Showing posts with label Guides. Show all posts
Clickjacking attack allows to perform an action on victim website, Mostly Facebook and Twitter accounts are targetable.When an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both. It may be similar to CSRF Cross Site Request Forgeries Attack.
Clickjacking is a term first introduced by Jeremiah Grossman and Robert Hansen in 2008 to describe a technique whereby an attacker tricks a user into performing certain actions on a website by hiding clickable elements inside an invisible iframe.
Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they
are typing in the password to their email or bank account, but are instead typing into
an invisible frame controlled by the attacker.
At present this attack mostly use on social network websites like Facebook and twitter, Because this attack is used by convinced victim for click on the link and Social Network website might be very useful for attack on victim.
Code:
<style>
iframe { /* iframe from facebook.com */
width:300px;
height:100px;
position:absolute;
top:0; left:0;
filter:alpha(opacity=50); /* in real life opacity=0 */
opacity:0.5;
}
</style>
<div>Click on the link to get more followers:</div>
<iframe src="/files/tutorial/window/clicktarget.html"></iframe>
<a href="http://www.google.com" target="_blank" style="position:relative;left:20px;z-index:-1">CLICK ME!</a>
<div>You'll be get 10000 followers..!!</div>
Output:
Click on the link to get more followers
Click Me
You'll be get 10000 followers..!!
Download
ClickJacking Tool
For Defence:
Clickjacking Protection
For more information:
OWASP
Every computer on the Internet has a
unique IP address allotted to it which makes it possible to trace it
back to its exact location. Even though the concept of Internet Protocol
address has been designed for its transparency and traceability, in
some cases this questions the privacy of the Internet user where one
would not like to reveal his/her identity to the outside world.
Well, if you are one such person who is in search of ways to hide your IP address online,
then you are at the right place. In this post, I will discuss some of
the easy and popular ways to mask your IP address so that your identity
and privacy is kept safe.
Why Hide IP Address?
The following are some of the common reasons why people want to mask their IP address online:
- By hiding the IP address, people can browse websites anonymously without leaving the trace of their identity.
- To access websites and portals that are not available to the IP addresse’s their Geo location.
- Stay safe from intruders and hackers by showing a fake IP to the world.
- Hiding IP means hiding geographical location.
- Hiding IP prevents leaving a digital footprint of their online activity.
How to Hide Your IP?
Some of the most common ways to hide IP and safeguard your online identity are discussed below:
1. Using a VPN Proxy – The Safe and Secure Way to Hide Your IP
Using a trusted VPN service is the best
way to hide your IP during your online activities. Here is a list of
most popular and highly reliable VPN services that you can go for:
- VyprVPN: VyprVPN offers the world’s fastest VPN services to its clients and supports wide range of operating systems including Windows, Mac, Android and iOS.
- Hide My Ass VPN: Hide My Ass is one of the most popular and trusted VPN service that allows people to easily conceal their IP address and protect their online privacy.
The following are some of the advantages of using a VPN service over any other method of concealing your IP address:
- In addition to hiding your IP, a VPN service encrypts all your web traffic to keep you safe from hackers and intruders.
- Unlike other IP hiding methods (discussed in the latter part of this article) which affects your speed of browsing, a VPN service keeps your Internet speed fast without affecting its performance.
- You have a long list of countries and states to select from as your place of origin. For example, if you are originally from United Kingdom, you may choose an IP address that belong to United States so that the websites that you visit will see you as from US and not UK.
- By selecting an IP address of your choice, you can easily bypass location blocks and even access restricted websites that are not available for your country.
2. Website Based Proxy Servers
This is another popular way to quickly
mask IP address on the Internet. Since it is a web based service, users
need not have to install any piece of software program on their
computer. The following are some of the popular websites that offer free
services to hide IP address:
The downside of using these free services
to hide your IP address is that most of them become overloaded and are
too slow to use. In addition, some of them will not offer a secured
connection (SSL) and you will often be presented with annoying ads and
pop-ups during the course of your browsing.
3. Browser Configured Proxy Servers
There are hundreds of freely available
open proxies that can be found on the Internet. You can obtain the IP
address of one of those freely available proxy servers and configure
your browser to start hiding your original IP address. However, as they
are openly available to public, most of them are either dead or perform
too slow under normal conditions.
Which Service to Choose?
If you only want to hide your IP address for
a specific amount of time and are not concerned with the performance,
go for the free web based services. On the other hand, if you have the
necessity to hide your IP on a regular basis, need high security and
performance, go for paid VPN services like Hide My Ass or VyprVPN.
For very many people, security is one of
the most important issues when it gets to sending their files into the
cloud. They worry that their files will be seen or even compromised by
other persons because that is what took place in the past. The user
accounts used to be hacked, cloud storage systems failed and personal
files and data were exposed. Therefore, how can you successfully prevent
that from ever happening even when the account gets hacked or something
happens to your provider of cloud storage?The answer to that question is encryption
Encryption can be defined as the process
of making one’s files unreadable with a pass phrase or an encryption key
so that even when another person gains access to the files, it does not
matter because the intruder will only be able to see gibberish. To be
able to see very properly what is in the file, one must have a key.
This article contains the two different
ways through which one can make his or her files secure and be able to
safely use cloud storage without any worries.
Available options
Essentially, when it gets to encrypting files in the cloud, one has two options from which he or she can choose, that is:
- He or she may choose the cloud storage with a built in encryption.
- Make use of a service which encrypts folders and/or files for him or her.
Cloud storage service with built-in encryption
Regardless of your choice, both of the
ways to encrypt data to store in cloud have advantages and
disadvantages. If you decide to go with the dedicated secure cloud
service, you might be required to change the entire setup of
transferring files to that specific service, familiarize yourself with
the way it works and probably give up on a certain third party support,
mainly if you come from the most well-liked cloud storage and syncing
service, that is “Dropbox”. Alternatively, you have got everything under
one hood and you do not have to worry any more about file security and
integrity.
Service for encryption only
If you are using a service which is
dedicated to encrypting your files, you will be having more control over
which files you would like to encrypt and where you would like them to
be stored. For instance, you may choose Dropbox, if at all you like the
service; and not give up after encrypting the files properly.
Conversely, your files might take longer to be properly synced in case
you are getting them encrypted using third party apps.
Conclusion
Either way, it is believed to be very
necessary to protect one’s files using the most proper encryption, most
especially if he or she is using Dropbox for managing his or her
critical files such as contracts, password databases, or any other
personal or business files which may be considered to be very important.
Depending on an individual, some would
like to install another software on their computers just for the purpose
of encryption, while others not. Those who don’t may take advantage of
the idea of signing up for a dedicated cloud solution which has built-in
local encryption for all the files. Some of such solutions available
include SpiderOak, Wuala and Cubby. If online viruses are among the
things troubling you, you may also consider making use of the Norton Contact Phone number so as to inquire about how you can be helped.
Disclaimer! This Software is designed only to be used to monitor your child or employee. We do not condone the use of this software for illegal or unethical purposes.
The PC Monitoring Software (keylogger) which we are talking about is WinSpy Software Pro which now supports Android smartphone monitoring.
WinSpy Software Pro is a Complete Stealth Monitoring Software for
Windows that can monitor your Local or Remote PC and now any Android
device (cell Phone or Tablet); In short Win Spy can capture anything the
user sees or types on the keyboard.
Unlike other Mobile Spy softwares that notify the users that they are being monitored by device notifications and a tamper-proof icon, the Winspy Android module
is completely invisible on the target phone; i.e It could Stalk Android
Smartphone without detection when it is installed on a target’s phone.
With the Android module you can:
- View complete SMS text messages.
- Get GPS locations as often as you wish.
- Log call details and websites visited.
- View memos, contacts and email.
- FTP Option: Get all the data to your FTP account.
This New WinSpy Android module does not rely on the phone’s call or message database to log activities. So even if your target tries to delete their usage histories, the information will still be retained and inserted to your account.
With this Software you can easily monitor your child or Employee for potential misuse of the Smartphone and there is no limitations to the number of target phones you can monitor or install on.
There are over 1.3 billion users on Facebook, out of which around 81 Million users are Fake (Fake Facebook profiles).
Somebody creating a Fake profile of yours is not a Big deal for
Facebook unless you represent a law enforcement agency or an Expensive
Legal firm. Most fake Facebook profiles are set-up by adolescents in
relationships seeking to destroy reputation of their ex-partner.Identity theft is common on Facebook, But somebody using your image to harass or play with other people you know, thereby defaming you is really embarrassing and malicious.
While you can always report such imposters profile to Facebook using their Report form, it takes hell lot of time for Facebook to review the profile and disable it. Also Facebook will never disclose to you any details about the fake profile, like when it was created and from which Computer it was operated. Facebook will provide Information regarding fake profile only when there is Police intervention and this is very long process.
Moreover police will not go through the hassle of contacting Facebook and behave like a loyal dogs to track down the imposter unless the matter is very serious. Once you have the IP address of fake profile user, you will then need to get a court-order for the ISP to reveal the information and billing address of the person involved. Remember If the fake profile user had used a proxy server to hide real-IP, it would be very difficult to track down the real IP address.
Here in this post we will show you how exactly you can Find an IP address of a fake Facebook user and even nab the culprit.
Facebook chat runs on XMPP protocol now which is not peer-2-peer, so it is not possible to determine the IP address of the user through Facebook Chat using Netstat command. All we will be doing is use some social engineering skills and default ‘Banner grabbing‘ technique of a web server.
Banner Grabbing is an enumeration technique used to get information about a particular computer system on a network/internet (Information like: Operating system, browser, IP address, etc.)
1. Collect as much information about the fake profile as you can and identify all of the people who are connected to the profile. Make a list of connected people to this account who are your real life friends.
2. Select any one of your close friend or relative on that list (select most trusted person). The person which you have selected will be doing all the job for you. If there is nobody you can trust on this list then ask any of your trusted friend to Befriend this fake profile user.
3. Ask your Friend to start chatting with this fake user casually everyday. (Remember whatever you do should remain between you can your friend. do not let it spread among other close friends)
4. Now Go to http://iptracking.geniushackers.com and fill in your valid email address and enter any name in the ‘Link Name’ field. Click Generate.
5. In the next page you will get a unique link. Just copy this unique link that will look something like this one:
http://iptracking.geniushackers.com/friendship.php?linkid=0gds65g1s2dg169741f32428a9
6. Next goto https://goo.gl and paste your ‘Unique URL’ (that is too long) in the text field and click shorten URL. You will get short URL that will look something like this: http://goo.gl/5HJY2s.
7. Ask your friend to send this shortened URL to the Fake profile user along with some nice message via chat such that he should click on that URL. Example message:
“Hey wassup? i found this really nice story, read here: http://goo.gl/5HJY2s“
Steps for Tracing fake profile user and catching the culprit:
Now that you have found out the IP address of the fake user, its time to know more about this fake user.
9. Goto http://www.iptrackeronline.com and enter the ‘IP address’ of the fake user, click submit query.
10. On the new page, scroll down a bit and you will get to see all the details like ISP, Area-code, Postal-code, etc. regarding his IP address along with a Map.
11. Relate these details with the suspect. If you are not able to suspect anyone then approach your attorney or lawyer, he will file the necessary documents for the ISP to disclose the subscriber details for the IP address.
12. If you are suspecting anyone but not sure if its him then repeat the steps 3 to 8 for this suspect. You can take help of the same friend and ask him to craft some different message accompanied by IP tracking link for this suspect.
13. As soon as your suspect clicks this link, you will have his IP address. Now match his IP address with the IP address of the Fake user. If there is a match, well congrats!! you have successfully nabbed the culprit.
Hope this helps.
Most of us are very curious to learn Hacking and want to become a Hacker, but don’t know where to start. If you are in a similar situation, then this article will most likely guide you to reach your goal.
“How to Become a Hacker?” This question is not an easy one to answer, since hacking is
not an art that can be mastered overnight. It requires knowledge,
skills, creativity, dedication and of course the TIME. Everyone
can become a hacker provided they learn it from the basics. So, if you
wanna become a hacker, then all you need is a good source of knowledge
that will guide you through various concepts of hacking from the basics.
What Skills do I Need to Become a Hacker?
In simple words, there is no magic to
become a Hacker. But, like anything else that is worthwhile, it takes
dedication and willingness to learn. It is most important to have
a basic knowledge of the topics such as operating system basics and it’s
working, computer networks, computer security and of course
programming. However, you need not be the expert in each or any of those
topics mentioned. As you gain the basic knowledge of various branches
of computer, you can choose any one as your favorite and advance in it.
What is the Best Way to Become a Hacker?
As said earlier, the best way to become a
hacker is to start from the basics. You will have to master the basics
to build a strong foundation. And once this is done, you’ll be in a
position to explore new ideas and start thinking like a Hacker.
There exists tons of books on the market
that will teach you hacking, but unfortunately, it requires a set of
pre-established skills and knowledge to understand the concepts
explained in those books. Also, most of them are not suitable for
the beginners who doesn’t know anything about hacking.
This book will take you from the core to
the top. It will tell you how to hack in simple steps. Everything in
this book is presented in a simple and effective manner. It is a great
source for the beginner who would like to become a hacker. This will
install a Hacker’s Mindset on you.
The following skills are uncovered in this book:
You will learn all the hacker underground tricks and learn to apply them in real world situations.
-
You will be put into a hacker mindset so that you will learn to think like a Hacker.
-
By learning how a hacker thinks and acts, you will be able to protect yourself from future hack attacks.
-
You will acquire knowledge nonexistent to 99.9% of the people in the world!
-
This underground handbook may get you interested in pursuing a career as an Ethical Hacker.
-
This book is of great value for all those who have a dream to become a Hacker.
So what are you waiting for? Go grab your copy now from the following link:
In my earlier post, I had discussed about How to find the IP address of
a remote computer. After you obtain this IP address, it is necessary to
trace it back to the source. So, in this post I will show you how to trace any IP address back to its source.
How to Trace the IP Address Back to the Source?
In fact, tracing an IP address back to
its location is a lot simpler than what many people imagine. There
exists many online tools using which you can accomplish this job. One of
my favorite site is IP2Location.com.
Just go to http://www.ip2location.com/demo.aspx and
enter the IP address that you want to trace in the dialog box and click
on “Find Location”‘. With just a click of a button you can find the
following information for any given IP address:
-
Country in which the IP is located
-
City to which the IP address belongs to
-
Latitude/Longitude of the IP’s location
-
Zip Code of the region to which the IP belongs to
-
Time Zone associated with the IP
-
Name of the ISP to which the IP address belong to
-
Internet Speed of the computer associated with the IP
-
Weather Station associated with the region of the IP
-
Domain name associated with the IP address
A sample snapshot of the results from ip2location.com is given below:
You can also visually trace route any IP address back to its location. For this, just visit http://www.yougetsignal.com/tools/visual-tracert/ and
enter the IP you want to trace in the dialog box and hit the “Proxy
Trace” button. Wait for few seconds and the visual trace route tool
displays the path Internet packets traverse to reach a specified
destination. Hope this helps.
Most of you may be curious to know how to find the IP address
of your friend’s computer or the IP of the person with whom you may be
chatting. If so, then this post will surely help you out.
In this post I’ll show you how to find the IP address of a remote computer in simple steps.
How to Capture the IP Address?
-
Download the IP Finder Script (IP_Finder.ZIP) that I have created from the following link:
-
Open a new account in X10Hosting (or any other free host that supports PHP).
-
Extract the IP_Finder.ZIP file and upload the two files ip.php and ip_log.txt into the root folder of your hosting account using the File Manager.
-
You can rename the ip.php to any name of your choice.
-
Set the permission to 777 on ip_log.txt.
Now, you are all set to find the IP
address of your friend or any remote computer of your choice. All you
have to do is send the link of ip.php to your friend or
the person with whom you’re chatting. Once the person click’s on the
link, his/her IP address is recorded in the file ip_log.txt.
For your better understanding let’s take up the following example:
Suppose you open a new account in X10hosting.com with the subdomain as abc, then your IP Finder link would be:
http://abc.x10hosting.com/ip.php
You have to send the above link to you
friend via email or while chatting and ask him to visit that link. Once
your friend clicks on the link, his IP address will be recorded along
with the Date and Time in the ip_log.txt file. After recording the IP address, the script will redirect the person to google.com so as to avoid any suspicion.
To find the recorded IP address, check the logs using the following link:
http://abc.x10hosting.com/ip_log.php
The sample log will be in the following format:
79.92.144.237 Thursday 07th of May 2009 05:31:27 PM
59.45.144.237 Thursday 07th of May 2009 05:31:28 PM
123.92.144.237 Thursday 07th of May 2009 05:31:31 PM
NOTE: You have to replace abc with your subdomain name.
Internet Protocol (IP) addresses are usually of two types: Public and Private.
If you have ever wondered to know what is the difference between a
public and a private IP address, then you are at the right place.
In this post I will try to explain the difference between a public and a private IP address in layman’s terms so that it becomes simple and easy to understand.
What are Public IP Addresses?
A public IP address is assigned to every
computer that connects to the Internet where each IP is unique. In this
case, there cannot exist two computers with the same public IP address
all over the Internet. This addressing scheme makes it possible for
the computers to “find each other” online and exchange information. User
has no control over the IP address (public) that is assigned to the
computer. The public IP address is assigned to the computer by the
Internet Service Provider as soon as the computer is connected to the
Internet gateway.
A public IP address can be either static or dynamic.
A static public IP address does not change and is used primarily for
hosting web pages or services on the Internet. On the other hand, a
dynamic public IP address is chosen from a pool of available addresses
and changes each time one connects to the Internet.
Most Internet users will only have a
dynamic IP assigned to their computer which goes off when the computer
is disconnected from the Internet. Thus when it is re-connected it gets a
new IP.
You can check your public IP address by visiting www.whatismyip.comWhat are Private IP Addresses?
An IP address is considered private if
the IP number falls within one of the IP address ranges reserved for
private networks such as a Local Area Network (LAN). The Internet
Assigned Numbers Authority (IANA) has reserved the following three
blocks of the IP address space for private networks (local networks):
10.0.0.0 – 10.255.255.255 (Total Addresses: 16,777,216) 172.16.0.0 – 172.31.255.255 (Total Addresses: 1,048,576) 192.168.0.0 – 192.168.255.255 (Total Addresses: 65,536)
Private
IP addresses are used for numbering the computers in a private network
including home, school and business LANs in airports and hotels which
makes it possible for the computers in the network to communicate with
each other.
Say for example, if a network X consists of 10 computers, each of them can be given an IP starting from 192.168.1.1 to 192.168.1.10. Unlike
the public IP, the administrator of the private network is free to
assign an IP address of his own choice (provided the IP number falls in
the private IP address range as mentioned above).
Devices
with private IP addresses cannot connect directly to the Internet.
Likewise, computers outside the local network cannot connect directly to
a device with a private IP. It is possible to interconnect two private
networks with the help of a router or a similar device that supports Network Address Translation.
If the
private network is connected to the Internet (through an Internet
connection via ISP), then each computer will have a private IP as well
as a public IP. Private IP is used for communication within the network
where as the public IP is used for communication over the Internet. Most
Internet users with a DSL/ADSL connection will have both a private as
well as a public IP.
You can know your private IP by typing ipconfig command in the command prompt. The number that you see against “IPV4 Address:” is your private IP which in most cases will be 192.168.1.1 or 192.168.1.2. Unlike the public IP, private IP addresses are always static in nature.
Common Myth about Private IP Address:
Most
people assume that a private IP is the one used for stealth Internet
activities and hence cannot be detected. But this is NOT TRUE!.
Unlike what most people think, a private
IP address (unlike the private telephone number) is just like any other
IP address that belongs to a private network. In reality, there is no
public IP address that is impossible to trace as the protocol itself is
designed for transparency.
If you are working in the field of
computer networks or an enthusiast in the field of network security, you
are sure to have come across the term “Denial of Service attack”
which is simply referred to as “DoS attack”. Today, this is one of the
most common types of network attacks carried out on the Internet. In
this post, I will try to explain DoS attack, its variants and methods
involved to carry out the same in an easily understandable manner.What is a DOS Attack?
Denial of Service or DoS attack is a
type of network attack designed to flood the target network or machine
with a large amount of useless traffic so as to overload it and
eventually bring it down to its knees. The main intention behind DoS
attack is to make the services running on the target machine (such as a
website) temporarily unavailable to its intended users. DoS attacks are
usually carried out on web servers that host vital services such as
banking, e-commerce or credit card processing.
A common variant of DOS attack known as DDoS (Distributed Denial of Service)
attack has become quite popular in the recent days as it is more
powerful and hard to detect. A typical DoS attack has a single place of
origin while a DDoS attack originates from multiple IP addresses
distributed across two or more different network. The working of a DDoS
attack is shown in the following diagram:
Unlike a DoS attack where the attacker
uses one single computer or a network to attack the target, a DDoS the
attack originates from different pre-compromised computers belonging to
different networks. As the attacker uses a number of computer systems
from different networks each residing in different geographical
locations, the incoming traffic looks natural and therefore becomes hard
to detect.
Protection Against DoS/DDoS Attacks:
DoS attacks can easily be handled by
blacklisting the target IP (or range of IPs) that are found to be making
too many requests/connections (in an unnatural way) to the server.
However, DDoS attacks are complicated as the incoming requests seem more
natural and distributed. In this case it is hard to find the difference
between the genuine and malicious traffic. Taking an action at the
firewall level to blacklist suspected IPs may result in false positives
and therefore may affect the genuine traffic as well.
Methods Involved in DoS Attack:
The following are some of the commonly employed methods in carrying out a DoS attack:
- SYN Flood Attack
- Ping Flood Attack (Ping of Death)
- Teardrop Attack
- Peer-to-Peer Attacks
