Archive for January 2016
10 Best Operating Systems For Ethical Hacking And Penetration Testing
It’s time to pause the archaic Windows vs. OS X vs. Linux discussion and switch over to some advanced operating systems dedicated to pen testing and ethical hacking. A security-focused operating system is a hacker’s best friend as it helps them to detect the weaknesses in computer systems or computer networks.
Here is the list of 10 best hacking operating system along with their download links. All of these are based on Linux Kernel and free to use. Let’s take a look:
Kali Linux:
Developed by Offensive Security as the rewrite of BackTrack, Kali Linux distro tops our list of the best operating systems for hacking purposes. This Debian-based OS comes with 600+ preinstalled pen testing tools that make your security toolbox richer. These versatile tools are updated regularly and are available for different platforms like ARM and VMware. For a forensic job, this top hacking operating system comes with a live boot capability that provides a perfect environment for vulnerability detection.
Parrot Security OS:
Debian-based Parrot Security OS is developed by Frozenbox’s team. This cloud-friendly operating system is designed for ethical hacking, pen testing, computer forensics, ethical hacking, cryptography etc. Compared to others, Parrot Security OS promises a lightweight OS that is highly efficient. Along with its plethora of legally recognized tools, you also get the opportunity to work and surf anonymously.
For those who don’t know, Parrot Security OS is a mixture of Frozenbox OS and Kali Linux. The OS uses Kali repos for updating its tools, but it has its own dedicated repo for storing the custom packets. It comes with MATE desktop environment and the powerful interface is derived from famous Gnome 2. This highly customizable hacking oeprating system also comes with a strong community support.
BackBox:
BackBox Linux is an Ubuntu-based operating system with its focus on security assessment and penetration testing. BackBox Linux comes with a wide range of security analysis tools that help you in web application analysis, network analysis etc. This fast and easy to use hackers’ favorite Linux distro comes with a complete desktop environment. The software repos of the hacking tools in this hacking operating system are regularly updated with the most stable versions.
Samurai Web Testing Framework:
Samurai Web Testing Framework is basically a live Linux environment that comes pre-configured to work as a web pen-testing platform. The framework contains multiple free and open source hacking tools for detecting vulnerabilities in websites. It’s often called the best operating system for Web Penetration Testing.
Pentoo Linux:
Based on Gentoo Linux, Pentoo is a pen testing operating system that is available as a 32 and 64-bit installable Live CD. You can also use Pentoo on top of an existing Gentoo Linux installation. This XFCE-based distro comes with persistence support that allows you to save all the changes you make before running off a USB stick.
This excellent hacking operating system comes with a wide variety of tools that fall under categories like Exploit, Cracker, Database, Scanner etc. This Gentoo derivative inherits the Gentoo Hardened feature set that brings additional control and configuration.
DEFT Linux:
The open source Linux distribution DEFT stands for Digital Evidence and Forensic Toolkit. It’s based on Ubuntu and built around the DART (Digital Advanced Response Toolkit) software. It comes with many popular forensic tools and documents that can be used by ethical hackers, penetration testers, IT security specialists, and other individuals.
Caine:
Caine is an Ubuntu-based security-focused distro that is available as a live disk. It stands for Computer Aided Investigation Environment and can also be run from the hard disk after installation. This Linux distro comes with a wide range of tools to help you in system forensics.
Caine comes with a large number of database, memory, forensics, and network analysis applications. This distro for ethical hacking also features common applications like web browsers, email clients, document editors etc. for usual computing purposes.
Network Security Toolkit (NST):
Network Security Toolkit is a Fedora-based Linux distro that runs on 32 and 64-bit platforms. This bootable live CD was created to give you an access to the best open source network security applications for pen testing purposes. This easy-to-use hacking distro easily converts the x86 systems into an ethical hacking machine that is helpful in intrusion detection, network traffic sniffing, network packet generation, network/host scanning etc.
BlackArch Linux:
BlackArch Linux is available as a complete Linux distribution for security researchers and ethical hackers. It’s derived from Arch Linux and one can also install the BlackArch Linux components on top of it.
The constantly growing repo of this useful operating system for hacking purposes is stuffed with more than 1400 tools that are thoroughly tested before being added to the codebase.
Bugtraq:
Available in Debian, Ubuntu, and OpenSuSe, Bugtraq is famous for its electronic mailing list that is purely dedicated to computer security. The issues that are covered are vulnerability discussion, security-related announcements, exploitation methods etc. The Bugtraq Team consists of experienced hackers and developers that offer a great service for ethicals and pen testers.
Bugtraq comes with tons of pen testing tools including mobile forensic tools, malware testing tools and other software developed by the Bugtraq-Community.
XSS bug in Yahoo Mail could have let attackers take over email accounts.
One minute, your Yahoo account is nice and calm. And it utterly lacks a signature.
Then out of the blue, you get a mysterious message in your inbox, and all hell breaks loose.
You open it, and you find that somebody – or something – has enabled the email signature, entered some wacky text about something “wonderful” happening and your Yahoo “being alive,” and stuck some warbling multimedia in there, to boot.
Luckily, in this case, it was a security researcher sending a boobytrapped email to his own Yahoo account.
The Finnish researcher, Jouko Pynnönen, of the security firm Klikki Oy, last month discovered a Cross-Site Scripting (XSS) vulnerability in Yahoo’s webmail that would have allowed attackers to fully compromise email accounts just by sending a malicious email.
To have their account taken over, a victim would have only needed to open and view the email.
Pynnönen also sent himself another rigged email with a hidden script that covertly sent the receiver’s inbox to an external website.
Because the malicious code is in the message’s body, the code is executed every time a user opens an email.
Pynnönen reported the issue to Yahoo on 26 December via the company’s HackerOne bug bounty program and says he was awarded a $10,000 bounty.
According to the researcher, Yahoo said that the XSS flaw was never used in the wild. Its developers fixed the vulnerability on 6 January.
Pynnönen says that he found the bug by force-feeding all known HTML tags and attributes to the filter that Yahoo uses to weed out malicious HTML.
He found that the filter didn’t actually strain out all the gunk, so that certain malformed HTML code managed to slip through.
The bug was only found on Yahoo Mail’s web interface, not in the mobile app.
XSS bugs are one of the most common web vulnerabilities.
Just yesterday, we wrote about a UK supermarket chain that recently patched its online store against various web security holes, including XSS. And last week, we wrote about a researcher who revealed that eBay had just patched an XSS bug that left users vulnerable to almost undetectable phishing attacks.
If you’d like to learn more about XSS (and a related class of bugs known as Cross Site Request Forgery, or CSRF), Read more.. http://redbackacademy.com/
Then out of the blue, you get a mysterious message in your inbox, and all hell breaks loose.
You open it, and you find that somebody – or something – has enabled the email signature, entered some wacky text about something “wonderful” happening and your Yahoo “being alive,” and stuck some warbling multimedia in there, to boot.
Luckily, in this case, it was a security researcher sending a boobytrapped email to his own Yahoo account.
The Finnish researcher, Jouko Pynnönen, of the security firm Klikki Oy, last month discovered a Cross-Site Scripting (XSS) vulnerability in Yahoo’s webmail that would have allowed attackers to fully compromise email accounts just by sending a malicious email.
To have their account taken over, a victim would have only needed to open and view the email.
Pynnönen also sent himself another rigged email with a hidden script that covertly sent the receiver’s inbox to an external website.
Because the malicious code is in the message’s body, the code is executed every time a user opens an email.
Pynnönen reported the issue to Yahoo on 26 December via the company’s HackerOne bug bounty program and says he was awarded a $10,000 bounty.
According to the researcher, Yahoo said that the XSS flaw was never used in the wild. Its developers fixed the vulnerability on 6 January.
Pynnönen says that he found the bug by force-feeding all known HTML tags and attributes to the filter that Yahoo uses to weed out malicious HTML.
He found that the filter didn’t actually strain out all the gunk, so that certain malformed HTML code managed to slip through.
The bug was only found on Yahoo Mail’s web interface, not in the mobile app.
XSS bugs are one of the most common web vulnerabilities.
Just yesterday, we wrote about a UK supermarket chain that recently patched its online store against various web security holes, including XSS. And last week, we wrote about a researcher who revealed that eBay had just patched an XSS bug that left users vulnerable to almost undetectable phishing attacks.
If you’d like to learn more about XSS (and a related class of bugs known as Cross Site Request Forgery, or CSRF), Read more.. http://redbackacademy.com/
Best Hacking Apps For Android Phones
As
Android has emerged as the top mobile operating system, we have seen a great
rise in the Android hacking apps. For our readers, we have prepared a list of
the best hacking apps for Android that can be used by a technology enthusiast,
an IT security administrator, or an ethical hacker.
9
Best Hacking Apps For Android Phones – 2016
AndroRAT
AndroRAT
stands for Android and RAT (Remote Administrative Tools). This top hacking tool
was released a long time ago as a client/server application. The app aims to
give you the control of the Android system remotely and fetch the information
from it. This Android app runs as a service right after the boot. So, a user
doesn’t need to interact with the service. The app provides you the ability to
trigger the server connection by a call or SMS.
The
features in this useful Android hacking app include collecting information like
contacts, call logs, messages, and location. The app also allows you to
remotely monitor received message and state of phone, making a phone call and
sending texts, taking picture from camera, opening URL in the default browser
etc.
Hackode
Hackode
is an Android app which is basically a collection of multiple tools for ethical
hackers, IT specialists, and penetration testers. In the app, there are three
modules –Reconnaissance, Scanning, Security Feed — available in the
application.
With
this app, you get the functionalities like Google hacking, SQL Injection, MySQL
Server, Whois, Scanning, DNS lookup, IP, MX Records, DNS Dif, Security RSS
Feed, Exploits etc. It’s a great Android hacking app to start with and it
doesn’t ask for your private information to operate.
zANTI
zANTI
is a reputed Android hacking suite from Zimperium. This software suite comes
with multiple tools that are widely used for penetration testing purposes. This
mobile penetration testing toolkit allows the security researchers to scan a
network easily. This toolkit allows the IT administrators to simulate an
advanced hacking environment to detect multiple malicious techniques.
zANTI
could be called an app that brings the power of Backtrack on your Android
device. As soon as you login into zANTI, it maps the entire network and sniffs
the websites being visited along with their cookies — thanks to ARP cache
poisoning on devices.
The
various modules in the app are network mapping, port discovery, sniffing,
packet manipulation, DoS, MITM, and more.
FaceNiff
FaceNiff
is a top Android hacking app that allows you to intercept and sniff your WiFi
network traffic. This tool is widely used to snoop into people’s Facebook,
Twitter and other social media websites using your Android device. This
hacker-favorite tool steals cookies from WiFi network and gives an attacker an
unauthorised access to victim’s account.
FaceNiff
is developed by Bartosz Ponurkiewicz — the same developer who wrote Firesheep
for Firefox hacking on desktop.
Droidsheep
Droidsheep
is an effective hacking app developed for security analysts interested in
playing with Wi-Fi networks. The app has the ability to hijack the web session
profiles over a network and it works with almost all services and websites.
As
you fire up the Droidsheep app, it acts a router that monitors and intercepts
all the Wi-Fi network traffic and fetches the profiles of active sessions. With
this app, one can sniff Facebook, LinkedIn, Twitter and other social media
accounts.
DroidSheep
Guard, another version of app, helps you to detect ARP-Snoofing on the networks
i.e. the attacks by FaceNiff, Droidsheep, and other software.
APKInspector
APKInspector
is an app that allows you to perform reverse engineering tricks. With this app,
you can get the graphic features and analysis functions for the users to get a
deep insight. This powerful Android hacking tool helps you get the source code
of any Android app and visualize the DEX code to erase the credits and license.
Nmap
One
of the most popular network scanning apps for desktop can also be used on
Android operating system. Nmap works on both non-rooted and rooted phones. If
you are a beginner Android hacker, this hacking app app is a must have.
SSHDroid
SSHDroid
is a SSH server implementation developed for Android that allows you to connect
your Android device to a PC and run commands like ‘terminal’ and ‘adb shell’
and edit files. It provides an extra security later when you are connecting to
a remote machine.
The
app provides features like shared-key authentication, WiFi autostart whitelist,
extended notification control etc.,
Largest DDoS Attack in History
DDoS attacks are one of the biggest enemies of a website admin. The year 2015 saw an unprecedented growth in the number of DDoS attacks. Along the similar lines, Arbor Networks recorded an attack peaking up to 334 Gbps. Well, things aren’t looking good in 2016 as a hacktivist group has taken the responsibility of the DDoS attack on BBC website that peaked up to 602 Gbps.
On New Year’s eve, the BBC website and iPlayer service went down due to a massive Distributed Denial of Service (DDoS) attack. The attack peaked up to 602 Gbps, according to the claims made by the New World Hacking group, who took the responsibility of the attack. In another recent attack, the Republican presidential candidate Donald Trump’s main campaign website was also targeted by the same group.
Earlier BBC announced that the service failure was due to some technical failure. Later it rephrased that the New World Hacking group took the responsibility just to “test its capabilities.”
602 Gbps – Largest DDoS Attack in History
DDoS attacks are conducted by flooding a web server with a torrent of traffic. These attacks are widely popular and often used by hackers with an aim to bring down the websites.
The BBC websites including the Player on-demand service suffered at least three hours outage on Thursday due to the DDoS attack.
This group is calling itself a hacktivist group whose main target is ISIS. One of the members of the group – calling himself as Ownz – has told ZDNet their real motives.
Detailing the attack, Ownz said that they have their own ways to bypass the security layers of the Amazon Web Services.They Said,
"The best way to describe it is we tap into a few administrative services that Amazon is use to using. The [sic] simply set our bandwidth limit as unlimited and program our own scripts to hide it."
We have contacted the Twitter handle of the New World Hacking group for more details and we’ll be updating the article as we get some update.
Bypass Android Pattern Lockscreen.
Many times many android mobile phone users forget his password and don’t know how to bypass this. Here we provide you all details for bypass pattern in android phone.
Make sure that your computer is set up with ADB (Android Debug Bridge ).
Make sure that your Android Device settings for “USB debugging “ is ENABLED or Active
Android 4.0 users : Home > Settings>Developers Options>USB Debugging >Check the box to enable
Make sure that your computer is equipped with necessary drivers and use your native USB Cable.
Follow below Steps :
1.Plug-in your device to your PC using your USB cable (works on Windows, Mac and Linux). Make sure that you have an active pattern screenlock.
2.Now Right Click with pressing SHIFT button on adb folder and open with command window here.(If you insall above software you find your adb folder in C: Drive and follow below steps)
3.On the cmd window type in “adb devices” (no quotation marks) then hit enter.
4.On the cmd window type in “adb shell” (no quotation marks) then hit enter.
5.Now shell is open ,type “su” (no quotation marks) (super user now you are a root user )
After entering type “rm /data/system/gesture.key” (no quotation marks) then hit enter.
After your phone fires up unplug it to your PC then your good to go you successfully bypassed your Pattern Lock Screen, your phone now will accept any pattern you will draw on the lock screen as VALID and CORRECT.
How to Improve Your Organisation’s Mobile Security
Mobile security is increasingly important for organisations to address, as the BYOD (Bring Your Own Device) trend blurs the line between personal and company data.
84% of mobile users utilise the same smartphone for business and personal use. This means that anyone accessing the internet from their mobile phone, connecting with home and work networks, is putting both their personal and their organisation’s information at risk.
6 Ways to Improve Mobile Security
1) Use Strong Passwords
62% of smartphone users don’t use a password to secure their device. Passwords are the first line of defence against unauthorised access to your phone’s data, so it’s imperative that you follow password best practices to keep your organisation’s data secure. Strong passwords should be 8 characters long as a minimum, and contain no personal information.
2) Install Anti-Malware Software
Mobile operating systems are increasingly becoming targets for malware, so if you’re using your phone to access the internet, you should install anti-malware software on your device – and keep it updated. This will help to keep your personal and company data safe from malware attacks.
3) Choose Mobile Applications Carefully
When you’re downloading software for your desktop computer, no doubt you’re careful to only download from reputable and secure sources, so why would you take risks when downloading apps for your smartphone? Not all applications are created to the same standards of security. Installing rogue or insecure software even on just a single device can compromise your entire organisation’s information security.
4) Avoid Unsecured WiFi
It’s important that your employees know to treat WiFi access with caution, so they’re not putting your company’s data at risk. This is particularly relevant to employees who work remotely, who may choose to work from a local coffee shop or log on to public WiFi between meetings.
But equally, if you’re using the same smartphone for work and personal communication, connecting to the WiFi while you’re out shopping, or in a restaurant at the weekend can pose a security risk to your organisation. Employees should ensure their phones don’t automatically connect to WiFi networks, and if possible opt for unlimited data contracts so they don’t need to rely on WiFi.
5) Encrypt Sensitive Mobile Communication
Most experts recommend all mobile communications be encrypted because wireless communications are so easy to intercept. Employees accessing company data from outside of the office should use a virtual private network (VPN) to protect and secure their communications.
6) Create a BYOD Policy
BYOD can offer a number of benefits to organisations, such as lower hardware costs and giving employees greater flexibility in terms of their working hours. However, this is at the expense of your organisation’s security. To address the security problems associated with BYOD working, it’s essential that your organisation has in place a BYOD policy, outlining the procedures employees need to follow to secure their devices.