Some comman HTools (Tool 1)

Now on I'll be posting about some common tools i know...
The tools covered here will allow you to do packet crafting, packet sniffing, port binding, and other neat stuff. With that said, let's get on with it!

Sniffing packets

Being able to see and verify packets is a critical ability. This also applies when you are at home and trying to understand a tool’s output. It also is of importance when you are trying to troubleshoot a problem on your network. So suffice it to say that you really must have a packet sniffer installed on your computer. I have said in the past that you really should simply install windump vice ethereal for it forces you to become familiar with a packet’s contents. Safe to say I have not changed my opinion since then. Seeing as some of you may be installing these tools on Win XP SP2 I have tried to find the tools that will work with it. I have not been entirely successful, so please realize that I would suggest you have as your test box either Windows 2000 Professional or Windows XP SP1. Sadly with the release of SP2 a lot of raw socket functionality was broken. Some tools have been able to compensate for this and others have not.

With that said let’s go and install our packet sniffer that I know works with XP SP2. Please download the tcpdump tool that we will install. The reason I suggest downloading this tool vice the actual windump.exe is that this version will work with XP SP2. I was unable to get windump.exe to work with XP SP2 and simply gave up as I had found this fully functional alternative, which is pretty much exactly the same. Once downloaded simply uncompress it and install it at the root of C drive ie: C:\ You are now ready to sniff packets!

Figure 1

You will note in the screenshot above some sample syntax to invoke it and what it also looks like. Should you wish to learn more about using a packet sniffer like this one simply read these articles. One last word on the use of packet sniffers! You should always have it up and running prior to playing with some tools or exploit code. That way you can verify at the packet level should you need to verify some condition that occurred during your experimentation.

My first Hacking tool

When i was in search of hacking tools (of course i m still searching) i found a great tool :
Metasploit Framework
I found this in a seminar at IIT KGP.
I think you should try it once.

Money Money and more Money...

I dont have to give the same speech of running behing money. On the same run we have found a way to generate money. I and some friend made a group "ApneLog" and we are creating websites and movies (clipping) and even music video. Its fun doing all and also we can get some money. But the whole thing is that "ki bhaiyya" do what u r interested in.

Books essential for "HCAK"

Some books i found that one must read :
1. William stallings - all series
2. Security+ in depth
3. No ankit Fadia book

Sniffing In switched Networks (contd..)

Previous I told about ARP Spoofing. Now i am gonna extend that.

I have been searching arp apoofer for windows at last i found this :

Switch Sniffer

A greate tool to use..

ARP Spoofing

ARP spoofing is powerful hacking technique in LAN. Its changes ur arp table so that now onwards ur machne will send data to the specified entry in arp table. ARP spoofing is done as :

ARP spoofing is an effective way to intercept, sniff, hijack and DoS connections. It is a more effective way of hijacking sessions, because it allows attackers to see incoming and outgoing communications, as if they were a proxy, as opposed to "blind" TCP/IP spoofing.
Background on ARP
ARP stands for Address Resolution Protocol. Basicaly it translates IP addresses into ethernet or MAC addresses. ARP is completely separate from TCP/IP, since it uses only the ethernet frame in its packets. ARP is very similar to DNS, except instead of converting host names to IP addresses, ARP converts IPs to MAC addresses.
MAC addresses A MAC address, or Media Access Control, is the address hard coded into the ethernet card. Changing it is possible but irrelevant to this article. MAC addresses consist of six hex numbers separated by colons or dashes ie. 00:3E:41:D2:53:21 or 00-3E-41-D2-53-21. Routers use these addresses along with IPs to route packets for example:
Machine A wants to open a connection on server B
1) A sends ARP to subnet asking "who has B's IP address? tell Machine A"
2) All Machines on the subnet recieve the query, if their their IP matches that of the query then they send back a response in this case:
3)Server B sends an ARP response of "My IP is at ethernet address 00:3E:41:D2:53:21" or whatever.
An insteresting thing about ARP, is that to improve efficientcy, it caches entries. This is so that every packet doesn't need to have a corresponding ARP query and response. Instead, the machine remembers what IP corresponds to what MAC. This cache is called an ARP table, and is flushed about every minuet or so depending on the operating system.
ARP Spoofing
Alright, enough of the boring stuff. On to the fun part: ARP spoofing. Here is the vulnerablility in the ARP protocol: to improve efficiency, most systems update their tables every time they get a response, even if they didn't ask for it. This means that an attacker can send a message out to computer B, saying "Computer C is at my MAC". Packets sent from B, to C's IP will instead be routed to The attackers computer. Below is A diagram:
A simple ARP Hijack
Note: for clarity, MAC addresses will be represented by Shapes.
A:Attacker:Square:192.168.0.2
B:Box:Triangle:192.168.0.3
C:Server:Circle:192.168.0.4
1)A--->B "192.168.0.4(Server) is at MAC address Square"
2)A--->C "192.168.0.3(Box) is at MAC address Square"
Now any communication from Box to server or Server to Box, is routed to the attacker, who can now decide what to do.
ARP Spoofing as DoS
One sneeky way of launching a Denial of Service attack is similar to DNS poisoning. Basicaly, the attacker tells the box he is DoSing that either his, or some other computer's MAC attaches to that of the routers. Basicaly what happens here is all of the DoSed box's packets go to some other computer instead of the router, making it impossible to access addresses outside the subnet.
...As Sniffing
Sniffing or passive hijacking is when the attacker lets the to machines talk to each other but monitors or "sniffs" the communications for information like logins or passwords. This can be extreamly devistating because the attacker can then gain authenticated access into the system.
...As Hijacking
Ah yes, if the attacker happend to decide to, he may cut off the user form the server and inject his own commands. Lets look at this example: Andrew, the attacker has set up a ARP hijack between server Sam and client Clay. Andrew watches as Clay telnets into sam and logs in. As soon as this happens Andrew stops forwarding Clay's packets to Sam. He then injects his own packets to Sam, pretending to be Clay that instruct Sam to create a new user account (using Clay's privleges). Andrew then starts forwarding packets from Clay back to Sam and Clay dismisses the lag to his bad connection. That is basicaly how ARP hijacking works, it can get a bit more complicated, but the purpose of this guide was to give a general understanding. Hope it helped.

I searched for many tool to use in Windows XP. I found SwitchSniffer. It can also detect any other arp spoofer in network.
So enjoy sniffing in switched networks now...