SecurityHunk

Many people open there inbox in-order to check their email or send a email and then sign-out but what we do not know that there are indeed lot of things are carried out when we simply send or receive a email.

There is a detail report/history of all those things  that are carried out and are attached with the email.

Yes, I am talking about email headers.They are kept hidden from normal user but we can certainly view it.

These headers comes very handy when tracing email, filtering spams, recording the Ip address of the sender etc. So, let's see what email header is all about and later in the post we will see how to get email header.


What is Email Header?

It is a record/report/history of  the email which covers the path from the sender to the receiver and also contains the vital information about the email servers that it has encountered in its path.

Few emails also contain digital signature to detect the tampering of the email in the path.

What information we can get from Email headers?

As i mentioned above we can get the history of the email and the information on the path the email has traveled to reach us.Lets see what information we can get from it.....
                               
            1.When the sender has composed the message(Date,Time)
            2.When the email was sent from the sender's PC to the email server.(Date,Time)
            3.When the email was sent from the email server to the intended receiver.(Date,Time)
            4.The type of protocol used in the entire path.
            5.The PC of the sender can be identified from the Header.
            6.The IP address of the sender but not always.
            7.The type and the number of digital signatures on the email I mean the type of algorithm.
            8.What type of email-client the sender has used to send the email
            9.The ISP of the sender. 
           10.If any third party is using any tracking means.

How to view Header of an Email?

Here I have listed out not all but few of the web mail providers and email client using which you can get email header.

1.Gmail: Login in a standard version >Open email of your choice >Click the down arrow next to reply >Then select show original.

2.Yahoo: Login >Select the desired email >Click on action drop down menu >Select view full header.

3.Hotmail: Login >Select Inbox >Right click on the desired email >Select view message source.


1.Outlook Express: In order to view email header in outlook Open it >Select  the desired email from Inbox >Right click on it and select Properties >Details.

2.Mozilla:Open it >Open the desired email > Click view menu >Message source.

How to read an Email Header.

Here I have taken the example of my Gmail account to explain, we will see how to view email header in gmail.

As mentioned above we first need to open up the header of  any desired email as shown below.

(Click on the image to zoom it.)

 This is what you will get in a new window as shown below.

(Click on the image to zoom it.)

As you can see i have divided the whole header into 3 sections.It is worth mentioning that a header is always analyzed in bottom to top approach.This is because most of the vital informations about the sender is there at the bottom.You can say in the above image section1 is for destination mostly and section3 is for source mostly.

Section 3:

(Click on the image to zoom it.)

MIME-Version:1.0:MIME stands for Multipurpose Internet Mail Extension. It tells about the types of attachments in the email.It allows to send sound,graphics etc.Here the Mime-Version field shows that it is currently in 1.0.

Received:by :It show the time and date the email reached the Gmail server.

In-Reply-to: and References : Both are same,as the name shows it means whether the sender has sent an reply to the past message or is a direct new message.If it is a reply message then it contains the reference of the past message.This is an unique number.

Message-ID:This show the system from which the email has originated,I mean the senders's PC.It can be changed or forged easily.This is also a unique number.

To: and From: It gives the sender's and receivers email-id.

Content type:What type of content is there in the email ie. text or image or anything else.
Section 2:

(Click on the image to zoom it.)

What is DKIM-Signature?

DKIM(DomainKeys Identified Mail) is a digital signature put on every email we send or receive through email servers.It is used because the emails cannot be tampered or altered in its path.This mechanism is also used in spam filters as spam do not have any digital signature.

In the above image there are certain values let me explain.
                  v=Version
                  a=The algorithm used by Sender or Originating Web mail provider.
                  c=canonicalization algorithm of header and body.
                  d=Sender or Originating Web mail provider.
                  s=Selector
                  h=Contains the list of all the digital signature done on this email.
                  bh=Body hash
                  b=Digital signature of header and body.

Section 1:

Delivered-To:It contains the email-id of the receiver.

Received:by : You can see there is a  2 second difference in time between the "received by:" in section 3 and section 2.It shows the time and date the email reaches the gmail server.

Return-Path: The sender's email-id.

Received :from :Specifies the Ip address of the sender generally in "[ ]" but in gmail it is masked by the gmail server address.

This video explain in detail the insights into what is Email Header using Mozilla Thunderbird client.



If you find this post worth reading then do drop a comment,it will be appreciated.

 "Ramnit"  the worm with multifaceted spreading capabilities,first detected on 2010 for infecting local systems. Now the hackers behind it have redesigned it into a more advanced kind of worm.The worm has already stolen 45000 facebook credentials and still on move.





It is also confirmed that this worm is able to bypass the two level authentication used by banking organizations and online money transfer.Below I have taken the snapshot of the code of the worm that was detected in 2010.
 It comes from online malicious sources and   creates infected .html files through that it infects the executable and .dll files. As,depicted in the video below.





But as the worm has spread its root to financial and social media so it a big concern.Users are advised to change there credentials in every 14 days.

Android in the one of the widely accepted OS in devices(phones,Tabs etc) these days because of its largely managed apps and control it give to its users.Where is honey so bears are there......
I mean because of its popularity it is one of the hotspot for attacker these days.So,I thought of sharing few security tips with my readers,for that the apps we need to work with will be functional on certain criteria that is we need to have root access on the device.Before going into the security part of it I would like to give my readers a basic idea about rooting.

What is Rooting in Android?

"Root" as you all may be knowing is related to Linux and it is analogous to administrator in Windows.So rooting an Android device means we get the full access and freedom on the functionality of the device,in windows language we can say we have the admininstrative previlage.So,the process by which we get the root access/previlage is called "Rooting".

Why we need Rooting?

1. Full access and control over the device.(Superuser access)

2. Make your device fast to your wish.

3. Add more apps of your choice.(Will be covered in the next Post)

4. Use the OS version of your choice.

Disclaimer: Root may cancel/void your warranty.Carry out the process at your own risk,the author will not be held responsible for any damage caused to your device.

How to root an Android device?

Instead of giving a detailed tutorial I will cover the basic overview of how this is exactly done and the tools and software associated with it.Here it is worth mentioning that all the android based devices do not have excatly the same rooting procedure.So,here I have listed out all the possible methods.

Note:Install Microsoft .Net Framework version 2.0 or greater.
         Enable USB debugging in device settings.
         Need USB drivers for your device and install it.

1.Rooting Android devices with SuperOneClick.

2.Rooting Android devices with Universal Androot

3.Rooting Android devices with Z4Root.

4.Rooting Android devices with flashRec

5.Rooting Android device using Easy Root.

6.Unrevoked Method:
If the above mentioned methods are not compatible with your device then you may try this method.This method is mostly used for HTC devices.You may download Unrevoker here.

 A Reference of how to "Root a HTC wildfire(Video Tutorial)".

You may need the below mentioned help before working with Unrevoker.

     * S-off tool  Revolutionary (Download)
    
     * You may need a Rom to get downgrade(Download)
   
     * Need to find the HBOOT version,as we may need it.


7.Rooting Android 2.3 Gingerbread devices with GingerBreak.

If the Android is 2.3 then no need to downgrade it to 2.2 and start rooting,you may see if your device is compatible with GingerBreak exploit.Follow the reference here as this may help you carry out the steps.

After you are done with rooting then you may install the desired OS version and add your custom ROM.

I hope this post will come to your help.If you feel that I need to add any thing else then feel free to drop a comment. :) 

"Yersinia" a type of bacteria but here in context to this site it is  a  Network tool designed to analyze,test and monitor  the weakness in different network protocols listed with it.

Attack on the following Network Protocol are possible as listed below.

Home Page : http://www.yersinia.net

Inguma is a free penetration and vulnerability research tool kit written in python, recently the new version has been released after 3 years and with a very user friendly Graphical user interface.

1.Learn more about it here.

2.Visit there blog for more updates.

Download Inguma 0.2 :

1.Inguma-0.2.tar.gz

2.You can use it with Backtrack as it comes with it under Pentesting tools.

We discussed Metasploit framework in a post and today in this tutorial we will be discussing about Fast-Track which is very easy to use as compared to metasploit as we will see later in the discussion.Here we will discuss how to generate payload using Fast-track from its menu driven interface.

What is Fast-Track?
 It is an open-source project in python and brain child of David Kennedy to come in help during penetration testing with the blend of metasploit framework to make pen testing automated.It makes it very easy for pen testers to exploit the client side data ,improper patch management etc.It has dependencies on metasploit,SQLite,FreeTDS etc.It is advantageous as compared to metasploit beacuse of its very user friendly usage.

What is Payload?
It is actually the work of the exploit that is the result or effect.For example while using any exploit on a targeted box we may get the shell,VNC desktop or access to the files etc on the attacker box.

What is Shellcode?
It is the opcode(Operational code) that can be executed on the targeted box to get the command shell etc.It can be encoded to bypass antivirus detection.

Requirements:

1.Backtrack

2.Virtual environment software.(Vmware player/Virtual Box)

>> Learn how to boot Backtrack from USB
>> Learn how to use Virtual Environment

Procedure:

Step 1.
Boot backtrack and open a shell console and change the directory to " cd /pentest/exploits " and
type "python setup.py install" to check if fast-track has all dependancies install so that it will download from online as shown below.
Step 2.
Now type "python fask-track.py" inorder to select the desired interactive mode.Here I have selected the menu driven mode (./fast-track.py -i) as in this discussion we will be using that.
Step 3.
Now as I got the menu for fast-track usage in the screen, I selected no.6 that is "Payload Generator" as shown in the image below.
Step 4.
Now in this step we have to select the type of payload from the given menu,here I have selected "Reverse_Tcp Meterpreter" that is no.2 as shown in the image below.
Step 5.
Now we need to encode our payload inorder to bypass the AV ,here we have selected no.2 as shown in the image below.
Step 6.
Now we need to enter the host IpAddress and the desired port.Then select the form of payload that is "executable" or "shellcode" as shown in the image below.
Step 7.
As you can see the payload is being saved in .txt format so,we can get the shellcode from it.If we would have choosen the "executable" format then a .exe file would have been created.

Step 8.
If the .exe file is run in the victim's box and we have setup a listener then we can get the meterpreter seesion on our desktop as shown in the image below.
 In the next post we will see how we can use the shellcode generated to make an executable.

If you find this post useful then do drop your comments it will be appreciated... :)

In Microsoft Windows user account password and information are stored in a file called SAM. The windows SAM file location is “%systemroot%\system32\config” and also a backup copy of the file is also stored in ”%systemroot%\repair”.Here in this post we will see how to use John the Ripper for windows to extract the information.

As part of Windows 10 Password hack, we will be using brute force password cracker that is John the Ripper and Pwdump7.In this John the Ripper tutorial we will keep things simple for understanding and keeping in mind if any beginner is following it.

In Windows 10 and earlier versions till Windows SP3 the SAM file is by default locked with syskey enabled so we cannot open it as such and view its content so here in this post, I will show you how we can crack it and retrieve the hash.

You may be wondering what does SAM stand for?

It is can be expanded as Security Accounts Manager, it stores the user credentials information.

Requirements:

1. Pwdump7: (Download)

2.John the ripper Download

Procedure:

Step 1. You need to have the administrative privilege then open up command prompt window, using the command prompt go to the directory where pwdump7 is present and follow the on-screen information as shown below.

Step 2. After all the hashes are being displayed on the command prompt screen right click on the title bar copy it then pastes and saves it in a text file.First right click and mark the screen before copying. Here I have saved it as pw-hash.txt

Step 3.Having downloaded John the ripper for windows browse into John’s root directory and use the command as shown in the image below.

Step 4.The command we have used above is “C:\JOHN\RUN>john-386 C:/pw-hash.txt –users=Administrator”, the format of the command is “john-386 [Hash file path] –users=[Username]”.Here the hash file path is “C:/pw-hash.txt” and the username is “Administrator”, by using the above command then the John will search for the password of Administrator.

You can also use “C:\JOHN\RUN>john-386 C:/pw-hash.txt” so that John will search for the password of all the usernames available.

If you have a John the ripper wordlist then you can use the wordlist mode as well.

john --wordlist=password.txt pw-hash.txt

I think from this post we were able to understand how to use John the Ripper for windows Tutorial and Pwdump7 .

If you find this post useful then do drop a comment it will be appreciated.

Key logging or Key stroke logging is an unethical way of monitoring the key strokes of a person without his knowledge.This is a very successful attack with success rate of 80-90%.This can also be used to grab the form or screen image of the person.This is carried out in form of hard ware or software.

"In this article we will basically concentrate on software based keylogging"



Hardware keylogger:
It does not need any software it is purely hardware based,it is connected in between the computer and the keyboard ie. it is inline with the keyboard cable connector and computer.It carries a drawback that is it needs physical installation and sometimes it may came to the notice of the user.


Software keylogger:
It has a greater success rate than its counter part because of its remotely administrative facility.he main drawback with it is that some times it get caught by some security tools installed in the system.It has also more functionalities than the hardware based one.Nowadays anti-sanboxie,anti-av option keyloggers are available which has increased its success rate.How an attack through software keylogger is carried out?

1.The main thing is choosing a proper keylogger otherwise the attacker himself will be infected and give away his own password to some other person.

2.One would prefer "EasyLogger1.1.1"(image shown above) ,it is a freeware and stores the keystrokes in the email account mentioned in it.

3.It has anti-sanboxie/vmware and anti-Avs functionalities.

4.The most important thing is that as you can see it asks only for "Gmail username" and not the password which increases its popularity in comparision to its counter parts.

5.After entering all the information it makes a sever which is an .exe file

6.One should look out for a good stub file for it.

7.It should be made fully undetectable (FUD) to hide it from security tools.
by using  a good crypter software or use hexing after making the sever.

8.Then a binder is used to bind it to some other file which can draw the victims attention like a torrent file,game,music file,image etc as we know virus comes with many extension.