Saturday, June 11, 2016
TSGrinder – Brute Force Terminal Services Server
This is a tool that has been around quite some time too, it’s still
very useful though and it’s a very niche tool specifically for brute
forcing Windows Terminal Server.
TSGrinder is the first production Terminal Server brute force tool, and is now in release 2. The main idea here is that the Administrator account, since it cannot be locked out for local logons, can be brute forced. And having an encrypted channel to the TS logon process sure helps to keep IDS from catching the attempts.
TSGringer is a “dictionary” based attack tool, but it does have some interesting features like “l337” conversion, and supports multiple attack windows from a single dictionary file. It supports multiple password attempts in the same connection, and allows you to specify how many times to try a
username/password combination within a particular connection.
You can download TSGrinder 2.0.3 here:
tsgrinder-2.03.zip
Note that the tool requires the Microsoft Simulated Terminal Server Client tool, “roboclient,” which may be found here:
roboclient.zip
Or read more here.
http://www.darknet.org.uk/2008/07/tsgrinder-brute-force-terminal-services-server/
TSGrinder is the first production Terminal Server brute force tool, and is now in release 2. The main idea here is that the Administrator account, since it cannot be locked out for local logons, can be brute forced. And having an encrypted channel to the TS logon process sure helps to keep IDS from catching the attempts.
TSGringer is a “dictionary” based attack tool, but it does have some interesting features like “l337” conversion, and supports multiple attack windows from a single dictionary file. It supports multiple password attempts in the same connection, and allows you to specify how many times to try a
username/password combination within a particular connection.
You can download TSGrinder 2.0.3 here:
tsgrinder-2.03.zip
Note that the tool requires the Microsoft Simulated Terminal Server Client tool, “roboclient,” which may be found here:
roboclient.zip
Or read more here.
http://www.darknet.org.uk/2008/07/tsgrinder-brute-force-terminal-services-server/
RainbowCrack
http://project-rainbowcrack.com/
Introduction
RainbowCrack is a general propose implementation of Philippe Oechslin's faster time-memory trade-off technique. It crack hashes with rainbow tables.RainbowCrack uses time-memory tradeoff algorithm to crack hashes. It differs from brute force hash crackers.
A brute force hash cracker generate all possible plaintexts and compute the corresponding hashes on the fly, then compare the hashes with the hash to be cracked. Once a match is found, the plaintext is found. If all possible plaintexts are tested and no match is found, the plaintext is not found. With this type of hash cracking, all intermediate computation results are discarded.
A time-memory tradeoff hash cracker need a pre-computation stage, at the time all plaintext/hash pairs within the selected hash algorithm, charset, plaintext length are computed and results are stored in files called rainbow table. It is time consuming to do this kind of computation. But once the one time pre-computation is finished, hashes stored in the table can be cracked with much better performance than a brute force cracker.
In this project, we focus on the development of optimized time-memory tradeoff implementation. GPU acceleration is another key feature of RainbowCrack software. By offloading most runtime computation to NVIDIA/AMD GPU, overall hash cracking performance can be improved further.
Several TB of generated rainbow tables for LM, NTLM, MD5 and SHA1 hash algorithms are listed in this page.
Download
Features of RainbowCrack Software
- Full time-memory tradeoff tool suites, including rainbow table generation, sort, conversion and lookup
- Support rainbow table of any hash algorithm
- Support rainbow table of any charset
- Support rainbow table in raw file format (.rt) and compact file format (.rtc)
- Computation on multi-core processor support
- GPU acceleration with NVIDIA GPUs (CUDA technology)
- GPU acceleration with AMD GPUs (OpenCL technology)
- GPU acceleration with multiple GPUs
- Runs on Windows operating systems
- Runs on Linux operating systems
- Unified rainbow table file format on all supported operating systems
- Command line user interface
- Graphics user interface
Download RainbowCrack
RainbowCrack 1.6.1 is released on April 25, 2015.We strongly recommend 64-bit version of the software. As no more than 2 GB memory can be used by 32-bit application.
| Version | Software | Operating System | GPU Acceleration | |
|---|---|---|---|---|
| 1.6.1 |  | rainbowcrack-1.6.1-win32.zip | Windows 7/8 32-bit |   |
| rainbowcrack-1.6.1-win64.zip | Windows 7/8 64-bit | |||
 | rainbowcrack-1.6.1-linux32.zip | Linux 32-bit (x86) | No | |
| rainbowcrack-1.6.1-linux64.zip | Linux 64-bit (x86_64) | |||
| 1.6 | | rainbowcrack-1.6-win32.zip | Windows XP/Vista/7/8 32-bit | |
| rainbowcrack-1.6-win64.zip | Windows XP/Vista/7/8 64-bit | |||
| rainbowcrack-1.6-linux32.zip | Linux 32-bit (x86) | No | |
| rainbowcrack-1.6-linux64.zip | Linux 64-bit (x86_64) | |||
| 1.5 | | rainbowcrack-1.5-win32.zip | Windows XP/Vista/7/8 32-bit | No |
| rainbowcrack-1.5-win64.zip | Windows XP/Vista/7/8 64-bit | |||
| rainbowcrack-1.5-linux32.zip | Linux 32-bit (x86) | No | |
| rainbowcrack-1.5-linux64.zip | Linux 64-bit (x86_64) |
Friday, June 10, 2016
password Dumper pwdump7 ( v7.1 )
Introduction
We have developed a new password dumper for windows named PWDUMP7. The main difference between pwdump7 and other pwdump tools is that our tool runs by extracting the binary SAM and SYSTEM File from the Filesystem and then the hashes are extracted. For that task Rkdetector NTFS and FAT32 filesystem drivers are used.
Details
Usage Information: Pwdump v7.1 - raw password extractor
Author: Andres Tarasco Acuna
url: http://www.514.es
usage:
pwdump7.exe (Dump system passwords)
pwdump7.exe -s
pwdump7.exe -d
pwdump7.exe -h (Show this help)
Note that this tool can only used against SAM and SYSTEM Files. Active directory passwords are stored in the ntds.dit file and currently the stored structure is unknown.
Download pwdump (Windows executable)
http://www.tarasco.org/security/pwdump_7/
XSS Attack Examples (Cross-Site Scripting Attacks)
XSS stands for Cross Site Scripting.
XSS is very similar to SQL-Injection. In SQL-Injection we exploited the vulnerability by injecting SQL Queries as user inputs. In XSS, we inject code (basically client side scripting) to the remote server.
Types of Cross Site Scripting
XSS attacks are broadly classified into 2 types:- Non-Persistent
- Persistent
1. Non-Persistent XSS Attack
In case of Non-Persistent attack, it requires a user to visit the specially crafted link by the attacker. When the user visit the link, the crafted code will get executed by the user’s browser. Let us understand this attack better with an example.Example for Non-Persistent XSS
index.php:"; echo "Click to Download"; ?>
Example 1:
Now the attacker will craft an URL as follows and send it to the victim:index.php?name=guestWhen the victim load the above URL into the browser, he will see an alert box which says ‘attacked’. Even though this example doesn’t do any damage, other than the annoying ‘attacked’ pop-up, you can see how an attacker can use this method to do several damaging things.
Example 2:
For example, the attacker can now try to change the “Target URL” of the link “Click to Download”. Instead of the link going to “xssattackexamples.com” website, he can redirect it to go “not-real-xssattackexamples.com” by crafting the URL as shown below:index.php?name=In the above, we called the function to execute on “window.onload”. Because the website (i.e index.php) first echos the given name and then only it draws the tag. So if we write directly like the one shown below, it will not work, because those statements will get executed before the tag is echoed
index.php?name=Normally an attacker tends not to craft the URL which a human can directly read. So he will encode the ASCII characters to hex as follows.
index.php?name=%3c%73%63%72%69%70%74%3e%77%69%6e%64%6f%77%2e%6f%6e%6c%6f%61%64%20%3d%20%66%75%6e%63%74%69%6f%6e%28%29%20%7b%76%61%72%20%6c%69%6e%6b%3d%64%6f%63%75%6d%65%6e%74%2e%67%65%74%45%6c%65%6d%65%6e%74%73%42%79%54%61%67%4e%61%6d%65%28%22%61%22%29%3b%6c%69%6e%6b%5b%30%5d%2e%68%72%65%66%3d%22%68%74%74%70%3a%2f%2f%61%74%74%61%63%6b%65%72%2d%73%69%74%65%2e%63%6f%6d%2f%22%3b%7d%3c%2f%73%63%72%69%70%74%3ewhich is same as:
index.php?name=Now the victim may not know what it is, because directly he cannot understand that the URL is crafted and their is a more chance that he can visit the URL.
2. Persistent XSS Attack
In case of persistent attack, the code injected by the attacker will be stored in a secondary storage device (mostly on a database). The damage caused by Persistent attack is more than the non-persistent attack. Here we will see how to hijack other user’s session by performing XSS.Session
HTTP protocol is a stateless protocol, which means, it won’t maintain any state with regard to the request and response. All request and response are independent of each other. But most of the web application don’t need this. Once the user has authenticated himself, the web server should not ask the username/password for the next request from the user. To do this, they need to maintain some kind of states between the web-browser and web-server which is done through the “Sessions”.When the user login for the first time, a session ID will be created by the web server and it will be sent to the web-browser as “cookie”. All the sub-sequent request to the web server, will be based on the “session id” in the cookie.
Examples for Persistent XSS Attack
This sample web application we’ve given below that demonstrates the persistent XSS attack does the following:- There are two types of users: “Admin” and “Normal” user.
- When “Admin” log-in, he can see the list of usernames. When “Normal” users log-in, they can only update their display name.
Now the attacker log-in as a normal user, and he will enter the following in the textbox as his display name:
"; echo "List of user's are "; $query = "select display_name from $Schema.members where user_name!='admin'"; $res = pg_query($Connect,$query); while($row=pg_fetch_array($res,NULL,PGSQL_ASSOC)) { echo "$row[display_name] "; } } else { echo "
My NameThe above information entered by the attacker will be stored in the database (persistent).
Now, when the admin log-in to the system, he will see a link named “My Name” along with other usernames. When admin clicks the link, it will send the cookie which has the session ID, to the attacker’s site. Now the attacker can post a request by using that session ID to the web server, and he can act like “Admin” until the session is expired. The cookie information will be something like the following:
xss.php?c=PHPSESSID%3Dvmcsjsgear6gsogpu7o2imr9f3Once the hacker knows the PHPSESSID, he can use this session to get the admin privilege until PHPSESSID expires.
To understand this more, we can use a firefox addon called “Tamper Data”, which can be used to add a new HTTP header called “Cookies” and set the value to “PHPSESSID=vmcsjsgear6gsogpu7o2imr9f3”.
We’ll cover how to use “Tamper Data” in future article of this series.
UNIX/Linux crypto algorithms: crypt()
UNIX/Linux encryption weakness: short key length, human factor
Possible attacks against UNIX/Linux: exhaustive key search / brute force, dictionary
Attacks complexity: 252
http://www.password-crackers.com/en/category_127/
UNIX/Linux encryption weakness: short key length, human factor
Possible attacks against UNIX/Linux: exhaustive key search / brute force, dictionary
Attacks complexity: 252
http://www.password-crackers.com/en/category_127/
Description: A
command-line portable utility, optimized for a lot of processors. Its
primary purpose is to detect weak Unix passwords. Also supports
non-standard crypt() functions, additionaly supports Windows NT
LanManager hash.
| |||||||||||||||||||
Description:
High-performance distributed password recovery for forensic and
government agencies, password recovery and data recovery services and
corporations. Recover the most complex passwords and strong encryption
keys in realistic timeframes. Accelerate the recovery by offloading
calculations to NVIDIA GPUs and scale to over 10,000 workstations with
zero scalability overhead.
| |||||||||||||||||||
THANK YOU SNOWDEN
Introduction
According to the official website, Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kinds of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols.
The latest version is faster and contains a lot of new features like APR (ARP Poison Routing) which enables sniffing on switched LANs and Man-in-the-Middle attacks. The sniffer in this version can also analyze encrypted protocols such as SSH-1 and HTTPS and contains filters to capture credentials from a wide range of authentication mechanisms. The new version also ships routing protocols authentication monitors and routes extractors, dictionary and brute-force crackers for all common hashing algorithms and for several specific authentications, password/hash calculators, cryptanalysis attacks, password decoders and some not so common utilities related to network and system security.
Who Should Use This Tool?
Cain & Abel is a tool that will be quite useful for network administrators, teachers, professional penetration testers, security consultants/professionals, forensic staff and security software vendors.
Requirements
The system requirements needed to successfully setup Cain & Abel are:
– At least 10MB hard disk space
– Microsoft Windows 2000/XP/2003/Vista OS
– Winpcap Packet Driver (v2.3 or above).
– Airpcap Packet Driver (for passive wireless sniffer / WEP cracker).
Learn Ethical Hacking From The Best!
Installation
First we need to download Cain & Abel, so go to the download page www.oxid.it/cain.html.
After downloading it,just run the Self-Installing executable package and follow the installation instructions.
Cain’s Features
Here’s a list of all of Cain’s features that make it a great tool for network penetration testing:
Related Definitions:
MAC: (from Wikipedia) “A Media Access
Control address (MAC address) is a unique identifier assigned to network
interfaces for communications on the physical network segment. MAC
addresses are used for numerous network technologies and most IEEE 802
network technologies, including Ethernet. Logically, MAC addresses are
used in the Media Access Control protocol sub-layer of the OSI reference
model.
MAC addresses are most often assigned by the manufacturer of a network interface card (NIC) and are stored in its hardware, the card’s read-only memory, or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer’s registered identification number and may be referred to as the burned-in address. It may also be known as an Ethernet hardware address (EHA), hardware address or physical address. A network node may have multiple NICs and will then have one unique MAC address per NIC.”
Sniffing: (fromWikipedia) “A packet analyzer (also known as a network analyzer, protocol analyzer or packet sniffer, or for particular types of networks, an Ethernet sniffer or wireless sniffer) is a computer program or a piece of computer hardware that can intercept and log traffic passing over a digital network or part of a network. As data streams flow across the network, the sniffer captures each packet and, if needed, decodes the packet’s raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.”
ARP(from Wikipedia) “Address Resolution Protocol (ARP) is a telecommunications protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was defined by RFC 826 in 1982. It is Internet Standard STD 37. It is also the name of the program for manipulating these addresses in most operating systems.”
Usage
Now after launching the application, we have to configure it to use appropriate network card.If you have multiple network cards, it’s better to know the MAC address of the network card that you will use for the sniffer.To get the MAC address of your network interface card, do the following:
Now let’s go through the configuration dialog tabs and take a brief look at most of them:
Sniffer Tab:
This tab allows us to specify which Ethernet interface card we will use for sniffing.
HTTP Fields Tab:
There are some features of Cain that parse information from web pages viewed by the victim such as LSA Secrets dumper, HTTP Sniffer and ARP-HTTPS,so the more fields you add to the username and passwords fields, the more you capture HTTP usernames and passwords from HTTP and HTTPS requests. Here is an example:
The following cookie uses the fields “logonusername=” and “userpassword=” for authentication purposes. If you don’t include these two fields in the list, the sniffer will not extract relative credentials.
GET /mail/Login?domain=xxxxxx.xx&style=default&plain=0 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Referer: http://xxx.xxxxxxx.xx/xxxxx/xxxx
Accept-Language: it
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; (R1 1.3); .NET CLR 1.1.4322)
Host: xxx.xxxxxx.xx
Connection: Keep-Alive
Cookie: ss=1; logonusername=user@xxxxxx.xx; ss=1; srclng=it; srcdmn=it; srctrg=_blank; srcbld=y; srcauto=on; srcclp=on; srcsct=web; userpassword=password; video=c1; TEMPLATE=default;
Traceroute Tab:
Traceroute is a technique to determine the path between two points by simply counting how many hops the packet will take from the source machine to reach the destination machine. Cain also adds more functionality that allows hostname resolution, Net mask resolution, and Whois information gathering.
Certificate Spoofing Tab:
This tab will allow Certificate spoofing.From Wikipedia:
“In cryptography, a public key certificate (also known as a digital certificate or identity certificate) is an electronic document that uses a digital signature to bind a public key with an identity — information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual.
In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority (CA). In a web of trust scheme, the signature is of either the user (a self-signed certificate) or other users (“endorsements”). In either case, the signatures on a certificate are attestations by the certificate signer that the identity information and the public key belong together.”
We can simply think of it as some sort of data (cipher suites & Public key and some other information about the owner of the certificate) that has information about the destination server and is encrypted by trusted companies (CA) that are authorized for creating these types of data.The server sends its own certificate to the client application to make sure it’s talking to the right server.
Certificate Collector Tab:
This tab will collect all certificates back and forth between servers and clients by setting proxy IPs and ports that listen to it.
Password Cracking
Now it’s time to speak about the cracker tab,the most important feature of Cain.When Cain captures some LM and NTLM hashes or any kind of passwords for any supported protocols, Cain sends them automatically to the Cracker tab.We will import a local SAM file just for demonstration purposes to illustrate this point.Here is how to import the SAM file:
Here are the 4 NTLM and LM hashes which will appear like the following image:
And here you will find all possible password techniques in the following image:
As you can see from the previous image, there are various types of techniques that are very effective in password cracking.We will look at each of their definitions.
Dictionary attack:
From Wikipedia: “A dictionary attack uses a targeted technique of successively trying all the words in an exhaustive list called a dictionary (from a pre-arranged list of values). In contrast with a brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words for example a dictionary (hence the phrase dictionary attack). Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short (7 characters or fewer), single words found in dictionaries or simple, easily predicted variations on words, such as appending a digit. However these are easy to defeat. Adding a single random character in the middle can make dictionary attacks untenable.”
Brute forcing attack:
From Wikipedia: “In cryptography, a brute-force attack, or exhaustive key search, is a cryptanalytic attack that can, in theory, be used against any encrypted data (except for data encrypted in an information-theoretically secure manner). Such an attack might be utilized when it is not possible to take advantage of other weaknesses in an encryption system (if any exist) that would make the task easier. It consists of systematically checking all possible keys until the correct key is found. In the worst case, this would involve traversing the entire search space.
The key length used in the cipher determines the practical feasibility of performing a brute-force attack, with longer keys exponentially more difficult to crack than shorter ones. A cipher with a key length of N bits can be broken in a worst-case time proportional to 2N and an average time of half that. Brute-force attacks can be made less effective by obfuscating the data to be encoded, something that makes it more difficult for an attacker to recognize when he/she has cracked the code. One of the measures of the strength of an encryption system is how long it would theoretically take an attacker to mount a successful brute-force attack against it.”
Cryptanalysis attack (Using Rainbow Table):
From Wikipedia: “A rainbow table is a precomputed table for reversing cryptographic hash functions, usually for cracking password hashes. Tables are usually used in recovering the plain text password, up to a certain length consisting of a limited set of characters. It is a practical example of a space-time tradeoff, using more computer processing time at the cost of less storage when calculating a hash on every attempt, or less processing time and more storage when compared to a simple lookup table with one entry per hash. Use of a key derivation function that employ a salt makes this attack infeasible. Rainbow tables are a refinement of an earlier, simpler algorithm by Martin Hellman.”
You will need to choose ahash algorithm, minimum andmaximum length of password, and finally the charset that the password will use.Then press OK.
Conclusion
According to the official website, Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kinds of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols.
The latest version is faster and contains a lot of new features like APR (ARP Poison Routing) which enables sniffing on switched LANs and Man-in-the-Middle attacks. The sniffer in this version can also analyze encrypted protocols such as SSH-1 and HTTPS and contains filters to capture credentials from a wide range of authentication mechanisms. The new version also ships routing protocols authentication monitors and routes extractors, dictionary and brute-force crackers for all common hashing algorithms and for several specific authentications, password/hash calculators, cryptanalysis attacks, password decoders and some not so common utilities related to network and system security.
Who Should Use This Tool?
Cain & Abel is a tool that will be quite useful for network administrators, teachers, professional penetration testers, security consultants/professionals, forensic staff and security software vendors.
Requirements
The system requirements needed to successfully setup Cain & Abel are:
– At least 10MB hard disk space
– Microsoft Windows 2000/XP/2003/Vista OS
– Winpcap Packet Driver (v2.3 or above).
– Airpcap Packet Driver (for passive wireless sniffer / WEP cracker).
Learn Ethical Hacking From The Best!
Installation
First we need to download Cain & Abel, so go to the download page www.oxid.it/cain.html.
After downloading it,just run the Self-Installing executable package and follow the installation instructions.
Cain’s Features
Here’s a list of all of Cain’s features that make it a great tool for network penetration testing:
| Protected Storage Password Manager | Credential Manager Password Decoder |
| LSA Secrets Dumper | Dialup Password Decoder |
| Service Manager | APR (ARP Poison Routing) |
| Route Table Manager | Network Enumerator |
| SID Scanner | Remote Registry |
| Sniffer | Routing Protocol Monitors |
| Full RDP sessions sniffer for APR | Full SSH-1 sessions sniffer for APR |
| Full HTTPS sessions sniffer for APR | Full FTPS sessions sniffer for APR |
| Full POP3S sessions sniffer for APR | Full IMAPS sessions sniffer for APR |
| Full LDAPS sessions sniffer for APR | Certificates Collector |
| MAC Address Scanner with OUI fingerprint | Promiscuous-mode Scanner |
| Wireless Scanner | PWL Cached Password Decoder |
| 802.11 Capture Files Decoder | Password Crackers |
| Access (9x/2000/XP) Database Passwords Decoder | Cryptanalysis attacks |
| Base64 Password Decoder | WEP Cracker |
| Cisco Type-7 Password Decoder | Rainbowcrack-online client |
| Cisco VPN Client Password Decoder | Enterprise Manager Password Decoder |
| RSA SecurID Token Calculator | Hash Calculator |
| TCP/UDP Table Viewer | TCP/UDP/ICMP Traceroute |
| Cisco Config Downloader/Uploader (SNMP/TFTP) | Box Revealer |
| Wireless Zero Configuration Password Dumper | Remote Desktop Password Decoder |
| MSCACHE Hashes Dumper | MySQL Password Extractor |
| Microsoft SQL Server 2000 Password Extractor | Oracle Password Extractor |
| VNC Password Decoder | Syskey Decoder |
MAC addresses are most often assigned by the manufacturer of a network interface card (NIC) and are stored in its hardware, the card’s read-only memory, or some other firmware mechanism. If assigned by the manufacturer, a MAC address usually encodes the manufacturer’s registered identification number and may be referred to as the burned-in address. It may also be known as an Ethernet hardware address (EHA), hardware address or physical address. A network node may have multiple NICs and will then have one unique MAC address per NIC.”
Sniffing: (fromWikipedia) “A packet analyzer (also known as a network analyzer, protocol analyzer or packet sniffer, or for particular types of networks, an Ethernet sniffer or wireless sniffer) is a computer program or a piece of computer hardware that can intercept and log traffic passing over a digital network or part of a network. As data streams flow across the network, the sniffer captures each packet and, if needed, decodes the packet’s raw data, showing the values of various fields in the packet, and analyzes its content according to the appropriate RFC or other specifications.”
ARP(from Wikipedia) “Address Resolution Protocol (ARP) is a telecommunications protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was defined by RFC 826 in 1982. It is Internet Standard STD 37. It is also the name of the program for manipulating these addresses in most operating systems.”
Usage
Now after launching the application, we have to configure it to use appropriate network card.If you have multiple network cards, it’s better to know the MAC address of the network card that you will use for the sniffer.To get the MAC address of your network interface card, do the following:
1- Open CMD prompt.
/p>
/p>
2- Write the following command “ipconfig /all”.
3- Determine the MAC address of the desired
Ethernet adapters, write it on Notepad,and then use this information to
help determine which NIC to select in the Cain application.
Now clickConfigure on the main menu. It
will open the configuration dialog box where you can select the desired
network interface card.
Sniffer Tab:
This tab allows us to specify which Ethernet interface card we will use for sniffing.
ARP Tab:
This tab allows us to configure ARP poison
routing to perform ARP poisoning attack, which tricks the victim’s
computer by impersonating other devices to get all traffic that belongs
to that device, which is usually the router or an important server.
Filters and Ports Tab:
This tab has the most standard services
with their default port running on.You can change the port by
right-clicking on the service whose port you want to change and then
enabling or disabling it.
Cain’s sniffer filters and application protocol TCP/UDP port.
There are some features of Cain that parse information from web pages viewed by the victim such as LSA Secrets dumper, HTTP Sniffer and ARP-HTTPS,so the more fields you add to the username and passwords fields, the more you capture HTTP usernames and passwords from HTTP and HTTPS requests. Here is an example:
The following cookie uses the fields “logonusername=” and “userpassword=” for authentication purposes. If you don’t include these two fields in the list, the sniffer will not extract relative credentials.
GET /mail/Login?domain=xxxxxx.xx&style=default&plain=0 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Referer: http://xxx.xxxxxxx.xx/xxxxx/xxxx
Accept-Language: it
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; (R1 1.3); .NET CLR 1.1.4322)
Host: xxx.xxxxxx.xx
Connection: Keep-Alive
Cookie: ss=1; logonusername=user@xxxxxx.xx; ss=1; srclng=it; srcdmn=it; srctrg=_blank; srcbld=y; srcauto=on; srcclp=on; srcsct=web; userpassword=password; video=c1; TEMPLATE=default;
Traceroute Tab:
Traceroute is a technique to determine the path between two points by simply counting how many hops the packet will take from the source machine to reach the destination machine. Cain also adds more functionality that allows hostname resolution, Net mask resolution, and Whois information gathering.
Certificate Spoofing Tab:
This tab will allow Certificate spoofing.From Wikipedia:
“In cryptography, a public key certificate (also known as a digital certificate or identity certificate) is an electronic document that uses a digital signature to bind a public key with an identity — information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual.
In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority (CA). In a web of trust scheme, the signature is of either the user (a self-signed certificate) or other users (“endorsements”). In either case, the signatures on a certificate are attestations by the certificate signer that the identity information and the public key belong together.”
We can simply think of it as some sort of data (cipher suites & Public key and some other information about the owner of the certificate) that has information about the destination server and is encrypted by trusted companies (CA) that are authorized for creating these types of data.The server sends its own certificate to the client application to make sure it’s talking to the right server.
Certificate Collector Tab:
This tab will collect all certificates back and forth between servers and clients by setting proxy IPs and ports that listen to it.
Challenge Spoofing Tab:
Here you can set the custom challenge value to rewrite into NTLM authentications packets. This feature can be enabled quickly from Cain’s toolbar and must be used with APR. A fixed challenge enables cracking of NTLM hashes captured on the network by means of Rainbow Tables.Password Cracking
Now it’s time to speak about the cracker tab,the most important feature of Cain.When Cain captures some LM and NTLM hashes or any kind of passwords for any supported protocols, Cain sends them automatically to the Cracker tab.We will import a local SAM file just for demonstration purposes to illustrate this point.Here is how to import the SAM file:
Here are the 4 NTLM and LM hashes which will appear like the following image:
And here you will find all possible password techniques in the following image:
As you can see from the previous image, there are various types of techniques that are very effective in password cracking.We will look at each of their definitions.
Dictionary attack:
From Wikipedia: “A dictionary attack uses a targeted technique of successively trying all the words in an exhaustive list called a dictionary (from a pre-arranged list of values). In contrast with a brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words for example a dictionary (hence the phrase dictionary attack). Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short (7 characters or fewer), single words found in dictionaries or simple, easily predicted variations on words, such as appending a digit. However these are easy to defeat. Adding a single random character in the middle can make dictionary attacks untenable.”
Brute forcing attack:
From Wikipedia: “In cryptography, a brute-force attack, or exhaustive key search, is a cryptanalytic attack that can, in theory, be used against any encrypted data (except for data encrypted in an information-theoretically secure manner). Such an attack might be utilized when it is not possible to take advantage of other weaknesses in an encryption system (if any exist) that would make the task easier. It consists of systematically checking all possible keys until the correct key is found. In the worst case, this would involve traversing the entire search space.
The key length used in the cipher determines the practical feasibility of performing a brute-force attack, with longer keys exponentially more difficult to crack than shorter ones. A cipher with a key length of N bits can be broken in a worst-case time proportional to 2N and an average time of half that. Brute-force attacks can be made less effective by obfuscating the data to be encoded, something that makes it more difficult for an attacker to recognize when he/she has cracked the code. One of the measures of the strength of an encryption system is how long it would theoretically take an attacker to mount a successful brute-force attack against it.”
Cryptanalysis attack (Using Rainbow Table):
From Wikipedia: “A rainbow table is a precomputed table for reversing cryptographic hash functions, usually for cracking password hashes. Tables are usually used in recovering the plain text password, up to a certain length consisting of a limited set of characters. It is a practical example of a space-time tradeoff, using more computer processing time at the cost of less storage when calculating a hash on every attempt, or less processing time and more storage when compared to a simple lookup table with one entry per hash. Use of a key derivation function that employ a salt makes this attack infeasible. Rainbow tables are a refinement of an earlier, simpler algorithm by Martin Hellman.”
How To Make A Rainbow Table?
There are many tools that create a rainbow table and there are many rainbow tables already available on the internet.Fortunately, Cain comes with a tool called winrtgen, which is located in its own folder in the installation.You will need to choose ahash algorithm, minimum andmaximum length of password, and finally the charset that the password will use.Then press OK.
Conclusion
Cain and Abel is a powerful tool that does
a great job in password cracking. It can crack almost all kinds of
passwords, and it’s usually just a matter of time before you get it.
Thursday, June 9, 2016
the
infinite quark 00+-00 charged with N command virus synthetis took 2
million clorate particles to hang over an assymetric LAN where the orbit
lives
let me try to divide this: the infinite electrical charge of a null number on a loop command input over a virus cure took 2 million chemical chlorate formulas to live over an orbit which is build on a LAN
why not consider the universe as a vaccum without gas molecules, and make an experience of creating an explosion by the chock of two vaccumns libertation on hydrogene
and let's consider that the hydrogene is the pressure created by the vaccumns
Elsa David
let me try to divide this: the infinite electrical charge of a null number on a loop command input over a virus cure took 2 million chemical chlorate formulas to live over an orbit which is build on a LAN
why not consider the universe as a vaccum without gas molecules, and make an experience of creating an explosion by the chock of two vaccumns libertation on hydrogene
and let's consider that the hydrogene is the pressure created by the vaccumns
Elsa David
I was crying over here, but not alone; this is so very difficult to
swallow, and Jesus did not ask me my opinion, if I would or would not
like to be part of a God's plan; Maybe he has a reward of me, I'm not
excpeting; but then, nevertheless, God has never been Justice; What's
God then? and why do we keep on trying to explain where the universes
begun? If the universes are infinite, God is infinite, the beggining is
infinite, and the end is infinite; if they have will meet? Well,
time as a measure shrinked in the year 2000, there's no more 24 hours,
but 23.57 minutes; the universe shrinked then, all the orbits
shrinked...are we running for the end? but ...why do we keep on using
the same category of measuring? time, has seconds, distance as meters,
liquids as gallons??? why not measure a neutron with the measure of
virus? of cells composition? and why using numbers for the couting of
cells, and not letters? and why are this language letters and not
numbers? and why computaion is symbols, letters and numbers, and not
cells? and why not giving cells chemical compositions with concepts and
not numbers? and so on..as soon we get to think without pre formed
languages, with numbers, we might make a different question, and get the
answer, who is God, where the begging of "virus" of choloratesynthesis
begun?
Subscribe to:
Posts (Atom)
Ambassador @EmbaixadaRusPt URGENT INTEL the guy hedge fund is stable wontget higher to convince investors until end of the day @realDonaldTrump desesperate either help friends either stay with some cents @USTreasury @POLITICOEurope @ecb @FT @WSJ @EUCouncil @DeptofDefense
https://www.mediaite.com/news/billionaire-trump-backer-bill-ackman-skewers-howard-lutnicks-glaring-conflict-of-interest-he-profits-when-ou...
