Making sniffer using libpcap

[0] http://www.tcpdump.org/pcap.html
[1] http://www.joshuarobinson.net/docs/libpcap_offline.html
[2] http://yuba.stanford.edu/~casado/pcap/section1.html
[3] http://www.winpcap.org/docs/docs_40_2/html/group__wpcapsamps.html
[4] http://www.linuxquestions.org/questions/programming-9/undefined-reference-to-functions-from-pcap-h-319252/

package samples
[5] http://wiki.wireshark.org/SampleCaptures



Tutorial how to
[1] http://www.linuxforu.com/2011/02/capturing-packets-c-program-libpcap/


More
http://www.tcpdump.org/pcap.html
http://networksecurity.org.ua/0596007949/networkst-chp-10-sect-2.html
http://www.tcpdump.org/pcap/pcap.html
http://commons.oreilly.com/wiki/index.php/Network_Security_Tools/Modifying_and_Hacking_Security_Tools/Writing_Network_Sniffers
 http://eecs.wsu.edu/~sshaikot/docs/lbpcap/
http://www.eecis.udel.edu/~sunshine/expcs/code/pcap_packet_read.c


Source:
[1] http://code.google.com/p/chengchuntu1/source/checkout
[2] http://sock-raw.org/papers/syn_scanner

Persistent Netcat Backdoor

http://www.offensive-security.com/metasploit-unleashed/Persistent_Netcat_Backdoor

OS detection sample

nmap samples
http://nmap.org/book/osdetect-usage.html

John the Ripper

http://www.openwall.com/john/

Ettercap - Man in Middle

Single steps
http://linuxpoison.blogspot.com.br/2009/09/how-to-do-man-in-middle-attack-using.html

More details
http://openmaniak.com/ettercap_arp.php

Video references:
[1] http://www.youtube.com/watch?v=1eTb7OnV8X8
[2] http://www.youtube.com/watch?v=QSQaOnaRT8w
[3] with plugins for restore  http://www.youtube.com/watch?v=ciuv5n5cmzs
[4] text mode/portugues http://www.youtube.com/watch?v=rPd7l4dF6mo
References:
[1] Arp http://openmaniak.com/ettercap_counter.php
[2] Dns Spoofing http://openmaniak.com/ettercap_filter.php

gpg steps

export public key to asc
gpg -a --export FD9C1B26  > jfiq.pub


sign file/get pk
gpg -s segc-tarefa02.txt

sign file to asc format/get pk
gpg --clearsign segc-tarefa02.txt

add public key
gpg --import mo639_1s2012.pub

encrypt file/get uid
gpg -e -a segc-tarefa02.txt

References:

http://www.guiafoca.org/cgs/guia/avancado/ch-d-cripto.html

http://eriberto.pro.br/wiki/index.php?title=Usando_o_GnuPG

http://www.gnupg.org/gph/en/manual/x135.html

ETTERCAP + METASPLOIT

http://shellrootsecurity.blogspot.com/2010/01/ettercap-metasploit-suplantacion-de_09.html

Password meter

referencias:
http://www.passwordmeter.com/

Console Commands::Regedit

>regedit.exe /s myfile.reg

References:
http://techsupt.winbatch.com/ts/T000001029F18.html

Offensive Security

Verify
nmap -sV -PN -p 445,137,139 --script=smb-check-vulns.nse


Meterpreter common commands

meterpreter > getprivs
meterpreter > migrate 2976
meterpreter > bglist

meterpreter > use -l
meterpreter > ?


meterpreter > bgrun keylogrecorder -c 1 -t 15
meterpreter> run keylogrecorder -c 1 -l -t 5
-c 1 to record a login session, "-l" to force logoff, and "-t 5" to deliver the keystrokes every 5 sec.

Basic meterpreter



Meterpreter Cllient commands
http://en.wikibooks.org/wiki/Metasploit/MeterpreterClient

Vulnerabilidad StickyKeys (sethc.exe)
http://foro.infiernohacker.com/index.php?topic=1867.0

Tools
http://www.md5decrypter.co.uk/

REG
http://ss64.com/nt/reg.html

Meterpreter REG
http://carnal0wnage.attackresearch.com/2007/06/defating-nod32-av.html

examples:
[1] Keylogging
http://www.offensive-security.com/metasploit-unleashed/Keylogging
[2] http://tekjournal.wordpress.com/2011/01/08/login-keystroke-recording/
[3] http://pctechtips.org/metasploit-getting-user-password-with-keylogrecorder/
[4] http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Screen_Capture
[5] http://exploit.co.il/hacking/screenspy-meterpreter-script-review/

modules:
http://www.metasploit.com/modules/auxiliary/analyze/jtr_crack_fast


references:
[1] http://www.blueliv.com/downloads/Meterpreter_cheat_sheet_v0.1.pdf
[2] http://www.question-defense.com/2009/12/21/getting-started-with-meterpreter
[3] Custom exploit
http://www.pentester.es/2009/11/por-que-no-consigo-shell-con-mi.html

Windows::Network commands(cmd)

net user

net user guest
net user invitado


To enable the Guest account for network access:

net user guest /active:yes
net user invitado /active:yes

To disable the Guest account for network access:

net user guest /active:no
net user invitado /active:no


netstat

References
[1] netstat http://commandwindows.com/netstat.htm

Default Ports

Puerto	Desc.	Estado	Observaciones
20	FTP	cerrado	Utilizado por FTP
21	FTP	cerrado	Utilizado por FTP
22	SSH	abierto	Secure Shell.
23	TELNET	cerrado	Acceso remoto
25	SMTP	cerrado	Servidor de correo SMTP
53	DNS	cerrado	Servidor DNS
79	FINGER	cerrado	Servidor de información de usuarios de un PC
80	HTTP	abierto	Servidor web
110	POP3	cerrado	Servidor de correo POP3
119	NNTP	cerrado	Servidor de noticias
135	DCOM-scm	cerrado	Solo se puede cerrar a través de un cortafuegos
139	NETBIOS	cerrado	Compartición de Ficheros a través de una red
143	IMAP	cerrado	Servidor de correo IMAP
389	LDAP	cerrado	LDAP. Tambien Puede ser utilizado por Neetmeting
443	HTTPS	cerrado	Servidor web seguro
445	MSFT DS	cerrado	Server Message Block.
631	IPP	cerrado	Servidor de Impresion
1433	MS SQL	cerrado	Base de Datos de Microsoft
3306	MYSQL	cerrado	Base de Datos. MYSQL
5000	UPnP	cerrado	En windows está activado este puerto por defecto.

Windows.:Hidden user account

http://juliorestrepo.wordpress.com/2008/09/19/trucos-regedit-como-ocultar-una-cuenta-de-usuario-de-la-pantalla-de-bienvenida-de-windows-xp/

PsTools::Remote tools

Share resource

NET SHARE sharename=drive:path /REMARK:"text" [/CACHE:Manual | Automatic | No ]
NET SHARE temp=c:\tmp /REMARK:"temporal files"

Drop share.
NET SHARE {sharename | devicename | drive:path} /DELETE
NET SHARE temp

Show resources
net view \\192.168.1.x


Open remote console

psexec \\IP -u USER -p PASSWORD


If Access denied(Acceso denegado) results, then:

Start, Control Panel, Administrative Tools,Local Security Policy.
Open the Local Policies, Security Options.

Accounts: Limit local account use of blank passwords to console logon only set to Disabled.

if don't work try:

Network access: Sharing and security model for local accounts set to "Classic - local users authenticate as themselves".


Notes(Remote Computer):

a) Debe tener habilitada la opción de "Compartir impresoras y archivos" (Inicio -> Ejecutar.... ncpa.cpl)
b) Debe tener deshabilitada la opción "Utilizar uso compartido simple de archivos"
c) Si tiene habilitado algún firewall debe permitir las conexiones por los puertos NetBIOS.
d) La máquina remota debe correr win NT, 2000, XP Pro, Vista o Server 2003
e) Tener usuario y contraseña válidos en la máquina remota
f) La máquina remota debe tener habilitado el recurso IPC$ y ADMIN$
g) La máquina remota debe tener iniciados los servicios NetLogon y Server

resources:
[1] psTools Download http://technet.microsoft.com/en-us/sysinternals/bb897553
[2] HOW TO: Restore Administrative Shares That Have Been Deleted http://support.microsoft.com/kb/318755
[3] Windows XP Professional File Sharing http://www.practicallynetworked.com/sharing/xp_filesharing/index.htm
[4] How to use the Simple File Sharing feature to share files in Windows XP http://support.microsoft.com/kb/304040

Web Security

Articles : How to hack a website (Basic sql injection)
http://www.ecademy.com/node.php?id=76050

references:
http://www.thc.org/thc-hydra/

Network Security Tools

Wireshark
Ethercap
Winpcap


Resources:
[0] http://wiki.wireshark.org/FrontPage
[1]http://seguridadyredes.nireblog.com/post/2008/03/24/analisis-de-red-con-wireshark-filtros-de-captura-y-visualizacian
[2]http://www.soportederedes.com/2007/06/wireshark-101-filtros-de-visualizacin.html
[3] Yahoo http://wiki.wireshark.org/YMSG
[4] AIM http://wiki.wireshark.org/AIM
[5] MSN http://wiki.wireshark.org/MSNMS?action=show&redirect=MSN
[6] Cain http://shetoldme.com/Technology/How-To-Dump-Windows-Password-Using-Pwdump

Windows Security Crack Tools

ophcrack
http://www.bujarra.com/?p=1002

Wireless Metrics

dBm is defined as power ratio in decibel (dB) referenced to one milliwatt (mW). It is an abbreviation for dB with respect to 1 mW and the "m" in dBm stands for milliwatt.

dBm is different from dB. dBm represents absolute power, whereas dB is a ratio of two values and is used to represent gain or attenuation. For example, 3 dBm means 2 mW, and 3 dB means a gain of 2. Similarly, -3 dBm means 0.5 mW, whereas -3 dB means attenuation of 2.

The formula to calculate dBm from mW is:

dBm = 10 log10( P )
1mW

Table of dBm and mW
http://www.guatewireless.org/internetworking/redes/wireless/tabla-de-relacion-entre-dbm-y-potencia-de-transmision-wlan/

BackTrack Live USB References

http://www.backtrack-linux.org/tutorials/usb-live-install/

http://www.pendrivelinux.com/usb-backtrack-linux-installation/

Making into Linux
http://www.kriptopolis.org/backtrack-usb

unetbootin
http://unetbootin.sourceforge.net/

WPA-PSK tips

Manual seguridad alta con configuración WPA-PSK
http://www.seguridadwireless.net/hwagm/wpa.html