ORKUT/GMAIL ID HACKING WITH SOCIAL SOCIAL ENGINEERING : HACK ORKUT ACCOUNT

This is one of the best way to hack ur friends orkut and gmail account in simple way . let me make it clear now how social engineering work with this practical example.

To hack ur friends account first of all u need to become friends in orkut .

then follow this details step by step.

1.select your victim and start chatting with him.

2.ask his mob no and tell him that ur orkut acc need varification.

3.if he gave u no like 9856.......57 .

4.now take him victim id from visit his profile like id is subedh@gmail.com

5.now go on  https://www.google.com/accounts/recovery Google Pass rEcovery Operation 

and paste his id and submit it for continue .

6. now paste his no like 9856....57 into "get verification code on my phone" and continue it.

7.now tel ur victim to give ur verification code.

8.and change pass 

80% people give his no they thinks u need a verification.

happy hacking and don't fall such a stupid social engineering .. My Dear :)

ATM HACKING | PROTECTION AGAINST ATM HACKING

We all uses ATM to get rid of problems that resides while transecting from bank.
We already posted an Article on Credit card hacking for free marketing
Today Posting On ATM Hacking.
Now These Days ATM hacking is the most wanted Article by the hackers.

Today we are posting a small but useful article On ATM Hacking and protection against that.
Before we start lets understand how ATM works.

Working Style Of ATM

An ATM is connected and communicate through a host processor. The host processor is analogous to an nternet Service Provider (ISP) in that it is the gateway through which all the various ATM networks become available to the cardholder (the person wanting the cash).

The Leased-line machines connect directly to the host processor through a dedicated telephone line. Dial-up ATMs connect to the host processor through a normal phone line using a modem and a toll-free number, or through an Internet service provider using a local access number dialed by modem.

The initial cost for a dial-up machine is less than half that for a leased-line machine. The monthly operating costs for dial-up are only a fraction of the costs for leased-line.

The host processor may be owned by a bank or financial institution, or it may be owned by an independent service provider. Bank-owned processors normally support only bank-owned machines, whereas the independent processors support merchant-owned machines.

Warning:- Hacking ATM is highly illegal. Can Put you into cell for minimum 3 years along with fine 7 lac.This is just for education purpose only ,respect the law in your country.We are not responsible for any incident after reading this

Methods Of ATM Hacking

a)Magnetic Reader

Here ATM hackers attach a Magnetic reader over the card slot on the ATM.As any one pin the card inside automatically it reads the magnetic information.
And with the advancement of time the with the help of wireless technology, the magnetic reader automatically transmitted the details to fraudsters in a nearby location.

b)Hidden Camera

Here the hacker use a webcam to keep an eye on the ATM users. As we all know our ATM is protected by a PIN which acts as our password so if some one have to get money after stealing our card he/she should have the PIN code too,These days criminals have a solution for this too.
Hackers enter into the ATM when Guard is absent install a hidden camera near by the keypad of the ATM from the user enter his/her PIN CODE, and again using the latest technology (wireless) and the PIN is digitally recorded and now hacker have the choice whether he want to get the details remotly or he/she will go to ATM and get the details by himself/herself.

Ways To Stay Protected Against ATM Hacking

1)Do not Disclose the PIN CODE to any one try to remember.
2)If found any camera which you think not supposed to be there do inform the ATM guard and the near by Bank.
3)DO confirmation of completeness of the transaction after getting the money.
4)If you find any thing Unusual in ATM, Put reverse your pin number (suppose if original pin is 1234 put 4321).if you are having palindrome number put '0' before pin number.
More information you can find At The ATM On the Notice board.

Thanks for reading.
All this post is for educational purpose only...Plz share it Thank You

Authentication Hacking attack

Authentication plays a critical role in the security of web applications. When a user provides his login name and password to authenticate and prove his identity, the application assigns the user specific privileges to the system, based on the identity established by the supplied credentials.

HTTP can embed several different types of authentication protocols. These include

• Basic - Cleartext username/password, Base-64 encode (trivially decoded)
• Digest - Like Basic, but passwords are scrambled
• Form-based - A custom form is used to input username/password (or other credentials) and is processed using custom logic on the backend.
• NTLM - Microsoft's proprietary authentication protocol, implemented within HTTP request/response headers.
• Negotiate - A new protocol from Microsoft that allows any type of authentication specified above to be dynamically agreed upon by the client and server. Also adds Kerberos for clients using Microsoft's IE v5+.
• Client-side Certificates - Although rarely used, SSL/TLS provides an option that checks the authenticity of a digital certificate present by the Web client, essentially making it an authentication token.
• Microsoft Passport - A single-sign-in (SSI) service run by Microsoft Corporation that allows web sites (called "Passport Partners") to authenticate users based on their membership in the Passport service. The mechanism uses a key shared between Microsoft and the Partner site to create a cookie that uniquely identifies the user.

These authentication protocols operate right over HTTP (or SSL/TSL), with credentials embedded right in the request/response traffic.

This kind of attack is not a technological security hole in the Operating System or server software. It depends rather on how securely stored and complex the passwords are and on how easy it is for the attacker to reach the server (network security).

Distributed Scan

Distributed scan works by dividing the scanning scope among multiple attack platforms. In such case, each attack platform performs a normal scan for a small range of port numbers. Although this is not 100% spoofing mechanism, it increases the overhead of the system administrator on the other side to trace back the attacker [e.g. there could be hundreds of originating IPs.] Furthermore, those originating IPs could be compromised
hosts of innocent people.

Advantages of Distributed Scan are:
• It minimizes the scan time since multiple scanning platforms are working in parallel.
• Tracing back the attacker is a little hard since there are many originating IPs appearing in the logs of the scanned network.

Disadvantages of Distributed Scan are:
• It requires that the attacker is controlling, in one way or another, all the scanning platforms.
• There is no real spoofing in this technique since all the IP addresses appearing in the scanned network are truly the IPs of the scanning machine.

Decoy Port Scan

    Decoy scan works by sending more than one packet per port. All of these packets
carry spoofed source IPs except one packet, which carries the original scanner IP address.
By doing so, the attacker guarantees at least one reply packet which is the reply to the
scan packet carrying the correct IP address. All other replies will not reach the scanning
machine. This scan type is done using the (-D) switch of nmap tool as follows:
# nmap –sS –P0 –D217.89.54.23,64.56.23.21,98.76.54.32 –p1-1024 10.10.10.10
Decoy port scan is done to make detection of the original scanner harder. The administrator of the scanned target cannot tell exactly which one of the used IPs is the
real scanner’s IP. However, if all IPs were investigated, investigation could lead to the
original scanning IP.

Advantages of Decoy scan are:
• Results are guaranteed. Since reply packets arrive at the scanning machine, the attacker can have true results of port status.
• Freedom of spoofing. Each spoofed IP used in the decoy is not bounded by any set of IPs Disadvantages of Decoy scan are:
• Detection is not impossible though it is hard. Since all used IPs are logged in a way or another on the target system, heavy investigation could lead to the original attacker.
• Lots of traffic. Since for each scanned port there are many packets, this will increase the traffic flow.


Disadvantages of Decoy scan are:
• Detection is not impossible though it is hard. Since all used IPs are logged in a way or another on the target system, heavy investigation could lead to the original attacker.
• Lots of traffic. Since for each scanned port there are many packets, this will increase the traffic flow.

Normal Spoofing Scan

    This is the simplest among all other technique. All the attacker needs to do is to spoof
the source IP of the scanning machine to any other IP without worrying about anything else. That spoofed IP is used for all scan packets. Also, that spoofed IP can by any valid
IP address and does not have to be within the subnet IP range of the scanning machine.
    This normal spoofing could be done with the (-S) switch of nmap tool:

# nmap –sS –S 217.64.121.34 –P0 –p 1-1024 64.23.16.21

However, this technique suffers from a major drawback. That is, there will be no results since all replies will be forwarded to the spoofed IP. The scanning machine will never receive any of those replies. One reason an attacker might attempt such type of spoofing is to fool the scanned target into thinking that somebody else – probably a competitor – is scanning them. The attacker here is not concerned about the replies or about the port status of the target.

Advantages of this spoofing technique are:
• Freedom of spoofing. The attacker is not bounded by a specific range of IPs.
• No wasted or unneeded initiated packets. The attacker sends one TCP/UDP
packet per port.
• No tracing of the original scanner. Detection of the scanning machine is impossible at the IP layer.

Disadvantages of this technique are:
• No replies. There will be no reply packets arriving at the scanning machine.
• No results. Since replies are not received, the attacker won’t know port status.

Dynamic Port Scanning

Dynamic Port Scanning is a new methodology that aims to dynamically spoof the source IP of the scanning machine. What is meant by “dynamic spoofing” is that each TCP or UDP scan packet has a randomly generated IP address. However, that IP address
must fall within the local subnet IP range of the scanning machine. The underlying implementation of such methodology is solely dependent on the integration of ARP
poisoning/spoofing into the scanning process.
    ARP poisoning/spoofing has been in place since the creation of TCP/IP protocols. It has been known and used for network traffic sniffing and interception in switched
network. However, this paper will show how ARP poisoning/spoofing could be used in conjunction with port scanning to achieve the dynamic way of spoofing the source IP of the scanning machine.
    In general, Dynamic Port Scanning [DPS] is implemented by ensuring that the ARP cache of the target host or even the default gateway is poisoned by fake IP/MAC entry which allows scan reply packets to carry the MAC address of the scanning machine. Although the reply packet is destined to a fake IP address (i.e. the spoofed IP), the
placement of scanner’s MAC address as destination MAC address in the reply packet enables that packet to arrive correctly at the scanning machine. The process of poisoning the remote ARP cache is done for each TCP/UDP scan packet that carries a spoofed IP
address.
   This paper will discuss deeply the process of Dynamic Port Scanning [DPS]. First, the paper examines current methodologies used in spoofing the source IP while scanning. Then, it will describe the new methodology along with TCP scan types. Finally, a new open-source tool called Dynamic Port Scanner [DPS], which does exactly the technique described in this paper, is outlined.