Java Applet Attack on WAN with Metasploit and ZTE Router

Java Applet Attack on WAN with Metasploit and ZTE Router

 

 

Hi everyone ..!!
You must have seen a lot of video tutorials on Metasploit usage inside LAN or Wifi networks but have you seen any video demonstrating metasploit usage over WAN (Internet) network.Well, here in this tutorial i will show you how to perform a Java Applet Attack using Metasploit over WAN network or Internet.


So to perform this attack we need the following apps and gadgets:

• Metasploit Framework 

• Router to forward ports 

Why do we need to forward ports??:

Well some people questions that why do we need to forward ports??Can't we attack without it ??
Well, inside LAN network you don't have to forward you port because you have specific LAN ip address and it is your only signle IP on one interface.
In case of Internet/WAN network, we have an External(Public) IP and one Internal (Private) IP.I mean, when we are behind a router we have an IP like this 192.168.1.X while when you type on google that what is my IP, google will show some other IP like 182.170.X.X.We might have a lot of users behind our router with many private IPs like 192.168.1.10,192.168.1.11 and so on..!!
So when someone will write our external IP in his browser, how our router will know that which webserver it has to run.So, to make this confusion clear, we assign a port to each private IP in our Internal network.This is is called port forwarding.Now traffic coming on that specific port will go to that specific IP for which it has been forwarded.

How To Manage Multiple Gmail Accounts In FireFox

Do you love Gmail, Don't know about you guys about but i am a big fan of Google Products. When i am online i need more than one email account for my ease and its really helpful because i don't have to worry about my accounts Security .

I know what you guys would say, “its pretty hard to remember my Accounts Username and passwords”

 
But again if i use multiple accounts and i remember each and everything. 
But that's not with you guys and that's why i have written this blog article.
Now i introduce you to my Tool which helps me a lot to run various Email Accounts together.

Well there are many tools on the internet
Lets Start :-

Gmail Manager 0.5.7.5

The original Gmail Notifier for multiple accounts.
Allows you to receive new mail notifications along with viewing account details including unread messages, saved drafts, spam messages, labels with new mail, space used, and new mail snippets.

Further Reference

1. Well you can also Find more Firefox Add-ons for managing multiple Gmail Accounts HERE
2. Do you use multiple Google products then use this Firefox Add-on HERE

Finding IP address in Gmail From Email Header's

Email headers determine where a message is sent, and records the specific path the message follows as it passes through each mail server.

When You send an email to any of your friends or others could be your Girl friends Never mind. But When you send the email through any email client like Gmail , Yahoo Mail , Hotmail, AOL, Outlook Express, etc it also sends the Email Header which contains Some important information for Us i.e.Hackers.
 
Basically it is a feature of Mailing protocol.
Now when the victim sends you a Email through any ,Gmail, Yahoo mail etc doesn't matter, then mail comes to your inbox in the form of Email Header but the your Email client changes it and shows only readable part of it.

Well This article is based on how to view Email headers in Gmail. We Will talk about others in Future too. Yeah its a kind of easy tutorial....

Finding IP address in Gmail

1. Login to your Gmail account with your username and password.
2. Open the mail.
3. To display the email headers,
   • Click on the inverted triangle beside Reply. Select Show Orginal.
4. Look for Received: from followed by the IP address between square brackets [ ].
   Received: from [69.138.30.1] by web31804.mail.mud.yahoo.com
5. If you find more than one Received: from patterns, select the last one.

Ok Most of the users use Gmail i think and its the most popular one also from the rest of the email clients that's why i liked to write this one first.

Example

Here's an example of a message header for an email sent from MrJones@emailprovider.com to MrSmith@gmail.com:

Delivered-To: MrSmith@gmail.com
Received: by 10.36.81.3 with SMTP id e3cs239nzb; Tue, 29 Mar 2005 15:11:47 -0800 (PST)
Return-Path:
Received: from mail.emailprovider.com (mail.emailprovider.com [111.111.11.111]) by mx.gmail.com with SMTP id h19si826631rnb.2005.03.29.15.11.46; Tue, 29 Mar 2005 15:11:47 -0800 (PST)
Message-ID: <20050329231145.62086.mail@mail.emailprovider.com>
Received: from [11.11.111.111] by mail.emailprovider.com via HTTP; Tue, 29 Mar 2005 15:11:45 PST
Date: Tue, 29 Mar 2005 15:11:45 -0800 (PST)
From: Mr Jones
Subject: Hello
To: Mr Smith </MRJONES@EMAILPROVIDER.COM></MRJONES@EMAILPROVIDER.COM>

Notice the received is the stuff we need here to get the IP Address of the victim.

Received: from [11.11.111.111] by mail.emailprovider.com via HTTP; Tue, 29

Ok Hope You all got the idea of the Email Headers in Gmail. More will posted later

Gmail Goes https For Secure : Wi-Fi Protection

Google Just announced they are now moving to the Stable connection of https rather then the traditional connection of http. Gmail previously have also announced that they are making the Mails on https security but now Google is changing the whole connection to https.


The Reason are straight the Google is pretty much haded with the Chinese issues going onn. So its just the China which made this possible and special thanks to the hackers, as many of the people are now using SLL on their Gmail.

A group of 37 security and privacy specialists sent Google a letter (PDF) last June, urging the company to offer this feature. Gmail became the third-largest email provider last August, with more than 37 million unique visitors...
 
You can also change the Default use of https on your Gmail account by going into settings and checking Not always use https. The new turn in this story of Gay is that, Google is making this because of the Wi-Fi owners as many people are now using wifi and making a secure connection will be good.

This is pretty obvious that Google is haded with its security and is on a way to change the way it is done. Lets see if this https stops us from Hacking.

What you say ?

Mozilla Caught in a Bad Romance with Add-On

Ok, i know the title of this post is kinda funny but that's what this news is all about, one of the greatest internet browsers of this time Mozilla Firefox and with other products also. This have been spread in the form of Add-on’s.
 

These aren't just add-on’s the real problem is that they are infected with Malwares and they have downloaded by many of the people worldwide.

According to the researchers “Two Firefox add-on’s available for months on Mozilla’s website infected users with malware that stole passwords and opened a backdoor on Windows machines, the open-source browser maker has confirmed.”…

According to Mozilla, version 4.0 of So think Web Video Downloader is infected with password sniffer Win32.LdPinch.gen and Master Filer is infected with the backdoor trojan Win32.Bifrose.

Which is worst for a popular web browser company as it would spread rapidly and would be more dangerous. But this is where it gets embarrassing for Mozilla – the infected add-ons have been available from the official download site for several months and, according to Mozilla, have together been downloaded around 4,600 times.


These were discovered about on the days between 25th of Jan to somewhat near and sure they have removed them and working on it to remove them fast as many of the antivirus software's have already recognized and are removing them.

That script, designated HTML.Xorer also appears to have slipped past Mozilla's anti-virus scanner. As a result, Mozilla developers announced that the add-on directory would in future be checked for malware on a daily basis.

So, What do you think ? Is it just mozilla or Google Chrome would be next ?

Ubisoft Hacked : Fake or Real ?

Some days ago we got news about Ubisoft being hacked by some hackers and was being believed till yet but after then some news breached out that the images of the hack was fake.


So, this is kind of big story. The ubisoft is a company which is been known and you can say is good in DRM and Anti-Hackers activity, as you can see there games such as Assassin's Creed and many others have been out of cracked games folder and are a DRM king game…

But as you can see we and most ‘em gamers won't be happy with the Ubisoft’s way of gamming. So what they do they hacked the Ubisoft’s website for a short while some days ago on 14th March 2010.

Its right if you see it from my mindset :D but as they gamers are freaked out on the ubisoft for there way of gaming products. This is what would be happing as of crackers won't be so patient to crack some ubisoft shit.

Screen’s

When it Faked out

2nd part starts now when some news break out that the images of the hack were fake and The ubisoft’s was down just for the maintenance work. Well we don't know if the site was hacked or not but various sources are saying it was and some are saying it wasn't.

Whatever is the truth the thing here is that DRM is what lets every hacker to work against any company. You don't believe me then see iPhone, iPod, Halo, Call Of Duty etc are some victims of DRM which hackers and crackers have cracked out.

Screen’s

This image shows another story of the incident which Ubisoft would have gone through. Whatever happened.

What Do You Think Fake Or Real ?

MacOSX Gets Massive Security Update

This is kinda weird but safe for the users at the same time Apple have just launched the update for the Mac OSX with a severe patchment of 92 vulnerabilities. Well it have also breaked the previous record of the Mac OSX update released last year, when Apple 's largest patched 67 vulnerabilities .



The update brings Snow Leopard to version 10.6.3, making this the third major update to the OS that Apple launched in August 2009. Apple also addressed a list of nearly 30 non-security issues in the 10.6.3 update. Leopard users, meanwhile, received only the security patches ..

As a matter of fact, most of the patches were for the QuickTime player for the Leopard OS and it was expected as we have already been knowing many of the Mp4 Zero Day exploitations etc and due to the Pwn2ownage conference the exploits shown there was a big reason for this turn out.

"The sheer number, it's almost so daunting that you don't even want to look," said Andrew Storms, director of security operations at nCircle Network Security.

Today on 30th Apple came out with a update of 42 security fixes which is about the 40% of the total number of the security apple is working onn. The other thing which is kinda in favour of apple is that they don't rate/score there patches like some of the other giants like Microsoft and Oracle.

RSnake’s Magic

The other news we got for you is that RSnake and his friends have done some research on this and found some of the exploitations in the safari browser which is regarding the port number float/integer overflow which can cause alot of damage.

“Safari has a typical integer overflow in the way they look at ports. So if you add the number 65,536 to the port you want to connect to (in this case 25 + 65,536 = 65,561) you can bypass their port blocking.”

And the best thing to note here is that Apple beat with the blacklist of ports or even whitelist of ports as it can be used in mass exploitation for hackers. Well lets see whats next.

Charlie Miller, the researcher who cracked Snow Leopard's security defenses to take down Safari, said today that Apple had not patched the vulnerability he used last Wednesday.

"New patch doesn't fix pwn2own bug," Miller said via Twitter .
"Sorry suckers, gonna have to wait for the next patch."

XBox Live Hacked or Suffering Connection Issues

Today Xbox Live users are suffering some Connection Issues and this is excepted as yesterday only the Xbox live account of Xbox’s Live Programming director’s was Hacked. So this points to the Xbox Live is been hacked aka compromised.

It is more likely that the Xbox live is hacked as the account of one of the makers of the Xbox live account was hacked yesterday only. While this can be a Connection issues too as the Expansion pack of Modern Warfare : “Stimulus Package” is out today which may have caused problems for the Xbox live servers as of large incensement in the connections ...

Xbox Support’s Twitter account is loaded with communications with customers about the problem, and the official support website at www.xbox.com/support is being bombarded by users.

“We’re aware of the issue and it is being worked on. Stay tuned for updates.”

An error code of 80150019 have been shown to the users of the Xbox live users. As the users are like not happy with this situation and would be likely as the Microsoft is in problems again.

… Talking about the Hacked account of Major Nelson’s of Xbox Live, Shortly after the hack happened, the Web site Lightzz took credit for the hack, posting a video of it, along with the hacker's Skype name. He is offering to hack other accounts as well.

   Well whatever is going we will update this post as soon as Microsoft figures it out is it hacked or connection issues.

Net Wars : New Challenge For Hackers [Video]

Net Wars are a new talent hunt for hackers that are good in hacking field and if they win they are given a job of ethical hacking. or if they not they can even get a handful of contacts and goodies too.
 
Some days ago CNN covered the story of this challenge which is currently taking place in U.S. These challenges are taken under by SANS : The most trusted source for computer security... Ya we all know the big SANS. if u dont know who are sans, its a organization of high end ethical hacking teachers and they provide some qualifications in US for ethical Hacking...

The United States Cyber Challenge

A national competition and talent search to find and develop 10,000 cyber security specialists to help the United States regain the lead in cyberspace [ 5/8/09 ].

The web pages for the US Cyber Challenge will be posted on May 29 at www.sans.org/uscc and at other sites. To learn more about the program prior to May 29, email USCC@sans.org

1.The Need
2.The Competition and Skills Programs
3.The Sponsorship...


Here is what they said about, why they need some hackers aka great security guys in there force and why now.

“The cyber threat to the United States affects all aspects of society, business, and government, but there is neither a broad cadre of cyber experts nor an established cyber career field to build upon, particularly within the Federal Government. [Using an] airplane analogy, we have a shortage of ‘pilots’ (and ‘ground crews’ to support them) for cyberspace.” (Center for Strategic and International Studies, Report of the Commission on Cybersecurity for the 44th Presidency, December 2008)

“The provisioning of adequate cyber forces to execute our assigned missions remains our greatest need.” (Gen. Kevin P. Chilton, Commander, U.S. Strategic Command, March 17, 2009, in testimony before the House Armed Services Committee)

“I cannot get the technical security people I need.” (Gen. Charles Croome, Commander, Joint Task Force ‐ Global Network Operations, in response to a question from a CSIS Commissioner asking what is the most critical problem he faces in meeting the growing cyber challenge. May 28, 2008)

“There are about 1,000 security people in the US who have the specialized security skills to operate effectively in cyberspace. We need 10,000 to 30,000.” (Jim Gosler, Sandia Fellow, NSA Visiting Scientist, and the founding Director of the CIA’s Clandestine Information Technology Office, October 3, 2008.)

Happy Hacking @hackerthdude

Hack Bsnl Broadband Username And Password

This is the most effective and the most prominent way to hack any bsnl username and password,

Its great that you are reading the above tutorial.



On the note i would like to tell you that it can even work or even not so Don't panic if it doesn't work in your case we will find something else. Enjoy


First Download Angry IP Scanner. Use Below Link
Click Here
  Step 1  :

Start Angry IP scanner and goto options ports.
Type in 80 in the first ports textbox and click ok.
Then goto options ; in the display section select "only open ports" and click ok - save.
Now on the main screen put in the ip scan range as something *.*.0.0 - *.*.255.255 (for e.g. 117.201.2.3) and click the start button.
And the list that shall follow next are the victims. In this example we choose the range 117.201.0.0 - 117.201.255.255.

You will be surprised at the number of victims you discover.

 Step 2  : Pick the ip-address of any of them and open up your browser and type in http://0.0.0.117/.*.*.* (the * should be replaced by the values from the ip you are using. A box will popup asking for username and password.)

Enter the username : admin and password : admin .


There is a high chance that you will be able to login with that username and password.admin-admin is the default username and password that is set while manufacturing the adsl modem devices.

What follows next is the modem administration panel.Simply search for the "WAN" option and click it.

On the next page you will find the username and password of that user. now right-click on the page and click view source. in Mozilla/Opera This frame -> view frame sourceNow in the source code search for this : INPUT TYPE="PASSWORD" and
the value field of this input element will have the password if its not there as in case of D-Link DSL 502T ADSL Routers the search for this Step 3:input type="hidden" name="connection0:pppoe:settings/password" value="password" id="uiPostPppoePassword"

and the value field will have the passwordAnd this exposes the weak security of bsnl broadband users.

(For Educational Purpous)
Dont Forget Give me a thanks

How to Hack Someones ISP Password

OK this is pretty amazing hack for you guys, you gonna enjoy it as i have enjoyed it in my back days when i was introduced to this hack.
This Hack is much dependent on the Victim and hence it would really help you to be successful if the victim is

 Follow These Steps :- 

1. Run your telnet program : On windows , go to START - RUN - "TELNET".
on Linux , you should open a shell , and write telnet.

2. Then connect (on windows "connect" , on Linux "open") some anonymous server , if don't have any then search for one , if you are too lame then email me now! I'll give you in the minute!
NOTE : you should connect the server mail program (port "25")

3. Now , write the following :

mail from:[**YOUR FRIEND'S ISP WEBMASTER**]
rcpt to:[**YOUR FRIEND'S EMAIL ADRESS**]
data
Hi there [YOUR FRIEND'S NAME] , this is [NAME OF YOUR FRIEND'S ISP] support team , lately , our server had some problems with the connection and the user-password files were destroyed , a backup was then released , and it was ok.
but yesterday we found out that it is not an updated version of the file , so , it will start charging you for a larger amount of money for each our you use!
- - - - - - - - - - - - - -
To correct the problem , we have made a speical program to correct the error , all YOU have to do is email :
"[**YOUR'S FRIEND'S ISP NAME**]@GalaxyCorp.Com" and in the SUBJECT write your "user name" and "password".

NOTE: No money will be returned if you don't follow our instructions!

Thank You,
Your Support Team

4. Press enter twice and then write "."(without the "") and press ENTER!

Now , The places you saw ** say that maybe you didn't understood it all , so I'll give you a simple example .
[**YOUR FRIEND'S ISP WEBMASTER**] - example , if your friend is connected through AOL , then type "webmaster@aol.com" , get it?

[**YOUR FRIEND'S EMAIL ADDRESS**] - example , if your friend's email is john@aol.com, then type "john@aol.com".

[YOUR FRIEND'S NAME] - if your friend is called "John" then type "John".

[NAME OF YOUR FRIEND'S ISP] - if your friend is connected through AOL(American Online) , then type "American - Online"

"[**YOURS FRIEND'S ISP NAME**]@GalaxyCorp.Com" - this is the hard-part , but if you are reading this , then don't worry , you're one step from the end! ..

uTorrent 2 To Speed Downloading By Fixing ISP Throttling

 There is a new buzz on the internet that BitTorrent to speed its downloading by fixing the ISP Throttling . The new version of uTorrent 2 will be optimized by the company in such a way that they are promising a new and rich downloading experience to its users. 

Years before Many ISP’s Have argued with the BitTorrent Inc. on the certain topic that with high number of BitTorrent connections are slowing down other applications and traffic, affecting its users download speed and their product quality.
With this Argument the company Officials Answered,

“ISPs have to invest in making their networks better and faster rather than stifling applications which consumers use and love,”

While encouraging users to switch to non throttling ISPs if possible, or complain to their ISP’s customer services.

What is Throttling ?

Bandwidth throttling is a method of ensuring a bandwidth intensive device, such as a server, will limit ("throttle") the quantity of data it transmits and/or accepts within a specified period of time.


For website servers and web applications, bandwidth throttling helps limit network congestion and server crashes, whereas for ISP's, bandwidth throttling can be used to limit users' speeds across certain applications (such as BitTorrent), or limit upload speeds.

*Source Wikipedia

BitTorrent

get widgetminimize

BitTorrent

Acquisitions

1 Acquisition

Funding Received

^$35.75M in 3 Rounds from 3 Investors

Headquarters:

San Francisco, California

Description:

BitTorrent is a protocol that creates advanced technologies to efficiently move large files across the internet.

Founders:

Bram Cohen, Ashwin Navin

Categories:

Software, Apps, Peer-to-Peer

Website:

http://adcoock.com/sites/top-45-best-torrent-torrenz-download-sites-torrenz.html