bagi yang ingin bertanya sebaiknya langsng melalui YM apabila lagi online atau inggalkan coment di artikel yang bersangutan.
11 Juli 2010
Membuat dua profil mozilla
caranya yaitu ketik start -> Run -> firefox -p 1 -no-remote
setelah itu silahkan membuat profil baru
gampang kan. semoga bermanfaat bagi yang membutuhkan
trik ini dapat login dengan lebih dari 1 user
semoga bermanfaat
22 April 2010
melihat photo pd facebook dr friends yg blm di add
tetapi cara yg ini tentunya berbeda bengan postingan yg beberapa bln yang lalu
ini berdasarkan pengalaman sy aja sich
sering kali add teman pada fb tetapi photo2'y tidak bs langsung di lihat
menunggu dahulu di app sama yg punya fb
nah dr situ sy cari2 cara gi mana cara'y biar tanpa menungu di app sy sudah bs melihat photo2'y
langsung aja ya sy kasih tw cara'y
gampang kok
pertama kita masuk ke fb yg br aja kita add
terus masuk ke wall'y
kita cari wall yg pd saat dy upload photo
sebagai contoh pd fb di bawah ini
pd yg di lingkai itu ada nama album n tgl upload'yuntuk membuka isi album'y ya tingal klik aja pd photonya
klo mw liat isi album yg laen'y ya kita cari aja wall lebih lama'y
nantiakan ada lg album yg laen'y
sekian du;u totorial'y
semoga bermanfaat
Melihat Private Photo di Friendster
tp gpp lah sebagai info n iseng2 aja
ini totorial untuk melihat privete photo yg ada di friendster
pertama buka dahulu halana di http://codesonweb.com/dev/fs.php/
pada bagian ini
contoh http://profiles.friendster.com/1234567
apabila keluar gambar gembok yg kaya di bawah ini ya anda selamat dapat membuka private photo
setelah klik gambar gembok'y tingal liat satu persatu dech pic'yselamat mencoba
19 Januari 2010
membuka web yang diblok dengan menggunakan proxy Your Freedom
selanjutnya untuk dapat mempergunakan software tersebut harus register terlebih dahulu, halaman untuk register dapat di sini
di sini registernya gratis kok
setelah mengisi data yang di butuhkan maka akan di kirim kode aktifasi ke alamat email yang telah di minta
setelah username di aktifasi maka username tersebut sudah dapat dipergunakan
langkah selanjutya yaitu istal software yang telah di download pada komputer dan ikuti semua perintah yang di minta
setelah terinstal dan memilih sebuah server maka lakukan koneksi terhadap server tersebut
setelah berhasil terkoneksi dengan server yang dipilih maka kita seting proxy pada browser yang dipergunakan
caranya yaitu (ini contoh pada browser firefox) -> Tools -> Options -> Advanced -> Network -> Setting -> proxy name di isi 127.0.0.1 port 1080
setelah selesai semua maka kita sudah dapat mengakses web yang tadinya di blok dech
ini dikarenakn kita mempergunakan server yang dari luar negeri yang disediakan oleh Your freedom
tetapi sayangnya ini hanya mendapatkan kecepatan akses 64kbps dan setiap 1 jam sekali disconet, apabila terjadi disconet maka kita dapat langsung coneksi kembali kok
10 November 2009
serial number windows
- Windows 98 -> K4HVD-Q9TJ9-6CRX9-C9G68-RQ2D3
- Windows 98Arabic -> B4DWD-2B3KX-KT7MR-GQXVB-WFMFY
- Windows 98Second Edition -> HQ6K2-QPC42-3HWDM-BF4KJ-W4XWJ
- Windows 2000 -> RM233-2PRQQ-FR4RH-JP89H-46QYB
- Win 2000Pro -> F6PGG-4YYDJ-3FF3T-R328P-3BXTG
- Windows 2000 Server Version: Service Pack 1 Retail
s/n: XF7DK-7X2WM-2QRCT-Y9R23-4BHDG - Windows 2000 Advanced Server Final
s/n: H6TWQ-TQQM8-HXJYG-D69F7-R84VM - Windows Milenium Eedition Ena -> AMQ67-PGP38-QD6D8-CJXDY-YG3FY
- Windows Milenium Eedition Arabic -> B6BYC-6T7C3-4PXRW-2XKWB-GYV33
- Windows XP -> FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8
- Windows XP SP1 -> 38BXC-F2C4R-PXMXV-DBQXM-3C7V6 or 6G3J7-RQ233-FJGHD-GKYP4-QGKPG
- Windows XP SP2 -> BR89Q-4B9GB-9DPFD-M2PY3-R3F83 or CRTGH-B68P2-XB6JC-44GCD-X9JHM
- Windows XP SP2 -> XP8BF-F8HPF-PY6BX-K24PJ-TWT6M
- windows 2003 Server Enterprise
QW32K-48T2T-3D2pJ-DXBWY-C6WRJ
DELTA FORCE TASK FORCE DAGGER
72YL-R4SB-GKG6-3WKS-HQ27 - Vista Ultimate: 6F2D7-2PCG6-YQQTB-FWK9V-932CC
- Vista Business: 72PFD-BCBK8-R7X4H-6F2XJ-VVMP9
- Vista Home Premium: BH626-XT3FK-MJKJH-6GQT2-QXQMF
- Vista Home Premium: 8XPM9-7F9HD-4JJQP-TP64Y-RPFFV
- Vista Home Basic: 2WP98-KHTH2-KC7KG-4YR37-H8PHC
- Vista Home Basic: 762HW-QD98X-TQVXJ-8RKRQ-RJC9V
- Vista Home Premium: 2TYBW-XKCQM-XY9X3-JDXYP-6CJ97
- Vista Ultimate: 6F2D7-2PCG6-YQQTB-FWK9V-932CC
- Vista Home Premium: 2R6WF-KYF88-27HYQ-XTKW2-WQD8Q
- Vista Home Premium: GP3FQ-JB647-7CW8F-H646B-7PMGF
- Vista Home Premium: 34BKK-QK76Y-WWR7C-QF2M7-2TB37
08 Oktober 2009
Keygen CorelDRAW X4
klik di sini
05 Oktober 2009
Cara Membuka Website yang telah di blokir oleh Admin
03 Agustus 2009
Menghilangkan Counter Down pada RapidShare
- Copy-paste alamat (URL) file yang hendak anda download di address bar Mozilla.
- Setelah halaman Rapidshare muncul, klik Free account.
- Akan muncul counter down, abaikan saja, hapus string url di address bar anda hingga bersih, kemudian ketik kode java script berikut: "javascript:alert(c=0)", tanpa tanda petik
- Tekan ENTER, akan muncul sebuah message box di hadapan kita, tenang, jangan panik, tetap fokus dan bersabar tekan saja [OK] dengan penuh percaya diri, counter down akan segera lenyap dari hadapan anda dan rapidshare akan menampilkan link download file yang ingin anda download.
- nah sekarang tinggal download dech filenya...
optimalkan mozilla firefox
tetapi apabila kita menggunakan setingan defalut ya kinerja browser kita tidak akan optimal, untuk dapat dipergunakan secara optimal maka kita harus merubah beberapa setingan yang ada di browser kita.
tanpa panjalang lebar lagi mari kita ikutin instruksi di bawah ini:
- Buka Mozilla.
- Ketikan di addres bar "about:config" (tanpa tanda patik). Maka akan muncul seperti di bawah ini
- hilangkan tanda centang pada "show this warning next time" dan klik I'll be careful, I promise. Maka akan tampil banyak pilihan, kita pilih yg di perintahkan di bawah ini:
- Scroll mouse anda kebawah dan cari "network.http.max-connections", double klik dan masukan nilai "64".
- Cari "network.http.max-connections-per-server", double klik dan masukan nilai "21".
- Cari 'network.http.max-persistent-connections-per-server", double klik dan masukan nilai "8".
- Doube klik pada "network.http.pipelining " menjadi "true".
- Cari "network.http.pipelining.maxrequests", double klik dan masukan nilai "100".
- Double klik pada "network.http.proxy.pipelining" menjadi "true".
- Langkah terakhir, klik kanan dimana saja pilih : New >> integrar >> lalu tulis "nglayout.initialpaint.delay" (tanpa tanda petik". Kemudian masukan nilai "0".
Setelah selesai semua maka Close Mozilla, kemudian buka lagi dan bandingkan kecepatan nya sebelum kamu melakukan setting tadi.
SEMOGA BERMANFAAT...
20 Juli 2009
Melihat foto pada FB yang bukan teman
Jika anda belum berteman dengan seorang user, maka anda tak akan bisa melihat foto-fotonya. Itulah salah satu rule di Facebook.
Bagaimana cara mengakalinya? Tentunya kita masih harus menggunakan layanan pihak ketiga yang membuat Aplikasi Facebook (Facebook Apps). Contoh apps yang bisa kita manfaatkan untuk kerjaan iseng ini adalah aplikasi Photo Stalker buatan Cubish.com.
URL untuk aplikasi ini:
http://apps.facebook.com/josh_owns/
Login ke FB dan kunjungi URL tersebut. Aprove/Izinkan aplikasi ini berjalan. Dan, segera eksekusi dengan mencantumkan ID, URL atau Nama teman atau yang bukan teman yang ingin anda lihat fotonya.
Selamat mencobah !
Tebak Password FB, Teknik Hack Terpopuler
11 Juli 2009
06 Juli 2009
WIRELESS FOOTPRINTING
Wireless networks and access points (APs) are some of the easiest and cheapest types of targets to footprint (or "war-drive") and ironically some of the hardest to detect and investigate. War-driving once was synonymous with the simple configuration of a laptop, a wireless card, and Network Stumbler (or NetStumbler). Now it is a much more sophisticated setup that can utilize multiple types of high-powered antennas, wireless cards, and palm-sized computing devices, including the ever-popular iPAQ and Palm. Allegedly, this will also be possible with a new version of Microsoft's personal watches, which are supposed to be released in late 2005. Wouldn't that be something? Hacking a wireless network with your watch!
We use the term "war-driving" loosely in the realm of the hacking methodology and "footprinting" mainly because you do not have to be driving. You may walk around a technology park, downtown area, or simply through the halls of your own building with your laptop if you are performing an internal audit. Footprinting wireless devices, particularly APs, starts with the simple task of locating them via the passive method of listening for AP broadcast beacons or the more aggressive method of transmitting client beacons in search of AP responses. Understand that all WLAN footprinting can be done remotely as long as you are in range to transmit and receive beacons and packets to and from the AP. With this said, a huge advantage would be to have a better antenna than what usually comes with the card you purchase.
As you will see, the proper equipment makes all the difference in footprinting a WLAN. Numerous types of wireless cards exist, with different chipsets. Some allow you to put the card in promiscuous mode (that is, to sniff the traffic), and others will not. Likewise, certain cards inherently work better because they provide support for different operating systems. Antenna strength and direction are also equipment factors. You may want to use an omnidirectional antenna if you are just driving through crowded streets, or you can use a directional antenna if you're targeting a specific building, location, or AP. Oh yes, let's not forget about the global positioning system (GPS). GPS will prove to be a wonderful addition to your equipment list if you wish to track APs, monitor their transmitting range, and potentially retest them in the future.
Equipment
Certain types of equipment will be necessary to execute a subset of the presented attacks in addition to the required software. Wireless cards, antennas, and GPS devices, as you will notice, play a large role in what kinds of attacks can be executed and at what range these attacks will be successful.
Cards
Be aware that not all wireless cards are created equal. It is important to understand the requirements and limitations of the cards you plan to use. Some cards require more power, are less sensitive, and might not have an available antenna jack for expanding the range with an additional antenna. You should also know that the ramp-up times to use a card with particular operating systems are significantly different. If you choose to use Linux or BSD, you will have to recompile the kernels with the proper pcmcia-cs drivers, which may not be an easy task if you have little to no UNIX experience. Windows, on the other hand, is a much easier setup process, but you will notice there are far fewer tools, exploits, and techniques you can use from the Win32 console.
AiroPeek NX is the only wireless sniffer worth mentioning for the Windows environment. NetStumbler, a tool that often gets mistaken as a wireless sniffer, only parses wireless packet headers and uses a nice GUI for real-time reporting on access point location, identification, and a few other particulars. The AiroPeek NX application supports packet capturing via 802.11a and 802.11b, even though 802.11g is the current standard. It also supports non-U.S. channel surfing. The United States has provisioned for 802.11 wireless networks to utilize channels 1 through 11 for communication; however, other countries outside the U.S.commonly utilize channels 1 through 24. One particularly useful feature of AiroPeek NX, if you are an international traveler, is that it can support up to all 24 channels. The link listed here provides a full listing of the cards supported by the AiroPeek NX suite:
| Windows WLAN Sniffer Driver Compatibility |
The most widely supported OS in regard to wireless attack tools, drivers, and sniffers is by far Linux. The Linux community has invested significant time and resources developing a collection of PCMCIA drivers (pcmcia-cs) that are compatible with most vendor releases of the 802.11b Prism2 chipset. As stated earlier, you must compile these drivers into the kernel.
Installing the drivers is quite easy and extremely similar to just installing about all other Linux-based applications and drivers. The following installation instructions are current for version 3.2.8 of the pcmcia-cs drivers. Obviously, if a later version is out and you attempt to install it, make sure you change the version number in the file name and directory structures. You can download the current pcmcia-cs drivers from http://sourceforge.net/project/showfiles.php?group_id=2405.
The following are general installation directions:
-
Untar and extract the pcmcia-cs-3.2.8.tar.gz files into /usr/src.
-
Run make config in /usr/src/pcmcia-cs-3.2.8.
-
Run make all from /usr/src/pcmcia-cs-3.2.8.
-
Run make install from /usr/src/pcmcia-cs-3.2.8.
Depending on your WLAN, system configuration, or target networks, you may need to customize the startup script and the option files in the /etc/pcmcia directory.
You can certainly find the drivers you need for your card with a quick query on http://www.Google.com, but it is always nice to have the information given to you. Therefore, listed next are some of the best locations to get your wireless card drivers for Linux. As you can see, they are divided by chipset:
| Orinoco | |
| Prism2 | |
| Cisco |
Next, let's tackle the driver issue for all you who like the new OpenBSD kernel on the Mac laptops (or any other laptop you use that's loaded with OpenBSD). The OpenBSD kernel is very similar to Linux for the types of procedures required to get the system up and running in a wireless mode, specifically promiscuous wireless mode. Because of this, here's a good link where you can get drivers and more information on the BSD tools, if your heart so desires:
| OpenBSD Wireless Drivers |
The 802.11g frequency is the latest protocol to hit the wireless mainstream. It has replaced the other 802.11 frequencies—802.11a and 802.11b—even though it is backward compatible. Therefore, you can use your 802.11b access point with your 802.11g card, and vice versa. This type of compatibility has become the wave of the future in regard to developing new types of technology.
Microsoft (http://www.microsoft.com) entered the wireless communication market in late 2002 but made a significant entrance in 2003 with their low-cost access point and wireless card bundles. For around $85, you could purchase an 802.11g AP and wireless card for Windows XP. Microsoft's new wireless NICs perform alongside with the Orinoco cards in comparison to range and packet loss.
Antennas
Be prepared. Finding and installing the proper antenna may prove to be the most cumbersome task in setting up your war-driving "giddyap." You must first decide what type of war-driving you are going to do. Is it going to be in a major city such as New York, Boston, or San Francisco? Maybe you are going to drive around an area that is less dense, such as the "Silicon Valley of the East Coast," Northern Virginia, or the suburbs of Los Angeles, where you need to drive at high speeds and may be 30 to 40 yards from the target buildings and their access points. These considerations must go into the decision for the antenna you are going to use (see Figure 8-1).
To completely understand the differences in antennas, you need to get a little primer on some of the behind-the-scenes technology for the antennas. First and foremost, you need to understand antenna direction. Basically, there are three types of direction when it comes to classifying antennas: directional, multidirectional, and omnidirectional. In general, directional antennas are used when communicating or targeting specific areas and are not very effective for war-driving (if you are actually driving). Directional antennas are also the type of antennas that are most effective in long-range packet capturing because the power and waves are tightly focused in one direction. Multidirectional antennas are similar to directional antennas in the sense that both use highly concentrated and focused antennas for their transceivers. In most cases, multidirectional antennas are bidirectional (a front and back configuration) or quad-directional. Their range is usually a bit smaller when compared to equally powered unidirectional antennas because the power must be used in more than one direction. Lastly, omnidirectional antennas are what most think of when they think of antennas. An omnidirectional antenna is the most effective in close city driving because it transmits and receives signals from all directions, thereby providing the largest angular range. As an example, car antennas are omnidirectional.
Now that you understand the different terms for antenna direction, it is pertinent that you understand a few of the common types of antennas and how to distinguish a good antenna from a bad one. The wireless term "gain" is used to describe the energy of a directionally focused antenna. Realize that all transceiver antennas have gain in at least two directions—the direction they are sending information and the direction they are receiving it. If your goal is to communicate over long distances, you will want a narrowfocus, high-gain antenna. Yet, if you do not require a long link, you may want a wide-focus, low-gain antenna (omni).
Very few antennas are completely unidirectional because in most cases this would involve a stationary device communicating with another stationary device. One common type of unidirectional antenna would be a building-to-building wireless bridge. A yagi antenna uses a combination of small horizontal antennas to extend its focus. A patch or panel antenna has a large focus that is directly relational to the size of the panel. It appears to be a flat surface and focuses its gain in one general direction. A dish is another type of antenna that can be used, but it's only good for devices that need to transmit in one general direction, because the back of the dish is not ideal for transmitting or receiving signals. For all practical purposes, you will most likely need an omnidirectional antenna with a wide focus and small gain that can easily connect to your wireless card without the need of an additional power supply.
Numerous vendors and distributors are out there that you could use to get the proper equipment to go war-driving. Listed next are some of our favorites. Each will sell you some of the general stuff you will need; however, Wireless Central is well known for its actual "war-driving bundles," and HyperLinkTech is known for its high-powered and long-range antennas.
| HyperLinkTech | |
| Wireless Central | |
| Fleeman, Anderson, and Bird Corporation |
Wireless networking and wireless Internet service providers (WISPs) are now popping up more than ever. Vendors such as Baltimore Wireless, Chicago Waves, and the seemingly unlimited number of mom-and-pop coffee shops in Seattle, Chicago, and New York offer free wireless Internet data services. These services were designed and created on the backs of strong antennas (some with amplifiers), the 802.11g protocol, and custom MAC address filtering logic. We'd hate to call these antennas commercial-ready because none of them are the types you would find on a radar tower in the middle of trees; moreover, they are better classified as "super" home-user antennas.
These home-user antennas usually combine multiple directional antennas (at least four) or stack omnidirectional antennas to improve signal strength (see Figure 8-2). This type of configuration is ideal for anyone offering wireless services to multiple people, or buildings for that matter.
The quad antenna shown in Figure 8-2 is nothing more than four daisy-chained omnidirectional antennas acting as one. This type of service-based antenna will yield a half-mile radius if placed at a high location and could run as much as $1200 to $1500.
The Wireless ISP (WISP) antenna, shown in Figure 8-3, is a custom product offered out by WiFi-Plus. WiFi-Plus designs and creates custom high-end antennas, specializing in configurations for small wireless service providing. Do not expect to start the next Verizon Wireless with one of these; however, it is plenty strong to host a session with a dozen of your closest friends or neighbors. The WISPer or an equivalent antenna can run you between $2000 and $5000, or upwards of $10,000 with the purchase of a corresponding transmission amplifier.
GPS
A global positioning system (GPS) is the wireless equivalent of using a network-mapping tool or application on wired network assessments (see Figure 8-4). Most GPS devices wrap into the war-driving software via timestamp comparisons. The GPS software keeps a real-time log of the device's position by mapping the longitude and latitude coordinates with corresponding timestamps into a simple text file. These text files are easily imported into a variety of mapping software programs that you can use to create colorful and accurate maps for identified access points and their range.
Installing the drivers and the GPS unit is more or less straightforward; however, there are a few considerations you should make before the actual installation takes place. You will need to determine where your setup will go and how you will actually do your war-driving. For example, a serial cable is needed for connecting your GPS to your laptop in most cases, plus you will find out that your GPS unit gets better and more accurate location readings if it has direct access to the sky. Those of you who are fortunate enough to have a convertible Boxter or Jeep need not worry; everyone else may want to consider purchasing a long-enough cable for the GPS unit to sit on the dashboard of their car or rigging the unit with a magnet and affixing it to the roof.
| Note | Don't forget that a GPS unit will do you little good if you don't have proper range with your wireless card to begin with. Hence, if you are going to spend the time, effort, and money to get set up with a war-driving package, including one with GPS mapping software, you should purchase a decent antenna. Refer to the previous section for details and specifics about antennas, their features, and other war-driving specifics. |
As with earlier sections in this chapter, we have listed a few of our personal favorites when it comes to finding and purchasing from a GPS vendor. We realize there are many other vendors you can choose from, but the following vendors are our recommendations because of their unique products, such as the Magellan line of GPS devices. Besides, the goal is that by the end of the chapter you will be able to properly design, implement, and use a top-of-the-line war-driving system that even your friends will be jealous of.
| Garmin International | |
| Magellan |
War-Driving Software
Setting up your war-driving software can be a bit more complicated due to its prerequisite hardware and software installations, mentioned previously. Because war-driving software requires a GPS unit to locate the position of the laptop by the AP as well as the use of AP identification software, setup may prove to be a challenge. However, for wardrivers, allowing for the implementation of GPS units is one of the most useful features you will need. This is true simply because it allows you to map out vulnerable APs for future use or to pinpoint them for hardening.
Because wireless technology (and technology in general) tends to rely on acronyms, you need to be aware of a few simple terms before heading into this section and the rest of the chapter. These terms include SSID, MAC, and IV. The Service Set Identifier (SSID) is used as an identifier to distinguish one access point from another (or in macro-cases, one organization from another). You can think of it as something similar to a domain name for wireless networks. The Media Access Control (MAC) address is the unique address that identifies each node of a network. In WLANs, it can be used as a source for client access control. The Initialization Vector (IV) of a Wired Equivalent Privacy (WEP) packet is included after the 802.11 header and is used in combination with the shared secret key to cipher the packet's data.
NetStumbler, the first publicly available war-driver application, was released as a tool that analyzed the 802.11 header and IV fields of the wireless packet in order to determine the SSID, MAC address, WEP usage, WEP key length (40 or 128 bit), signal range, and potentially the access point vendor. Soon after, a few Linux and UNIX-based tools came out that had similar tactics but also allowed for WEP key cracking and actual packet data cracking. Most of these cracking tools made use of Tim Newsham's discovery and implementation of exploiting key weaknesses in the WEP algorithm and key scheduling algorithm (KSA). Some of the industry-standard war-drivers are listed next. All are different; hence, each has a unique tool feature that you may need in the field.
NetStumbler
| Popularity: | 9 |
| Simplicity: | 9 |
| Impact: | 9 |
| Risk Rating: | 9 |
NetStumbler (http://www.netstumbler.com) is a Windows-based war-driving tool that will detect wireless networks and mark their relative position with a GPS. NetStumbler uses an 802.11 Probe Request sent to the broadcast destination address, which causes all access points in the area to issue an 802.11 Probe Response containing network configuration information, such as their SSID and WEP status. When hooked up to a GPS, NetStumbler will record a GPS coordinate for the highest signal strength found for each access point. Using the network and GPS data, you can create maps with tools such as StumbVerter and Microsoft MapPoint. NetStumbler supports the Hermes chipset cards on Windows 2000, the most popular being the Lucent (now Proxim) Orinoco branded cards. On Windows XP, the NDIS 5.1 networking library has 802.11 capabilities itself, which allows NetStumbler to be used with most cards that support it.
To use NetStumbler, insert your wireless card and set your SSID or network name to ANY. For Orinoco cards, this can be found in the Client Manager utility, as shown next. If NetStumbler doesn't detect access points you know are present, check this first before performing other troubleshooting. Setting the Network Name field to ANY tells the driver to use a zero-length SSID in its Probe Requests. By default, most access points will respond to Probe Requests that contain their SSID or a zero-length SSID.
Once the card is configured correctly, start up NetStumbler and click the green arrow on the toolbar (if not depressed already). If there are any access points in the area that will respond to a Broadcast Probe Request, they should respond and be shown in the window. You can use the Filters option to quickly sort multiple networks on criteria such as WEP usage or whether the network is an IBSS or BSS type network. Because an IBSS (Independent BSS) network is a group of systems operating without an access point like a BSS network, an attacker would only be able to access the systems in that network and not necessarily use the wireless network as a bridge to the internal LAN. Selecting any of the networks by their circle icon will also show a signal-to-noise ratio graph (see Figure 8-5).
NetStumbler's primary weakness is that it relies on one form of wireless network detection, the Broadcast Probe Request. Wireless equipment vendors will usually offer an option to disable this 802.11 feature, which effectively blinds NetStumbler. Other wardriving software available now, such as Kismet, also use this method but have other detection mechanisms to back them up if they fail. That said, there is still no shortage of networks that can be detected by NetStumbler, and the feature to respond to a Broadcast Probe Request is still enabled by default for many vendors.
| Note | Another newly released tool that may prove useful is Hotspotter. Hotspotter can be utilized to find wireless hotspots or wireless networks; it along with documentation can be downloaded from http://www.remote-exploit.org/downloads/hotspotter-0.4.tar.gz. |
Kismet
Kismet (http://www.kismetwireless.net) is a Linux and BSD-based wireless sniffer that has war-driving functionality. It allows you to track wireless access points and their GPS locations like NetStumbler, but it offers many other features as well. Kismet is a passive network-detection tool that cycles through available wireless channels looking for 802.11 packets that indicate the presence of a wireless LAN, such as Beacons and Association Requests. Kismet can also gather additional information about a network if it can, such as IP addressing and Cisco Discovery Protocol (CDP) names.
Included with Kismet is a program called GPSMap, which generates a map of the Kismet results. Kismet supports most of the wireless cards available for Linux and OpenBSD.
To use Kismet, you will first have to install the custom drivers required for monitormode operation. This can vary depending on the chipset your card uses, but Kismet comes with a single way to enable all of them for monitor operation. Before starting Kismet, run the kismet_monitor script to place your card into monitor mode. Be sure you are in a directory that the Kismet user has access to before starting Kismet:
[root@localhost user]# kismet_monitor
Using /usr/local/etc/kismet.conf sources...
Enabling monitor mode for a cisco card on eth1
Modifying device eth1
This will place the wireless card configured in your kismet.conf file into monitor mode. Once Kismet is loaded, the interface will display any networks in range. By default, Kismet will sort the networks in an "Autofit" mode that doesn't let you step through them. Press S to bring up the sort menu and then choose one of the available options; "l" (or latest time seen) works well in most cases. The main window, shown next, displays the network name (SSID). The T column displays the type of network, W signifies whether or not WEP is enabled, and Ch stands for "channel number." The IP Range column shows any detected IP addresses found, either via ARP requests or normal traffic.
Kismet Countermeasures
As far as countermeasures to Kismet go, there aren't many. Kismet is currently the best war-driving tool available and will find networks that NetStumbler routinely misses. In addition to its network-discovery capabilities, it can also automatically log WEP packets with weak IVs for use with AirSnort as well as detect IP addresses in use on the WLAN.
Dstumbler
| Popularity: | 5 |
| Simplicity: | 6 |
| Impact: | 9 |
| Risk Rating: | 7 |
Dstumbler (http://www.dachb0den.com/projects/dstumbler.html) is part of the BSD-Airtools package for the OpenBSD, NetBSD, and FreeBSD operating systems. Dstumbler is a war-driving application that supports logging access point locations with a GPS. Support for both Orinoco and Prism2 cards is provided, although the monitor mode support that allows Dstumbler to detect access points that don't respond to a Broadcast Probe Request is for Prism2 cards only. Dstumbler will also report if an access point is using a default SSID, and it has some capabilities to detect whether a network is using 40or 104-bit WEP.
Dstumbler requires kernel patches for monitor mode support on the Prism2 cards for NetBSD and FreeBSD. OpenBSD 3.2, however, includes these modifications in the default kernel. After the bsd-airtools package is installed, you can start Dstumbler by specifying the wireless interface to use:
foo# dstumbler wi0 -o -m 30 -l log.txt
This will start up Dstumbler on the wi0 interface in monitor mode ( -o ), randomly changing the MAC address every 30 seconds ( -m 30 ) and logging to an output file called log.txt ( -l log.txt ). Once the application has loaded, you are presented with an ncurses interface with three main windows, as shown next. At the upper left is a display of detected networks, to the right are the details for the selected network, and below is the real-time signal strength of the selected network. You can move up and down the network list with the upand down-arrow keys.
Dstumbler Countermeasures
When scanning with an Orinoco card, Dstumbler can be blocked if you disable the response to Broadcast SSID requests. When Dstumbler is in monitor mode, however, you will likely not be able to prevent the tool from detecting your SSID. Because Dstumbler can highlight the fact that you are using a default SSID, you should at least change the SSID to something other than the OEM initial setting.
Wireless Mapping
Once you've discovered the available access points, one thing you can do with this data is create maps based on the results of the network and GPS data. War-driving tools will log the current GPS location, signal strength, and attributes of each access point. Based on this data, these tools can guess where the access point is on the assumption that the closer you get to an AP, the stronger the signal will be. Previously, you would need to convert the results from your war-driving tool to a format that a mapping system such as Microsoft MapPoint or the MapBlast website could use to interpret the GPS coordinates. Now, however, software is available that automates this process for you and reads in the data straight from the war-driving tool. In addition to using your own data, some groups have established sites such as http://www.wifimaps.com and http://www.gigle.net to accumulate the information in a large database.
StumbVerter
StumbVerter (http://www.sonar-security.com) is an application that uses MapPoint 2002 to plot data from files in the NetStumbler format. This saves you the hassle of manually inputting this information into MapPoint or another mapping tool. It also creates NetStumbler-style icons on the map for each access point. Green icons represent nonencrypted networks, and red icons indicate networks using WEP.
To use StumbVerter, click the Import button and select a saved NetStumbler scan (be sure it's one with GPS data; otherwise, StumbVerter will not be able to plot the AP locations). Once the map is loaded you can select View | Show All AP Names and Info to get additional information about each network, including the SSID and MAC address. The normal MapPoint 2002 controls are available, so you can zoom and edit the map just like you would in MapPoint. If you are satisfied with the map, you can save it off to a MapPoint file, bitmap, or HTML page (see Figure 8-6).
GPSMap
| Popularity: | 3 |
| Simplicity: | 5 |
| Impact: | 2 |
| Risk Rating: | 3 |
GPSMap is included with the Kismet wireless monitoring package. It imports Kismet.gps and network files and then plots the network locations on maps from a variety of sources. GPSMap is probably the most versatile war-driving map generator available and supports many drawing options for each access point. Maps can be made based on the estimated range of each network, the power output, a scatter plot, or all these options together. Although it is extremely flexible, GPSMap can be a bit command-line intensive. To create a map with GPSMap, you'll need some saved Kismet results with GPS data. This would be at least a .network file and a .gps file for a given date and scan. Here's an example:
Kismet-07-2002-1.network and Kismet-07-2002-1.gps.
Once you know which result files you want to use, you'll need to run GPSMap against those files with the right options. The major arguments are the name of the output file ( -o ), what source to take the background map image from ( -S ), and your draw options. Because GPSMap uses ImageMagick, your output file can be in almost any imaginable format, such as JPEG, GIF, or PNG. The background image sources are three vector map services—MapBlast, MapPoint, and Tiger Census maps—and one photographic source using United States Geological Survey (USGS) maps from Terraserver (http://terraserver.homeadvisor.msn.com). Map sources or drawing options depend on your personal preferences and what you want to do with the map. It's best to try them all out and see which ones best fit your needs.
In the following example, we are creating a PNG map called newmap.png ( -o new-map.png ) using a USGS map as the background ( -S 2 ) to a scale of 10 ( -s 10 ). The drawing options are set to color the networks based on WEP status ( -n 1 ), draw a track of the driven route ( -t ) with a line width of 4 ( -Y 4 ), and map each access point with a dot at the center of the network range ( -e ), making the circle five units wide ( -H 5 ). The last argument is the name of the .gps file to use for input.
[root@localhost user]# gpsmap -o newmap.png -s 10 -S 2 -n 1 -t -Y 4
-e -H 5 Kismet-Jan-07-2005-1.gps
JiGLE
| Popularity: | 2 |
| Simplicity: | 6 |
| Impact: | 2 |
| Risk Rating: | 3 |
JiGLE (http://www.wigle.net) is a Java client for viewing data from the WiGLE.net database of wireless networks (see Figure 8-7).
WiGLE.net currently has over 160,000 wireless networks listed in its database, which means that if you live in an area with WiGLE data, people wouldn't even have to go wardriving themselves to find your network. JiGLE reads in network and GPS data from WiGLE map packs. By default, it comes with a map pack for Chicago, but you just need to register to download any other available pack for other parts of the country. The client itself can also read in your own NetStumbler or Kismet results file and plot the network points on a map you provide.
To use JiGLE, make sure you have the Java JRE 1.3.0 or above installed and click the run. bat file in the JiGLE directory. Then select from the available map packs using the dropdown menu on the left side of the toolbar. If you'd like to get additional map packs, you'll need to download them from http://www.wigle.net/gps/gps/GPSDB/mappacks.
If you're performing a wireless assessment, it would be a good idea to check the WiGLE database, or other online databases such as http://www.netstumbler.com, for the presence of your access point. Most of the DBs will honor your request to remove your AP.
GAINING ACCESS
In the realm of wireless and 802.11, gaining system access is significantly different when compared to "wired" systems. In most cases, this is due to a lack of strong WEPenforced encryption, thereby allowing the attacker to crack weak keys and obtain pertinent transmitted data. If the attacker has gained access to the AP's WEP key, the WLAN is all but penetrated. The small amount of communication information that is still required to effectively gain access should be considered ridiculously elementary when compared to the skill-set required to configure and utilize a wireless-cracking-capable system. As you will notice, a variety of methods is available to gain access to systems, covering a wide range of effort levels.
SSID
Once you have the SSID, you'll need to reconfigure your wireless interface to use it. On Windows operating systems, the card vendor will usually provide a utility to reconfigure card settings or an interface in the driver itself to reconfigure the SSID. Shown next is the configuration screen for an SMC wireless card and its driver settings. The network name has been changed to "Linksys," the SSID of the network we wish to connect to.
For Linux, most drivers will support the iwconfig interface. iwconfig is a wireless version of the ifconfig command used to configure basic 802.11 network parameters such as the SSID. To change the SSID with iwconfig, use the following command, where "sigma" is the network name and "eth1" is the wireless interface:
[root@localhost root]# iwconfig eth1 essid sigma
BSD systems such as OpenBSD and FreeBSD use the wicontrol command, which is used to change parameters of cards that use the wi (Wavelan) driver and handle the 802.11-specific network configuration parameters. To change the SSID using wicontrol, use the following example, where the interface we want to change is "wi0" and the target network name is "Lucent":
# wicontrol -I wi0 -n Lucent
MAC Access Control
Once you've gathered a list of usable MAC addresses, you will need to reconfigure your system to use a new MAC. For Windows systems, this may be driver dependent. Some older drivers allow you to reconfigure the MAC address in the interface properties, but many vendors have since disabled this capability. A few utilities are available to help with this problem—one of them is Bwmachak, created by BlackWave. Bwmachak will change the MAC address of an Orinoco wireless card to one you specify. To use Bwmachak, remove the card first, then run Bwmachak as shown next (00:09:E8:B4CB:E8 is the MAC we want to use):
E:\> BWMACHAK.exe 0009E8B4CBE8
After the command has run, insert your card and run an ipconfig /all to verify the MAC address has changed.
Linux systems can use the ifconfig command to change the MAC. You'll need to bring down the interface first, then issue the new hardware Ethernet address, and finally bring the interface back up and check the results. Here is a sample command sequence to use. As you can see, the wireless interface is eth1 and the MAC we wish to use is 00:02:2D:07:E1:FF.
[root@localhost root]# ifconfig eth1 down [root@localhost root]# ifconfig eth1 hw ether 00:02:2D:07:E1:FF [root@localhost root]# ifconfig eth1 up [root@localhost root]# ifconfig eth1 eth1 Link encap:Ethernet HWaddr 00:02:2D:07:E1:FF UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:15 errors:2388 dropped:0 overruns:0 frame:2388 TX packets:10 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:720 (720.0 b) TX bytes:3300 (3.2 Kb) Interrupt:3 Base address:0x100
FreeBSD systems use the ifconfig command as well, but with a slightly different context. Bring down the interface before applying changes, just as in Linux, but omit the "hw" and colons in the address itself:
# ifconfig fxp0 ether 00022d07e1ff
Then bring the interface up and check it to make sure the changes have taken effect.
OpenBSD users can use the sea utility to change the MAC address because the supplied version of ifconfig does not support that capability. sea does not have an official download location, so the easiest way to find it is with a Google search for "openbsd" and "sea.c". Sea's operation is very straightforward and works in the following manner. In this example, wi0 is the wireless interface and 00:02:2D:07:E1:FF is the MAC address we want to use:
# sea -v wi0 00:02:2D:07:E1:FF
WEP
Wired Equivalent Privacy (WEP) is a standard derived by the IEEE to provide an OSI Layer 2 protection schema for 802.11 wireless networks. The goal of WEP is not to completely secure the network but rather to protect the data from others passively and unknowingly eavesdropping on the WLAN. Many people mistake the WEP algorithm for a security solution that encompasses secure authentication and encryption, a goal that the 802.11 standard did not intend to address.
The WEP algorithm relies on a secret key that is shared between the AP and the client node, most commonly a wireless card on a laptop. WEP then uses that shared secret to encrypt all data between the nodes. The common misconception is that WEP provides network authentication via the use of a shared secret. If a WLAN is enforcing WEP, then any party that does not obtain that shared secret may not join that network. Therefore, the network is thought to be secure. The WEP algorithm does not encrypt the 802.11 header, nor does it encrypt the Initialization Vector (IV) or ID portions of the packet (see Figure 8-15).
A new tool called file2air was created to inject seemingly random traffic into the air, or wireless network airspace. Written by Joshua Wright (Joshua.wright@jwu.edu), this tool leverages the Air-Jack drivers to arbitrarily write packets to the wireless network. Replayed communication tunnels such as these are excellent for overloading small wireless access points, wireless intrusion detection systems, and perimeter security systems such as AirDefense and BlueSocket. The source for file2air can be downloaded from http://home.jwu.edu/jwright/code/file2air-0.1.tar.bz2.
|
|
RC4, a stream cipher encryption algorithm created by RSA, constantly encrypts the data between two nodes, thereby creating a fully encrypted virtual tunnel. In relation to its common use within the wireless arena, RC4 may utilize either a 64-bit or 128-bit shared secret key as the seed for the RC4 streams. One of the issues with the shared secret key is that 24 of the bits are directly derived from the unencrypted IV; that is why 128-bit WEP is sometimes referred to as 104-bit WEP. As detailed hereafter, multiple attacks leverage the unencrypted IV field. The packet data is then encrypted with the secret key and appended with a packet checksum.
Attacks Against the WEP Algorithm
Several attacks on the WEP algorithm surfaced just shortly after its commercial introduction and implementation in wireless APs and client cards. The attacks range from passive to active, from dictionary based to key length, and one-to-one to man-in-the-middle. However, in general, most of the attacks work via brute-force techniques. Such techniques allow an attacker to test entire keysets, all the possibilities, looking for the single correct instance. The other category for attacking WEP is based on analysis of the IVs in correlation to the first RC4 output byte.
As mentioned previously, brute-force attacks are commonly used to exploit some of the key weaknesses within the WEP algorithm, particularly in determining the shared secret key. Passive attacks—that is, attacks that do not require you to send any packets—allow you to sniff 802.11 packets and perform computations on those packets locally. The goal for this type of attack is not to knock other systems off the Net or to forge packets to systems but rather to gather information about the network clients, the implemented security features, and the AP configuration, in addition to potentially cracking the WEP key. Through traffic analysis, you can potentially determine the services running, the encryption and authentication methods, whether a MAC-based authentication schema is implemented, and what the size of the key is in bits.
The only passive attacks that target the WEP algorithm are key and packet cracking. The attack starts by sniffing a large number of packets from potentially numerous clients (the more packets, the more likely the attack will be successful). Because the IV is in cleartext, you can do packet analysis based on client and corresponding IV. Once you have two packets that use the same IV, you can XOR the packets and obtain the one XOR of the packets. This can be used to infer information about the packets and further eliminate possibilities within the keyspace for brute-force attacks on the message. Once the XOR, encrypted text, and unencrypted text of a packet is determined, it's trivial to determine the shared secret because the shared secret was used to create the XOR.
The other type of attack is simply brute-forcing the shared secret key. You can attempt to decrypt the message in the same fashion that an AP would, verifying success via the checksum. By taking advantage of the IV weaknesses, you can execute dictionary attacks on WEP checks in minutes or sometimes seconds, depending on the wordlist and CPU speed. An entire 40-bit keyspace brute-force attack only takes about a few weeks when running on a single system.
Almost all the active attacks against the WEP algorithm are not focused on determining the shared secret key. The active attacks focus on injecting packets into current 802.11 streams. However, in all cases, you must first know the MAC of the AP and whether WEP is enforced, as well as the bit-strength and key if it is implemented. Now that you understand what you need, if WEP is disabled, the effort to use a packet-injection technique is insignificant. In either case, you would just forge the packet you want to write to the "wire" and send it off. The tools that use some of these techniques include Air-Jack and Libradiate.
Securing WEP
Multiple vendors, including Cisco, Orinoco, and Intel, have developed more secure implementations of the WEP algorithm, key scheduling, or product firmware. WEP-Plus was developed as a firmware upgrade for APs and wireless cards to modify the current IV-creation algorithm within WEP. WEP-Plus uses a more secure algorithm for determining and masking the IV field. PKI vendors such as Baltimore Technologies and Entrust have leveraged their PKI and VPN technologies to be compatible within the realm of wireless. In this case, wireless clients would have to authenticate to the network via a certificate server. If authentication succeeds, the user is allowed to join the network via an encrypted VPN tunnel. This type of security is not much different from a few of the smaller vendors pushing their wireless VPN solutions utilizing an SSL or IPSec tunnel on top of WEP. Granted, the data may be secured because of the additional applicationand transport-layer encryption, but the actual wireless sessions are still insecure. The IVs are still in cleartext and not properly randomized with this solution.
WEP has inherent security issues within the protocol, implementation, and overall vendor and consumer usage. Unfortunately, 802.11 offers great functionality because it allows people to work without wires, so wireless technology will never go away. The defensive solution is to layer security with multiple encryption and authentication schemas and to only use vendors that have addressed the IV and weak KSA WEP issue.
27 Juni 2009
07 Mei 2009
membuka password pada file pdf
nah ini saya punya sebuah link software yang dapat membuka pasword pdf dan sudah ada serial numbernya juga jadi ini oftware sudah versi full
nama aplikasinya tuh PDF Password pro v3.0
untuk download dapat klik di sini
semoga aplikasi ini dapat membantu temen-temen semua
private folder
Sekarang ini saya juga akan berbagi cara agar sebuah folder tidah dapat di buka oleh sembarang orang. Sebelumnya donlot dulu ya file ini.
folder private.zip
setelah di download maka extract dahulu
di dalem file tersebut terdapat folder pv, loc, dan key. Fungsi dari file tersebut adalah:
- folder pv ini tempat menyimpan file-file yang orang lain tidak dapat mengaksesnya
- aplikasi yang bernama loc ini untuk mengunci folder pv agar folder pv ini tidak bisa di akses
- aplikasi yang bernama key ini untuk membuka kembali folder pv (folder pv yang tadinya tidak dapat di akses maka sekarang dapat di akses lagi)
- copy seluruh data rahasia kita (data yang orang lain tidak boleh tau) ke dalam folder pv, ya untuk uji coba 1 ato 2 file aja dulu dech.....
- dobele klik file loc (setelah di itu folder pv akan berubah iconnya menjadi icon control panel dan isinya tidak dapat dilihat dech....
- untuk mengembalikan seperti semula lagi maka dobele klik aja file key, setelah itu folder pv yang tadinya tidak dapat di lihat isisnya maka sekarang sudah dapat di lihat lagi dech isinya.
- ketiga file tersebut harus berada pada folder yang sama agar dapat berfungsi
- agar lebih aman ya kita setelah mengunci ato membuka folder pv file loc dan key di pindahin ke sebuah folder yang berbeda, sehingga orang yang sudah tau cara teknik ini sedikit bingung untuk membuka folder tersebut
- lisning tersebut hanya berfungsi pada folder yang bernama pv saja, untuk folder yang bernama selain pv bisa saja hanya lisning program dalam file loc dan key di rubah juga. cara ngerubahnya gampang saja sich tinggal buka notpad lalu klik file->open pada bagian file of tipe rubah menjadi all file setelah itu cari file loc dan key di simpan. maka akan tampil sebuah lisning program. nah di situ kita ganti dech semua tulisan pv dengan nama folder yang akan kita kunci. setelah itu di save filenya. hal ini jg kita lakukan dengan file key.
- lisning ini juga hanya dapat berfungsi di windows xp
semoga tulisan ini dapat bermanfaat
