a href="http://dc121.4shared.com/download/wwPhUxMQ/hackme_bank_vm_Ninja-Sec.zip">download</a>)</li> 
 
<li>Kioptrix4 (VMware & Hyper-V): <a href="http://www.kioptrix.com/blog/?p=604">http://www.kioptrix.com/blog/?p=604</a> (<a href="http://www.kioptrix.com/dlvm/Kioptrix4_vmware.rar">download</a>) </li> 
 
<li>LAMPSecurity (VMware): <a href="http://sourceforge.net/projects/lampsecurity/">http://sourceforge.net/projects/lampsecurity/</a> (<a href="http://sourceforge.net/projects/lampsecurity/files/">download</a>) (<a href="http://sourceforge.net/projects/lampsecurity/files/Documentation/">doc</a>)</li> 
 
<li>Metasploitable (VMware): <a href="http://blog.metasploit.com/2010/05/introducing-metasploitable.html">http://blog.metasploit.com/2010/05/introducing-metasploitable.html</a> (<a href="http://updates.metasploit.com/data/Metasploitable.zip.torrent">download</a> - torrent) (<a href="http://www.metasploit.com/learn-more/how-do-i-use-it/test-lab.jsp">doc</a>)</li> 
 
<li>Metasploitable 2 (VMware):  
<a href="https://community.rapid7.com/docs/DOC-1875">https://community.rapid7.com/docs/DOC-1875</a> (<a href="https://sourceforge.net/projects/metasploitable/files/Metasploitable2/">download</a>)</li> 
 
<li>Moth (VMware): <a href="http://www.bonsai-sec.com/en/research/moth.php">http://www.bonsai-sec.com/en/research/moth.php</a> (<a href="http://sourceforge.net/projects/w3af/files/moth/moth/">download</a>)</li> 
 
<li>PentesterLab - The Exercises (ISO & PDF): <a href="https://www.pentesterlab.com/exercises/">https://www.pentesterlab.com/exercises/</a> </li> 
 
<li>PHDays I-Bank (VMware):  
<a href="http://phdays.blogspot.com.es/2012/05/once-again-about-remote-banking.html">http://phdays.blogspot.com.es/2012/05/once-again-about-remote-banking.html</a> (<a href="http://downloads.phdays.com/phdays_ibank_vm.zip">download</a>)</li> 
 
<li>Samurai WTF (ISO - list): <a href="http://www.samurai-wtf.org/">http://www.samurai-wtf.org</a> (<a href="http://sourceforge.net/projects/samurai/files/">download</a>)</li> 
 
<li>Sauron (Quemu) [Spanish]: <a href="http://sg6-labs.blogspot.com/2007/12/secgame-1-sauron.html">http://sg6-labs.blogspot.com/2007/12/secgame-1-sauron.html</a> (<a href="http://sg6-labs.blogspot.com/search/label/SecGame">solutions</a>)</li> 
 
<li>UltimateLAMP (VMware - <a href="http://www.metasploit.com/learn-more/how-do-i-use-it/test-lab.jsp">list</a>): <a href="http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/">http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/</a> (<a href="http://ronaldbradford.com/tmp/UltimateLAMP-0.2.zip">download</a>)</li> 
 
<li>Virtual Hacking Lab (ZIP): <a href="http://sourceforge.net/projects/virtualhacking/">http://sourceforge.net/projects/virtualhacking/</a> (<a href="http://sourceforge.net/projects/virtualhacking/files/">download</a>)</li> 
 
<li>Web Security Dojo (VMware, VirtualBox - <a href="http://www.mavensecurity.com/web_security_dojo/">list</a>): <a href="http://www.mavensecurity.com/web_security_dojo/">http://www.mavensecurity.com/web_security_dojo/</a> (<a href="http://sourceforge.net/projects/websecuritydojo/files/">download</a>)</li> 
 
You can have a lots of fun time with these so why to waste time download and gets started now .Happy hacking :)

Downloadable Vulnerable Web Application For Practice Hacking Skills

: Part2 : In part1 of this post i have listed Online | Live Sites For Practice Web Application Hacking Skills Now here i will give you lin...

Online | Live Sites For Practice Web Application Hacking Skills

:Part1: 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTFcFaz6_UQ1YUhXR_QYwxHxwxbpU0WTY-33AsEjjGMdAwKrY74wKTXVSfdHJKQAUFpw7kCVbH672CnAKhXPz2UT6yP5zW3HfoMfnChR_GKEU1OvmnjfXTxlMWHXwYb5QBzEDyEtJD_qu0/s1600/hacker.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="online live site to practice hacking skills" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTFcFaz6_UQ1YUhXR_QYwxHxwxbpU0WTY-33AsEjjGMdAwKrY74wKTXVSfdHJKQAUFpw7kCVbH672CnAKhXPz2UT6yP5zW3HfoMfnChR_GKEU1OvmnjfXTxlMWHXwYb5QBzEDyEtJD_qu0/s1600/hacker.jpg" /></a></div>Here are the list of website that beginners always look for in order furnish their skills,many at various place i encounter where students/new excited security learner ask me "is there any site available to practice all this hacking skills legally?" . 
 
So here are list of online where you can test your practice its complete safe . next post i will share how you can mount own server on vmware and practice locally from own computer. 
 
These are few online and live vulnerable web applications available on the Internet to play with. 
 
Acunetix: 
<a href="http://testasp.vulnweb.com">http://testasp.vulnweb.com</a> (Forum - ASP) 
<a href="http://testaspnet.vulnweb.com">http://testaspnet.vulnweb.com</a> (Blog - .NET) 
<a href="http://testphp.vulnweb.com">http://testphp.vulnweb.com</a> (Art shopping - PHP) 
Cenzic CrackMeBank: <a href="http://crackme.cenzic.com">http://crackme.cenzic.com</a> 
Google Gruyere (Python): <a href="http://google-gruyere.appspot.com/start">http://google-gruyere.appspot.com/start</a> 
Hacking-Lab (eg. OWASP Top 10): <a href="https://www.hacking-lab.com/events/registerform.html?eventid=245">https://www.hacking-lab.com/events/registerform.html?eventid=245</a> 
Hack.me (beta): <a href="https://hack.me">https://hack.me</a> 
HackThisSite (HTS - Basic & Realistic (web) Missions): <a href="http://www.hackthissite.org">http://www.hackthissite.org</a> 
Hackxor online demo: <a href="http://hackxor.sourceforge.net/cgi-bin/login.pl">http://hackxor.sourceforge.net/cgi-bin/login.pl</a> (algo/smurf) 
HP/SpiDynamics Free Bank Online: <a href="http://zero.webappsecurity.com">http://zero.webappsecurity.com</a> (admin/admin) 
IBM/Watchfire AltoroMutual: <a href="http://demo.testfire.net">http://demo.testfire.net</a> (jsmith/Demo1234) 
NTOSpider Web Scanner Test Site: <a href="http://www.webscantest.com">http://www.webscantest.com</a> (testuser/testpass) 
OWASP Hackademic Challenges Project - Live (PHP - Joomla): <a href="http://hackademic1.teilar.gr">http://hackademic1.teilar.gr</a> 
Pentester Academy: <a href="http://pentesteracademylab.appspot.com">http://pentesteracademylab.appspot.com</a>(One of my fav) 
 
Enjoy all these different web vulnerable environments and sharp your web app pen-testing skills and tools practicing with them. 
On Next part i will post the list downloadable file which you can use for boost your hacking skills

Online | Live Sites For Practice Web Application Hacking Skills

: Part1 : Here are the list of website that beginners always look for in order furnish their skills,many at various place i encounter where...

Penetration Testing VPN With Ike Scanner On Backtrack Part-1

Hi All As you all know these days many organisation using VPN Quite Actively so we will take a quick look on penetration testing Virtual Private Network Using Ike Scanner On Backtrack. 
So there is a myth on everyone mind that VPN Provide Full Protection Against Hacker (Means no hacker can hack :P )...so its never like that if there exist some loop hole than any attacker can hack network against any high security but VPN Does ensure some level of protection..still we will discuss some good and bad point in VPN connection. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizUrPP7oX9oxnTd3qf8yDiv4R_lyfiJ1BYV4ev41DXgh8K93rHKWvuhqLU_1kdtWvc5D1tMFJAwUJbOuUDe4fK85Y_uoCzTzCVBh2ajoj0wldUKQMxPeuiple-r0nO7aMuCx3w9wHDo3cz/s1600/vpn-service.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Penetration Testing VPN Network" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizUrPP7oX9oxnTd3qf8yDiv4R_lyfiJ1BYV4ev41DXgh8K93rHKWvuhqLU_1kdtWvc5D1tMFJAwUJbOuUDe4fK85Y_uoCzTzCVBh2ajoj0wldUKQMxPeuiple-r0nO7aMuCx3w9wHDo3cz/s620/vpn-service.jpg" width="550" /></a></div>The meaning of doing VPN penetration testing because it help the organisation to baseline (identify the loopholes that exist in the present implementation and modify the configuration accordingly to protect itself from known problems) its current VPN security posture, identify threats and weaknesses, and implement a new security policy that will mitigate risks. 
 
Penetration Testing A VPN Network Involves several phases those are :- 
 
<li>Scanning or identifying the VPN gateway. 
<li>Fingerprinting the VPN gateway for guessing implementation. 
<li>PSK mode assessment and PSK sniffing. 
<li>Offline PSK cracking. 
<li>Checking for default user accounts. 
<li>Testing the VPN gateway for vendor specific vulnerabilities. 
 
this first step you can easily do with tools like <a href="http://www.darksite.co.in/2013/08/nmap-commands-for-hackers-kali.html">nmap</a> 
Example :- 
<blockquote>root@bt:~# nmap -sU -p 500 172.16.21.200 
Starting Nmap 5.51 (http://nmap.org) at 2011-11-26 10:56 IST 
Nmap scan report for 172.16.21.200 
Host is up (0.00036s latency). 
PORT STATE SERVICE 
500/udp open isakmp 
MAC Address: 00:1B:D5:54:4D:E4 (Cisco Systems) 
 
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds 
</blockquote>Now as you now i have used -sU For Udp Scan And -p is for specifying port to be 500. 
 
IKE Scan Tool :- 
Ike-scan is a simple but powerful command-line tool that is used to find and fingerprint VPN gateways. It sends specially crafted IKE packets to target gateways and enlists any IKE responses that are received. By default, Ike-scan works in main mode, and sends a packet to the gateway with an ISAKMP header and a single proposal with eight transforms inside it. 
 
Each transform contains a number of attributes like DES or 3DES as the encryption algorithm, SHA or MD5 as the integrity algorithm, a pre-shared key as the authentication type, Diffie-Hellman 1 or 2 as the key distribution algorithm and 28800 seconds as the lifetime. 
 
Initial VPN discovery with Ike-scan is as shown below: 
<blockquote>root@bt:~# ike-scan -M 172.16.21.200 
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/) 
172.16.21.200 Main Mode Handshake returned 
HDR=(CKY-R=d90bf054d6b76401) 
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) 
VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation) 
 
Ending ike-scan 1.9: 1 hosts scanned in 0.015 seconds (65.58 hosts/sec). 1 returned handshake; 0 returned notify 
</blockquote>The -M shows each payload in a line, so that the output will be neat and easy to understand. The output can be any of the following: 
 
<li>0 returned handshake; 0 returned notify: This means the target is not an IPsec gateway. 
<li>1 returned handshake; 0 returned notify: This means the target is configured for IPsec and is willing to perform IKE negotiation, and either one or more of the transforms you proposed are acceptable. 
<li>0 returned handshake; 1 returned notify: VPN gateways respond with a notify message when none of the transforms are acceptable (though some gateways do not, in which case further analysis and a revised proposal should be tried). 
In the example shown, the VPN gateway replies with one returned handshake and the acceptable transform set has these parameters: 
<blockquote>Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800 
 
Custom transform sets can be tried against the target with the 
"--trans" switch: 
 
--trans=(1=1,2=2,3=1,4=2) 
</blockquote>where 1=Encryption Algorithm, 2=Hash Algorithm, 3=Authentication Method, 4=Group Description, and 5=Group Type. 
 
Kindly refer to <a href="http://www.ietf.org/rfc/rfc2409.txt">RFC 2409</a> Appendix A for a complete understanding of transform set values. There are a number of other tools like ipsectrace, ipsecscan, etc., available for IPsec scanning, but undoubtedly Ike-scan is one of the best and a frequently updated tool. 
 
Vulnerability assessment tools like Nessus, Nexpose, etc, can be used to identify the vulnerabilities of VPN implementations. A full security audit on the target gateway with such types of tools will generate a detailed report with all identified problems and the mitigation steps available. 
 
Further penetration testing i will post on later tutorial plese leave your comment below if you have any query.

Penetration Testing VPN With Ike Scanner On Backtrack Part-1

Hi All As you all know these days many organisation using VPN Quite Actively so we will take a quick look on penetration testing Virtual Pri...

Free Learn Wifi Security With Vivek Ramachandran ( Books | Video Tutorials & Concepts )

Hi everyone it really Feel great that Vivek RamaChandran Sir has done an awesome video series of wifi security which makes you clear on most of the concept related to wifi security .past few days i have a great interest on learn wifi security so i found wifi security by vivek sir and let me tells you this video series some contain some quality training material with live practicals and clear cut understanding. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEix3ryC73Dtaype1CnlFnxSVKPruQfQlnBjSPDFCOH4J7gBQoavhrdXVvzpUu4OtNU9nJcviniS0Nwx2hFQQ5doLxEh3WVgpDNUPA1MjuYwmWPVgdDnHBg7-a2C_ETquuYu4f8z_dQyTw9Y/s1600/free+learn.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="free download wifi hacking videos and books" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEix3ryC73Dtaype1CnlFnxSVKPruQfQlnBjSPDFCOH4J7gBQoavhrdXVvzpUu4OtNU9nJcviniS0Nwx2hFQQ5doLxEh3WVgpDNUPA1MjuYwmWPVgdDnHBg7-a2C_ETquuYu4f8z_dQyTw9Y/s1600/free+learn.png" /></a></div>You must have seen our previous Post 
 
<a href="http://www.darksite.co.in/2013/05/free-download-backtrack-5-wireless.html">Free download BackTrack 5 Wireless Penetration Testing By Vivek Ramachandran</a> Which share free e book by vivek sir. 
 
let me tell you about some contents about the video series:- 
 
It Contain fully practical with explanation.it is best for penetration testers, security enthusiasts and network administrators. 
This video series will take you through a journey in wireless LAN (in)security and penetration testing.it will also teach you very basics of how WLANs work, graduate to packet sniffing and injection attacks, move on to audit infrastructure vulnerabilities, learn to break into WLAN clients and finally look at advanced hybrid attacks involving wireless and applications 
 
A non-exhaustive list of topics to be taught includes: 
 
<li>Bypassing WLAN Authentication – Shared Key, MAC Filtering, Hidden SSIDs 
<li>Cracking WLAN Encryption – WEP, WPA/WPA2 Personal and Enterprise, Understanding encryption based flaws (WEP,TKIP,CCMP) 
<li>Attacking the WLAN Infrastructure – Rogues Devices, Evil Twins, DoS Attacks, MITM, Wi-Fi Protected Setup 
<li>Advanced Enterprise Attacks – 802.1x, EAP, LEAP, PEAP, EAP-TTLS 
<li>Attacking the Wireless Client – Honeypots and Hotspot attacks, Caffe-Latte, Hirte, Ad-Hoc Networks and Viral SSIDs, WiFishing 
<li>Breaking into the Client – Metasploit, SET, Social Engineering 
<li>Enterprise Wi-Fi Worms, Backdoors and Botnets 
 
About VivekRamachandran (Author of Book /Trainer):- 
 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglZMgJRuFn50SEPF0pR85W8ojzJf5PxM8J3mRYGgW6ZLuwEob7n1QayR7bh7YUHAO5SaLOOyn7ailMDyAwMUX6lv3L5yHcx2cbdoEopj5VY8_YG35WO9H2tCP1Be0fK6-YsDZWjb2NxNlJ/s1600/vivek+sir.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img alt="Vivek Ramachandran" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglZMgJRuFn50SEPF0pR85W8ojzJf5PxM8J3mRYGgW6ZLuwEob7n1QayR7bh7YUHAO5SaLOOyn7ailMDyAwMUX6lv3L5yHcx2cbdoEopj5VY8_YG35WO9H2tCP1Be0fK6-YsDZWjb2NxNlJ/s1600/vivek+sir.jpg" /></a></div>Vivek has been into Wireless security research since 2003 ,He was also one of the winners of Microsoft Security Shootout contest held in India among a reported 65,000 participants,his work on wireless security has been quoted in BBC online, InfoWorld, MacWorld, The Register, IT World Canada etc. places. He has spoken/trained at top conferences around the world including Blackhat USA and Abu Dhabi, Defcon, Hacktivity, Brucon, ClubHack, SecurityByte, SecurityZone, Nullcon, C0C0n etc.He is best known in the hacker community as the founder of SecurityTube.net where he routinely posts videos on Wi-Fi Security, Assembly Language, Exploitation Technique. 
 
i think you all security geeks knows him so no need to write more about him. 
 
<a href="http://securitytube.aircrack-ng.org/Wi-Fi-Security-Megaprimer/WLAN-Security-Megaprimer-v1.iso">Download All Free Video Tutorial</a> (iso File 4.2 GB) 
you can also see all video tutorial part wise <a href="http://www.securitytube.net/groups?operation=view&groupId=9">here</a> 
 
TO start up with you need ALFA NETWORK AWUS036NH 2W USB Wireless N Adapte You can easily purchase from<a href="http://www.ebay.com/itm/ALFA-NETWORK-AWUS036NH-2W-USB-Wireless-N-Adapter-WiFi-b-g-N-2000mW-/400611594109?pt=US_USB_Wi_Fi_Adapters_Dongles&hash=item5d464fcf7d"> ebay</a>/amazon .You also need to <a href="http://www.darksite.co.in/2012/05/how-to-install-backtrack-5-r1-in-your.html">set up backtrack</a> on your laptop/pc(<a href="http://www.darksite.co.in/2012/08/how-to-install-vmware-tools-in-backtrack.html">vmweare/virtual box</a>) which i think very easy and i know even a kid can do it. 
 
So Even i have Started to learn wifi security gone upto 22+ videos and the whole video series contain 45+ Videos so have fun and special thanks to vivek sir _/\_ for making these videos and sharing it for free.

Free Learn Wifi Security With Vivek Ramachandran ( Books | Video Tutorials & Concepts )

Hi everyone it really Feel great that Vivek RamaChandran Sir has done an awesome video series of wifi security which makes you clear on most...

How to Protect your website from web vulnerability Scanners

Hello here i come with a small trick but quite useful it can make your website safe from kiddie hackers :P. some time actually new born hackers do use various web scanners like Acunetix, nessus, Openvas & other scanner available at backtrack.so being a web sec guy how can you protect your website from such automated scanner the code is very simple all you need to do is Just add the below given codes to your .htaccess file . <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmz1A7mBmj7rW5bKf_y_p_VuRsvAZxqgEXTuWPfRPSmkE3KNus8cDAGaR7hc2ZherD6SN_BKZsfGmLUv8PBabw9t_DqsHWTxP4FG767HUtjamAbAv6EFNrPla2vtMHp_zLOW2n4KOtG4yA/s1600/hacker.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="protect from web vulnerability scanners" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmz1A7mBmj7rW5bKf_y_p_VuRsvAZxqgEXTuWPfRPSmkE3KNus8cDAGaR7hc2ZherD6SN_BKZsfGmLUv8PBabw9t_DqsHWTxP4FG767HUtjamAbAv6EFNrPla2vtMHp_zLOW2n4KOtG4yA/s620/hacker.png" /></a></div><blockquote>RewriteEngine On 
<�IfModule mod_rewrite.c> 
RewriteCond %{HTTP_USER_AGENT} ^w3af.sourceforge.net [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} dirbuster [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} nikto [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} SF [OR] 
RewriteCond %{HTTP_USER_AGENT} sqlmap [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} fimap [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} nessus [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} whatweb [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} Openvas [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} jbrofuzz [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} libwhisker [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} webshag [NC,OR] 
RewriteCond %{HTTP:Acunetix-Product} ^WVS 
RewriteRule ^.* http://127.0.0.1/ [R=301,L] 
<�/�IfModule> 
(Please Remove � On Original Code) 
</blockquote>after adding this content to .htaccess save it now.this is just a counter step taken to stay away from web scanners. hope you like this post do share ,comments ,like and thank you :) .

How to Protect your website from web vulnerability Scanners

Hello here i come with a small trick but quite useful it can make your website safe from kiddie hackers :P. some time actually new born hack...