Showing posts with label Hacking. Show all posts
Showing posts with label Hacking. Show all posts

Saturday, July 19, 2014

How Can We Protect Our Website By Common Web Attacks ?

 


On this post i am telling about five types of common web attacks, which are used in most types of defacements or dumps of databases.
Following five exploits are listed SQL injection, XSS, RCE, RFI, and LFI. Most of the time, we missed out some website code tags. So that our website gets attack and allows the hacker for hijack the vulnerable website.

1. SQL Injection
       
Types ->

     Login Form Bypassing
     UNION SQL Injection

2. Cross Site Scripting ( XSS )

Types -> Cross Site Request Forgery

3: File Inclusion

Types -> Remote File Inclusion and Remote Code Execution


1. SQL Injection

>> Login Form Bypassing
Here is an example of the vulnerable code that we can bypass very easily:

    index.html file:
    <form action="login.php" method="POST" />
    <p>Password: <input type="text" name="pass" /><br />
    <input type="submit" value="Authenticate" /></p>
    </form>
    login.php file:
    <?php
    // EXAMPLE CODE
    $execute = "SELECT * from database WHERE password = '{$_POST['pass'])";
    $result = mysql_query($execute);
    ?>

We can simply bypass this by using ' or '1=1', which will execute "password = ''or '1=1'';".

Alternatively, the user can also delete the database by executing "' drop table database; --".


>> PREVENTION:

Use mysql_real_escape_string in your php code.

Example:

    <?php
    $badword = "' OR 1 '";
    $badword = mysql_real_escape_string($badword);
    $message = "SELECT * from database WHERE password = "'$badword'";
    echo "Blocked " . $message . ";
    ?>

>> UNION SQL Injection

UNION SQL injection is when the user uses the UNION command. The user checks for the vulnerability by adding a tick to the end of a ".php?id=" file.
If it comes back with a MySQL error, the site is most likely vulnerable to UNION SQL injection. They proceed to use ORDER BY to find the columns, and at the end, they use the UNION ALL SELECT command. An example is shown below.

http://www.site.com/website.php?id=1'

You have an error in your SQL syntax near '' at line 1 SELECT SUM(quantity)
as type FROM orders where (status='completed' OR status='confirmed' OR status='pending') AND user_id=1'


No error--> http://www.site.com/website.php?id=1 ORDER BY 1-- 

Two columns, and it comes back with an error! This means that there is one column.
 http://www.site.com/website.php?id=1 ORDER BY 2--


Selects the all the columns and executes the version() command on the only column.
http://www.site.com/website.php?id=-1 UNION SELECT ALL version()--



SOLUTION:

Add something like below to prevent UNION SQL injection.

    $evil = "(delete)|(update)|(union)|(insert)|(drop)|(http)|(--)|(/*)|(select)";
    $patch = eregi_replace($evil, "", $patch);



2. Cross Site Scripting

Cross site scripting is a type of vulnerability used by hackers to inject code into vulnerable web pages. If the site is vulnerable to cross site scripting, most likely users will try to inject the site with malicious javascript or try to scam users by creating a form where users have to type their information in.

There are two types of XSS (cross site scripting) are persistent XSS and non-persistent XSS.


Example:
http://www.site.com/search.php?q=">


SOLUTION

        function RemoveBad(strTemp) {
            strTemp = strTemp.replace(/\<|\>|\"|\'|\%|\;|\(|\)|\&|\+|\-/g,"");
            return strTemp;
        }



3. File Inclusion
Types: Remote File Inclusion/Local File Inclusion, and Remote Code Execution

Remote File Inclusion allows a hacker to include a remote file through a script (usually PHP). This code is mostly patched on websites, but some websites are still vulnerable to the vulnerability. RFI usually leads to remote code execution or javascript execution.

Example of the vulnerable code:

    <?php
    include($_GET['page']);
    ?>

Exploiting would be something like as follows:
http://www.site.com/page.php?page=../../../../../etc/passwd or
http://www.site.com/page.php?page=http://www.site.com/xyz.txt?

SOLUTION:

    Validate the input.
    $page = $_GET['page'];
    $allowed = array('index.php', 'games.php' 'ip.php');
    $iplogger = ('ip.php');
    if (in_array $page, $pages)) {
    include $page {
    else
    {
    include $iplogger
    die("IP logged.");
    }


For remote code execution, the site would have to have a php executing command. You would patch this by about doing the same thing.

 Note: I hope this post will helpful for your website to get secure from above types of attacks.

Thursday, July 17, 2014

Type of attack on Web Based Application


 
[~]Sql Injection Attack
[~]Hibernate Query Language Injection
[~]Direct OS Code Injection
[~]XML Entity Injection
[~]Broken Authentication and Session Management
[~]Cross-Site Scripting (XSS)
[~]Insecure Direct Object References
[~]Security Misconfiguration
[~]Sensitive Data Exposure
[~]Missing Function Level Access Control
[~]Cross-Site Request Forgery (CSRF)
[~]Using Components with Known Vulnerabilities
[~]Unvalidated Redirects and Forwards
[~]Cross Site Scripting Attacks
[~]Clickjacking Attacks
[~]DNS Cache Poisoning
[~]Symlinking – An Insider Attack
[~]Cross Site Request Forgery Attacks
[~]Remote Code Execution Attacks
[~]Remote File inclusion
[~]Local file inclusion
[~]Evercookie
[~]Denial of Service Attack
[~]Cookie Eviction
[~]phpwn
[~]NAT Pinning
[~]XSHM
[~]MitM DNS Rebinding SSL/TLS Wildcards and XSS
[~]Quick Proxy Detection
[~]Improving HTTPS Side Channel Attacks
[~]Side Channel Attacks in SSL
[~]Turning XSS into Clickjacking
[~]Bypassing CSRF protections with ClickJacking and
[~]HTTP Parameter Pollution
[~]URL Hijacking
[~]Strokejacking
[~]Fooling B64_Encode(Payload) on WAFs and filters
[~]MySQL Stacked Queries with SQL Injection.
[~]Posting raw XML cross-domain
[~]Generic cross-browser cross-domain theft
[~]Attacking HTTPS with Cache Injection
[~]Tapjacking
[~]XSS-Track
[~]Next Generation Clickjacking
[~]XSSing client-side dynamic HTML.
[~]Stroke triggered XSS and StrokeJacking
[~]Lost in Translation
[~]Persistent Cross Interface Attacks
[~]Chronofeit Phishing
[~]SQLi filter evasion cheat sheet (MySQL)
[~]Tabnabbing
[~]UI Redressing
[~]Cookie Poisoning
[~]SSRF
[~]Bruteforce of PHPSESSID
[~]Blended Threats and JavaScript
[~]Cross-Site Port Attacks
[~]CAPTCHA Re-Riding Attack

Wednesday, July 16, 2014

32 Commands For Linux Users From All Levels!

Beginner Commands

1. find: Use this command when you need to search for files in a particular directory. It starts from the parent directory and then moves to the sub directories. The –name option makes the search case sensitive, while the –iname option searches irrespective of the case.

2. grep: You use the grep command in order to find lines in a particular file that match a given string or words.

3. man: The man command is used as the manual pager for the system. It brings online documentation for a particular command.

4. ps: This is the process command, which shows you the status of all the processes that are being run by a unique id, known as the PID.

5. kill: This command is used in order to kill a process that is not responding or is not being used. All you need is to known the process ID or PID. To find the process id, you need to run ps-A with the grep command (ps-A | grep processname).

6. whereis: When you need to locate the binary, sources and the manual page of a command you use the whereis command.

7. service: This is the command that is used in order to control the start, stop or restart function of a particular service. You do not have to restart your system in order to start, stop or restart the services.

8. alias: This is a built in shell command which is used in order to assign the name for a long command or for a frequently used command.

9. df: Use this command when you want to report the disk usage of a file system. It is quite useful for the user and also for the system admin.

10. rm: This command is used in order to remove complete files and directories from your system.

Intermediate Commands

1. find: Use this command when you need to search for files in a particular directory. It starts from the parent directory and then moves to the sub directories. The –name option makes the search case sensitive, while the –iname option searches irrespective of the case.

2. grep: You use the grep command in order to find lines in a particular file that match a given string or words.

3. man: The man command is used as the manual pager for the system. It brings online documentation for a particular command.

4. ps: This is the process command, which shows you the status of all the processes that are being run by a unique id, known as the PID.

5. kill: This command is used in order to kill a process that is not responding or is not being used. All you need is to known the process ID or PID. To find the process id, you need to run ps-A with the grep command (ps-A | grep processname).

6. whereis: When you need to locate the binary, sources and the manual page of a command you use the whereis command.

7. service: This is the command that is used in order to control the start, stop or restart function of a particular service. You do not have to restart your system in order to start, stop or restart the services.

8. alias: This is a built in shell command which is used in order to assign the name for a long command or for a frequently used command.

9. df: Use this command when you want to report the disk usage of a file system. It is quite useful for the user and also for the system admin.

10. rm: This command is used in order to remove complete files and directories from your system.

Advanced Commands

1. ifconfig: You will use the ifconfig command when you need to improve the kernel-resident network interfaces. The command is usually needed for system tuning and debugging, but it is also used during boot time in order to set up the interfaces.

2. netstat: This is an advanced command for Linux users that is used to display information related to the network. This includes information such as routing tables, network connections, masquerade connections, interface statistics and others.

3. nslookup: This command will be used when you need to find information about Internet servers. It finds you the name server information for the domains that are querying the DNS.

4. dig: The dig tool is used in order to query the DNS nameservers. If you need to find information on host addresses, mail exchanges, nameservers and other related information, then this is the tool for you. You can use the command from Linux and Mac OS X operating systems.

5. uptime: The uptime command is used in order to verify what all happened when a server has been left unattended. It is especially useful when you sit down in front of the server machine and see something gone awry.

6. wall: This command is used to send a message to all logged in users. You can only send the message to those with their message permission setting at ‘yes’ though. The message is given as an argument for the wall command.

7. mesg: Users can use the ‘write’ command in order to send messages to you. But as the server admin, you can use the mesg command in order to decide whether they can. You can choose from ‘n’ and ‘y’, which allow messages to not popup and popup on your screen respectively.

8. write: If the status for the ‘mesg’ command for a user is set to ‘y’ then the write command will allow you to send messages to that user.

9. talk: When a simple message is not enough, use the talk command to talk to users logged into the server.

10. w: This command is a combination of uptime and who commands, if they are given in that order and one after the other.

11. rename: When you need to rename certain specific files, the rename command comes in handy. This command renames files by replacing the first occurrence from that file.

12. top: Use this command in order to display the processes running in the CPU. The command will refresh automatically and keep displaying the processes until you use the interrupt command to stop it.


An SQL injection attack is a code injection attack that is used to exploit web applications and websites. It is one of the most common methods for hackers to get into your system. Learning such attacks are important for anyone looking to perform their own exploits. Here are 10 of the most powerful tools that aid in performing SQL Injection attacks.

1. BSQL Hacker
This is a useful tool for both experts and beginners that automates SQL Injection attacks on websites.

2. The Mole
This is an SQL Injection tool that uses the union technique or the boolean query-based technique.

3. Pangolin
This is a penetration testing tool developed by NOSEC. It is aimed at detecting and exploiting SQL injection vulnerabilities on websites.

4. Sqlmap
This is an open source penetration testing tool that security professionals can use. Like the BSQL Hacker tool, this one also automates SQL Injection attacks.

5. Havij
This is an automated SQL injection tool that can be used by penetration testers in order to detect vulnerabilities in web applications and exploit them.

6. Enema SQLi
This is a dynamic penetration testing tool for professionals. It is an auto-hacking software.

7. Sqlninja
This is a tool targeted at exploiting SQL injection vulnerabilities. It uses the Microsoft SQL server as its back end.

8. sqlsus
Written using the Perl programming language, this is an open source penetration testing tool for MySQL Injection and takeover.

9. Safe3 SQL Injector
This is a powerful penetration testing tool, which automates the process of detecting and exploiting SQL Injection vulnerabilities.

10. SQL Poizon
This tool includes php , asp , rfi , lf dorks that can be used for penetration testing.

Saturday, July 12, 2014

Hacker's Dictionary


Are you new to the realm of hacking?

Do you feel dumb when you don't know the meaning of a certain term?Well, then this will certainly help you out!If you are ever unsure about anything, simply scroll down and find that specific word, then read the definition.
Anything includes: Abbreviations, Phrases, Words, and Techniques.*The list is in alphabetical order for convenience!*


----------------------------------------------------------------------------------------------------------------------------------


Abbreviations


★ DDoS = Distributed Denial of Service

★ DrDoS = Distributed Reflected Denial of Service Attack, uses a list of reflection servers or other methods such as DNS to spoof an attack to look like it's coming from multiple ips. Amplification of power in the attack COULD occur.

★ FTP =File Transfer Protocol. Used for transferring files over an FTP server.

★ FUD = Fully Undetectable

★ Hex =In computer science, hexadecimal refers to base-16 numbers. These are numbers that use digits in the range: 0123456789ABCDEF. In the C programming language (as well as Java, JavaScript, C++, and other places), hexadecimal numbers are prefixed by a 0x. In this manner, one can tell that the number 0x80 is equivalent to 128 decimal, not 80 decimal.

★ HTTP =Hyper Text Transfer Protocol. The foundation of data communication for the World Wide Web.

★ IRC = Internet Relay Chat. Transmiting text messages in real time between online users.

★ JDB =Java drive-by, a very commonly used web-based exploit which allows an attacker to download and execute malicious code locally on a slave's machine through a widely known java vulnerability.

★ Malware =Malicious Software

★ Nix = Unix based operating system, usually refered to here when refering to DoS'ing.

★ POP3 =This is the most popular protocol for picking up e-mail from a server.

★ R.A.T = Remote Administration Tool

★ SDB = Silent drive-by, using a zero day web-based exploit to hiddenly and un-detectably download and execute malicious code on a slave's system. (similar to a JDB however no notification or warning is given to the user)

★ SE = Social Engineering

★ Skid =Script Kid/Script Kiddie

★ SMTP =A TCP/IP protocol used in sending and receiving e-mail.

★ SQL =Structured Query Language. It's a programming language, that used to communicate with databases and DBMS. Can go along with a word after it, such as "SQL Injection."

★ SSH =Secure Shell, used to connect to Virtual Private Servers.

★ TCP = Transmission Control Protocol, creates connections and exchanges packets of data.

★ UDP =User Datagram Protocol, An alternative data transport to TCP used for DNS, Voice over IP, and file sharing.

★ VPN =Virtual Private Network

★ VPS =Virtual Private Server

★ XSS (CSS) = Cross Site Scripting


Words


★Algorithm = A series of steps specifying which actions to take in which order.

★ANSI Bomb = ANSI.SYS key-remapping commands consist of cryptic-looking text that specifies, using ansi numeric codes to redefine keys.

★Back Door = Something a hacker leaves behind on a system in order to be able to get back in at a later time.

★Binary = A numbering system in which there are only two possible values for each digit: 0 and 1.

★Black Hat = A hacker who performs illegal actions to do with hacking online. (Bad guy, per se)

★Blue Hat =A blue hat hacker is someone outside computer security consulting firms who is used to bug test a system prior to its launch, looking for exploits so they can be closed. Microsoft also uses the term BlueHat to represent a series of security briefing events.

★Bot = A piece of malware that connects computer to an attacker commonly using the HTTP or IRC protocal to await malicous instructions.

★Botnet = Computers infected by worms or Trojans and taken over by hackers and brought into networks to send spam, more viruses, or launch denial of service attacks.

★Buffer Overflow = A classic exploit that sends more data than a programmer expects to receive. Buffer overflows are one of the most common programming errors, and the ones most likely to slip through quality assurance testing.

★Cracker = A specific type of hacker who decrypts passwords or breaks software copy protection schemes.

★DDoS = Distributed denial of service. Flooding someones connection with packets. Servers or web-hosted shells can send packets to a connection on a website usually from a booter.

★Deface =A website deface is an attack on a site that changes the appearance of the site or a certain webpage on the site.

★Dictionary Attack = A dictionary attack is an attack in which a cyber criminal can attempt to gain your account password. The attack uses a dictionary file, a simple list of possible passwords, and a program which fills them in. The program just fills in every single possible password on the list, untill it has found the correct one. Dictionary files usually contain the most common used passwords.

★DOX = Personal information about someone on the Internet usualy contains real name, address, phone number, SSN, credit card number, etc.

★E-Whore = A person who manipulates other people to believe that he/she is a beautiful girl doing cam shows or selling sexual pictures to make money.

★Encryption = In cryptography, encryption applies mathematical operations to data in order to render it incomprehensible. The only way to read the data is apply the reverse mathematical operations. In technical speak, encryption is applies mathematical algorithms with a key that converts plaintext to ciphertext. Only someone in possession of the key can decrypt the message.

★Exploit = A way of breaking into a system. An exploit takes advantage of a weakness in a system in order to hack it.

★FUD = Fully undetectable, can be used in many terms. Generally in combination with crypters, or when trying to infect someone.

★Grey Hat = A grey hat hacker is a combination of a Black Hat and a White Hat Hacker. A Grey Hat Hacker may surf the internet and hack into a computer system for the sole purpose of notifying the administrator that their system has been hacked, for example. Then they may offer to repair their system for a small fee.Hacker (definition is widely disputed among people...) = A hacker is someone who is able to manipulate the inner workings of computers, information, and technology to work in his/her favor.

★Hacktivist = A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious, or political message. In general, most hacktivism involves website defacement or denial-of-service attacks.

★IP Address = On the Internet, your IP address is the unique number that others use to send you traffic.

★IP Grabber = A link that grabs someone's IP when they visit it.

★Keylogger = A software program that records all keystrokes on a computer's keyboard, used as a surveillance tool or covertly as spyware.Leach = A cultural term in the warez community referring to people who download lots of stuff but never give back to the community.

★LOIC/HOIC = Tool(s) used by many anonymous members to conduct DDoS attacks. It is not recommended to use these under any circumstances.

★Malware =Software designed to do all kinds of evil stuff like stealing identity information, running DDoS attacks, or soliciting money from the slave.

Neophyte = A neophyte, "n00b", or "newbie" is someone who is new to hacking or phreaking and has almost no knowledge or experience of the workings of technology, and hacking.

★smith = Somebody new to a forum/game.

★OldFag = Somebody who's been around a forum/game for a long time.

★Packet = Data that is sent across the Internet is broken up into packets, sent individually across the network, and reassembled back into the original data at the other end.

★Phreak =Phone Freaks. Hackers who hack cell phones for free calling. Free Long distance calling. Etc.

★Phreaking = The art and science of cracking the phone network.

★Proxy = A proxy is something that acts as a server, but when given requests from clients, acts itself as a client to the real servers.

★Rainbow Table = A rainbow table is a table of possible passwords and their hashes. It is way faster to crack a password using rainbow tables then using a dictionary attack (Bruteforce).

★Remote Administration Tool =A tool which is used to remotely control (an)other machine(s). These can be used for monitoring user actions, but often misused by cyber criminals as malware, to get their hands on valuable information, such as log in credentials.

★Resolver =Software created to get an IP address through IM (instant messenger, like Skype/MSN) programs.

★Reverse Engineering = A technique whereby the hacker attempts to discover secrets about a program. Often used by crackers, and in direct modifications to a process/application.

★Root = Highest permission level on a computer, able to modify anything on the system without restriction.

★Rootkit (ring3 ring0) =A powerful exploit used by malware to conceal all traces that it exists. Ring3 - Can be removed easily without booting in safemode. Ring0 - Very hard to remove and very rare in the wild, these can require you to format, it's very hard to remove certain ring0 rootkits without safemode.

★Script Kiddie = A script kid, or skid is a term used to describe those who use scripts created by others to hack computer systems and websites. Used as an insult, meaning that they know nothing about hacking.

★Shell = The common meaning here is a hacked web server with a DoS script uploaded to conduct DDoS attacks via a booter. OR A shell is an script-executing unit - Something you'd stick somewhere in order to execute commands of your choice.

★Social Engineer = Social engineering is a form of hacking that targets people's minds rather than their computers. A typical example is sending out snail mail marketing materials with the words "You may already have won" emblazoned across the outside of the letter. As you can see, social engineering is not unique to hackers; it's main practitioners are the marketing departments of corporations.

★Spoof = The word spoof generally means the act of forging your identity. More specifically, it refers to forging the sender's IP address (IP spoofing). (Spoofing an extension for a RAT to change it from .exe to .jpg, etc.)

★SQL Injection =An SQL injection is a method often used to hack SQL databases via a website, and gain admin control (sometimes) of the site. You can attack programs with SQLi too.

★Trojan = A Trojan is a type of malware that masquerades as a legitimate file or helpful program with the ultimate purpose of granting a hacker unauthorized access to a computer.

★VPS = The term is used for emphasizing that the virtual machine, although running in software on the same physical computer as other customers' virtual machines, is in many respects functionallyequivalent to a separate physical computer, is dedicated to the individual customer's needs, has the privacy of a separate physical computer, and can be configured to run server software.

★Warez = Software piracy

★White Hat = A "white hat" refers to an ethical hacker, or a computer security expert, who specializes in penetration testing and in other testing methods to ensure the security of a businesses information systems. (Good guy, per se)

★Worm = Software designed to spread malware with little to no human interaction.

Zero Day Exploit = An attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability. This means that the developers have had zero days to address and patch the vulnerability.

Hope we helped the new learners..............

Tuesday, April 8, 2014

When you first turn on you computer (BEFORE DIALING INTO YOUR ISP),
open a MS-DOS Prompt window (start/programs MS-DOS Prompt).
Then type netstat -arn and press the Enter key.
Your screen should display the following (without the dotted lines
which I added for clarification).

-----------------------------------------------------------------------------
Active Routes:

  Network Address          Netmask  Gateway Address        Interface  Metric
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
  255.255.255.255  255.255.255.255  255.255.255.255          0.0.0.0      1

Route Table

Active Connections

  Proto  Local Address          Foreign Address        State

--------------------------------------------------------------------------------

If you see anything else, there might be a problem (more on that later).
Now dial into your ISP, once you are connected;
go back to the MS-DOS Prompt and run the same command as before
netstat -arn, this time it will look similar to the following (without
dotted lines).

-------------------------------------------------------------------------------------

Active Routes:

  Network Address          Netmask  Gateway Address        Interface  Metric
          0.0.0.0          0.0.0.0    216.1.104.70    216.1.104.70      1
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
      216.1.104.0    255.255.255.0    216.1.104.70    216.1.104.70      1
    216.1.104.70  255.255.255.255        127.0.0.1        127.0.0.1      1
    216.1.104.255  255.255.255.255    216.1.104.70    216.1.104.70      1
        224.0.0.0        224.0.0.0    216.1.104.70    216.1.104.70      1
  255.255.255.255  255.255.255.255    216.1.104.70    216.1.104.70      1

Route Table

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    0.0.0.0:0              0.0.0.0:0              LISTENING
  TCP    216.1.104.70:137      0.0.0.0:0              LISTENING
  TCP    216.1.104.70:138      0.0.0.0:0              LISTENING
  TCP    216.1.104.70:139      0.0.0.0:0              LISTENING
  UDP    216.1.104.70:137      *:*      

--------------------------------------------------------------------------------

What you are seeing in the first section (Active Routes) under the heading of
Network Address are some additional lines. The only ones that should be there
are ones belonging to your ISP (more on that later). In the second section
(Route Table) under Local Address you are seeing the IP address that your ISP
assigned you (in this example 216.1.104.70).

The numbers are divided into four dot notations, the first three should be
the same for both sets, while in this case the .70 is the unique number
assigned for THIS session. Next time you dial in that number will more than
likely be different.

To make sure that the first three notation are as they should be, we will run
one more command from the MS-DOS window.
From the MS-DOS Prompt type tracert /www.yourispwebsite.com or .net
or whatever it ends in. Following is an example of the output you should see.

---------------------------------------------------------------------------------------

Tracing route to /www.motion.net [207.239.117.112]over a maximum of 30 hops:
1  128 ms  2084 ms  102 ms  chat-port.motion.net [216.1.104.4]
2  115 ms  188 ms  117 ms  chat-core.motion.net [216.1.104.1]
3  108 ms  116 ms  119 ms  www.motion.net [207.239.117.112]
Trace complete.

------------------------------------------------------------------------------------------

You will see that on lines with the 1 and 2 the first three notations of the
address match with what we saw above, which is a good thing. If it does not,
then some further investigation is needed.

If everything matches like above, you can almost breath easier. Another thing
which should you should check is programs launched during startup. To find
these, Click start/programs/startup, look at what shows up. You should be
able to recognize everything there, if not, once again more investigation is
needed.

-------------------------------------------------------------------------------------------

Now just because everything reported out like we expected (and demonstrated
above) we still are not out of the woods. How is this so, you ask? Do you use
Netmeeting? Do you get on IRC (Internet Relay Chat)? Or any other program
that makes use of the Internet. Have you every recieved an email with an
attachment that ended in .exe? The list goes on and on, basically anything
that you run could have become infected with a trojan. What this means, is
the program appears to do what you expect, but also does just a little more.
This little more could be blasting ebay.com or one of the other sites that
CNNlive was talking about.

What can you do? Well some anti-virus software will detect some trojans.
Another (tedious) thing is to start each of these "extra" Internet programs
one at a time and go through the last two steps above, looking at the routes
and connection the program uses. However, the tricky part will be figuring
out where to tracert to in order to find out if the addresses you see in
step 2 are "safe" or not. I should forewarn you, that running tracert after
tracert, after tracert might be considered "improper" by your ISP. The steps
outlined above may not work exactly as I have stated depending upon your ISP,
but with a true ISP it should work. Finally, this advise comes with NO
warranty and by following my "hints' you implicitly release me from ANY and
ALL liability which you may incur.


 Other options

Display protocol statistics and current TCP/IP network connections.
Netstat [-a] [-e] [-n] [-s] [-p proto] [-r] [intervals]

-a.. Display all connections and listening ports.
-e.. Display Ethernet statistics. This may be combined with the -s option.
-n.. Diplays address and port numbers in the numerical form.
-p proto..Shows connections for the protocol specified by proto; proto may be
TCP or UDP. If used with the -s option to display per-protocol statistics,
proto may be TCP, UDP, of IP.
-r.. Display the routing table.
-s.. Display per-protocol statistics. By default, statistics are shown for TCP
UDP and IP; the -p option may be used to specify a subset of the default
interval..Redisplay selected statistics, pausing intervals seconds between each
display. If omitted. netstat will print the current configuration information
once

Wednesday, April 2, 2014

 

Hacking & Security but Hacking is possible only when you're good in Programming. If you're champ in programming and Networking then Hacking is like a Piece of Cake for you, yeah it will take little long time, but it's really worthy.

Can I learn Hacking without Knowing Programming ?

Simply you can't, Listen guys daily I get many request to teach Hacking, Cracking, Defacing & Vulnerability hunting but basically I just tell them if you don't know Programming then you can't Hack anything, Yeah you can learn simple tricks, and some basic attacks only. But if you want to become Professional Hacker or Security Researcher then you'll have to become Champ in Programming and Networking. Guys Programming isn't too much hard just we need to concentrate and practice, practice & practice. If you'll understand Programming and Coding of Web-App, and Software then you'll simply understand weakness point of the App, You'll get to know HOW it works and you can create,explore, hack,learn and Earn.

Programming language is the base of Hacking, without Programming no one can learn Hacking, I mean Professional & Best Hacking methods like Vulnerability Hunting, Exploitation, Reverse Engineering, SQLi, XSS & Advance XSS methods etc.

So! How can I learn Programming ?

There're many ways to learn Programming languages, if you've passion in Hacking & Programming and you're Computer geek! then you can do it by yourself only : Yeah! you can use Google, E-books, Some Websites that teach us online Programming languages, or you can also learn in Group friendsJoin Classes.



What Should I learn ? to become Hacker ?

Well, this is our main Point of tutorial - So what should I learn ? First of all be passionate about Programming & Hacking. Trust in yourself & Be Passionate.

There are two fields in Hacking :

1. Web-Application Hacking
2. Software Cracking/Hacking

So, first of all make sure in which field you want to become best. If you'll ask me then I'll prefer you First Web Application Hacking & Programming, web Programming isn't too much Hard, you'll be able to understand Software Programming languages. Below is the Step by Step Languages Guide and Compulsory Programming languages for Hackers.

1. Web Application Hacking & Programming.

As you know that guys, Web Application are coded in different languages and methods using Advance Programming techniques and Codes, and if you'll learn all types of Web Programming and Coding then you'll be able to Hack it & find weakness point of Web App.

Important Programming languages for Hackers (Web App):
  •     HTML, JavaScript, & CSS (DHTML)
  •     PHP/ASP & SQL (Most Recommended - Server Side Scripting)
  •     Ajax, jQuery, & JSON - (Must know little bit)
  •     XML, DHTML.
  •     Networking - (TCP/IP, HTTP, SMPT, etc) Most recommended.
  •     Moving to advance stuffs like - (Python, C, Perl, and Ruby)


HTML is one of the famous and all time useful Web Programming languages, to develop website and contents it is strongly recommended you to learn HTML. Static and Dynamic generators. JavaScript and CSS is also useful for hackers to discover XSS flaws and Bypassing techniques.

PHP/ASP is strongly recommended you to learn because it is server side scripting languages. It's Dynamic Web-Apps Programming language. Now SQL, As you know that SQL Injection the technique of Injection attacks into DB, that can leak website sensitive data and also lead to Defacement. XML is also recommende to learn - Data transmission, SOAP technology etc.

AJAX, jQuery and JSON are lightweight fat client - programming languages, it's not highly recommended but you must know it's 50%.

Now Networking is also one of the mostly recommended thing you must learn. because without knowing it's flow, method, logic and Encoding/Decoding you won't understand how everything is going on. so the most important things you must know is - TCP/IP, SSL, HTTP, SMPT, Proxies and Other Protocols.

Unfortunately even i've not moved to advance stuffs like Python, Perl - Writing exploits, so no experience or knowledge. I'm still on programming, but i'll definitely post in future about Advance Scripting and writing Exploits.

2. Software Cracking/Hacking & Programming.

Okay! so now Software Cracking, Hacking & Programming is also very useful in Computer Hacking & Cracking Field. #Reverse Engineering, #Network, Adatpter, Wifi Cracking & Hacking, #Software Cracking #Virus #Trojan #Malware and etc methods used to hack , #Software and #Secret Service Information.

What you must know ?

  •     C Programmming
  •     C++
  •     Python
  •     UNIX/Linux
  •     VB & .Net
  •     Assembly Language (Most Important for Cracking & Hacking)
 

 Seven things you must know to become Hacker
  •     Right Definition & Meaning of Hacker.
  •     You must have Hacker Attitude & Confidence.
  •     Programming & Networking, (The Main thing beginner must know).
  •     Learn Networking, Linux, Start use Backtrack/Linux.
  •     Create Penetration testing lab and try to Hack it.
  •     Never Give-up in Hacking - (Always remember there is always a way).
  •     Stop Requesting Hackers to teach Hacking or (Hack for me).

Right Definition & Meaning of Hacker
                            
You know guys, beginners, lamers and noobs think to Hack facebook account, they just learn Phishing, key-logging, Sniffing and some small tricks & techniques to steal passwords- But seriously that isn't a Hacking, That's a stealing method. Let's learn the real meaning of Hacker.

Hacker : A hacker is the one who search for vulnerabilities & flaws (weakness point of Web-Application or Software) and exploit it with different techniques and hack it or report it. There are only five purpose of hackers : Learn, Earn, Protest, Publicity, & Challenge. Simply hacker is awesome.

You must have an Hacker Attitude & Confidence

Hacker must have an attitude to break anything with their knowledge, talent & Experience. I saw that many people's says - I'll learn all Programming languages to become Hacker, but the fact is they give up and start believing, I don't need to learn Programming I can hack directly via exploits and small techniques!, but it's simply impossible. Even I too accept learning programming is not easy, but it ain't hard also. You must have confidence and an attitude to do something at any how condition, think like hacker - try to know how stuffs work ? think different from all, Be quite and Simply awesome guy with an attitude of ability to do something. Believe in what you see, feel and be the tech lover, just Program and Keep Calm - Never GIVE UP. Try to learn all types of Computer Technology start with Basic and go step by step! Feel like hacker, Make contacts with hackers and crackers.

Stop Requesting Hackers to teach Hacking or (Hack for me plz), this is very bad method learners use to talk with hackers, then only hackers understand that you're lamer and noob - After that he doesn't like to talk with you.
Learn by yourself or Join Hacking Institutes :

  •     CEH     :  Certified Ethical Hacker.
  •     CHFI    :  Computer Hacking Forensics Investigation.
  •     CCNA   :  Cisco Certified Networking Associate.
  •     CISSP  :  Certified Information System Security Professional.
  •     CCSN   : Certified Cyber Security Ninja.

Learn Programming

The main problem of all learners, beginners is that they don't want to learn Programming - I know it's hard but if you once stepped never look back and always remember that "Beginning part is always Hard!", Nothing is impossible. Go step-by-step in Programming field, Don't start with Hard parts.

Click here to know : Important Programming languages for Hackers.
Programming is the solution of all problems that learners faces in hacking, coding and learning. Programming is the source, base and the main point of Computer Application or Web Application.


- Without Learning Programming & Networking you cannot Hack anything.

Other Tips and Learning methods :

  •     Learn Networking.
  •     Learn Backtracking, Switch to Linux from Windows
  •     Always create Penetration testing lab and Penetrate yourself against web-app and some software
  •     Be Confident, Learn Programming as much as you can.

Saturday, March 29, 2014

Change your IP in just a minute

How to Change Your IP Address In Less Then 1 Minute

1. Click on "Start" in the bottom left hand corner of screen
2. Click on "Run"
3. Type in "command" and hit ok

You should now be at an MSDOS prompt screen.

4. Type "ipconfig /release" just like that, and hit "enter"
5. Type "exit" and leave the prompt
6. Right-click on "Network Places" or "My Network Places" on your desktop.
7. Click on "Properties"

You should now be on a screen with something titled "Local Area Connection", or something close to that, and, if you have a network hooked up, all of your other networks.

8. Right click on "Local Area Connection" and click "Properties"
9. Double-click on the "Internet Protocol (TCP/IP)" from the list under the "General" tab
10. Click on "Use the following IP address" under the "General" tab
11. Create an IP address (It doesn't matter what it is. I just type 1 and 2 until i fill the area up).
12. Press "Tab" and it should automatically fill in the "Subnet Mask" section with default numbers.
13. Hit the "Ok" button here
14. Hit the "Ok" button again

You should now be back to the "Local Area Connection" screen.

15. Right-click back on "Local Area Connection" and go to Properties again.
16. Go back to the "TCP/IP" settings
17. This time, select "Obtain an IP address automatically"
18. Hit "Ok"
19. Hit "Ok" again
20. You now have a new IP address

With a little practice, you can easily get this process down to 20 seconds.

P.S: This only changes your dynamic IP address, not your ISP/IP address. With a little effort, this can be traced.

Thursday, March 27, 2014


Android Malware 'Dendroid' targeting Indian Users 


Wednesday, March 26, 2014

 Lead


Hacking, the art of writing computer code, and manipulating computer hardware has traditionally kept men at the top of the field, and that is why many are surprised to hear that there are a handful of women that have found a place in this world. It remains an evolving, multi-billion dollar industry as some hackers are often blamed for causing irreparable damage while others are simultaneously credited for some of the biggest breakthroughs in technology. No matter what a hacker may be, they are known for their resourcefulness and their knowledge of complex theory, so here is a closer look at ten of the most notorious female hackers and the impact that they have had on the world.

1. Susan Headley

thunder.jpg
Susan Headley was a hacker in the 1970's and early 1980's who went by the name "Susan Thunder." She was one of the most well known and successful female hackers of her time, and is still held in high regard in hacker history. She was a member of the hacking group Cyberpunks and was most known for her use of social engineering skills in order to hack into organizations. Thunder began her use of social engineering in the early 1970's to get backstage passes to concerts by pretending to be someone important or close to the band. This led her to become a very well practiced Phreaker at the end of the 1970's since she had already mastered the art of social engineering and manipulating people. She later met up with Ron and Kevin Mitnick, who were both already established hackers of the time. Soon after, Thunder began to specialize in attacking military computer systems. She also used her "abilities" as a woman, such as sleeping with guards to certain companies in order to gain access to information, to demonstrate that female hackers could do things in order to reach their objectives that male hackers could not. Thunder said this "gave her a sense of power" over men and over the organizations she would hack into. She was later suspected in setting up Ron and Kevin Mitnick to get caught by the police, but the police made a deal with her. She witnessed against the two men and both Ron and Kevin were sent to jail for the hacking job. Thunder became an expert in the art of hacking and was considered a "security expert" on military issues due to her access and experience from hacking into military computers. Later, in the mid 90's, Thunder was elected into public office in California as a City Clerk.

2. Gigabyte
Kimberly Vanvaeck a.k.a Gigabyte is a female Belgian who was credited for writing the first ever C# virus which she called 'Sharpei'. She was 17 at that time when she released Sharpei, which is designed to infect computers loaded with the .Net framework. The worm appears in an e-mail with the subject line "Important: Windows update" and the following message attached:


https://www.soldierx.com/system/files/hdb/kimberley2.jpg
  • "Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I should forward it as you may like it."
  • If the attachment is opened, then the worm uses the Outlook address book to send messages--with a copy of the virus attached--to every address in the book. It then deletes the e-mails from the sent folder and removes the copy of itself.
    She lives mostly in Belgium, Brussels, but sometimes she still go home to the town where she was raised, near Mechlin. She recently graduated as a Master of Industrial Sciences (Industrial Engineer) in Electronics-ICT. Before that, she also did a Bachelor in Applied Computer Sciences. Now she works as an advisor in IT, at Erasmushogeschool Brussel.
    Facts
    A female virus writer with a penchant for media attention.
    She was arrested by the Belgian Police a few years ago after she was discovered for creating the worm.
    She is also well known for frequent run-ins with ubiquitous AV spokesman Graham Cluley over his sociological analysis of virus writers.
    During her last year of Bachelor in Applied Computer Sciences, she went to Hanoi, Vietnam, to participate in a project on Multilayer Traffic Engineering, for her final work


    3. Kristina Vladimirovna Svechinskaya
    6-Kristina-Vladimirovna-Svechinskaya
    Without question, Krisina Svechinskaya remains one of the most well-known names in hacking. This Russian hacker is also a top-notch New York University student, but most will recognize her fr
    om a string of high-end hacking jobs that have potentially resulted in millions of dollars lost. Specializing in the use of Trojan horses, Svechinskaya attacked thousands of bank accounts, most within the United States, and then created a series of fake accounts through both Bank of America and Wachovia. She then utilized nine other people to create fake passports, but was finally caught and is now under threat of multiple charges. Overall, some authorities estimate that she stole $3 million in as little as a few months.


    4. Xiao Tian
    After feeling female hackers had little outlet for their interest in technology, Xiao Tian created the renowned hacking group China Girl Security Team. Still a teenager, Tian quickly expanded the group to just over 2,200 members, all of which were female girls looking for a community in which they would feel welcome. This female hacking organization now has ties to some of the most infamous hacking groups throughout the world and has become one of the largest Chinese-based hacking groups. As with most well-known and outspoken groups of this nature, Xiao Tian and the rest of China Girl Security Team continue to receive attention from national and international police organizations due to their activities.


    5. Raven Adler
    10-Raven-AdlerOften recognized as one of the most gifted and intelligent hackers in the world, Raven Adler graduated high school at just 14 and got her college degree at 18. As a frequent speaker at hacking and software conferences, Adler was also the first female to ever give a presentation at DefCon, one of the world’s most prestigious gathering of hackers. When asked about her appearance at DefCon, she often replies that she would like to be known for her work, not for being a female in the field. Currently, Adler specializes in

    securing data from end-to-end, and this has made her invaluable to both private and public organizations looking to protect sensitive information. She now works as a senior security consultant for a number of companies and continues to give lectures and regularly publish her work in industry magazines. She also works closely alongside a number of federal firms in an effort to secure their online databases.

    Tuesday, March 25, 2014

     Basic Things needed to become a Hacker

    Many noobs in the hacking world are confused what should they do to stat their carrier. So, in short it is discussed here:

    What are the things that you need to become a hacker?

    1. Programming Knowledge:

    * C/C++
    *Web designing (HTML/CSS,Javascript,PHP,etc)
    *Visual Basic
    *VBscript,Batch file programming,Autohotkey script
    writing.

    2. Basic Networking Knowledge:

    * Understanding of various networking protocols (TCP/
    IP,HTTP,etc)
    *Different forms of network encryption
    *Understanding of packets.

    3. Experience with UNIX / LINUX Operating Systems.

    4. Ability to think like a Criminal

    Sunday, March 23, 2014

    The Hacker Attitude

     

    1. The world is full of fascinating problems waiting to be solved.
    2. No problem should ever have to be solved twice.
    3. Boredom and drudgery are evil.
    4. Freedom is good.
    5. Attitude is no substitute for competence.

    Hackers solve problems and build things, and they believe in freedom and voluntary mutual help. To be accepted as a hacker, you have to behave as though you have this kind of attitude yourself. And to behave as though you have the attitude, you have to really believe the attitude. But if you think of cultivating hacker attitudes as just a way to gain acceptance in the culture, you'll miss the point. Becoming the kind of person
    who believes these things is important for you — for helping you learn and keeping you motivated. As with all creative arts, the most effective way to become a master is to imitate the mind-set of masters — not just intellectually but emotionally as well. Or, as the following modern Zen poem has it:
    To follow the path:
    look to the master,
    follow the master,
    walk with the master,
    see through the master,
    become the master.

    So, if you want to be a hacker, repeat the following things until you believe
    them:

    1. The world is full of fascinating problems waiting to be solved.

    Being a hacker is lots of fun, but it's a kind of fun that takes lots of effort. The effort takes motivation. Successful athletes get their motivation from a kind of physical delight in making their bodies perform, in pushing themselves past their own physical limits. Similarly, to be a hacker you have to get a basic thrill from solving problems, sharpening your skills, and exercising your intelligence. If you aren't the kind of person that feels this way naturally, you'll need to become one in order to make it as a hacker. Otherwise you'll find your
    hacking energy is sapped by distractions like sex, money, and social approval. (You also have to develop a kind of faith in your own learning capacity — a belief that even though you may not know all of what you need to solve a problem, if you tackle just a piece of it and learn from that, you'll learn enough to solve the next piece — and so on, until you're done.)
     

    2. No problem should ever have to be solved twice.

    Creative brains are a valuable, limited resource. They shouldn't be wasted on re-inventing the wheel when there are so many fascinating new problems waiting out there. To behave like a hacker, you have to believe that the thinking time of other hackers is precious — so much so that it's almost a moral duty for you to share
    information, solve problems and then give the solutions away just so other hackers can solve new problems instead of having to perpetually re-address old ones. Note, however, that "No problem should ever have to be solved twice." does not imply that you have to consider all existing solutions sacred, or that there is only one right solution to any given problem. Often, we learn a lot about the problem that we didn't know before by studying the first cut at a solution. It's OK, and often necessary, to decide that we can do better. What's not OK is artificial technical, legal, or institutional barriers (like closed-source code) that prevent a good solution from being re-used and force people to re-invent wheels. (You don't have to believe that you're obligated to give all your creative product away, though the hackers that do are the ones that get most respect from other hackers. It's consistent with hacker values to sell enough of it to keep you in food and rent and computers. It's fine to use your hacking skills to support a family or even get rich, as long as you don't forget your loyalty to your art and your fellow hackers while doing it.)
     

    3. Boredom and drudgery are evil.

    Hackers (and creative people in general) should never be bored or have to drudge at stupid repetitive work, because when this happens it means they aren't doing what only they can do — solve new problems. This wastefulness hurts everybody. Therefore boredom and drudgery are not just unpleasant but
    actually evil. To behave like a hacker, you have to believe this enough to want to automate away the boring bits as much as possible, not just for yourself but for everybody else (especially other hackers). (There is one apparent exception to this. Hackers will sometimes do things that may seem repetitive or boring to an observer as a mind-clearing exercise, or in order to acquire a skill or have some particular kind of experience you can't have otherwise. But this is by choice — nobody who can think should ever be forced into a situation that bores them.)

    4. Freedom is good.

    Hackers are naturally anti-authoritarian. Anyone who can give you orders can stop you from solving whatever problem you're being fascinated by — and, given the way authoritarian minds work, will generally find some appallingly stupid reason to do so. So the authoritarian attitude has to be fought wherever you find it, lest it smother you and other hackers. (This isn't the same as fighting all authority. Children need to be guided and criminals restrained. A hacker may agree to accept some kinds of authority in order to get something he wants more than the time he spends following orders. But that's a limited, conscious bargain; the kind of personal surrender authoritarians want is not on offer.) Authoritarians thrive on censorship and secrecy. And they distrust voluntary cooperation and information-sharing — they only like ‘cooperation’ that they control. So to behave like a hacker, you have to develop an instinctive hostility to censorship, secrecy, and the use of force or deception to compel responsible adults. And you have to be willing to act on that belief.
     

    5. Attitude is no substitute for competence.

    To be a hacker, you have to develop some of these attitudes. But copping an attitude alone won't make you a hacker, any more than it will make you a champion athlete or a rock star. Becoming a hacker will take intelligence, practice, dedication, and hard work. Therefore, you have to learn to distrust attitude and respect competence of every kind. Hackers won't let posers waste their time, but they worship competence — especially competence at hacking, but competence at anything is valued. Competence at demanding skills that few can master is especially good, and competence at demanding skills that involve mental acuteness, craft, and concentration is best. If you revere competence, you'll enjoy developing it in yourself — the hard work and dedication will become a kind of intense play rather than drudgery. That attitude is vital to becoming a hacker.

    Saturday, March 22, 2014


    Introduction to TCP/IP.

     

    That means packets! Datagrams! Ping oversize packet denial of service exploit explained. But this hack is a lot less mostly harmless than most. Don't try this at home...
    ____________________________________________________________

    If you have been on the Happy Hacker list for a while, you've been getting some items forwarded from the Bug traq list on a new ping packet exploit.
    Now if this has been sounding like gibberish to you, relax. It is really very simple. In fact, it is so simple that if you use Windows 95, by the time you finish this article you will know a simple, one-line command that you could use to crash many Internet hosts and routers.
    *************************************************

    YOU CAN GO TO JAIL WARNING: This time I'm not going to implore the wannabe evil genius types on this list to be virtuous and resist the temptation to misuse the information I'm about to give them. See if I care! If one of those guys gets caught crashing thousands of Internet hosts and routers, not only will they go to jail and get a big fine. We'll all think he or she is a dork. This exploit is a no-brainer, one-line command from Windows 95. Yeah, the operating system that is designed for clueless morons. So there is nothing elite about this hack. What is elite is being able to thwart this attack.
    **************************************************

    **************************************************
    NEWBIE NOTE: If packets, datagrams, and TCP/IP aren't exactly your bosom buddies yet, believe me, you need to really get in bed with them in order to call yourself a hacker. So hang in here for some technical stuff. When
    we are done, you'll have the satisfaction of knowing you could wreak havoc on the Internet, but are too elite to do so.
    A packet is a way to send information electronically that keeps out errors. The idea is that no transmission technology is perfect. Have you ever played the game "telephone"? You get a dozen or so people in a circle and the first person whispers a message to the second. Something like "The bun is the lowest form of wheat." The second person whispers to the third, "A bum is the lowest form of cheating." The third whispers, "Rum is the lowest form of
    drinking." And so on. It's really fun to find out how far the message can mutate as it goes around the circle.
    But when, for example, you get email, you would prefer that it isn't messed up. So the computer that sends the email breaks it up into little pieces called datagrams. Then it wraps things around each datagram that tell what
    computer it needs to go to, where it came from, and that check whether the datagram might have been garbled. These wrapped up datagram packages are called "packets."
    Now if the computer sending email to you were to package a really long message into just one packet, chances are pretty high that it will get messed up while on its way to the other computer. Bit burps. So when the receiving computer checks the packet and finds that it got messed up, it
    will throw it away and tell the other computer to send it again. It could take a long time until this giant packet gets through intact.
    But if the message is broken into a lot of little pieces and wrapped up into bunches of packets, most of them will be good and the receiving computer will keep them. It will then tell the sending computer to retransmit just the packets that messed up. Then when all the pieces finally get there, the receiving computer puts them together in the right order and lo and behold, there is the complete, error-free email.
    TCP/IP stands for Transmission Control Protocol/Internet Protocol. It tells computers that are hooked up to the Internet how to package up messages into packets and how to read packets these packets from other computers. Ping uses TCP/IP to make its packets.
    ********************************************** 

    "Ping" is a command that sends a feeler out from your computer to another computer to see if it is turned on and hooked to the same network you are on. On the Internet there are some ten million computers that you can ping.
    Ping is a command you can give, for example, from the Unix, Windows 95 and Windows NT operating systems. It is part of the Internet Control Message Protocol (ICMP), which is used to troubleshoot TCP/IP networks. What it does is tell a remote computer to echo back a ping. So if you get your ping
    back, you know that computer is alive. Furthermore, some forms of the ping command will also tell you how long it takes for a message to go out to that computer and come back again.
    But how does your computer know that the ping it just sent out actually echoed back from the targeted computer? The datagram is the answer. The ping sent out a datagram. If the returning ping holds this same datagram, you know it was your ping that just echoed back.
    The basic format of this command is simply:
    ping hostname
    where "hostname" is the Internet address of the computer you want to check out.
    When I give this command from Sun Release 4.1 Unix, I get the answer "hostname is alive."
    ************************************** 

    TECHNICAL TIP: Because of the destructive powers of ping, many Internet Service Providers hide the ping program in their shell accounts where clueless newbies can't get their hands on it. If your shell account says "command not found" when you enter the ping command, try:
    /usr/etc/ping hostname
    If this doesn't work, either try the command “whereis ping” or complain to your ISP's tech support. They may have ddiabled ping for ordinary users, but if you convince tech support you are a good Internet citizen they may let you use it.
    *************************************** 

    ****************************************
    NEWBIE NOTE: You say you can't find a way to ping from your on-line service? That may be because you don't have a shell account. But there is one thing you really need in order to hack: A SHELL ACCOUNT!!!!
    The reason hackers make fun of people with America Online accounts is because that ISP doesn't give out shell accounts. This is because America Online wants you to be good boys and girls and not hack!
    A "shell account" is an Internet account in which your computer becomes a terminal of one of your ISP's host computers. Once you are in the "shell" you can give commands to the operating system (which is usually Unix) just
    like you were sitting there at the console of one of your ISP's hosts.
    You may already have a shell account but just not know how to log on to it. Call tech support with your ISP to find out whether you have one, and how to get on it.
    *************************************** 

    There are all sorts of fancy variations on the ping command. And, guess what, whenever there is a command you give over the Internet that has lots of variations, you can just about count on there being something hackable in there. Muhahaha!
    The flood ping is a simple example. If your operating system will let you get away with giving the command:
    -> ping -f hostname
    it sends out a veritable flood of pings, as fast as your ISP's host machine can make them. This keeps the host you've targeted so busy echoing back your pings that it can do little else. It also puts a heavy load on the network.
    Hackers with primitive skill levels will sometimes get together and use several of their computers at once to simultaneously ping some victim's Internet host computer. This will generally keep the victim's computer too
    busy to do anything else. It may even crash. However, the down side (from the attackers' viewpoint) is that it keeps the attackers' computers tied up, too.
    ************************************** 

    NETIQUETTE NOTE: Flood pinging a computer is extremely rude. Get caught doing this and you will be lucky if the worst that happens is your on-line service provider closes your account. Do this to a serious hacker and you may need an identity transplant.
    If you should start a flood ping kind of by accident, you can shut it off by holding down the control key and pressing "c" (control-c).
    ************************************** 

    *************************************
    EVIL GENIUS TIP: Ping yourself! If you are using some sort of Unix, your operating system will let you use your computer to do just about anything to itself that it can do to other computers. The network address that takes you back to your own host computer is localhost (or 127.0.0.1).

    Add me on Facebook Follow me on Twitter!