SecurityHunk

Many people open there inbox in-order to check their email or send a email and then sign-out but what we do not know that there are indeed lot of things are carried out when we simply send or receive a email.

There is a detail report/history of all those things  that are carried out and are attached with the email.

Yes, I am talking about email headers.They are kept hidden from normal user but we can certainly view it.

These headers comes very handy when tracing email, filtering spams, recording the Ip address of the sender etc. So, let's see what email header is all about and later in the post we will see how to get email header.


What is Email Header?

It is a record/report/history of  the email which covers the path from the sender to the receiver and also contains the vital information about the email servers that it has encountered in its path.

Few emails also contain digital signature to detect the tampering of the email in the path.

What information we can get from Email headers?

As i mentioned above we can get the history of the email and the information on the path the email has traveled to reach us.Lets see what information we can get from it.....
                               
            1.When the sender has composed the message(Date,Time)
            2.When the email was sent from the sender's PC to the email server.(Date,Time)
            3.When the email was sent from the email server to the intended receiver.(Date,Time)
            4.The type of protocol used in the entire path.
            5.The PC of the sender can be identified from the Header.
            6.The IP address of the sender but not always.
            7.The type and the number of digital signatures on the email I mean the type of algorithm.
            8.What type of email-client the sender has used to send the email
            9.The ISP of the sender. 
           10.If any third party is using any tracking means.

How to view Header of an Email?

Here I have listed out not all but few of the web mail providers and email client using which you can get email header.

1.Gmail: Login in a standard version >Open email of your choice >Click the down arrow next to reply >Then select show original.

2.Yahoo: Login >Select the desired email >Click on action drop down menu >Select view full header.

3.Hotmail: Login >Select Inbox >Right click on the desired email >Select view message source.


1.Outlook Express: In order to view email header in outlook Open it >Select  the desired email from Inbox >Right click on it and select Properties >Details.

2.Mozilla:Open it >Open the desired email > Click view menu >Message source.

How to read an Email Header.

Here I have taken the example of my Gmail account to explain, we will see how to view email header in gmail.

As mentioned above we first need to open up the header of  any desired email as shown below.

(Click on the image to zoom it.)

 This is what you will get in a new window as shown below.

(Click on the image to zoom it.)

As you can see i have divided the whole header into 3 sections.It is worth mentioning that a header is always analyzed in bottom to top approach.This is because most of the vital informations about the sender is there at the bottom.You can say in the above image section1 is for destination mostly and section3 is for source mostly.

Section 3:

(Click on the image to zoom it.)

MIME-Version:1.0:MIME stands for Multipurpose Internet Mail Extension. It tells about the types of attachments in the email.It allows to send sound,graphics etc.Here the Mime-Version field shows that it is currently in 1.0.

Received:by :It show the time and date the email reached the Gmail server.

In-Reply-to: and References : Both are same,as the name shows it means whether the sender has sent an reply to the past message or is a direct new message.If it is a reply message then it contains the reference of the past message.This is an unique number.

Message-ID:This show the system from which the email has originated,I mean the senders's PC.It can be changed or forged easily.This is also a unique number.

To: and From: It gives the sender's and receivers email-id.

Content type:What type of content is there in the email ie. text or image or anything else.
Section 2:

(Click on the image to zoom it.)

What is DKIM-Signature?

DKIM(DomainKeys Identified Mail) is a digital signature put on every email we send or receive through email servers.It is used because the emails cannot be tampered or altered in its path.This mechanism is also used in spam filters as spam do not have any digital signature.

In the above image there are certain values let me explain.
                  v=Version
                  a=The algorithm used by Sender or Originating Web mail provider.
                  c=canonicalization algorithm of header and body.
                  d=Sender or Originating Web mail provider.
                  s=Selector
                  h=Contains the list of all the digital signature done on this email.
                  bh=Body hash
                  b=Digital signature of header and body.

Section 1:

Delivered-To:It contains the email-id of the receiver.

Received:by : You can see there is a  2 second difference in time between the "received by:" in section 3 and section 2.It shows the time and date the email reaches the gmail server.

Return-Path: The sender's email-id.

Received :from :Specifies the Ip address of the sender generally in "[ ]" but in gmail it is masked by the gmail server address.

This video explain in detail the insights into what is Email Header using Mozilla Thunderbird client.



If you find this post worth reading then do drop a comment,it will be appreciated.

We discussed Metasploit framework in a post and today in this tutorial we will be discussing about Fast-Track which is very easy to use as compared to metasploit as we will see later in the discussion.Here we will discuss how to generate payload using Fast-track from its menu driven interface.

What is Fast-Track?
 It is an open-source project in python and brain child of David Kennedy to come in help during penetration testing with the blend of metasploit framework to make pen testing automated.It makes it very easy for pen testers to exploit the client side data ,improper patch management etc.It has dependencies on metasploit,SQLite,FreeTDS etc.It is advantageous as compared to metasploit beacuse of its very user friendly usage.

What is Payload?
It is actually the work of the exploit that is the result or effect.For example while using any exploit on a targeted box we may get the shell,VNC desktop or access to the files etc on the attacker box.

What is Shellcode?
It is the opcode(Operational code) that can be executed on the targeted box to get the command shell etc.It can be encoded to bypass antivirus detection.

Requirements:

1.Backtrack

2.Virtual environment software.(Vmware player/Virtual Box)

>> Learn how to boot Backtrack from USB
>> Learn how to use Virtual Environment

Procedure:

Step 1.
Boot backtrack and open a shell console and change the directory to " cd /pentest/exploits " and
type "python setup.py install" to check if fast-track has all dependancies install so that it will download from online as shown below.
Step 2.
Now type "python fask-track.py" inorder to select the desired interactive mode.Here I have selected the menu driven mode (./fast-track.py -i) as in this discussion we will be using that.
Step 3.
Now as I got the menu for fast-track usage in the screen, I selected no.6 that is "Payload Generator" as shown in the image below.
Step 4.
Now in this step we have to select the type of payload from the given menu,here I have selected "Reverse_Tcp Meterpreter" that is no.2 as shown in the image below.
Step 5.
Now we need to encode our payload inorder to bypass the AV ,here we have selected no.2 as shown in the image below.
Step 6.
Now we need to enter the host IpAddress and the desired port.Then select the form of payload that is "executable" or "shellcode" as shown in the image below.
Step 7.
As you can see the payload is being saved in .txt format so,we can get the shellcode from it.If we would have choosen the "executable" format then a .exe file would have been created.

Step 8.
If the .exe file is run in the victim's box and we have setup a listener then we can get the meterpreter seesion on our desktop as shown in the image below.
 In the next post we will see how we can use the shellcode generated to make an executable.

If you find this post useful then do drop your comments it will be appreciated... :)

If you have interest in hacking then I feel metasploit framework platfrom is very essential to know and implement.It is used by security reseachers,Pentesters,Hackers,script kiddes etc.So,in this tutorial I will discuss few basics of metasploit and its architecture.So lets start....

I recommend readers if they abide by the blog's Disclaimer then they can proceed reading this post otherwise leave this page immediately.

What is metasploit?

It is an exploitation framework written in ruby language used for devloping and executing exploits on a remote host after assessing the vulnerability.It has a wide range of pre developed exploits and few useful applications like "nmap" attached with it.It was primarily developed for penetration testing but now it has come out to be must needed tool for hackers.

Note:All the screen shots in this post are from Windows OS.

Architecture:

Image Credit:HD Moore

Basic Terms:

1.Exploits:
It is similar to a vehicle in real life that helps in entering or penetrating to a system because of any vulnerability or any flaw in the system.

2.Payload:
Its specifies the work of the exploit

3.Auxillary:
These are few other applications combined with the framework like sniffers,enumeration tool.

4.Meterpreter:
It is a payload that is injected into a process of an exploited system where no additional process is created in the memory and later it can be migrated to any desired process using PID(Process ID.)

5.Encoders:
Exploits are sometimes detected by anti-virus so these encoders can be used to make the exploits undetectable and manipulate the code.

6.Nops:
Known as no operation generators are helpful in letting the exploit remain undetected from IDS.


7.Plugins:
The extend the functionality of the cosole.

Basic Commands:

1.help:
As the name signifies it will show some commands for reference.

2.search:
If you want to search an exploit and donot know the excat name then.For example search windows as shown in the image below.

3.use:
After the desired exploit has been sorted out then use this command to select he particular exploit as shown in the image below.


4.set:
If you want to use a particular option once then this command is used as shown in the image below.

5.show options:
If this command is used then it will show the options of the exploit.What port to be used etc...

6.setg:
It is same as "set" but the "g" stands for global so if you want to use a particular option for the complete session then use this command.

7.show :
Only "show" command will display all the exploits,payload and auxillaries at a time on the screen but if used as "show payloads" etc will show only the payloads as shown in the image below.
 


8.info :
It displays the needed information about an exploit or payload.

9.exploit/run:
After every thing is set this command is used to run the exploit.

10.sessions:session -i,session -i <1,2,3...id>:
After the exploit is succesful then to see the sessions this command is used and then the ID is used to select a specific one.

11.ps:
Suppose a meterpreter session is running successfully then "Ps" will display the processes running in the exploited system.

12.migrate :
It somtimes happens that the process to which the meterpreter is being injected is a temporary process so here the migrate command can be used to tranfer the meterpreter to some other process by specifing the process id.

You can setup a "Pentesting Environment" at your home using Virtual environment,find out here.

For more information on Metasploit visit here.

The title of this post may appear a noob but today we will try to do it in a different way.One can find many command prompt usage for it in web and many softwares for cracking it.The software i would recommend for doing it are....

1.Ophcrack:It is a windows password cracker implemented on rainbow tables.It is available as a freeware.(DOWNLOAD HERE)

2.Backtrack:It is one of my fav,it is a multi-functionality tool that is used for software cracking,wireless hacking,penetration testing,password cracking..etc.When it boots in one can see a linux based interface and it is typically a GNU/Linux based.It is also a freeware(DOWNLOAD HERE).

Quoting Kevin Mitnik-"I wish i had Backtrack-3 many years ago.It would have saved me lot of time."

 Well,after reading the above quote by the great Kevin you must  have imagined the functionality of backtrack.So,before going into the article  i want you all to go through the Disclaimer.

WE CAN USE THIS METHOD FOR WIN VISTA ALSO

Finally we should start......i should mention that we will hack using Backtrack3......though version 4 is  available and you can use it.

1.I hope you all have downloaded the .iso  file of  Backtrack from the above link(Always use official link).

2.You can  burn it to a  DVD/CD(make bootable) or boot it from USB,i would prefer using USB.

3.For booting it from USB you need to make your USB a booting one,for that you will need  UseNetbootin(DOWNLOAD).....and use the instructions given here.

4.Now i hope you have come up with a bootable  USB with Backtrack loaded in it,now restart your system with USB plugged and then go to the boot menu and select boot from USB....and leave it....you will be guided to the backtrack desktop screen as shown below.

5.Some times you may need Root ...Username:root & Password:toor.

6.Now open up chntpw by clicking on the start button as shown in the image below.

7.Then you all can see a command window will open up....now inorder to proceed you need to know the different partitions in your  harddisk,so for that type "df"(with out quotes)hit enter and it will show different partitions as shown in the image below.

8.Select the partition where the system files are loaded....here in my system it is in "sda1" so i will be using it in my further steps.

9.Now type in  this  chntpw -i /mnt/sda1/WINDOWS/system32/config/SAM  and hit enter.

Note:All the characters in the above command are case sensitive.

Because all the passwords in Windows Xp are stored in SAM file which is located in the above specified location and the SAM file is encrypted  with LM hashes and sometimes a key is provided.

10.In the above image  you can see a question is asked "what to do?"by default it will take "1" if you hit enter...as it denotes "edit user data and password" as you can see in the above list (in image) so,hit enter and the below screen comes up.....

As it has taken "Administrator " as default value as you can see in the above image so again hit enter.

11.Here you can see there are many  options you can choose any one from the list by  typing that and hitting enter.I have chosen  option "1" which says "clear (blank) user password".
Now as you can see the "password cleared !" message has come up so,lets check again.

12.Hit enter again to get  the confirmation message as shown below.
So,the hack is successful!!! as you must have felt that hack using backtrack is purely command based....so remember few commands  and it can work wonders for you.
If  you liked this hack then do drop your comments and  give your suggestions on it they will be appreciated!!!