Hacking Wireless Acces Point

There are many things that someone can do to outsmart the process authentication. Some of the ways discussed in this article only covers a small aspect of the design using the weaknesses of a wireless hotspot gateway. Given that the materials have been presented in front of the public, most likely the service provider and vendors of products that have been affected improve midst is. 

As a notice, no vendor name that will be associated with a slit that I find. Please gather your own estimate. And tricks that can only be explained.

1. Use the demo account. 

Many service providers be careful to give the opportunity for prospective users to be able to access the Internet in the period Time is limited. At the authentication page is usually mentioned username and password for testing purposes. 

Someone using an account trial / demo should do re-authentication after the end of the period. However, it can be done automatically by using the script Like this. 

-------------------------------------------------- ------------------- 
#! / Bin / sh 

While sleep 3; 
Do 
Curl - data 
"username = demo & password = demo & submitForm = login" 
"https: / / server: port / goform / HtmlLoginRequest"; 
Done 
-------------------------------------------------- ------------------- 

2. Using tunneling. 

Some of the implementation of the hotspot can be utilized with Tunneling method. Implementation of the implementation is do not block the port or protocol against Certain. 0x05 

For example, a hotspot only to make the diversion all queries to the HTTP and HTTPS authentication for the login page Users who have not terautentikasi. You can use the socks-tunneling via SSH port because that is not used for SSH Terfilter. You can add the option 'DynamicForward' on SSH your user configuration (see the file ~ / .ssh / config). 

-------------------------------------------------- ------------------ 
... 
Host titanium 
Hostname titanium.justanotherrandomdomain.com 
Port 22 
Users whfb 
DynamicForward 22344 
... 
-------------------------------------------------- ------------------ 

If you are connecting to the SSH host titanium, the Automatic, will open port 22344. You can add the IP 127.0.0.1 and port 22344 on the network configuration in a web browser Your choice for SOCKS proxy. 

However, the above is not always successful because gateway to the diversion of all TCP and UDP ports. To outsmart conditions, if you can take advantage of DNS tunneling. 
Why DNS protocol? Because most service providers do not to block or to query DNS. 

Please refer to the reference DNS Tunneling [3] [4] [5] [6] [7]. 

3. Utilizing rift on a web application portal Internet gateway. 

I find the following tricks when I get a chance the opportunity to stay in one of the famous hotel and found the wireless hotspot service is available in the lobby. 

At the authentication page, I provided several options for Make payments, among others: 

A. login using the username and password from the pre-paid can Purchased in the lobby, 
B. login using the username and password from the service and iPass Boingo 

After observing the correct source-code of a web page that is used for authentication purposes, I see where the awkwardness have a choice billing_method_id is 2, and a choice of b Have any billing _method_id is 3. So my question is that time is what the options that have billing_method_id Is 1. With niatan try-try, I change the variable ago billing_method_id query with a value of 1, that I can Direct access to the Internet. 

-------------------------------------------------- ------------------ 
http://host/defaultportal/check_form.cgi?&billing_method_id=1 
-------------------------------------------------- ------------------ 

Later the day after I had borrowed the product used as an Internet gateway, I know that 
billing_method_id with a value of 1 is a choice to make Billing on the room. Something that is not possible because I access it using the wireless from the lobby. I know that the only option 
effective if the customer is not using the cable and wireless. 

4. Changing the IP address 

Found the implementation of some of the known wireless hotspot share allocation on the user's IP address is not yet autentication And users who already terautentikasi. After the user successfully through the process of authentication, the gateway will remember the MAC address 
And give you a new IP address (on the new subnet) for User. 

Using software such as packet sniffer or tcpdump ethereal (now wireshark), you can find out what IP address Just across the wireless network you. You can surmise, conjecture own IP address allocation of 'new' with the following netmask it. 

For example, if you have not yet IP autentication with the address 10.0.0.14 netmask 255.255.255.0, and after your autentication, you get the IP address 10.0.1.18 Netmask 255.255.255.0. 

If you do not want to make the process of authentication, you can simply mengkonfigur IP Address in the range of your network users who are autentication. 

5. Piggyjacking 

I piggyjacking defines as activities to obtain access to a wireless access to the session took session that is first to get access Internet autentication. 

To do this, you need information: 
- IP address and MAC address users who already terautentikasi 
- IP address gateway 

You can refer to the presentation Dean Pierce, Brandon Edwards & Anthony Lineberry given at DEFCON 13 [8] to use Software 'Pul'. If you want to do with the method manual, you can follow the procedure mentioned in the Point 4 above. 

6. SQL Injection on the portal application gateway 

Some hotspot that can diakali using the technique SQL injection. I think that does not need to explain more about this technique because it is often discussed. Not only for mem-by-pass access to the Internet, this technique can also be mem-by-pass Administrative authentication page. 

7. Move the bill to another room. 

If you are lucky to stay in hotels that provide services Internet Speed cables on hotel rooms. You may Can apply this trick. Tricks following can only be done on the cable network in the hotel (not related to wireless), but I study here because the product is used as a gateway With a wireless hotspot services. 

You may be able to 'pester' switch with other people Internet billing your room or mengalihannya to empty rooms. 

For example, you can modify the query such as the following HTTP This 
-------------------------------------------------- ------------------ 
http://HOTSPOT_GATEWAY/mlcbb/mlc/welcome.asp?UI=012345 & 
UURL = & http://BILLING_SERVER/userok.htm&MA=00AABBCCDDEE&RN=1234 
Http://google.com/&SC=12345 
-------------------------------------------------- ------------------ 
You can simply change the value 00AABBCCDDEE (MAC address) and 1234 
(The room). Billing will be made in the room if the new room 
Exist. 

For safe, I suggest you search the room used for public purposes such as a lobby or ballroom.

Read more...

Create Windows XP Bootable CD

Slipstreaming a Service Pack, is the process to integrate the Service Pack into the installation so that with every new installation the Operating System and Service Pack are installed at the same time.

Slipstreaming is usually done on network shares on corporate systems. But with the advent of CD burners, it does actually make some sense for the home user or small business user to do the same.

Microsoft added the ability to Slipstream a Service Pack to Windows 2000 and Windows XP. It not only has the advantage that when you (re)install your OS, you don't have to apply the Service Pack later, also if you update any Windows component later, you'll be sure that you get the correct installation files if Windows needs any.


Slipstream Windows XP Service Pack 1a:
CODE
http://download.microsoft.com/download/5/4/f/54f8bcf8-bb4d-4613-8ee7-db69d01735ed/xpsp1a_en_x86.exe


Download the (full) "Network Install" of the Service Pack (English version [125 MB]), and save it to a directory (folder) on your hard drive (in my case D:\XP-SP1). Other languages can be downloaded from the Windows XP Web site.

Microsoft recently released Windows XP SP1a. The only difference is that this Service Pack does no longer include Microsoft's dated Java version. If you have already installed Windows XP SP1, there is no reason to install SP1a, but the "older" SP1 (with MS Java) is no longer available for download.

Next copy your Windows XP CD to your hard drive. Just create a folder (I used \XP-CD), and copy all the contents of your Windows XP CD in that folder.

Now create a folder to hold the Service Pack 1a (SP1a) files you are about to extract. I named it \XP-SP1. Next, open a Command Prompt (Start > Run > cmd), and go to the folder where you downloaded SP1a (cd \foldername). Type the command: servicepack filename -x. A small window will appear, and you need to point it to the folder where you want to extract the SP1 files. Click Ok to start extracting the SP1a files.

Once the SP1a files are extracted, change to the update folder of the SP1a files (cd update), and type the following command: update /s:path to WinXP CD files. In my example the command is update /s:D:\XP-CD).

Windows XP Update will do its thing:

When ready, you should get a confirmation. Windows XP Service Pack 1a has now been Slipstreamed into your original Windows XP files.

It is also possible to add the Windows XP Rollup 1 Update. For instructions, please read Adding Windows XP Rollup 1 Hotfix.


Creating a Bootable CD
For this part I used ISO Buster
CODE
http://www.smart-projects.net/isobuster/

and Nero Burning.

Start to extract the boot loader from the original Windows XP CD. Using ISO Buster, select the "folder" Bootable CD, and right-click Microsoft Corporation.img. From the menu choose Extract Microsoft Corporation.img, and extract it to the folder on your hard drive where you have your Windows XP files (D:\XP-CD in my case).

Next, start Nero Burning ROM, and choose CD-ROM (Boot) in the New Compilation window. On the Boot tab, select Image file under Source of boot image data, and browse to the location of the Microsoft Corporation.img file. Also enable Expert Settings, choosing No Emulation, and changing the Number of loaded sectors to 4 (otherwise it won't boot!)


If you have an older version of Nero you won't have the option Do Not Add ";1" ISO file version extention under Relax ISO Restrictions. You won't be able to boot your new CD, so update Nero!
You can configure the Label tab to your liking, I would however recommend that you keep the Volume Label the same as on your original Windows XP CD.

Next press New, and drag & drop the files and folders from your Windows XP hard drive location into Nero.

Next, burn your new CD.

You now have a Bootable, Slipstreamed Windows XP Service Pack 1a CD!

Read more...

Stealing Files From Sites

This is a simple tutorial about stealing files such as flash from a web site. 

1. find a site that hosts the flash file you want. 

2 right click and select view source. this will open the source code of the page you are looking at. 

3 look for the file you are wanting to steal in the source code. in the case of flash this will end in .SWF i.e www.domain.com/files/flash/game.swf 

Quote: 

< object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0" width="176" height="233" id="FLASHNAME" > 

 
 
 
 
 


now copy the url http://www.domain.com/files/flash/game.swf to your clipboard and open note pad. 

this part requires little knowledge of HTML. 

make a html file and code this 
Code: 
FILE 


now save it as .html and open it in your browser. If you done it correct you should have a page that only has the word "FILE" on it. now right click the word file and select "save target as", save it to your desktop and you all done. 

of cors if you have a download manager it should allow you to drop in a url to download but the windows downloder dosnt let you do that. 

also sometimes files will be saved into your temporary intermet folder and you can retrieve them from there.

Read more...

Hacking Windows XP

Hack to Change Windows XP Home to Windows XP Professional  Enable the features found in Windows XP Professional on your Windows XP Home  Edition installation with this hack. It will allow you to turn your Windows XP Home CD into  a Windows XP Profrssional CD. 

Note: If your Windows XP CD does not contain Service Pack 2, you might want to  Slipstream Your Windows XP CD first as you will not be able to upgrade an installation  after using the CD.

1. Copy the root directory and the i386 directory of the WindowsXP CD to your hard drive. 

2. Extract the Bootsector of your Windows XP CD. 

3. Click START­­>RUN­­>REGEDIT 

4. Highlight HKEY_LOCAL_MACHINE 

5. Click FILE­­>LOAD HIVE and select the Setupreg.hiv file  This file is located on your Windows XP CD in the i386 folder. 

6. Locate the following registry key:  HKEY_LOCAL_MACHINEHomekeyControlSet001Servicessetupdd 

7. Edit the DEFAULT key and change the following values:  01 to 00  02 to 00 

8. Change the name to the value HOMEKEY to anything. 

9. Locate the following registry key:      HKEY_LOCAL_MACHINEHomekeyControlSet001Servicessetupdd  Edit the DEFAULT key and change the following values:  01 to 00  02 to 00 

10. Highlight HOMEKEY and select FILE­­>UNLOAD HIVE

 You can now burn the data on your hard drive to a CD. Then use the CD to install  Windows XP. Be sure to make the CD bootable. You can use the instructions here to help  you do that.

Read more...

Step 5 Changing the Google logo with your name

If you're bored with the Google logo display, you can create a page like Google with your name. How very easily. Simply click-click only the logo and style desired, in a glance you will be able to have a page search engine such as Google with your name. Check out the steps: 

1. Open site http://www.funnylogo.info/create.asp 
2. Input the name you want on the site. 
3. Specify the desired writing style, eg: Google Style. 
4. Click the "Create My Search Engine". 
5. After that will appear, "Google Site" with a logo that we want. 

To make it into the default page when you open the browser, copy the address listed in the Address. 

Browser for Internet Explorer (IE): 
1. Click the Tools menu - Internet Options 
2. Select the General tab and change the field with the Home Page address. 

Mozila browser to: 
1. Click the Tools menu - Options 
2. Select the tab Main, and change the field with the Home Page address. 
3. In the field When Firefox starts, setting select Show my home page, then click OK. 

After all the steps done, you can try to open the browser and see the results. :-)

Read more...

Make a bootable Linux in the Flashdisk

Make a bootable Linux Live CD Ubuntu 7.10 in the Flashdisk through the windows was not as hard as we imagine, the steps - steps are as follows:

1. Download the file first syslinux here
2. Create a directory on the C syslinux:
3. Then extract the files we had downloaded to the folder C: \ syslinux
4. In the command promt windows into direktory c \: syslinux \ Win32
5. Use the following command to create a usb bootable disk can be as: syslinux-s F: (assuming the usb drive in F)
6. The next step is copying all the files in Ubuntu Live CD 7:10 into the USB, you should use the command xcopy / e / h / KD: \ *.* f: (D as a CD-ROM).

Furthermore, the USB flash already in use.^_^

Read more...

Computer virus in cats - Part 2

 How the virus to penetrate supermarkets 

First, the attacker will buy a product with RFID tags, as usual. At home, he switch label electronic tags are empty and the device is free sold. When re-shuffle of the product to supermarkets, the cashier will scan the label that has been manipulated before. In tests, Tanenbaum write 'Quine', that is a program that reproduce the source-text to its own. The Attack is the target Oracle database. 

Noted: In Neuss, Metro tests RFID labels for supermarkets of the future. 


Still need a few more years before the cashier in supermarkets, read RFID tags. Store retail chain Metro Group to try new techniques for logistic goods and services customers. For them, only about 10 years time the price will be quite economical label to apply to every package. Currently, some containers and palettes have been using the code with the electronic chip that can be rewritten. 

"We take very serious warning Tanenbaum," comments Harald Kelter from BSI (Bureau of Technical Information Security Germany) on a warning from Amsterdam. However, he did not want to call this as RFID virus. "It's a normal PC virus. We also did not mention toh virus floppy just because malwarenya stored on floppy disks. "Scenario-attack through SQL injection is basically not new. Cleft used long-known, only a new channel transfernya. 

BSI a research titled 'Risks and the possibility of RFID application system' revealed that the experts did not consider the security of the virus through RFID. The research discusses in detail the various types of attacks, but attacks the virus is not included. 

"Danger is not think about when we make research 2 years ago," said Harald Kelter. He also saw lab experiment with a database without the full protection dikonstruksi. "For that, a simple label is not sufficient," said Kelter. 

However, does not mean that such a theme with RFID malware is completed. In tests Tanenbaum, RFID tags-only functions as a virus. Goods in supermarkets also certainly not your cat infected with the virus. 

Unknown risks: RFID on a debit card 
On the other variants RFID encrypt the data and perform calculations directly on the chip, story can be more interesting, for example, the RFID functions as a dual-interface functions of the smartcard with a debit card, or to control access. "It is interesting to know whether the RFID chip of its own, not only database, it can be attacked or not," said Kelter. 

Full TAK: A security research BSI give a description of risks RFID, but it does not offend the virus. 


What happens if the RFID chip is encrypted with algorithms that have experienced inadequate by some car manufacturers a year ago. Portal road barrier they are based on RFID can be penetrated! Data on the transponder from Texas Instruments is protected with a key 40 Bit. To read this key, security experts only takes 15 minutes. Further manipulation becomes easier.

source : chip.co.id

Read more...

Computer virus in cats - Part 1

Computer virus in cats 

RFID labels on the product, RFID chip in the animal, and now the first RFID virus. Moreover, the technique brought RFID eongan than a cat in the future. 

Cattle are marked, dog and cat also put RFID chip. As the 'electronic sign', the chip will be overseeing the trip since the meat-cutting diternakkan home to animals. Pets that are found can be identified through a 15-digit code that is contained in the chip. However, the practical benefits of RFID is still in a high security risk. 

To show the potential danger, the scientists at the Vrije Universiteit Amsterdam has chosen a cat as the object demo. 'Are you a cat infected with a computer virus', a research team leader Professor. Andrew Tanenbaum in a scientific publication. In any posts in the Computer Systems Group researchers show how RFID chip attacked a database. 

An attack scenario is theoretically possible through such a cat is described Tanenbaum. A hacker insert a chip that has been manipulated into a cat. He brought a cat to the vet and identification system will show things that are not normal. Data is transferred to a central database. Some hours later the system to delete data on the RFID chip cat. Finally, strange things happen. ID display system and frozen display the message 'All your animals are owned by us'. 


Marked: The veterinarian, RFID chip that is injected into a small body of a cat. 

Data-in RFID tags can not be trusted fully, said the team Tanenbaum warns. "During this time we think that only the data that will be falsified attack on RFID. However, hackers are also able to attack the database through SQL-injection or buffer-overflow, "said Tanenbaum. In the same way, malware, worms, and RFID viruses can spread. 

Although security is not possible rift be on the chip, but on a database programmer, the RFID feel attacked. Asosiasinya, AIM, publish a direct response to the title 'Cats you safe'. Basically, the team considered Tanenbaum has created a model system that has a weakness. According to AIM, RFID-tags used in the animal can not be rewritten. 


Infected: In this kind of tags researchers in Amsterdam enter first RFID virus. 

AIM may be correct because the Computer Systems Group in Amsterdam also does not discuss the more likely a cat as a virus. They create a scenario for the actual test in which RFID will be more of a role again in the future: They mensimulasi a computer supermarkets.

source : chip.co.id

Read more...

Radio Frequency Identification

RFID is the abbreviation of Radio Frequency Identification. Simply defined as the effort Identification objects using radio frequency. 

There are 3 components that are required in an RFID system, the RFID Tag, RFID reader and RFID midleware. RFID tag is a micro-transmitter placed on the object to be identified. The form of the various tags in accordance with the functionality that you want to achieve. Tags on the market that have shaped bracelet, cards, buttons, and others. RFID tags are classified based on the frequency of work, there is a Low Frequency (LF) Modulation, MF, UHF and microwave. Tag next classification method is based on updating the data. There are read only, read and write and write once. Last is the classification tags based power transmission mode is active tags and passive tags. On a ration power due to internal, passive because the resources taken from the transmission wave induction elektromagnetik reader. 

The second component is the RFID reader or often called interogerator. Function to read and detect the presence of RFID tags on the distance bacanya. Data to be read and forwarded to midleware to be processed as needed. In selecting reader 2 things must be considered. The first problem with the tag reader kompatabilitas, because not all the tags will match with the reader, there are spouses of each. Second consideration is the distance read reader. Reader cheap may only have read the near distance. Reader expensive distance will have read very much especially when the tag is used bertipe active. 

The second component is midleware. In fact midleware only because the software is located in the middle is often referred to midleware. Its duty is to make the data read by the RFID reader. Normal for a complete RFID package expensive, RFID midlewarenya already included. But it can also midleware designed in accordance with the needs banyka programming language. Collaboration with the database and network connection capabilities into additional value that are easy to crystallize. 

The last part will discuss the function. RFID can be applied in many areas that require identification capabilities. Being tracking object identifier component, as an e-card that can be enabled to pass-toll, bus ticket or access control card. For tracking goods, small children, pets and so on.

Read more...