ARP cache poisoning with cain abel

1) Start Cain

2) Click blue + icon on the upper left, note username (ID) and Password and
URL of resource it was saved for on the Protected Storage tab.

3) To save information from any of the Protected Storage sites:
a. Click on one of the resources
b. Right click and select Export
c. Key in name such as resc1.txt
d. Now, open file using notepad or similar text editor

4) To delete entry, left click on item, select either Remove or Remove All.

To find Windows login ID and passwords on a local machine.

• Create three users on your local machine. Make the accounts as follows:
user1 with password of password, user2 with password of 1password1,
and user 2 with password of 123xyz321.
Now proceed to #1 below.

With the different passwords selected, you will be able to examine how
password difficulty affects auditing and cracking techniques.

1) Click on Cracker tab

2) Click on LM & NTLM Hashes

3) Click on + sign icon on toolbar then Dump NT Hashes from Local machine. *
Note, if you have a SAM file from an NT/win2k/XP machine you can also use
the import option to import from that. *See bottom of lab on remote
installation of Abel to see how you might gain access to a SAM file from a
remote PC.

4) Click Next

5) On Guest id, right click and select dictionary attack NTLM. Select Add, then
browse to where cain is installed (possibly in c:\program\files\cain) Then
select wordlists folder and wordlist.txt. Then click Start.

6) Note options such as As is Password, etc. Also note that you could use a
Brute force attack if you had no luck on a dictionary word from a list file.
However, this would take much longer.

Using APR – ARP Poison Routing.
Theory -- On an Ethernet/IP network, when host A wants to send a packet to
host B, it must know the MAC or physical address of the machine and IP
address. It also needs to know the application layer protocol (IP) address, but
the physical MAC is required for construction of the Ethernet frame. Review
the OSI model if you are unclear on these concepts. In short we have to have
both.
Once it knows the MAC's of the machines on the network, it keeps them stored
in an ARP cache table. However, before it can “know” it has to query the
network to find out the addresses. A host does this by sending out an ARP
request on broadcast to FFFFFFFFFFFF. Only the station with the specified IP
will reply in unicast with an ARP reply packet to the requesting station with it's
MAC. Now host A has an updated table entry for host B and it will
communicate now in unicast directly to it by using the MAC of B in the
Ethernet frame. ARP request and reply packets are only sent if the host
doesn't know the destination machines MAC. Again, once it is learned the
cache is used....this is a key point to why APR works.

How APR works – ARP Poison Routing uses the stored cache as a way to reroute
or re-direct packets from a target, to an intermediary machine, then
forward to the host, thus the middle machine “sees” all traffic between target
and host, even if on a switched LAN. First the target MAC address must be
established, then the APR feature “poisons” the cache of the target by forcing
a cache update with the path re-routed so that the middle machine forwards
traffic to and from host and target. The middle machine can now examine
packets with a sniffer such as Ethereal, Nmap, or others.

Instructions to use APR:
** Before you try this, you must make sure that WinPcap is properly bound to
your NIC. Select Configure and make sure you see your adapter ( s) listed.

At main screen, select Configure, then click your your network adapter, then
Apply and Ok.

1) Click to enable both Sniffer and APR (Left of the + ).

2) Click on +, then Range. Range for your network (based on adapter you
chose) is displayed. Click OK to start scanning.

3) After 100% you will see IP address, MAC, and OUI fingerprint of devices in
range.
4) Now click on APR icon to enable it.

5) Click on + and select IP address to poison, then OK.

6) Now you should see it change from Idle to Poisoning.

7) IP connections should appear from target and spoofing computer(your
computer.

8) So, what we have now, looking at C3, is the target IP on the left, where they
were going on the right. All of this passing harmlessly through the middle
PC.

9) For better analysis of this traffic, and perhaps text strings that have been
sent from the target, etc. (e.g. They connected to Google, but what did
they search for?) We will run a sniffer on the middle computer.

10) Start Ethereal, select Capture, then select the same interface adapter you
selected in Cain. Then select OK. You are trying to capture the packets
being forwarded to and from your machine via ARP session.

11) Stop the capture after connecting to google and searching for items such as
“vacation villas”, or “cheap air fare”. Your machine is now analyzing the
traffic from a target as all of its traffic is rerouted through yours. Note in
Figure C4 we see all traffic listed in the top window of Ethereal (examine
that we see our connection to Google).

12)Click the Protocol field to organize the list, then scroll down to HTTP and
look for GET /search? Here we see in Figure C5 that the user was
searching on vacation villas (vacation+villa).

13)Click the Protocol field to organize the list, then scroll down to HTTP and
look for GET /search? Here we see in Figure C5 that the user was
searching on vacation villas (vacation+villa).

14)When finished select Tools, Disconnect, Disconnect All.

What is Abel? How can I install it ?
Abel is an NT service composed by two files: "Abel.exe" and "Abel.dll". These
files are copied by the installation package into the program's directory but the
service IS NOT automatically installed. Abel can be installed locally or
remotely (using Cain), anyway you need Administrator privileges to do that.

LOCAL INSTALLATION:
1) Copy the files Abel.exe and Abel.dll into the %WINNT% directory (ES:
C:\WINNT)

2) Launch Abel.exe to install the service (not automatically started)

3) Start the service using the Service Manager

REMOTE INSTALLATION (most reliable on wired network):
1) Use the "Network TAB" in Cain and choose the remote computer where Abel
will be installed

2) Right click on the computer icon in the tree and select "Connect As"

4) Provide Administrator credentials for the remote machine.

5) Once connected right click on the "Services" icon and select "Install Abel"

6) The two files "Abel.exe" and "Abel.dll" will be copied into the remote
machine, the service will be installed
and started automatically.

7) Once installed on the remote computer, note that among other things, you
can bring up a console prompt on the remote machine, examine password
Hashes, etc.

How to use wireshark to Capture, Filter and Inspect Packets

Start Wireshark
On a Linux or Unix environment, select the Wireshark or Ethereal entry in the desktop environment's menu, or run "wireshark" (or "ethereal") from a root shell in a terminal emulator.
Note that on Un*x systems, a non-GUI version of Wireshark called "tshark" (or "tethereal") may be available as well, but its use is beyond the scope of this document.

Configure Wireshark

After starting Wireshark, do the following:

-Select Capture | Interfaces

-Select the interface on which packets need to be captured.

-If capture options need to be configured, click the Options button for the chosen interface. Note the following recommendations for traces that are to be analysed by Novell Technical Services:
Capture packet in promiscuous mode: This option allows the adapter to capture all traffic not just traffic destined for this workstation. It should be enabled.

Limit each packet to: Leave this option unset. Novell Support will always want to see full frames.

Filters: Generally, Novell Support prefers an unfiltered trace. For documentation on filters, please refer to TID 10084702 - How to configure a capture filter for Ethereal (formerly NOVL90720).

-Capture file(s): This allows a file to be specified to be used for the packet capture. By default Wireshark will use temporary files and memory to capture traffic. Specify a file for reliability.

-Use multiple files, Ring buffer with: These options should be used when Wireshark needs to be left running capturing data data for a long period of time. The number of files is configurable. When a file fills up, it it will wrap to the next file. The file name should be specified if the ring buffer is to be used.

-Stop capture after xxx packet(s) captured: Novell Technical Support would most likely never use this option. Leave disabled.

-Stop capture after xxx kilobyte(s) captured: Novell Technical Support would most likely never use this option. Leave disabled.

-Stop capture after xxx second(s): Novell Technical Support would most likely never use this option. Leave disabled.

-Update list of packets in real time: Disable this option if the problem that's being investigated is occuring on the same workstation as where Wireshark is running.

-Automatic scrolling in live capture: Wireshark will scroll the window so that the most current packet is displayed.

-Hide capture info dialog: Disable this option so that you can view the count of packets being captured for each protocol.

-Enable MAC name resolution: Wireshark contains a table to resolve MAC addresses to vendors. Leave enabled.

-Enable network name resolution: Wireshark will issue DNS queries to resolve IP host names. Also will attempt to resolve network network names for other protocols. Leave disabled.

-Enable transport name resolution: Wireshark will attempt to resolve transport names. Leave disabled.

Now click the Start button to start the capture.

Recreate the problem. The capture dialog should show the number of packets increasing. If not, then stop the capture. Examine the interface list and pick the one that is not associated with the WANIP. It will probably be a long alpha-numeric string. If packets are still not being captured, try removing any filters that have been defined.

Once the problem which is to be analysed has been reproduced, click on Stop. It might take a few seconds for Wireshark to display the packets captured.

If the destination address is always displayed as FFFFFFFF (IPX) or always ends in .255 (IP) then all that has been captured is broadcast traffic. This is a useless trace.

This usually occurs when another machine is being traced (to start the trace while the target machine is powered off, in order to capture the bootup process). The capture setup needs to be reconsidered - port mirroring on the switch may need to be set up, or a dumb hub may need to be used to make the traffic reach the sniffing system. (Some devices advertised as "hubs" are in fact switches that may have the intelligence to prevent the workstations from seeing each other's packets; with these, getting a good trace may not be possible)

Save the packet trace in any supported format. Just click on the File menu option and select Save As. By default Wireshark will save the packet trace in libpcap format. This is a filename with a.pcap extension. Use this default for files sent to Novell.

Create a trace_info.txt file with the IP and MAC address of the machines that are being traced as well as any pertinent information, such as:

• What is the problem? (when did it start? steps to reproduce? any other pertinent information)
• What steps were traced?
• Give names of the servers and files being accessed.
• If analysis of the trace has already been attempted, please provide Novell Support with analysis notes.For example: Packets 1-30 are boot. Packets 31-500 are login. Packets 501 to 1,000 is my application loading. Packet 1,001 to 1,500 is me saving my file. The error occurred at approximately packet 1,480.
• Give the MAC addresses of hardware involved? (Workstation, servers, printers ...)
• What is the workstation OS and configuration?
• What version of client software is running?
• If it works with one version of the client (or a particular server patch), then get a trace of it working, and a trace of it not working.
• For Novell Client issues: Are there any client patches loaded?
• For NetWare servers: What version of NetWare (and other relevant products i.e. ZEN or NDPS) are running on the server?
• What patches have been applied?
• What is the configuration of the network? Are there routers involved? If so, what kind of routers?

How to hack a wifi password using aircrack

First of all you need to scan for available wireless networks.

you can use“NetStumbler” or "Kismet" for Windows and Linux and KisMac for Mac.

It’ll also show how the Wi-fi network is encrypted. The two most common encryption techniques are:

1) WEP (Wire Equivalent Privacy )

2) WAP(Wireless Application Protocol)

WEP allows a hacker to crack a WEP key easily whereas WAP is currently the most secure and best option to secure a wi-fi network

It can’t be easily cracked as WEP because the only way to retreive a WAP key is to use a brute-force attack or dictionary atack.

How to Crack WEP

To crack WEP we will be using Live Linux distribution called BackTrack to crack WEP.

BackTrack have lots of preinstalled softwares but for this time
The tools we will be using on Backtrack are:

a)Kismet – a wireless network detector
b)airodump – captures packets from a wireless router
c)aireplay – forges ARP requests
d)aircrack – decrypts the WEP keys

Follow the steps One by One

1) First of all we have to find a wireless access point along with its bssid, essid and channel number. To do this we will run kismet by opening up the terminal and typing in kismet. It may ask you for the appropriate adapter which in my case is ath0. You can see your device’s name by typing in the command iwconfig.

2) To be able to do some of the later things, your wireless adapter must be put into monitor mode. Kismet automatically does this and as long as you keep it open, your wireless adapter will stay in monitor mode.

3) In kismet you will see the flags Y/N/0. Each one stands for a different type of encryption. In our case we will be looking for access points with the WEP encryption. Y=WEP N=OPEN 0=OTHER(usually WAP).

4) Once you find an access point, open a text document and paste in the networks broadcast name (essid), its mac address (bssid) and its channel number. To get the above information, use the arrow keys to select an access point and hit to get more information about it.

5) The next step is to start collecting data from the access point with airodump. Open up a new terminal and start airodump by typing in the command:

airodump-ng -c [channel#] -w [filename] –bssid [bssid] [device]

In the above command airodump-ng starts the program, the channel of your access point goes after -c , the file you wish to output the data goes after -w , and the MAC address of the access point goes after –bssid. The command ends with the device name. Make sure to leave out the brackets.

6) Leave the above running and open another terminal. Next we will generate some fake packets to the target access point so that the speed of the data output will increase. Put in the following command:

aireplay-ng -1 0 -a [bssid] -h 00:11:22:33:44:55:66 -e [essid] [device]

In the above command we are using the airplay-ng program. The -1 tells the program the specific attack we wish to use which in this case is fake authentication with the access point. The 0 cites the delay between attacks, -a is the MAC address of the target access point, -h is your wireless adapters MAC address, -e is the name (essid) of the target access point, and the command ends with the your wireless adapters device name.

7) Now, we will force the target access point to send out a huge amount of packets that we will be able to take advantage of by using them to attempt to crack the WEP key. Once the following command is executed, check your airodump-ng terminal and you should see the ARP packet count to start to increase. The command is:

aireplay-ng -3 -b [bssid] -h 00:11:22:33:44:5:66 [device]

In this command, the -3 tells the program the specific type of attack which in this case is packet injection, -b is the MAC address of the target access point, -h is your wireless adapters MAC address, and the wireless adapter device name goes at the end.
Once you have collected around 50k-500k packets, you may begin the attempt to break the WEP key. The command to begin the cracking process is:

aircrack-ng -a 1 -b [bssid] -n 128 [filename].ivs

In this command the -a 1 forces the program into the WEP attack mode, the -b is the targets MAC address,and the -n 128 tells the program the WEP key length. If you don’t know the -n , then leave it out. This should crack the WEP key within seconds. The more packets you capture, the bigger chance you have of cracking the WEP key.

BackTrack applications for data collection TheHarvester

TheHarvester is atool to collect e-mail accounts, names user and host names or subdomains from different public sources such as search engines and servers PGP key.

This tool is intended to help penetration testers in the early stages of the project, is a very simple, but very effective.

Sources support are:

• Google - emails, subdomains or hostnames
• Google Profiles - the names of the employees
• Bing - emails, subdomains or hostnames, virtual servers
• Pgp servers, emails, subdomains or hostnames
• Linkedin - The names of the employees
• Exalead - emails, hostnames or subdomain

New features:

• The delays between requests
• Results XML and HTML export
• Search a domain in all sources
• Checker virtual host
• Shodan computer database integration
• Enumeration of active (DNS enumeration, reverse DNS lookups, DNS TLD expansion)
• Chart statistics

cd /pentest/ Enumeration / theharvester
/ Pentest / enumeration / theharvester #. / TheHarvester.py
/ Pentest / enumeration / theharvester #. / Nasa.gov theHarvester.py-d-l 500-b google

Downloads
The latest version can always be found in the reservoirsiteGoogle code: https://code.google.com/p/theharvester

Download Mantra-Web Browser With Hacking Tools

Mantra is a collection of tools of free and open source integrated into abrowser web, which can be handy for students, Penetration testing, web application developers, security professionals etc. It is portable , ready-to-run, compact and follows the true spirit of free and open.

The software is intended to be lighted, flexible, portable and easy to use with a nice GUI. It can lead to memory cards, flash drives, CD / DVDs, etc. can run natively onLinux, Windows and Mac can also be installed on yoursystemin minutes. Mantra is absolutely free and takes no time for you to understand. Mantra can be very useful in performing the five phases of attacks including reconnaissance, scanning and enumeration, access, privilege escalation, the maintenanceaccess, and covering tracks.

Apart from that it also contains a set of tools aimed at web developers and code debuggers which makes it useful for both offensive and defensive security related tasks safely. Objectives of the project to create an ecosystem-based hackers the browser to draw people's attention to the potential safety of a platform , browser-based security provide an easy to use and portable to demonstrate common attacks based on the web (read training) To associate with other security tools / products for a better environment .

Download:
Linux 32-bit - Mantra Security Toolkit - Gandiva.tar.bz2
Windows - OWASP Mantra Security Toolkit - Gandiva.exe

How to crack encrypted zip file password using fcrackzip

Most common method for cracking passwords of such types of file are with Brute Force technique in which every combination of letters for a word are tested one by one. Although this method is very slow as because all combination are to be checked. But it is not impractical, as with some software it is possible.

The time consumed in cracking one password depends on the length of password, char. set used for password and on processing capabilities of system software,application software and your system configuration. So brute forcing time can be reduced by adding some conditions if we know nature of password. For example if the password is of 6 in length and it only contains digit, than these conditions can be defined in the application so that it can use only digits and exclude alphabets and symbols from its dictionary and searches only for 6 digit password, which increases the speed of searching.

There are many software present which can do this for you but the best one is fcrackzip as it is fast and free. fzcrack is available for both windows and linux.
fcrackzip implementation works tremendously faster on linux platforms comparing to windows one but you can use it on windows also. 
Its usage user interface is same for both platforms but installation is different.

For using it on windows, just download it and extract it.
Then open command prompt and change its directory to fcrackzip.exe, for example if your fcrackzip.exe is placed on your desktop than change your directory to desktop.
for this type cd [path] in cmd, for example if on desktop than type

 cd C:\Users\varun\Desktop\

Once you have done than continue with below dashed step

And for installing it on ubuntu just download it and than open terminal and use the below command

sudo aptitude install fcrackzip

 If you have backtrack than no need to download and install, it is preinstalled on it just go through

Applications>Backtrack>Privilege Escation>Pasword Hacks>Offline Attacks>chntpw

- Once you have completed the above steps for appropriate operating system than continue using it with following steps.
For using fcrackzip with brute force technique on file named sample.zip type the following command

fcrackzip -b [path for file sample.zip]

where fcrackzip remains the same for all commands but execution changes according to commands in between fcrqackzip and path which is -b for above command, which means brute force. Your can use following set if cammand for specifying conditions.

-h, --help

Prints the version number and (hopefully) some helpful insights.

-v, --verbose

Each -v makes the program more verbose.

-b, --brute-force

Select brute force mode. This tries all possible combinations of the letters you specify.

-D, --dictionary

Select dictionary mode. In this mode, fcrackzip will read passwords from a file, which must contain one password per line and should be alphabetically sorted (e.g. using (1)).

-c, --charset characterset-specification

Select the characters to use in brute-force cracking. Must be one of

a   include all lowercase characters [a-z]
  A   include all uppercase characters [A-Z]
  1   include the digits [0-9]
  !   include [!:$%&/()=?{[]}+*~#]
  :   the following characters upto the end of the spe-
      cification string are included in the character set.
      This way you can include any character except binary
      null (at least under unix).

-p, --init-password string

Set initial (starting) password for brute-force searching to string, or use the file with the name string to supply passwords for dictionary searching.

-l, --length min[-max]

Use an initial password of length min, and check all passwords upto passwords of length max (including). You can omit the max parameter.

-u, --use-unzip

Try to decompress the first file by calling unzip with the guessed password. This weeds out false positives when not enough files have been given.

-m, --method name

Use method number "name" instead of the default cracking method. The switch --help will print a list of available methods. Use --benchmark to see which method does perform best on your machine. The name can also be the number of the method to use.

-2, --modulo r/m

Calculate only r/m of the password. Not yet supported.

-B, --benchmark

Make a small benchmark, the output is nearly meaningless.

-V, --validate 

          Make some basic checks wether the cracker works.

 

For example, 

a1:$% selects lowercase characters, digits and the dollar and percent signs.
fcrackzip -b -c a1:$% -L 5 [path for encrypted zip file]
This will search for a password that is 5 in length and can contains a1:$% in its character.

 

Working Modes

BRUTE FORCE MODE 

By default, brute force starts at the given starting password, and successively tries all combinations until they are exhausted, printing all passwords that it detects, together with a rough correctness indicator. The starting password given by the -p switch determines the length. fcrackzip will not currently increase the password length automatically, unless the -l switch is used.

DICTIONARY MODE
This mode is similar to brute force mode, but instead of generating passwords using a given set of characters and a length, the passwords will be read from a file that you have to specify using the -p switch.

CP MASK
A CP mask is a method to obscure images or parts of images using a password. These obscured images can be restored even when saved as JPEG files. In most of these files the password is actually hidden and can be decoded easily (using one of the many available viewer and masking programs, e.g. xv). If you convert the image the password, however, is lost. The cpmask crack method can be used to brute-force these images. Instead of a zip file you supply the obscured part (and nothing else) of the image in the PPM-Image Format (xv and other viewers can easily do this). The cpmask method can only cope with password composed of uppercase letters, so be sure to supply the --charset A or equivalent option, together with a suitable initialization password. 

Tracking Key Strokes by Keylogger

One of the many ways for password hacking is tracking key strokes, that is by tracking what the user types with keyboard. This is possible by tracing activity between keyboard and CPU. There are numerous keylogging methods for tracing activity between keyboard and CPU ranging from hardware keyloggers to software-based keyloggers.  
Software-based keyloggers can be of many types differentiated according to their purpose for which they are designed. These keylogger comes for many platform and once installed on operating system than can be used without even knowing the user that somebody is spying them, which means these can be hidden in background. These software can be used for various purpose such as it is helpful for parents to look for what your child is doing on net or trace his or her activity. Many software-based keylogger offer many features such as sending screenshots after every fixed time, key strokes, process activity etc. These spying data can be saved to log file and sent to you by e-mail or to online hosting service.

For its e mail configuration you should have an online account better if it uses smtp (simple mail transfer protocol). Than for software smtp configuration field use smtp.email-website-name.com (such as smtp.aol.om) use pop.email-website-name.com if it asks for pop enabled mailing service.

In hardware keylogger a device is used to connect keyboard and CPU which traces the line directly between keyboard and CPU. It has its own memory to save the logging activity.

Although these methods can not be used for network hacking but is good for spying anyone as because it have many limitation such as anti virus can detect them, for e mail service firewall can create problems for many keyloggers, the major drawback is that you have to use the target system once.
The only way of hacking with keyloggers is to install it on public computers where many people type there password in browser but this is of no use unless you have criminal tendencies.