SecurityHunk

Many people open there inbox in-order to check their email or send a email and then sign-out but what we do not know that there are indeed lot of things are carried out when we simply send or receive a email.

There is a detail report/history of all those things  that are carried out and are attached with the email.

Yes, I am talking about email headers.They are kept hidden from normal user but we can certainly view it.

These headers comes very handy when tracing email, filtering spams, recording the Ip address of the sender etc. So, let's see what email header is all about and later in the post we will see how to get email header.


What is Email Header?

It is a record/report/history of  the email which covers the path from the sender to the receiver and also contains the vital information about the email servers that it has encountered in its path.

Few emails also contain digital signature to detect the tampering of the email in the path.

What information we can get from Email headers?

As i mentioned above we can get the history of the email and the information on the path the email has traveled to reach us.Lets see what information we can get from it.....
                               
            1.When the sender has composed the message(Date,Time)
            2.When the email was sent from the sender's PC to the email server.(Date,Time)
            3.When the email was sent from the email server to the intended receiver.(Date,Time)
            4.The type of protocol used in the entire path.
            5.The PC of the sender can be identified from the Header.
            6.The IP address of the sender but not always.
            7.The type and the number of digital signatures on the email I mean the type of algorithm.
            8.What type of email-client the sender has used to send the email
            9.The ISP of the sender. 
           10.If any third party is using any tracking means.

How to view Header of an Email?

Here I have listed out not all but few of the web mail providers and email client using which you can get email header.

1.Gmail: Login in a standard version >Open email of your choice >Click the down arrow next to reply >Then select show original.

2.Yahoo: Login >Select the desired email >Click on action drop down menu >Select view full header.

3.Hotmail: Login >Select Inbox >Right click on the desired email >Select view message source.


1.Outlook Express: In order to view email header in outlook Open it >Select  the desired email from Inbox >Right click on it and select Properties >Details.

2.Mozilla:Open it >Open the desired email > Click view menu >Message source.

How to read an Email Header.

Here I have taken the example of my Gmail account to explain, we will see how to view email header in gmail.

As mentioned above we first need to open up the header of  any desired email as shown below.

(Click on the image to zoom it.)

 This is what you will get in a new window as shown below.

(Click on the image to zoom it.)

As you can see i have divided the whole header into 3 sections.It is worth mentioning that a header is always analyzed in bottom to top approach.This is because most of the vital informations about the sender is there at the bottom.You can say in the above image section1 is for destination mostly and section3 is for source mostly.

Section 3:

(Click on the image to zoom it.)

MIME-Version:1.0:MIME stands for Multipurpose Internet Mail Extension. It tells about the types of attachments in the email.It allows to send sound,graphics etc.Here the Mime-Version field shows that it is currently in 1.0.

Received:by :It show the time and date the email reached the Gmail server.

In-Reply-to: and References : Both are same,as the name shows it means whether the sender has sent an reply to the past message or is a direct new message.If it is a reply message then it contains the reference of the past message.This is an unique number.

Message-ID:This show the system from which the email has originated,I mean the senders's PC.It can be changed or forged easily.This is also a unique number.

To: and From: It gives the sender's and receivers email-id.

Content type:What type of content is there in the email ie. text or image or anything else.
Section 2:

(Click on the image to zoom it.)

What is DKIM-Signature?

DKIM(DomainKeys Identified Mail) is a digital signature put on every email we send or receive through email servers.It is used because the emails cannot be tampered or altered in its path.This mechanism is also used in spam filters as spam do not have any digital signature.

In the above image there are certain values let me explain.
                  v=Version
                  a=The algorithm used by Sender or Originating Web mail provider.
                  c=canonicalization algorithm of header and body.
                  d=Sender or Originating Web mail provider.
                  s=Selector
                  h=Contains the list of all the digital signature done on this email.
                  bh=Body hash
                  b=Digital signature of header and body.

Section 1:

Delivered-To:It contains the email-id of the receiver.

Received:by : You can see there is a  2 second difference in time between the "received by:" in section 3 and section 2.It shows the time and date the email reaches the gmail server.

Return-Path: The sender's email-id.

Received :from :Specifies the Ip address of the sender generally in "[ ]" but in gmail it is masked by the gmail server address.

This video explain in detail the insights into what is Email Header using Mozilla Thunderbird client.



If you find this post worth reading then do drop a comment,it will be appreciated.

Recently Google has reported a XSS vulnerability security issue with its Web Optimizer code.So,it has requested its users to update the code in their site immediately.Though the level of threat is low but it is recommended to update the code.The  attacker may exploit this vulnerability and execute malicious code in the victim's site but the attack can be successful  if the attacker has earlier compromised  the web browser.So, friends do update your code immediately and create a new experiment of web optimizer.

Below I have posted the screen shot of the mail that google has sent to my inbox with this alert.

Email: www.securityhunk.com

Gmail is again hit by a new phishing scam, which is warned by the Security researchers from Sunbelt.This is almost similar to the old phishing scam that is using a spoof page(a.k.a fake page) along with the blend of social engineering inorder to fool the users.Dont know what is phishing visit here.

What is new about this scam?

As i mentioned earlier that it is almost similar to the old one but the only striking difference is that it has got an attachment along with a mail.The attacker has used the skills of social engineering to make the user believe that the mail is from the "GOOGLE" itself.Take a look at the mail below......

(Source:Sunbelt.blogspot.com)

The attach file is in Html format called as Gmail_access.html,which is a fake page of Gmail login page having  all the elements and graphics exactly similar to the original page.Take a look at the image below.

(Source:Sunbelt.blogspot.com)

How it Works?

Check the source code of the attachment(html file),use ctrl + f  to find "action=" use without quotes then u will find something different to that of the original page.

action="http://www.wtwener.com/e107_themes/serviceloginAuth.php"

which means when the user enter any values in the login field of the fake page(attachment) then it sends the values to a "serviceloginAuth.php" on an external domain for the attacker and the website under this domain is registered to someone in Sremska Kamenica, Serbia-said Tom Kelchner of sunbelt.

(Credits:sunbelt.blogspot.com)

A Beginners Guide to Ethical Hacking



Download
Why you should buy this book?

• Are you interested in ethical hacking but donot know where to start then this book by Rafay Baloch is the most reliable source and i too also recommend it. 
• "A Beginners Guide to Ethical Hacking" is really a great book for newbie hackers those who are really curious for ethical hacking and lead them to become a master hacker.
• Amaze your friends with awesome hacking tricks from this book and apply them to real world situation.
• It will help you learn how to make your computer secure and free from future hack attacks.
• This book will certainly make your dream come true.
• This book is a unique of its kind and you can have you copy from the vendor.

Bonus 1:  



1000 Hacking Tutorials 

For a limited time only , with the purchase of “A Beginner’s Guide to Ethical Hacking” you will receive the following bonus package! 1000 Hacking Tutorials contains 1000 of the best hacking tutorials of 2010 leaked on the internet!

Set of Phishers

With the purchase of A beginners Guide to Ethical Hacking you will also get a set of 30+ phishers(Fake login page) already created by Rafay.

Its Decision Time!
Now you have heard it all so what are you waiting for.

• This book does not demand any prior knowledge about Hacking. So if you are a newbie to the concept of hacking and want to master it from the basics, then this book is for you.
• The information given in this underground handbook will put you into a hacker’s mindset and teach you all of the hacker’s secret.So what are you waiting for! Grab "A Beginners Guide to Ethical hacking" and start your Hacking journey.

Note: A Beginners guide to Ethical Hacking is in PDF format to make it easy for you to apply the information in real world.

A Beginner's Guide to Ethical Hacking

Regular Price $67.00  Today's Price $20.00

Download Me

Note: Earlier CompufreakS.blogspot.com is now SECURITYHUNK.

Spying on Remote PC can be done in many ways....but today we are going to see how it can be done using RATS(Remote Administration Tools).This tutorial is a general one which can be followed for installing server of all types of RATS.Only thing that you have to notice are the terms associated and data that are to be filled.

This is a Black Hat Tutorial so I would suggest my readers to go through the DISCLAIMER before reading the tutorial.

For carrying out this attack you will need......

a)A Remote Administration Tool (Here i will be using Spy Net2.7Beta)

b)A FTP service and a host under No-Ip.com (How to?....Read here )

Note:Click on the images to Zoom them.

 So lets start......

1.First download the RAT,here i will use Spy Net 2.7Beta.

Purposefully I have not given the download  link,you can take the help of our best friend.... "Google"

2.Run it and click the "START  BUTTON"select your suitable language as shown in the image below.

3.Then click on "CREATE SERVER " and give a suitable name to it as shown in the image below.

4.After step 3. a user with the desired name has been created,now select that and click on "FORWARD"as shown in the image below.

5.Now you will be guided to the server installation process,so fill in the details as shown in the image below...inorder to know  how to fill  read this.


6.After that hop up to the next tab and fill that excatly as show in the image below,i have chosen "svchost.exe" as these are found in multiple in  MS boxes..... lol.

7.The next tab is the message...which means if  you enable this then that message will pop-up when the server is run on the victim's computer,here I am not using it.

8.Then open up the keylogger tab and fillup as shown below but in step 2. fill as said  described here.

9.Now hop up to "Create server" tab and fill as shown in the image below.

10.Now since the server is ready so make it FUD(Fully UnDetectable) by using crypter and you may bind it to some other file using a binder and scan it with novirusthanks.org(do not click on distribute option.)This part will be covered in detail my later post.

For Countermeasures read from below.....



( RATS:Remote Administration Tools & Spying on Remote PC )


If you find this post worth reading do drop a comment it will be appreciated...... :)

This is black hat tutorial is for Educational purpose,Compufreaks condemns black hat.(Disclaimer).

IF YOU LIKED THE CONTENT OF THIS BLOG THEN DO "VOTE" FOR IT........