Showing posts with label Ethical Hacking Training. Show all posts
Showing posts with label Ethical Hacking Training. Show all posts

Saturday, January 31, 2015

Accessing Databases with Object-Oriented PHP Tutorial



- 01. Introduction


 01_01-Welcome 

 01_02-What you should know before watching this course


01_03-Using the exercise files


01_04-Setting SQLite permissions


01_05-A quick primer on using PHP objects



 Downlaod >> 01. Introduction :  Password For 7zip is AlbDll.com


-----------------------------------------------------------


- 02. Why Use Object-Oriented PHP to Access a Database 

02_01-Overview of PHP database APIs


02_02-Using prepared statements



02_03-Using transactions


 Downlaod >> 02. Why Use Object-Oriented PHP to Access a Database  :  Password For 7zip is AlbDll.com

-----------------------------------------------------------

Thursday, December 12, 2013

How to Become an Ethical Hacker?

What is Ethical Hacking or Ethical Hacker?
Ethical Hacking, also known as Penetration testing, is the process of vulnerability testing or hacking the system with a permission from corresponding vendor. Normally, organization who are in the need of security recruits Ethical Hacker or PenTester for improving their security.

Ok, let us come to the article below.


How to Become an Ethical Hacker?

                                                         ethical hacker



1- Dedication :
Dedication is the main key to become an ethical hacker. Don't plan to become pentester because of money. If you really have interest, then go ahead.

2- Reading :
Be a bookworm. Try to read books related to computer and its architecture. Buy books related to Security and Ethical hacking.

3- Should Know how hackers hack into: 
You can not solve the problem until you know what is behind the problem. So you have to learn method of hackers. How ??! Just read the articles provided in our site.

4- Programming and Scripting: 
Learn Some programming or scripting languages because most of time you will need to write a code to break into a system. Also, you have to know the coding for understanding how a system works,then only you can penetrate into. Ok, which language?! My suggestion is C. I Love C programming. It is one of best,powerful language and easy to learn. Some peoples prefer python. As far as i am concerned, once you learned one language, it is easy for you to learn any other languages. There are are plenty of online programming tutorial sites are out there.

5- Linux: Ok, it is time to switch from Windows to Linux. Learn to work with Linux.

6- BackTrack Linux Distribution:
Backtrack Linux is one of the famous Penetration Testing Linux distribution. This backtrack is funded byOffensive Security. It has almost all penetration testing tools required for security professionals.

7- Get Certification for Ethical Hackers:
 Some organization recruits based on security certification. You can learn and get ethical certification from your nearest center. Search in google for these keywords "CEH","OSCP","security certifications". Anyway, if you have dedication and confidence, you don't need a certificate and get into a firm easily.

8- Th3Hacker:  I will written plenty of articles related to Ethical hacking and penetration testing. Hope it will help you to get some knowledge. Also, you can find the latest ethical hacking techniques here. 

9- Forums: Participate in any Security or ethical Hacking related forums.
 
10- Need help? feel free to contact me

Opportunities for Ethical Hacker
There are plenty of jobs available in government organisations, banks, financial institutions, military establishments and private companies. AL requires more Ethical Hackers.

Instroduction to Computer Hacking

WHAT IS HACKING?

Hacking is the process of taking advantages of weakness in a computer or computer network to accomplish his goal. The person who is engaging in hacking activities called as 'Hacker
'. Hackers may be motivated by a multiple reasons, such as profit, protest, challenge or just for fun.


                                                         computer hacking




CrackersOne who breaks security on a system. Coined ca. 1985 by hackers
in defense against journalistic misuse of hacker (q.v., sense 8). An
earlier attempt to establish ‘worm’ in this sense around 1981–82
on Usenet was largely a failure.

Use of both these neologisms reflects a strong revulsion against
the theft and vandalism perpetrated by cracking rings. While it is
expected that any real hacker will have done some playful cracking
and knows many of the basic techniques, anyone past larval stage
is expected to have outgrown the desire to do so except for immediate,
benign, practical reasons (for example, if it’s necessary to get
around some security in order to get some work done).
Thus, there is far less overlap between hackerdom and crackerdom
than the mundane reader misled by sensationalistic journalism
might expect. Crackers tend to gather in small, tight-knit,
very secretive groups that have little overlap with the huge, open
poly-culture this lexicon describes; though crackers often like to
describe themselves as hackers, most true hackers consider them a
separate and lower form of life.

It’s clear that the term cracker is absolutely meant to be derogatory. One
shouldn’t take the tone too seriously though, as The Jargon File is done with a
sense of humor, and the above is said with a smile. As we can see from the
above, illegal or perhaps immoral activity is viewed with disdain by the “true
hackers,” whomever they may be. It also makes reference to cracker being a
possible intermediate step to hacker, perhaps something to be overcome.


Script Kiddie

The term script kiddie has come into vogue in recent years. The term refers to
crackers who use scripts and programs written by others to perform their intrusions.
If one is labeled a “script kiddie,” then he or she is assumed to be incapable
of producing his or her own tools and exploits, and lacks proper
understanding of exactly how the tools he or she uses work. As will be apparent
by the end of this chapter, skill and knowledge (and secondarily, ethics) are the
essential ingredients to achieving status in the minds of hackers. By definition,
a script kiddie has no skills, no knowledge, and no ethics.


Phreak
A phreak is a hacker variant, or rather, a specific species of hacker. Phreak is
short for phone phreak (freak spelled with a ph, like phone is). Phreaks are
hackers with an interest in telephones and telephone systems. Naturally, there
has been at times a tremendous amount of overlap between traditional hacker
roles and phreaks.


White Hat/Black Hat/Gray Hat
White Hat Hacker:
White Hat hackers are good guys who does the hacking for defensing. They probably work an organization for providing security.


Black Hat Hacker
Black hat hackers are bad guys(the malicious hackers or crackers). They usually steal the other bank information and steal the money.
They use their skills for illegal purposes.
They are creators of viruses,malware,spyware.
They will destroy your pc.


Gray Hat Hackers
Grey hats are hackers who may work offensively or defensively, depending on the situation.
This is the dividing line between hacker and cracker. Both are powerful forces on the Internet,
and both will remain permanently. And some individuals qualify for both categories. The
existence of such individuals further clouds the division between these two groups of people.
In addition to these groups, there are self-proclaimed ethical hackers, who are interested in
hacker tools mostly from a curiosity standpoint. They may want to highlight security problems
in a system or educate victims so they secure their systems properly. These hackers are
doing their “victims” a favor. For instance, if a weakness is discovered in a service offered by
an investment bank, the hacker is doing the bank a favor by giving the bank a chance to rectify
the vulnerability.

Sunday, December 1, 2013

Email Accounts Hacking Method - How To Hack Email Accounts

The Basic level Hacking is Email Account Hacking. Everyone like to do first email account hacking only. So here is the tutorial for budding hackers about email Hacking.

There are different types of Email Account Hacking . Here is some of them :

  1.  Social Engineering
  2.  Phishing
  3.  Brute Force Attack
  4.  Keylogger
  5.  Guessing the Answer for the Security Question


Social Engineering:

Social engineering takes advantage of the weakest link in any organization’s
information security defenses: people. Social engineering is
“people hacking” and involves maliciously exploiting the trusting nature of
human beings to obtain information that can be used for personal gain.

Social engineering is one of the toughest hacks to perpetrate because it takes
great skill to come across as trustworthy to a stranger. It’s also by far the
toughest hack to protect against because people are involved.

Social Engineering is different from Physical Security exploits . In social engineering hackers will analyze about
victim. Hackers will send mail to victim. The contents will be related to the victim.

Eg:

✓ False support personnel claim that they need to install a patch or new
version of software on a user’s computer, talk the user into downloading
the software, and obtain remote control of the system.
✓ False vendors claim to need to update the organization’s accounting
package or phone system, ask for the administrator password, and
obtain full access.
✓ Phishing e-mails sent by external attackers gather user IDs and passwords
of unsuspecting recipients. Hackers then use those passwords to
gain access to bank accounts and more. A related attack exploits crosssite
scripting on Web forms.
✓ False employees notify the security desk that they have lost their keys
to the computer room, receive a set of keys from security, and obtain
unauthorized access to physical and electronic information.

Phishing WebPage:



It is a fake webpage which looks similar to the original page of the website. Using this WebPage we can easily get the Password of victims. The process involved in creating Phishing webpage are,
✓ First Visit the Website which is associated with the email id. Copy the Source code.
✓ Edit the the Source code such that it will store the password for you.
✓ Upload the Webpage to any free webhosting sites. (don't select a famous hosting site,they will find that
your page is fake). Try uploading through the proxy server.



Guessing the Answer for Security Question:




Do you remember that the mail sites will ask for the security questions to retrieve the mail account? You can hack the mail account simply guessing the answer. If the victim is your friend ,then it may very easy to hack.



Brute Force Attack:

                                  
A famous and traditional attacking method . In this method ,the password will be found by trying all possible passwords with any program or software.



Keyloggers:

It is one of the spyware which will capture what you type in the keyboard. so whenever you type the username and password ,it will simply capture.

It is software program which will be attached with any softwares and send to victim. While victim install the software ,the keylogger also start to work.
 

Wednesday, November 27, 2013

Ethical Hacking Lab to Test and Learn SQL injection,XSS, CSRF Vulnerability



So far i have provided few Web Application Pen Testing tutorials . Now it is time to for practicing your hacking / pentesting skills in legal way. Last time , i explained about the Damn Vulnerable Web Application(DVWA).

Now, i've come with different web application that will help you to improve your knowledge in web app pentesting.


The BodgeIt Store

Like DVWA, This is also a Vulnerable web Application that will help you to develop your skills in Pen testing.

With this Vulnerable Application , you can practice the Following attacks:

Cross Site Scripting (XSS)
SQL injection (SQLi)
Hidden (but unprotected) content
Cross Site Request Forgery
Debug code
Insecure Object References
Application logic vulnerabilities

There is also a 'scoring' page (linked from the 'About Us' page) where you can see various hacking challenges and whether you have completed them or not.

How to setup the Pen Testing Lab?


Requirements:

BodgeIt app(download)
Tomcat server

Download the bodgeit.1.3.0.zip file and extract the zip file . Now you will get a WAR file(bodgeit.WAR).

step 1:Install the Tomcat
Install the Tomcat in your system. If you don't know how to do install the tomcat , do google search.

Step 2: Start the server
Start the tomcat server.

In Ubuntu, type the following command in Terminal:

sudo /etc/init.d/tomcat6 start

For windows users, just click the tomcat server in all programs.

Step 3:
Open the browser and type "localhost:8080". It will show a page "It works !". There you can access the manager webapp(http://localhost:8080/manager/html) page. Clicking the link will ask to enter the username and password. enter your computer username and password.

Step 4:
Now you are in "Tomcat Web Application Manager" page. Scroll down and there you can see theWAR file to deploy form.

Step 5: Deploying the WAR
click the Browse button and select the bodgeit.WAR file . Now click the Deploy button.







Yes, Now the Application successfully installed..





Access the BodgeIt in this location: http://localhost:8080/bodgeit/

Set up your own Lab for practicing SQL injection and XSS : Ethical Hacking



I hope you learned about the Sql injection and XSS from BTS. But you may curious to practice the SQLi and XSS attacks. we know that doing the attack on third-party website is crime. So how can we do the practice? Here is the solution for you friends. Why shouldn't set up your own web application ? Yes, you can setup your own Pen Testing lab for practicing the XSS and SQLi vulnerabilities.

When i surf in the internet, i come to know about the "Damn Vulnerable Web App (DVWA)". It is one of web application that used for practicing your Ethical hacking/Pen Testing skills in legal way.

Download this web Application from here:
http://www.dvwa.co.uk/

For Installing the this application, you will need XAMPP server.

The installation procedure :







Using this application , you can also practice:


* LFI /RFI (File Inclusion methods)
* Command Execution
* Upload Script
* Login Brute Force