A. SCOPE
This tutorial is intended for users with little or no experience with linux or wifi. The folks over at remote-exploit have released Backtrack
Get it Remote-Exploit.org - Supplying offensive security products to the world
a tool which makes it ridiculously easy to access any network secured by WEP encryption. This tutorial aims to guide you through the process of using it effectively.
Required Tools
You will need a computer with a wireless adapter listed here
Download Backtrack and burn its image to a CD
B. OVERVIEW
BACKTRACK is a bootable live cd with a myriad of wireless and tcp/ip networking tools. This tutorial will only cover the included kismet and aircrack-ng suite of tools.
Tools Overview
Kismet - a wireless network detector and packet sniffer
airmon - a tool that can help you set your wireless adapter into monitor mode (rfmon)
airodump - a tool for capturing packets from a wireless router (otherwise known as an AP)
aireplay - a tool for forging ARP requests
aircrack - a tool for decrypting WEP keys
iwconfig - a tool for configuring wireless adapters. You can use this to ensure that your wireless adapter is in monitor mode which is essential to sending fake ARP requests to the target router
macchanger - a tool that allows you to view and/or spoof (fake) your MAC address
Glossary of Terms
AP: Access Point: a wireless router
MAC Address: Media Access Control address, a unique id assigned to wireless adapters and routers. It comes in hexadecimal format (ie 00:11:ef:22:a3:6a)
BSSID: Access Point MAC address
ESSID: Access Points Broadcast name. (ie linksys, default, belkin etc) Some AP’s will not broadcast their name but Kismet may be able to detect it anyway
TERMINAL: MS-Dos like command line interface. You can open this by clicking the black box icon next to the start key in backtrack
WEP: short for Wired Equivalency Privacy, it is a security protocol for Wi-Fi networks
WPA: short for WiFi Protected Access. a more secure protocal than WEP for wireless networks. NOTE: this tutorial does not cover cracking WPA encryption
Since Backtrack is a live CD running off your cdrom, there is nowhere that you can write files to unless you have a linux partition on your hard drive or a usb storage device. Backtrack has some NTFS support so you will be able to browse to your windows based hard drive should you have one, but it will mount the partition as “read-onlyâ€. I dual boot windows and ubuntu on my laptop so I already have a linux swap partition and a reiserfs partition. Backtrack had no problem detecting these and mounting them for me. To find your hard drive or usb storage device, just browse to the /mnt folder in the file manager. Typically a hard drive will appear named something like hda1 or hda2 if you have more than one partition on the drive. Alternately hdb1 could show if you have more than one hard disk. Having somewhere to write files that you can access in case you need to reboot makes the whole process a little easier.
C. DISCLAIMER
Hacking into someone’s wireless network without permission is probably against the law. I wouldn’t recommend doing it. I didn’t break into anyone else’s network while learning how to do this .
D. IMPLEMENTATION
STEP 1
Monitoring Wireless Traffic With Kismet
Place the backtrack CD into your cd-rom drive and boot into Backtrack. You may need to change a setting in your bios to boot from cd rom. During boot up you should see a message like “Hit ctrl+esc to change bios settingsâ€. Changing your first boot device to cdrom will do the trick. Once booted into linux, login as root with username: root password: toor. These are the default username and password used by backtrack. A command prompt will appear. Type startx to start KDE (a ‘windows’ like workspace for linux).
Once KDE is up and running start kismet by clicking on the start key and browsing to Backtrack->Wireless Tools -> Analyzers ->Kismet. Alternatively you can open a Terminal and type:
kismet
Kismet will start running and may prompt you for your wireless adapter. Choose the appropriate adapter, most likely ‘ath0?, and sit back as kismet starts detecting networks in range.
NOTE: We use kismet for two reasons.
1. To find the bssid, essid, and channel number of the AP you are accessing.
2. Kismet automatically puts your wireless adapter into monitor mode (rfmon). It does this by creating a VAP (virtual access point?) or in other words, instead of only having ath0 as my wireless card it creates a virtual wifi0 and puts ath0 into monitor mode automatically.
While kismet detects networks and various clients accessing those networks you might want to type ’s’ and then ‘Q’ (case sensitive). This sorts all of the AP’s in your area by their signal strength. The default ‘autofit’ mode that kismet starts up in doesn’t allow you much flexibility. By sorting AP’s by signal strength you can scroll through the list with the arrow keys and hit enter on any AP you want more information on. (side note: when selecting target AP keep in mind this tutorial only covers accessing host AP’s that use WEP encryption. In kismet the flags for encryption are Y/N/0. Y=WEP N=Open Network- no encryption 0= other: WPA most likely.)
Select the AP (access point) you want to access. Copy and paste the broadcast name(essid), mac address(bssid), and channel number of your target AP into a text editor. Backtrack is KDE based so you can use kwrite. Just open a terminal and type in ‘kwrite’ or select it from the start button. In Backtrack’s terminal to copy and paste you use shift+ctrl+c and shift+control+v respectively. Leave kismet running to leave your wireless adapter in monitor mode. You can also use airmon to do this manually.
airmon-ng -h
for more help with this
STEP 2
Collecting Data With Airodump
Open up a new terminal and start airodump so we can collect ARP replies from the target AP. Airodump is fairly straight forward for help with this program you can always type “airodump-ng -h†at the command prompt for additional options.
airodump-ng ath0 -w /root/belkin 9 1
Breaking down this command:
ath0 is my wireless card
-w tells airodump to write the file to
/root//belkin
9 is the channel 9 of my target AP
1 tells airodump to only collect IVS - the data packets with the WEP key
STEP 3
Associate your wireless card with the AP you are accessing.
aireplay-ng -1 0 -e belkin -a 00:11:22:33:44:55 -h 00:fe:22:33:f4:e5 ath0
-1 at the beginning specifies the type of attack. In this case we want fake authentication with AP. You can view all options by typing
aireplay-ng -h
0 specifies the delay between attacks
-e is the essid tag. belkin is the essid or broadcast name of my target AP. Linksys or default are other common names
-a is the bssid tag(MAC address). 00:11:22:33:44:55 is the MAC address of the target AP
-h is your wireless adapters MAC addy. You can use macchanger to view and change your mac address.
macchanger -s ath0
ath0 at the end is my wireless adapters device name in linux
STEP 4
Start packet injection with aireplay
aireplay-ng -3 -b 00:11:22:33:44:55 -h 00:fe:22:33:f4:e5 ath0
NOTES:
-b requires the MAC address of the AP we are accessing.
-h is your wireless adapters MAC addy. You can use macchanger to view and change your mac address.
macchanger -s ath0
if packets are being collected at a slow pace you can type
iwconfig ath0 rate auto
to adjust your wireless adapter’s transmission rate. You can find your AP’s transmission rate in kismet by using the arrow keys up or down to select the AP and hitting enter. A dialog box will pop up with additional information. Common rates are 11M or 54M.
As aireplay runs, ARP packets count will slowly increase. This may take a while if there aren’t many ARP requests from other computers on the network. As it runs however, the ARP count should start to increase more quickly. If ARP count stops increasing, just open up a new terminal and re-associate with the ap via step 3. There is no need to close the open aireplay terminal window before doing this. Just do it simultaneously. You will probably need somewhere between 200-500k IV data packets for aircrack to break the WEP key.
If you get a message like this:
Notice: got a deauth/disassoc packet. Is the source MAC associated ?
Just reassociate with the AP following the instructions on step 3.
STEP 5
Decrypting the WEP Key with Aircrack
Find the location of the captured IVS file you specified in step 2. Then type in a terminal:
aircrack-ng -s /mnt/hda2/home/belkin_slax_rcu-03.ivs
Change /mnt/hda2/home/belkin_slax_rcu-03.ivs to your file’s location
Once you have enough captured data packets decrypting the key will only take a couple of seconds. For my AP it took me 380k data packets. If aircrack doesn’t find a key almost immediately, just sit back and wait for more data packets.
If you get approx. 4,000 packets and ur desperate try wep_crack it works faster most the time
NSDECODER is a automated website malware detection tools. It can be used to decode and analyze weather the URL exist malware. Also, NSDECODER will analyze which vulnerability been exploit and the original source address of malware.
In my last post i gave you the list of best port scanner tools. In this post i will explain about port scanning process and use of port scanning.
Port Scanning:
Port scanning is the process of searching for active or opened ports in victim system. Just like a thief searching for gate opened house. Consider this scanning
Starting Scan.
Target Host: www.yourcompany.com or IP Address
TCP Port :7 (echo)
TCP Port :9 (discard)
TCP Port :13 (daytime)
TCP Port :19 (chargen)
TCP Port :21 (ftp)
TCP Port :23 (telnet)
TCP Port :25 (smtp)
TCP Port :37 (time)
TCP Port :53 (domain)
TCP Port :79 (finger)
TCP Port :80 (www)
TCP Port :110 (pop)
TCP Port :111 (sunrpc)
Finished.
It shows the active ports in that domain or ip address
What is the Use?
what we can do with these ports? we can communicate with the victim system remotely using those active ports. So we can get their data without their knowledge.(The thing is that you can theft their data).
Scanning for open ports is done in two ways.
Ddosim is a tool that can be used in a laboratory environment to simulate a distributed denial of service (DDOS) attack against a target server. The test will show the capacity of the server to handle application specific DDOS attacks. ddosim simulates several zombie hosts (having random IP addresses) which create full TCP connections to the target server. After completing the connection, ddosim starts the conversation with the listening application (e.g. HTTP server).
ddosim is written in C++ and runs on Linux. Its current functionalities include:
Hi friends now you know about encryptions right ? if you don't know about encryption ,please read this article
Introduction to cryptography
Now you know the importance of encryption. If you like to protect your documents using encryption, then here is the tool for you. This is open source software. So no need to worry about the key,it is completely free.
Features of Axcrypt :
Do you know what programs are processing in your pc? You use Default task manager for seeing the list of Process. In Default task manage it just show only the list of process and memory usage. You may not know which one is system process,malware program,application program. Some advanced users can analyze himself what process are going on. He can end the process by right clicking on the process. But this will stop the program at the moment only. When he restart the system or after sometime,the process may continue.
Is your ip address banned in any forum or website? Can not you create account or login to your account? Don't worry i am here to help you to create a new account. Also You can have multiple accounts in forum.
If you are the administrator of public cafe or school,this trick will be helpful for giving protection to your system. You can disable writing to USB. This will prevent from file stealing. You have to login to administrator so that you can access regedit.
So far we have seen lot of keyloggers for computer. Now i am going to introduce mobile spy software to my blog visitors.
Mobile Spy is the next generation of smartphone spy software. Do you suspect that your child or employee is abusing their SMS or vehicle privileges? If yes, then this software is ideal for you. Install this small program directly onto your compatible smartphone you want to monitor to begin recording.
Using the Internet capabilities of your phone, recorded activities, logs and GPS locations are quickly uploaded to your Mobile Spy account. To view the results, you simply login to your secure account at the Mobile Spy web site. Logs are displayed by categories and sorted for easy browsing.
The software is completely stealth and works independently. Mobile Spy does not rely on the phone's call and message logs to record activities. So even if the user tries to delete their tracks, the data will still be retained and uploaded. Compatible with most models of iPhone, BlackBerry or Android phones! Also compatible with Windows Mobile, Symbian OS and iPad.
Features:
Call Log: Each incoming and outgoing number is logged along with duration and time stamp.
SMS (Text Messages) Log:Every text message is logged even if the phone's logs are deleted. Includes full text.
GPS Locations Log: GPS postions are uploaded every thirty minutes with a link to a map.
Contacts: Every contact on the phone is logged. New contacts added are also recorded.
Tasks: All personal tasks that are created are logged and viewable.
Memos: Every memo input into the phone is logged and viewable.
Cell ID Locations:
ID information on all cell towers that the device enters into range of is recorded.
E-Mail Log:
All inbound & outbound email activity from the primary email account is recorded.
Calendar Events
Every calendar event is logged. Date, time, and locations are recorded.
URL (Website) Log
All URL website addresses visited using the phone's browser are logged.
Photo & Video Log
All photos & videos taken by the phone are recorded & are viewable.
For More Details Visit:
MD5 is one of the famous Hash algorithm. This algorithm is used in many websites for storing the password in encrypted form. The MD5 message-digest algorithm was developed by Ronald Rivest at MIT in 1992. This algorithm takes a input message of arbitrary length and produces a 128-bit hash value of the message.
Now a days Internet is important part of Life. We are using Internet for sending confidential data also like password,for storing army secrets. But the Internet is insecure medium. Do you know why?
Insecure Medium:
Imagine you are sending a data. In internet world data are separated as packets and send to destination. Do you think the data directly reaching the destination? If you think so,you are wrong. The packets are going through different routers. Finally the data is send to user. In this gap, Intruders(i mean attackers) takes advantages. Intruders can see what you are sending. Because your data are simple and easy to readable by anyone.
How to secure the data?
We can not stop the intruders and their activities. But we can make our data as Unreadable for Intruders. For this purpose the Cryptography is introduced.
Introduction to Cryptography:
Julius Ceaser who introduce the Cryptography technology. Cryptography is technology in which we are changing the plain text to unreadable text(known as cipher text) .
In your home you put money in locker, Isn't it? The locker probably has key to open. Imagine thief is coming to your home to steal. if he want to open the locker,certainly he need the key. Without the key he can not do. Yeah i can hear what you are saying, he can break the locker. If the locker is very strong,he can not open it at all.
Likewise in cryptography also we are going to create a Key for our data. So that Intruders can not read the data. It is possible to read the data, if the encryption(will explain later) is weak. So we need to encryption method very strong.
Terminologies used In cryptography:
Plain Text:
original data or text is known as Plain text.
Cipher Text:
The encrypted message(unreadable message).
Encryption:
Changing the Plain text to unreadable.
Decryption:
Changing the cipher text to plain text.
Traditional Encryption Methods:
euhdnIf the intruders see the cipher text(here "euhdn") ,he can not understand anything. But this method is easily hackable . Because intruders can try 25 shifts and finally he can get the result.
Posts
All Comments
