Google Launches WHAT DO YOU LOVE wdyl.com

Google  without any  announcement or hype, it silently launched a new service or new search page called What do you love? which can be accessed from the webpage

The new What Do You Love? search page lets you access search results from all Google products in a single page.According to Techcrunch, for example if you look for term “love“, you will find pictures of love, patents about love, love on Google Trends, videos about love, how to say love in different languages, books about love and all these results in a single page.Do you think this new search feature is interesting then try it yourself at www.wdyl.com

Read More

Break All OS Passwords Using KON BOOT

There are times when you may need to access a computer but you don’t know the password – this can include running an old machine you haven’t used it for  years, using one purchased at a flea market or online auction, or even the need to quickly access your child’s computer for something. What ever the reason, accessing a computer without knowing the password is fairly simple with this free tool called Kon-Boot .

Of course there are alternatives like Ophcrack,However particularly I think Kon-Boot is the best tool, Which doesn’t ask any questions while gaining access to any PC without knowing its’ password.
Kon- boot is a software that will allow us to access any computer without knowing the password, and without modifying any files on Hard disk. All we have to do is to (just ) insert a boot (cd or floppy) disk Burned with Kon-boot software(110kb) in to any PC , and this offers unlimited access to that machine.

I tested this on one of my end users with special permission through my co-partner, this boot CD got me through the  account with no interruption no password required. I realized while on line, it locked out the account, but when offline I did not have any issues. Now just to make sure my account being the Local Domain Admin I went ahead and tested myself a few times, and thank God can’t access my account,only as a local administrator it’s possible. This is very scary because it forces you to set a bios password, and encrypt your hard drive. So far I have not tested on Vista or Windows 7,


Kon-boot which was initially started as a small project for Linux (mainly Ubuntu),where it allows to log into a Linux system as ‘root’ user without typing the correct password or to elevate privileges from current user to root. Now it was moved to windows platform where it enables Windows users to login to any password protected machine profile without any knowledge of the password.
This program works with the following versions of Windows: XP (SP1, SP2, SP3), Vista (Business, Ultimate), 2000, Server 2003 and 2008, and Windows 7. Kon-Boot also allows you to boot Linux (distributions: Ubuntu, Gentoo, Debian and Fedora) without a password as well.
Windows users doesn’t require any special instructions for using kon-boot , just boot the PC with Kon-Boot CD/Floppy, select your profile and put any password ,that’s all.The funny thing is Zipped version of Kon-boot for CD i.e ISO image is 8.5kb (110 kb after extracting ),where as Zipped version for floppy is 10kb which will goes to 1.4mb after unzipping it.

but I’m sure someone out there can give us some feedback, try it on a 64bit OS maybe it might work. Once you reboot back to your system without the Cd everything should be back to normal.

http://www.piotrbania.com/all/kon-boot/

Read More

How to run a Windows 7 as Virtual Router

Previously, I had always believed that the only way you could create a fake (aka virtual) access point was using a wireless card that supported monitor mode, Linux, and software like hostapd. Well, with the introduction of Windows Vista/7, Microsoft now requires certified drivers to support monitor mode, which allows the user to (among other things) create virtual access points.

Two free programs that take advantage of this are Connectify (free) and an open-source project (currently in beta) called Virtual Router. Turning your internet connected system into an access point can be useful for certain types of penetration testing, as well as just to allow those around you to access  your internet connection if they are unable to get connectivity.

Connectify Demo:
For more information about Virtual Router, check out the detailed review on freeware genius.

Read More

Ubuntu Linux Bible: Featuring Ubuntu 10.04 LTS

Ubuntu Linux Bible: Featuring Ubuntu 10.04 LTS By William von Hagen Wiley | English | 2010-06-08 | ISBN: 0470604506 | 1224 pages | PDF | 16 MB
The best resource on the very latest for Ubuntu users! Ubuntu is a free, open-source, Linux-based operating system that can run on desktops, laptops, netbooks, and servers. If you've joined the millions of users around the world who prefer open-source OS-and Ubuntu in particular-this book is perfect for you. It brings you the very latest on Ubuntu 10.04, with pages of step-by-step instruction, helpful tips, and expert techniques. Coverage Includes: • The Ubuntu Linux Project • Installing Ubuntu • Installing Ubuntu on Special-Purpose Systems • Basic Linux System Concepts • Using the GNOME Desktop • Using the Compiz Window Manager • Managing E-Mail and Personal Information with Evolution • Surfing the Web with Firefox • Migrating from Windows Systems • Sending and Receiving Instant Messages • Using Command-Line Tools • Working with Text Files • Creating and Publishing Documents • Other Office Software: Spreadsheets and Presentations • Working with Graphics • Working with Multimedia • Consumer Electronics and Ubuntu • Adding, Removing, and Updating Software • Adding Hardware and Attaching Peripherals • Network Configuration and Security • Going Wireless • Software Development on Ubuntu • Using Virtual Machines and Emulators • Connecting to Other Systems • File Transfer and Sharing • Managing Users, Groups, and Authentication • Backing Up and Restoring Files • Setting Up a Web Server • Setting Up a Mail Server • Setting Up a DHCP Server • Setting Up a DNS Server • Setting Up a Print Server • Setting Up an NFS Server • Up a Samba Server Updating your Ubuntu? Ubuntu Linux Bible, Third Edition, is the book you need to succeed! Note: CD-ROM is not included as part of eBook file.

Download

  Code: 

http://www.4shared.com/document/Zsa0meI8/ubuntu-linux-bible-featuring-u.html

Read More

Reliance Netconnect Broadband Review

ts been a while since i've been using the reliance broadband netconnect plus . I did do a lot of searching on the internet before i decided on this product. Here's more on this :

The reason i wanted a product like this is because i realized that while travelling i needed to get access to the internet either on the go or at my destination . In most cases the places i went to had no internet access so i had to get access by
myself . Hence i decided to go with a 3g data card.

I had two primary options - the reliance netconnect plus and the tata photon plus . I did a lot of searching on the internet you know the typical reliance netconnect vs tata photon google search :) . And after all that hunting i decided to go with
reliance for the following reasons :

1)Reliance is known to have a much better network coverage
2) They were a little more cheaper in terms of costs
3) They had the pay as you use option i.e. 1 Rs/mb which photon did not provide
I was really excited about the 3rd reason because then i dont need to go for any plan or pack where there is a validity.The idea is to use this only while travelling cause at home i have my DSL connection . Whenever i travel its usually over the
weekend or maximum 4-5 days , so getting a monthly pack or plan would be a waste.
Hence postpaid was never an option as i dont want to spend monthly as i dont travel every month. In prepaid to i wasnt looking for any packs/plans which is valid for 15 days etc cause i wont be using it for that long. The best option was pay as you use i.e. 1Rs/mb which only reliance provides . At the most i could go for the 200Rs pack which has a 7 day validity.

My browsing usage while travelling is not much just very light browsing .Mostly email and other such similar sites or even chat . Very less of audio/video chat . So the 1 Rs/mb is suitable or maybe at the most the 7 day validity pack.
So i decided to go for this and went ahead and purchased the device . Put in a top up of around 150 Rs which i can use as 1Rs/mb which means i can use 150mb as and when i want no validity period as such and this is more than enough for email,chat etc .This is also of great use when your DSL line is down for some reason and you need internet access immediately.
Reliance also provides an online interface to check your balance and to do an online recharge incase you find yourself out of balance while you are travelling.
Will hopefully be able to do a how to on how to setup reliance netconnect plus. On the whole i am pretty happy with the service. The coverage of reliance is amazing , they cover a lot of cities across the country and in other cities which it is
not covered you will be connected to the 1X network which is not all that bad. Decent for browsing mail etc.
The reliance customer care is pretty good , very helpful and polite people . On the whole if you are in a similar situation that i am in , reliance netconnect is a good option . You just need to shell out an initial amount of around 2k Rs and after that its like filling petrol for your car :) .

Read More

BackTrack 4 - Free E Book (Rare)

Today I am writing special review for the latest book - BackTrack 4: Assuring Security by Penetration Testing.  Written by expert authors on Penetration Testing, this book does real justice to its title.
.

.

Here is the core information about the book,

.

• Title: BackTrack 4: Assuring Security by Penetration Testing
• Author: Shakeel Ali & Tedi Heriyanto
• Publisher: Packt Publishing
• Hardcover: 392 pages
• Release Date: Apr 14, 2011.
  

Here is the table of contents

PART I: Lab Preparation and Testing Procedures
Chapter 1: Beginning with BackTrack
Chapter 2: Penetration Testing Methodology

PART II: Penetration Testers Armory
Chapter 3: Target Scoping
Chapter 4: Information Gathering
Chapter 5: Target Discovery
Chapter 6: Enumerating Target
Chapter 7: Vulnerability Mapping
Chapter 8: Social Engineering
Chapter 9: Target Exploitation
Chapter 10: Privilege Escalation
Chapter 11: Maintaining Access
Chapter 12: Documentation and Reporting

PART III: Extra Ammunition
Appendix A: Supplementary Tools
Appendix B: Key Resources

.
The book is well structured and written with systematic approach towards every stage of Pen Testing – starting with A,B,C…

First part explains how to setup BackTrack on virtual machines (such as Vmware, VirtualBox) and USB disk with step by step pictorial illustrations. Next comes the important step of bringing up network interface where most of has struggled and this book does right job by showing how to set up both wired & wireless interface with neat instructions. Then it goes into theory explaining different types of Pen Testing – Black-box & White-box testing – along with detailed explanation of various Pen Testing methodologies.

.
Second part is where real fun begins as authors delve into practical Pen Testing lessons. It starts with ‘Target Scoping’ where in author describes the process of collecting client requirements, preparing test plan and cross-verifying the same with the client before getting down to the battle field. This is very important part so as to understand scope of pen testing and its perimeters, failing which you may land into legal battle with the client later on.

.
Once the stage is set, author moves on with real Pen Testing phase by explaining passive information gathering using DNS enumeration, traceroute, whois, email harvesting tools from BackTrack. Next chapter focus on the target discovery on client network by identify live hosts and then OS fingerprinting using tools like hping, nbtscan, xprobe2 etc. Next follows detecting open ports and live services running on these discovered targets using NMAP, Amap, Httprint, ike-scan etc. Next comes the “Vulnerability Mapping” where in author shows how to use specialized & fuzzing based auditing tools for discovering vulnerabilities in Cisco, SMB, SNMP, Database & Web applications with very informative examples.

.

Often life does not go as planned and tools does not show the colors, then comes the PLAN B - Social Engineering !

Compared to olden days, now Social Engineering has become very important part of Pen Testing (very well demonstrated by Anonymous in recent HBGary hack). Author adds real juice here by demonstrating power of SET (Social Engineering Toolkit) with scenarios such as ‘targeted phishing attack’, ‘gathering user credentials’ etc.
.

Finally we come to the climax where in you are just a step away from pwning the target system. Chapter on ‘Target Exploitation’ does complete justice by unleashing the power of Metasploit with real life scenarios titled ‘Ninja 101 Drills’. Author showcases around 5 practical scenarios with descriptive explanation surrounding Meterpreter, finally ending with short session on writing Metasploit exploit module.
.

Next chapter on Privilege Escalation deals with gathering user credentials using various password recovery (pwdump, samdump2, dsniff, l0pthcrack, john) & MITM (ettercap, arpspoof) attack tools. Once you have got access to the system, it is important to maintain it through covert mechanisms. So is chapter on ‘Maintaining Access’ explains how to use various protocol tunneling tools such as DNS2tcp, cryptcat, netcat, ptunnel etc to maintain link between source & target systems.
.

Finally it is time to submit report or show up presentation on your Pen Testing work.  Now if you don’t have good presentation or report writing skills then all your hard work in pen testing goes for toss. Most of the times it is true that being techsavvy your softkills will be little hazzy. Author takes note of it and describes how to write different kind of reports (Executive, Management & Technical) and offer various tips on how to prepare each of the report and how to present them to the appropriate audience in a right way.  It would have been beneficial if author would have put sample report? for each of the mentioned types, hope they will include it in second edition.

.

At the end, authors have added additional resources in “Appendix Section” to show the usage of some of external tools such as NeXpose, Netcat, WhatWeb etc which are not included in BackTrack. Also you will find some good links related to vuln disclosure, vuln incentive programs, reverse engineering etc.

.

Highlights of the Book

• Well written, easy/enjoyable to read
• Each tool is shown well with detailed usage and practical example
• No real need for live system while reading
• How each tool works internally [like PING uses ICMP packets etc]
• Tips on using right tools at right times.

.
Though this book have written for BackTrack4 – it is very well applicable to any BackTrack version (with little difference with old/new tools) as it follows the practical & systematic approach making it one of the best guide for any Pen Tester.



Here is the Link :

http://www.ziddu.com/download/15169978/backtrack4.rar.html


http://www.filefactory.com/file/ccf05cb/n/BackTrack_4_Assuring_Security_by_Penetration_Testing.pdf   [Will Avail upto the next 15days ]

Link is Available tested(22/6/2011)  If its Broken in Future Mail me suren.click@gmail.com I will Upload once again

After too many flood request fr uploading the book , i took this sunday to upload it back its LIVE NOW 



UPDATED LINKS BT4




GRAB UR COPY


h@ckfr3ak

.

Read More

How Kerberos Authentication Works

Recently wen i was reading the LM algorithm, like how it works , how the passwords are concatenated and encrypted and stored as Binary form in the SAM Database , i get stuck on with Kerberos , what is the role of in windows ? so i asked in fb page, friend called Vishal Sharma has said , Keberos mechanism used wen a client is connect to the domain or to the ACTIVE DIRECTORY, So i tried to read more abt that , and i found this is the best article i found on internet,thought of sharing with you, Must read for All Network Enginners and Admins

Random Posts

Filed Under: Security

Tags: kerberos

And You may not know it, but your network is probably unsecured right now. Anyone with the right tools could capture, manipulate, and add data between the connections you maintain with the internet. The security cat and mouse game isn’t one sided, however. Network administrators are currently taking advantage of Kerberos to help combat security concerns.

Project Athena

Project Athena was initiated in 1983, when it was decided by the Massachusetts Institute of Technology that security in the TCP/IP model just wasn’t good enough. A total of 8 long years of research passed before Kerberos, named after the three-headed Greek mythological dog known as Cerberus, was officially complete.

The result of MIT’s famous research became widely used as default authentication methods in popular operating systems. If you are running Windows 2000 or later, you are indeed running Kerberos by default. Other operating systems such as the Mac OS X also carry the Kerberos protocol. Kerberos isn’t just limited to operating systems, however, since it is employed by many of Cisco’s routers and switches.

What Does It Protect Against, Anyways?

If you have ever used an FTP program over a network, you are at risk. If you have ever used a Telnet program over a network, you are again at risk. These are just two examples of how little security some applications allow. FTP and Telnet use what are called plaintext passwords, or otherwise known as cleartext passwords. These passwords are ridiculously easy to intercept with the right tools.

Anyone with a simple packet sniffer and packet analyzer can obtain an FTP or telnet logon with ease. With that kind of sensitive information being transmitted, the need for Kerberos is obvious. This need doesn’t stop there, however. Sure FTP and Telnet related logons are easy to intercept, but then again so is every other connection any of your applications has to the internet.
Through a process of man in the middle attacks, any hacker can get most logon information for just about anything. From online bank passwords to private passwords on your computer, they are all generally vulnerable to this attack. A man in the middle attack generally occurs when the hacker acts as the “man in the middle” between two computers. The hacker attempts to pretend to each computer that it is in fact, the computer they have connected to. In reality, all the data is being routed to the hacker, who can then modify or add instructions to the data.

Okay, This Sounds Useful…But How Does It Work?

Kerberos operates by encrypting data with a symmetric key. A symmetric key is a type of authentication where both the client and server agree to use a single encryption/decryption key for sending or receiving data. When working with the encryption key, the details are actually sent to a key distribution center, or KDC, instead of sending the details directly between each computer. The entire process takes a total of eight steps, as shown below.

1. – The authentication service, or AS, receives the request by the client and verifies that the client is indeed the computer it claims to be. This is usually just a simple database lookup of the user’s ID.
2. – Upon verification, a timestamp is created. This puts the current time in a user session, along with an expiration date. The default expiration date of a timestamp is 8 hours. The encryption key is then created. The timestamp ensures that when 8 hours is up, the encryption key is useless. (This is used to make sure a hacker doesn’t intercept the data, and try to crack the key. Almost all keys are able to be cracked, but it will take a lot longer than 8 hours to do so)

3. – The key is sent back to the client in the form of a ticket-granting ticket, or TGT. This is a simple ticket that is issued by the authentication service. It is used for authenticating the client for future reference.

4. – The client submits the ticket-granting ticket to the ticket-granting server, or TGS, to get authenticated.

5. – The TGS creates an encrypted key with a timestamp, and grants the client a service ticket.
6. – The client decrypts the ticket, tells the TGS it has done so, and then sends its own encrypted key to the service.

7. – The service decrypts the key, and makes sure the timestamp is still valid. If it is, the service contacts the key distribution center to receive a session that is returned to the client.

8. – The client decrypts the ticket. If the keys are still valid, communication is initiated between client and server.
Is all that back-and-forth communication really necessary? When concerning speed and reliability, it is entirely necessary. After the communication is made between the client and server, no further need of transmitting logon information is needed. The client is authenticated until the session expires.

Yet More Authentication

The authentication method described above seems a little one-sided. Kerberos provides support for mutual authentication, for a more secure protection against man in the middle attacks. Remember how the client no longer needs to send logon information after the authentication takes place? Well it sure would ruin everything if a hacker just intercepted our communication to the server and pretended to be us!

This type of authentication is fairly easy to understand, since it only involves two systems.

The Mutual Authentication Process

---

• 1. The first system creates a challenge code made up of random numbers.
• 2. This code is sent to the second system, which generates a response to the received code. This response and a challenge code of its own are then sent back to the first system.
• 3. The first system verifies the response of the second system, and then sends a response to the challenge code it received.
• 4. When the second system receives the response, it is verified. If all is well, it notifies the first system that they are indeed mutually authenticated.

---

This type of authentication uses challenge codes to ensure that both computers are who they claim to be. If someone tries to intercept the data, they obviously will fail because they can’t pretend to be one of the computers after they have been authenticated with challenge codes.

Sounds Great! Any Drawbacks I Should Know About?

Of course, nothing is perfect. Kerberos has a couple of main flaws that system administrators need to take into account.

First and foremost is the need of the Kerberos server. This server will handle all the functions required for authentication. If this server goes down, no one can get authenticated, and thus- the network is down. A total network crash can be prevented by using more than one Kerberos server, but that is more costly than some people would like to think.
Next, we have the issue of clock synchronization. Since Kerberos uses timestamps to handle all activity, the clocks on all host machines must be within 10 minutes of the Kerberos server’s clock. Since not all clocks are perfect, the host clock and server clock will eventually be misaligned enough to cause a failure. This can usually be remedied by keep clocks up to date, or use a Network Time Protocol, or NTP.

Closing Comments

Kerberos isn’t the only encryption protocol available. There are multiple ways to encrypt data, and this holds true for many types of different applications. Email encryption protocols, for example, are a breed all of their own.
With a product that has been researched and developed for over 8 years, it is generally expected that the product should be well polished. Kerberos doesn’t fail to deliver, and this can be seen by looking at all the vendors who use it. Cisco, Microsoft, Apple, and many others rely on this faithful three-headed dog for network security.
As Greek mythology goes, you could get around Cerberus by gently lulling him to sleep with honey cakes. Rest assured it will take a lot more than that to get past the famous Kerberos security.



Source: Learn networks

Read More

Control computers remotely with your Android phone

As a Quote Saying , iPhone is a RICH MANS Phone , and ANDROID is a POOR MANS iPhone, Android is Going Awesome, And taking Google a way One Step above , Google has started to Conquere the World Once again, THE INTERNET GIANT..! We Love you

And So guys Are you tired of providing on-site tech support for your friends and family? Providing support remotely is an easy way to help them while maintaining your sanity. If you don't have a computer nearby, but have your Android phone, you can still help. Here's how:
Computer setup
Step 1:
On the computer you want to remote control, download "TeamViewer QuickSupport" from TeamViewer. The downloaded file is named TeamViewerQS_en.exe. The program is self-contained so it does not need to be installed.
Step 2:
Double-click on the TeamViewerQS_en.exe file to launch TeamViewer on the computer you want to control.
Step 3:
At the main screen, the numeric ID of that system is listed and a numeric password for that session. Make a note of the ID and password as you'll need that information later.

(Credit: Screenshot by Ed Rhee)

 

Step 4:
If you're setting this up on someone else's computer, you may want to create a shortcut for them or place the file on their desktop so they can find it more easily when they need your help. Once you've connected to the computer, a small window with a session list will pop up in the lower right-hand corner.

A session list will pop up on the remote computer.

(Credit: Screenshot by Ed Rhee)

Android setup
Step 1:
On your Android phone, install TeamViewer from the Android Market and launch it. In the first box, enter the ID of the "partner" computer. In the second box, enter the password and tap the "Connect to partner" button.

 

(Credit: Screenshot by Ed Rhee)

Step 2:
Once connected, you'll see gesture control instructions.

 

(Credit: Screenshot by Ed Rhee)

Step 3:
Close the instruction screen to see the desktop of the remote computer.

The desktop can be zoomed in or out.

You've got control! Now you can help your in-law's figure out how to use Netflix streaming or add an RSS feed to Google Reader. You can help someone with just about anything he or she might need help with, without having to physically be there. You can use the mouse, type, print, and even reboot the remote computer.
The Android version of TeamViewer does have a few limitations, compared with the computer version. The Android version does not support local audio, text chat , video chat, or file transfers.



I hope you all People FIND This Intersting, Wannna Kick Somebody ass.ROFL...! i reallly would like to hear something from you all .wat u feel about "DH" Drop me a comments

Read More