All Types Of Hacking Techniques.17 ways to bring accounts to your Mercy..

So, Its time now that we should know what are various categories hacking fall into. I will try to focus on the ones based on password hacking. There is no distinct classification of hacking.. but i will list all i could remember..

So, as you all would have guessed this will not be a practical application.. I will give tutorials on all of them in coming posts.. but its the most important thing to have basic knowledge about all the techniques available.. So, consider going through the post once..

Common Methods for Hacking Computer Terminals(Servers):
This comprises of either taking control over terminal(or Server) or render it useless or to crash it.. following methods are used from a long time and are still used..

☻☻☻
1. Denial of Service -
DoS attacks give hackers a way to bring down a network without gaining internal access. DoS attacks work by flooding the access routers with bogus traffic(which can be e-mail or Transmission Control Protocol, TCP, packets).

☻☻☻
2. Distributed DoSs -
Distributed DoSs (DDoSs) are coordinated DoS attacks from multiple sources. A DDoS is more difficult to block because it uses multiple, changing, source IP addresses.

☻☻☻
3. Sniffing -
Sniffing refers to the act of intercepting TCP packets. This interception can happen through simple eavesdropping or something more sinister.

☻☻☻
4. Spoofing -
Spoofing is the act of sending an illegitimate packet with an expected acknowledgment (ACK), which a hacker can guess, predict, or obtain by snooping

☻☻☻
5. SQL injection -
SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. It uses normal SQL commands to get into database with elivated privellages..

☻☻☻
6. Viruses and Worms -
Viruses and worms are self-replicating programs or code fragments that attach themselves to other programs (viruses) or machines (worms). Both viruses and worms attempt to shut down networks by flooding them with massive amounts of bogus traffic, usually through e-mail.

☻☻☻
7. Back Doors -
Hackers can gain access to a network by exploiting back doors administrative shortcuts, configuration errors, easily deciphered passwords, and unsecured dial-ups. With the aid of computerized searchers (bots), hackers can probably find any weakness in the network.

☻☻☻
So, not interested in these stuffs.. huh??? wait there is more for you.. So, how about the one related to hacking the passwords of email and doing some more exciting stuffs.. The various methods employed for this are:

☻☻☻
8. Trojan Horses -
Trojan horses, which are attached to other programs, are the leading cause of all break-ins. When a user downloads and activates a Trojan horse, the software can take the full control over the system and you can remotely control the whole system.. great..!!! They are also reffered as RATs(Remote Administration tools)

☻☻☻
9. Keyloggers -
Consider the situation, everything you type in the system is mailed to the hacker..!! Wouldn't it be easy to track your password from that.. Keyloggers perform similar functionallities.. So next time you type anything.. Beware..!! Have already posted about keyloggers and ways to protect yourself from them..

☻☻☻
10. BruteForcing -
The longest and most tiring job.. don't even consider this if you don't know the SET of password for your victim..

☻☻☻
11. Secret Question -
According to a survey done by security companies, it is found that rather than helping the legitimate users the security questions are more useful to the hackers.. So if you know the victim well try this..

☻☻☻
12. Social Engineering -
Ya this was one of the oldest trick to hack.. Try to convince your user that you are a legitimate person from the system and needs your password for the continuation of the service or some maintainence.. This won't work now since most of the users are now aware about the Scam.. But this Social Engginering concept is must for you to have to convince victim for many reasons..!!!

☻☻☻
13. Phishing -
This is another type of keylogging, here you have to bring the user to a webpage created by you resembling the legitimate one and get him to enter his password, to get the same in your mail box..!! Use social engginering..

☻☻☻
14. Fake Messengers -
So its a form of phishing in the application format.. getting user, to enter the login info in the software and check your maill..!!!

☻☻☻
15. Cookie Stealer -
Here the cookie saved by the sites are taken and decoded and if you get lucky.. You have the password..!!!

Hmmm.. not satisfied with single account at a time..?? so there are ways to hack lots of accounts together.. I know few but there exists many..!! listed are the ones i know and will teach you in coming posts...

☻☻☻
16. DNS Poisoning or PHARMING -
So, phisihing is a tough job.. isn't it..?? convincing someone to enter their password at your page..?? what if you don't have to convince..?? what if they are directed automatically to your site without having a clue..?? Nice huh..?? Pharming does the same for you.. More about it in my next post..

☻☻☻
17. Whaling -
This method gets you the password of the accounts which are used by the hackers to recive the passwords.. So you just have to hack one ID, which is simplest method( Easy then hacking any other account, will tell you how in coming posts..) and you will have loads of passwords and so loads of accounts at your mercy..!!!

I would like to add one thing the methods metioned under exiting ways are easy but are for newbiees and script kiddies so if you really want to learn hacking then do some real work, then relaying on the softwares or tools.. will give info of that in my later posts.. or comment if you want any more info..



Enjoy..☻☻☻☻☻☻☻☻☻☻☻☻

READMORE

everything about hacking ...

Now,first free ur time before reading this tutorial.This is a big tutorial ..so that u can learn and hack everything. 1. Introduction. Most of the hackers who deface websites are script-kiddies, we're now going to take a look how hackers quickly detect vulnerable websites and deface other domains on the system. 2. SQL Injection. Many people would take as a main the SQL Injection (SQLi) attack. SQLi is very popular and there are many dorks out there. 2.1 Searching for vulnerable websites. The search is very easy. We just put the dork and try diffrent search results. For quicker results you may use the exploit scanner. 2.2 I want to attack a specific website which is on a shared hosting. Again the search is very easy. Let's say we have the IP 69.162.119.226 with no malicious thoughts on it, of course. We navigate to: www.bing.com In the search field write: Code: ip:69.162.119.226 id= You should get very interesting results which you might attack. 3. Attacking the web application itself. A very good method to gain access is to attack the web application itself. Even if the websites' web application is up-to-update and you aren't able to exploit it, you can search for vulnerable web applications on the server itself. We'll be using the same method as in the 2.2 . Let's say we have again the IP 69.162.119.226 with no malicious thoughts on it, of course. We navigate to: www.bing.com In the search field write: Code: ip:69.162.119.226 "wordpress" You should get websites powered by wordpress or any other system you have a working exploit on. 4. I've got admin access, now what ? After you've got admin access, upload a shell. 5. I've got a shell, now what ? Now it's time to take down your target. You can either: - Root the server. - Get the victims' website configuration database. 5.1 Rooting the server. First we need to disable the security. There is a good tutorial in this forum, follow it and you'll be fine. Second we need a back-connection OR we can bind a port. A back connection means that the server connects to you after you have opened the specific port and have launched netcat to listen ( nc -l -v -p PORT ) . Locus shell provides a great interface for begginers. Just upload locus, after which go to back-connection OR bind shell and follow the instructions. 5.1.1 Pwning the kernel. One of the most popular ways to root a web server is by pwning the kernel if it's a Linux box. To find out the kernel version simply type "uname -a" on your back/bind connection to/from the server. After you've got the version try finding a local root exploit for it. If you can't find, don't give up ... try harder ... Code: http://www.exploit-db.com/local/ 5.1.2 Getting the victims' database configuration file. Many of you have heard of "symlinking" . This is actually something like a shortcut on the Windows OS except this term is used in the Linux/Unix Distributions. Symlinking is a necessity in order to the Linux/Unix box to run about 10 times faster. Without it the server will be really slow even with high hardware configuration , which is just pointless. To get the configuration file, first find out what system is the victim using ( e.g. Wordpress, Joomla, vBulletin etc ). Now go to your shell ( you will have to had disabled the security ) and type in "cat etc/passwd" . Etc/passwd file contains all usernames on the Linux/Unix box which are created when you get hosting ( usually that's the cpanel username ). Now to get this file you will have to have disabled the security. In this file the usernames aren't long as the domain ones, for e.g. You have victim website hackers1.com In etc/passwd this can refer to the username: hack1, hak1, hac1, hckrs1, hrs1 etc So spend some time figuring out the username. After you've got it it's time to get the database config file. You can see the default configuration files list here: Code: vBulletin -- /includes/config.php IPB -- /conf_global.php MyBB -- /inc/config.php Phpbb -- /config.php Php Nuke -- /config.php Php-Fusion -- config.php SMF -- /Settings.php Joomla -- configuration.php , configuration.php-dist WordPress -- /wp-config.php Drupal -- /sites/default/settings.php Oscommerce -- /includes/configure.php e107 -- /e107_config.php Seditio -- /datas/config.php After you've got your path, it's time to extract the db information. Let's assume you're in directory /home/attacker1/public_html/shell.php , where shell.php is your shell and attacker1 is the username of some domain we've just compromised. Doesn't this ring the bell ? The path to the victims' hosting should be /home/victim1/public_html/ where victim1 is your victims' username. Let's execute this command on our shell, assuming the victims' system is vBulletin : Code: ln -s /home/victim1/public_html/includes/config.php victim1.txt This command uses symlink and it tells the server "hey, give me the file /config.php and save it as victim1.txt" (symlinking) . Now when you navigate to attacker1.com/victim1.txt you should have their configuration file. Many administrators put some security on their forums/cmses so we're going to break them now ... 5.1.2.1 Htaccess. The admin of the victim1.com website might have put this htaccess file in the /includes folder: order allow, deny deny from all When we try to symlink this it will return in a 403 Forbidden Error. So how do we bypass this ? Easy. We create a folder e.g. "hack" . We navigate to "hack" by typing "cd /hack". Next we symlink like this: Code: ln -s /home/victim1/public_html/includes/config.php victim1.txt and we get a 403 Forbidden error ... Now we put this htaccess file in a directory before "hack" for example we are in "/home/attacker1/public_html/hack" and we have to put this htaccess file (below) in "/home/victim1/public_html/" . The htaccess file you have to put: Code: HeaderName victim1.txt Now we navigate to "/home/attacker1/public_html/hack" and click "victim1.txt" and it should load us the configuration file. If you have done a symlink but with a different .txt file, replace your custom name in the htaccess as well e.g. I have done symlink: Code: ln -s /home/victim1/public_html/includes/config.php 1.txt so I have to put htaccess: HeaderName 1.txt 5.1.2.2 Browse Through Attack - Bypassing ALL Security. Tired of bypassing everything step by step by step ? Now I'm going to show you a very cool method to bypass ALL security. Take this scenario as example: We have disabled all security. But still we can't symlink right. What do we do ? First we create a folder with a custom named folder like "hack". We enter it via our shell and type in "ln -s / root" . Next we choose a victim domain like victim1.com . We type in " ls -la /etc/valiases/victim1.com ". Now we navigate one folder back and put this htaccess file in the "hack" folder: Options Indexes FollowSymLinks DirectoryIndex test.htm AddType txt .php AddHandler txt .php Now if we are in "/home/attacker1/public_html/" this equals to "attacker1.com" . So we want to navigate to the "hack" folder and we type in the URL "attacker1.com/hack" and we see a "folder" which actually is a symlink called "root". Don't get too happy, we still have got restricted permissions to some folders. Now to "browse through" their hole hosting space we just navigate to "attacker1.com/hack/root/home/victim1/public_html/". Fr34k1ng pwn3d Now you can browse through his website without worrying about IP restrictions with htaccess file. Although if there is htaccess because of which you have to enter username and password, you have to find a way to bypass that yourself. OK so you're browsing through and you are in "/includes/" and you find "config.php". You click on it but it gives you a BLANK page. WTF ?! Not exactly. Right-click and select "view source" and the configuration file is there . 6. Is this is it ? Is it really this simple ? Yes, this is it, nothing complicated. This is the way most hackers "deface", "root" or whatever they do to websites/forums.

READMORE

Steps On what to learn to become a Hacker

it's best to learn yourself due to the time it takes to teach a person and every person can't learn for long periods of time we each have our own learning pace. So these are steps I wrote that will make you into a hacker and get you into a good job in IT Security in basically any company that you apply for if you show proof of experience which I'll describe what that means. You are welcome to give input but I think i pretty much covered everything in 20 steps. 1. Learn TCP/IP, Basic Information gathering, Proxies, Socks, SSL, VPN, VPS, RDP, FTP, POP3, SMTP, Telnet, SSH. 2. Learn Linux, Unix, Windows - You can do this using vmware or any virtual desktop utility. 3. Learn a programming language that's compatible with all OS - Perl, Python, C, ASM 4. Learn HTML, PHP, Javascript, ASP, XML, SQL, XSS, SQLI, RFI, LFI 5. Learn Reverse engineering and crack some programs for serials easy ones like mirc, winzip, winrar or old games. 6. Code a fuzzer for common protocols - ftp, pop3, 80, 8080 - Pick some free software like ftp server, mail server, apache or iis webserver or a webserver all-in-one pack, or teamspeak, ventrilo, mumble. 7. Code a tool that uses grep to sort out unique code in source codes. 8. Make a custom IPtable, IPsec firewall that blocks all incoming traffic and out going traffic and add filters to accept certain ports that your software or scripts use. 9. Pick a kernel in linux or unix, also pick a Microsoft OS version lets say Winxp pro sp2 put them on the virtual desktops (vmware) and find and code a new local exploit in those versions, then install a Apache webserver on the Linux/Unix and a IIS webserver on the winxp pro and attempt to find and code a new local reverse_tcp_shell exploit. 10. Learn Cisco Router and Switch configuration and setup. 11. Learn Checkpoint Setup and Config 12. Learn Wifi scanning, cracking, sniffing. 13. Pick a person in you phonebook for the area code you live in or city then ring the person on a anonymous line like skype or a payphone or a carded sim and attempt to social engineer the person for his name, address, data of birth, city born, country born, ISP connected with, Phone company connected with, What bank he/she uses and anything else you can get. Then Attempt to ring using a spoof caller ID software with the person's phone number - call the ISP and try reset the password to his/her internet connection/webmail, get access to bank account or ask them to send out a new *** to a new address (drop) with a new pin, reset of phone company passwords. 14. Use your information gathering skills to get all the information off a website like a shop then use the spoof callerID software or hack your phone to show a new number of the Webserver's Tech Support number then ring the shop owner and try get the shop site password. 15. Do the same thing but attempt to use a web attack against a site or shop to gain admin access. 16. Once got access upload a shell and attempt to exploit the server to gain root using a exploit you coded not someone else s exploit. 17. Make your own Linux Distro 18. Use your own Linux Distro or use a vanilla Linux gnome (not kde) keep it with not much graphics so you can learn how to depend on the terminal and start from scratch install applications that you will only need for a blackbox (Security test box), make folders for fuzzers, exploits, scanners..etc Then load them up with your own scripts and other tools ( By this stage you shouldn't need to depend on other peoples scripts). 19. Learn macosx and attempt to gain access to a Macosx box whether it be your own or someones else s. 20. Create a secure home network and secure your own systems with your own Security policies and firewall settings. All this isn't a over night learning it will take a nice 3 - 4 years to learn a bit of this 5+ years to learn most of it and even then you may need time to keep learn as IT keeps changing ever day. As long as your dedicated to learning you won't have any problems and if you learn all that you should easy get a job in any company if you show proof that you can do these things (print out scripts that you made or put on disc) to show the companies. Hope this helps ...

READMORE