Saturday, March 30, 2013

Spooftooph Automated Spoofing & Cloning Bluetooth Device - DOWNLOAD!!

Spooftooph is designed to automate spoofing or cloning Bluetooth device Name, Class, and Address. Cloning this information effectively allows Bluetooth device to hide in plain site. Bluetooth scanning software will only list one of the devices if more than one device in range shares the same device information when the devices are in Discoverable Mode (specificaly the same Address).

 Features

  • Clone and log Bluetooth device information
  • Generate a random new Bluetooth profile
  • Change Bluetooth profile every X seconds
  • Specify device information for Bluetooth interface
  • Select device to clone from scan log
Usage : To modify the Bluetooth adapter, spooftooth must be run with root privileges. Spooftooph offers five modes of usage:

1) Specify NAME, CLASS and ADDR.
root@thnlab: spooftooph -i hci0 -n new_name -a 00:11:22:33:44:55 -c 0x1c010c

2) Randomly generate NAME, CLASS and ADDR.
root@thnlab: spooftooph -i hci0 -R

3) Scan for devices in range and select device to clone. Optionally dump the device information in a specified log file.
root@thnlab: spooftooph -i hci0 -s -w file.csv

4) Load in device info from log file and specify device info to clone.
root@thnlab: spooftooph -i hci0 -r file.csv

5) Clone a random devices info in range every X seconds.
root@thnlab: spooftooph -i hci0 -t 10

 Download Spooftooph Here For Free

Penetration Testing Cheat Sheet - DOWNLOAD!!

Average Security Guy upload a cool Cheat sheet on their website, that are really useful on one's pen. test engagements. We have make a image of the sheet for your easiness, you can Download the Here For Free, or get the Text version from their Website Here.

WebSploit Framework With WiFi Jammer - DOWNLOAD!!

WebSploit Is An Open Source Project For Scan And Analysis Remote System From Vulnerability.
WebSploit Is An Open Source Project For :
[>]Social Engineering Works
[>]Scan,Crawler & Analysis Web
[>]Automatic Exploiter
[>]Support Network Attacks
 [+]Autopwn - Used From Metasploit For Scan and Exploit Target Service
[+]wmap - Scan,Crawler Target Used From Metasploit wmap plugin
[+]format infector - inject reverse & bind payload into file format
[+]phpmyadmin Scanner
[+]LFI Bypasser
[+]Apache Users Scanner
[+]Dir Bruter
[+]admin finder
[+]MLITM Attack - Man Left In The Middle, XSS Phishing Attacks
[+]MITM - Man In The Middle Attack
[+]Java Applet Attack
[+]MFOD Attack Vector
[+]USB Infection Attack
[+]ARP Dos Attack
[+]Web Killer Attack
[+]Fake Update Attack
[+]Fake Access point Attack

THIS TOOL IS LEGAL!!

 Download WebSploit Framework Here For Free

Server Analyser: Malware Scanner - DOWNLOAD!!

Server Analyser  is a service for detecting and analyzing web-based threats. It currently handles shells, obfuscated JavaScript, Executables, Iframes and port scans.
Featured added:
+ Logging scans
+ Just paste the results ( option 1 )
+ Added new Exploit methods to option 1
+ Latest infections ( will be updated automaticly )
+ Added PHP Shell detection exec()/system() etc. ( more will be added soon )
+ The code has been changed into a smaller one
+ Added new BlackHole methods
+ Added different javascript methods
+ Added decoded php syntaxes
 

Finddomains Reverse IP Lookup Tool - DOWNLOAD!!

FindDomains is a multithreaded search engine discovery tool that will be very useful for penetration testers dealing with discovering domain names/web sites/virtual hosts which are located on too many IP addresses. Provides a console interface so you can easily integrate this tool to your pentest automation system. It retrieves domain names/web sites which are located on specified ip address/hostname. 
In order to use FindDomains :
Create an appid from "Bing Developers", this link.
It'll be like that : 32AFB589D1C8B4FEC73D4BCB6EA0AD810E0FA2C7
When you have registered an appid, enter it to the "appid.txt" which is on program directory.
 
 Some outlines :
  • Uses Bing search engine. Works with first 1000 records.
  • Multithreaded on crawling and DNS resolution.
  • Performs DNS resolution for extracted domains to eleminate cached/old records.
  • Has a console interface so it can be very useful with some command-line foo.
  • Works with Mono. But running under Windows is more efficient.  
 Sample usage :
FindDomains.exe 1.2.3.4
FindDomains.exe www.hotmail.com


jNetPort Active Monitoring Tool - Scanner Tool - DOWNLOAD!!

jNetPort is a complete Java based active monitoring tool and network status display. It includes a graphic user interface for multiple port scanner engines (including Nmap) with multitasking environment (allowing to do multiple scans at the same time), graphic ping tool, traceroute tool with worldwide IP location display, and a complete statistics section which allows to display plots and compare and save results.


Burp Suite - Hacking & Security Tools - DOWNLOAD!!

Burp Suite helps you secure your web applications by finding the vulnerabilities they contain.  Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, persistence, authentication, upstream proxies, logging, alerting and extensibility.

 Burp Suite allows you to combine manual and automated techniques to enumerate, analyse, scan, attack and exploit web applications. The various Burp tools work together effectively to share information and allow findings identified within one tool to form the basis of an attack using another.


User Interface:
  • Burp's UI has been completely overhauled, to improve looks and usability:
  • Fonts are now available throughout the UI, with corresponding resizing of all UI elements (tables, dialogs, buttons, etc.).
  • There are configurable hotkeys for all common functions.
  • Intruder and Repeater now have smart tabs, which you can drag to reorder, and click to create, close or rename.
  • Tables are natively sortable everywhere, except where the row ordering is part of the options you are configuring.
  • Text fields now have context-aware auto-complete memory.
Burp now implements sslstrip-style functionality, allowing you to use non-SSL-capable tools against HTTPS applications, or to perform active MITM attacks against users who begin browsing using HTTP.
 

BeEF Browser Explotation Framework - Professional Exploit Tool - DOWNLOAD!!

The Browser Exploitation Framework (BeEF) is a powerful professional security tool. It is a penetration testing tool that focuses on the web browser. BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors. Unlike other security frameworks, BeEF focuses on leveraging browser vulnerabilities to assess the security posture of a target. This project is developed solely for lawful research and penetration testing.

 BeEF hooks one or more web browsers as beachheads for the launching of directed command modules. Each browser is likely to be within a different security context, and each context may provide a set of unique attack vectors. The Version 0.4.3.8


DiskCryptor - Encrypt Your Partitions - DOWNLOAD!!

Encrypting your documents protects them from prying eyes if your computer becomes lost or stolen. However, you shouldn’t stop at just encrypting your sensitive documents. A thief can recover passwords and other sensitive information stored by Windows. Even if you password-protect your Windows account, your system files can still be easily accessed, for example, from a Linux-based Live-CD.
 
DiskCryptor - fully open solution to encrypt all partitions, including system. The program is a replacement for proprietary DriveCrypt Plus pack and PGP WDE. The only alternative to DiskCryptor that has comparable features is TrueCrypt. There are other alternatives with similar functionality, but they are fully proprietary ones, which makes them unacceptable to use for protection of confidential data.Originally, DiskCryptor was conceived as a replacement for DriveCrypt Plus Pack and PGP Whole Disk Encryption (WDE). Now, however, the aim of the development of the project is to create the best product in its category.
 
 
Encryption of system and bootable partitions with pre-boot authentication:
· Full support for dynamic disks.
· Support for disk devices with large sector size, which is important for hardware RAID operation.
· Automatic mounting of disk partitions and external storage devices.
· Broad choice in configuration of booting an encrypted OS. Support for various multi-boot options.
 
High performance, comparable to efficiency of a non-encrypted system:
· Support for hardware cryptography on VIA processors (PadLock extensions for hardware AES acceleration).
· Support for hardware AES acceleration (AES-NI instruction set) on new Intel CPUs.
 Full support for external storage devices. Full compatibility with third party boot loaders (LILO, GRUB, etc.) Transparent encryption of disk partitions.

The Autopsy Forensic Browser 3 - DOWNLOAD!!

The Autopsy Forensic Browser is a graphical interface to The Sleuth Kit. Together, they can analyze Windows and UNIX disks and file systems (NTFS, FAT, UFS1/2, Ext2/3). Version 3.0 of Autopsy is a complete re-write and this page describes its features.
 
Autopsy 3 has been designed to be a graphical platform for open source digital forensics tools. It was written in Java using the NetBeans Platform. This approach allows Autopsy to run on multiple platforms (Windows, OS X, Linux, etc.) and have a modular framework that makes it easy to incorporate other open source forensics tools and create an end-to-end solution. Autopsy 3.0 is faster and easier to use than Autopsy 2.0
New features:
- Using Sleuthkit 4.0.0
- Integrated plugin installer.
- New options menu to globally access module options.
- Added custom ingest module loader and ingest module auto-discovery
 

TCHead TrueCrypt Password Cracking Tool - Download!!

TCHead is software that decrypts and verifies TrueCrypt headers. TCHead supports all the current hashes, individual ciphers, standard volume headers, hidden volume headers and system drive encrypted headers (preboot authentication). Brute-force TrueCrypt : However, TrueCrypt passwords go through many iterations and are strengthened. Cracking them takes time. Very strong passwords will not be cracked. Also, in addition to trying multiple passwords an attacker must try each password against each combination of hash and cipher (assuming they do not know what these are beforehand). System encrypted hard drives use only one hash and cipher, so attacking those is faster.
Testing TCHead: Create a TrueCrypt volume using the default hash and cipher (RIPEMD-160 and AES), set the password to "secret", then run TCHead against it like this and it will decrypt the header (provided that the word "secret" is in the word list)
Command : TCHead -f name_of_volume.tc -P words.txt

Decrypt hidden volumes:
Command : TCHead -f name_of_volume.tc -P words.txt --hidden
 Multiple passwords (brute-force): Create or download a list of words in a text file (one word per line) using words that you think are likely to decrypt the header, then run TCHead against it like this. If the correct password is found, the header will be decrypted:
Command : TCHead -f name_of_volume.tc -P words.txt

Hideman Free VPN Service With Mutliple Server Locations - For Windows & Android - DOWNLOAD!!

Virtual Private Network services are handy when you want to surf internet privately. VPN helps us to protect our surfing habits cached by website. Your internet service provider also not able to know what you are doing on internet. VPN helps you to surf anonymously.

Connections to VPNs are encrypted which means that your data is safe from snooping users in the same network. This means you do not have to fear that someone in a hotel, Internet cafe or airport can steal personal information and data from you.
 
Hideman provides its customers with VPN and Wi-Fi protection services. VPN is short for “Virtual Private Network,” which basically allows for an encrypted pathway between servers and hardware. As a result, all computers and web presences using a VPN are completely anonymous, ensuring unsurpassed privacy. Hideman offers this service through their special software which can be downloaded for free. In order to utilize the service, the user runs the software and manually establishes a unique IP address and country of origin.

Hideman’s software is completely free to download. On top of that, its users will also be able to use it for four hours a week, providing a nearly “unlimited” free trial.  


JBoss Autopwn Hacking Tool - DOWNLOAD!!

This JBoss script deploys a JSP shell on the target JBoss AS server. Once deployed, the script uses its upload and command execution capability to provide an interactive session.
Features include:
- Multiplatform support - tested on Windows, Linux and Mac targets
- Support for bind and reverse bind shells
- Meterpreter shells and VNC support for Windows targets
 
 
Installation: Dependencies include
- Netcat
- Curl
- Metasploit v3, installed in the current path as "framework3"
 

SANS Investigative Forensic Toolkit - DOWNLOAD!!

The SANS Investigative Forensic Toolkit (SIFT) Workstation is a VMware Appliance that is pre-configured with all the necessary tools to perform a detailed digital forensic examination. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats. The brand new version has been completely rebuilt on an Ubuntu base with many additional tools and capabilities that can match any modern forensic tool suite.


New in SIFT 2.14
  • iPhone, Blackberry, and Android Forensic Capabilities
  • Registry Viewer (YARU)
  • Compatibility with F-Response Tactical, Standard, and Enterprise
  • PTK 2.0 (Special Release – Not Available for Download)
  • Automated Timeline Generation via log2timeline
  • Many Firefox Investigative Plugins
  • Windows Journal Parser and Shellbags Parser (jp and sbag)
  • Many Windows Analysis Utilities (prefetch, usbstor, event log, and more)
  • Complete Overhaul of Regripper Plugins (added over 80 additional plugins)

WiFi Honey - Creates Fake AP'S - DOWNLOAD!!

This is a script, attack can use to creates fake APs using all encryption and monitors with Airodump. It automate the setup process, it creates five monitor mode interfaces, four are used as APs and the fifth is used for airdump-ng. To make things easier, rather than having five windows all this is done in a screen session which allows you to switch between screens to see what is going on. All sessions are labelled so you know which is which.
 Installing wifi honey
chmod a+x wifi_honey.sh
./wifi_honey.sh fake_wpa_net
./wifi_honey.sh fake_wpa_net 1 waln1

 Download Wifi Honey Here For Free

Android Privacy Guard - DOWNLOAD!!

There's no public key encryption for Android yet, but that's an important feature for many of us. Android Privacy Guard is to manage OpenPGP keys on your phone, use them to encrypt, sign, decrypt emails and files.
Change log v1.0.8
  • HKP key server support
  • app2sd support
  • more pass phrase cache options: 1, 2, 4, 8 hours
  • bugfixes
 

Joomscan Security Scanner - Updated - DOWNLOAD!!

Security Team Web-Center just released an updated for Joomscan Security Scanner. The new database Have 673 joomla vulnerabilities. Joomla! is probably the most widely-used CMS out there due to its flexibility, user friendlinesss, extensibility to name a few.So, watching its vulnerabilities and adding such vulnerabilities as KB to Joomla scanner takes ongoing activity.It will help web developers and web masters to help identify possible security weaknesses on their deployed Joomla! sites. 

NetSleuth Network Forensics & Analysis Tools - DOWNLOAD!!

NetSleuth identifies and fingerprints network devices by silent network monitoring or by processing data from PCAP files. NetSleuth is an opensource network forensics and analysis tool, designed for triage in incident response situations. It can identify and fingerprint network hosts and devices from pcap files captured from Ethernet or WiFi data (from tools like Kismet).
It also includes a live mode, silently identifying hosts and devices without needing to send any packets or put the network adapters into promiscuous mode ("silent port-scanning"). NetSleuth is a free network monitoring, cyber security and network forensics analysis (NFAT) tool that provides the following features:
  • An easy real-time overview of what devices and what people are connected to any WiFi or Ethernet network.
  • Free. The tool can be downloaded for free, and the source code is available under the GPL.
  • Simple and cost effective. No requirement for hardware or reconfiguration of networks.
  • “Silent port-scanning” and undetectable network monitoring on WiFi and wired networks.
  • Automatic identification of a vast array of device types, including smartphones, tablets, gaming consoles, printers, routers, desktops and more.
  • Offline analysis of pcap files, from tools like Kismet or tcpdump, to aid in intrusion response and network forensics.
 

Pentoo 2013.0 RC1.1 Security Tools - DOWNLOAD!!

Pentoo is a security-focused live CD based on Gentoo. It's basically a Gentoo install with lots of customized tools, customized kernel, and much more. Pentoo 2013.0 RC1.1 features :

  • Changes saving
  • CUDA/OpenCL Enhanced cracking software
    • John the ripper
    • Hashcat Suite of tools
  • Kernel 3.7.5 and all needed patches for injection
  • XFCE 4.10
  • All the latest tools and a responsive development team!
Here is a non-exhaustive list of the features currently included :
  • Hardened Kernel with aufs patches
  • Backported Wifi stack from latest stable kernel release
  • Module loading support ala slax
  • Changes saving on usb stick
  • XFCE4 wm
  • Cuda/OPENCL cracking support with development tools
  • System updates if you got it finally installed

PwnPi Penetration Testing Tool For Linux - DOWNLOAD!!

PwnPi Version 2.0 is a Linux-based penetration testing dropbox distribution for the Raspberry Pi. It currently has 114 network security tools pre-installed to aid the penetration tester. It is built on the debian squeeze image from the raspberry pi foundation’s website and uses Xfce as the window manager. It is like Metasploit & S.E.T. It has a hint of Netmask & Search Engine Assessment Toolkit.

 Download PwnPi Here For Free

Biggest Password Cracking Wordlist - DOWNLOAD!!

One of the biggest and very comprehensive collection of 1,493,677,900 words for Password cracking list released for download. The word-lists are intended primarily for use with password crackers such as hash-cat, John the Ripper and with password recovery utilities.Defuse Security have released the wordlist of 4.2 GiB (compressed) or 15 GiB (uncompressed) used by their Crackstation project.

Download Password Cracking Wordlist Here For Free

Weevely PHP Web Shell Exploit Tool - Download!!

Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.
  • More than 30 modules to automatize administration and post exploitation tasks:
    • Execute commands and browse remote filesystem, even with PHP security restriction
    • Audit common server misconfigurations
    • Run SQL console pivoting on target machine
    • Proxy your HTTP traffic through target
    • Mount target filesystem to local mount point
    • Simple file transfer from and to target
    • Spawn reverse and direct TCP shells
    • Bruteforce SQL accounts through target system
    • Run port scans from target machine
    • And so on..
  • Backdoor communications are hidden in HTTP Cookies
  • Communications are obfuscated to bypass NIDS signature detection
  • Backdoor polymorphic PHP code is obfuscated to avoid HIDS AV detection

      

Friday, March 29, 2013

SSLsplit v0.4.5 Attacks Against SSL/TLS Encrypted Networks - Download!!

SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encrypted network connections. Connections are transparently intercepted through a network address translation engine and redirected to SSLsplit. SSLsplit terminates SSL/TLS and initiates a new SSL/TLS connection to the original destination address, while logging all data transmitted. SSLsplit is intended to be useful for network forensics and penetration testing.

Change Log: 
  • Add support for 2048 and 4096 bit Diffie-Hellman
  • Fix syslog error messages 
  • Fix threading issues in daemon mode .
  • Fix address family check in netfilter NAT lookup 
  • Fix build on recent glibc systems 
  • Minor code and build process improvements
 

TXDNS V2.2.1 Multi-Threaded DNS Digger - Download!!

TXDNS is a Win32 aggressive multithreaded DNS digger. Capable of placing, on the wire, thousands of DNS queries per minute. TXDNS main goal is to expose a domain namespace trough a number of techniques:

-- Typos: Mised, doouble and transposde keystrokes;
-- TLD/ccSLD rotation;
-- Dictionary attack;
-- Full Brute-force attack: alpha, numeric or alphanumeric charsets.
 
 New features:
1. Support AAAA(IPv6)record queries: -rr AAAA
  • Rewrite summarizing statistics using a thread-safe algorithm instead mutex.
Bug Fixes: 

  • Fixed a problem when running under Windows XP;
  • Fixed a problem when parsing a IPv6 address.
  • November 9th, 2012 by Arley Silveira

Automated HTTP Enumeration Tool - Python Script - Download!!

Null Security Team writing a python script for Automated HTTP Enumeration. currently only in the initial beta stage, but includes basic checking of files including the Apache server-status as well as well IIS WebDAV and Microsoft FrontPage Extensions, many more features will be added to this tool which will make lot of the enumeration process quick and simple.Version 0.2 adds scanning of SSL / TLS as well as an option for probing delays and general bug fixes.


BlindElephant Web Application Fingerprinting - Download!!

During Black Hat USA 2010, Patrick Thomas presented a new web application fingerprinting tool called Blind Elephant. BlindElephant Web Application Finger-printer attempts to discover the version of a (known) web application by comparing static files at known locations against precomputed hashes for versions of those files in all all available releases. The technique is fast, low-bandwidth, non-invasive, generic, and highly automatically.

BlindElephant works via a new trendy technique of fetching static elements of the web app such as .js, .css, and other core files then running a check sum to compare sizes of those files from released versions.
 

PwnStar Exploit Tool - Download!!

A bash script to launch a Soft AP, configurable with a wide variety of attack options. Includes a number of index.html and server php scripts, for sniffing/phishing. Can act as multi-client captive portal using php and iptables.  Launches classic exploits such as evil-PDF. De-auth with aireplay, airdrop-ng or MDK3.

 New Features

  • “hotspot_3″ is a simple phishing web page, used with basic menu option 4.
  • “portal_simple” is a captive portal which allows you to edit the index.html with the name of the portal eg “Joe’s CyberCafe”. It is used for sniffing.
  • “portal_hotspot3″ phishes credentials, and then allows clients through the portal to the internet
  • “portal_pdf” forces the client to download a malicious pdf in order to pass through the portal
Updated Features
  • captive-portal with iptables and php
  • more php scripts added
  • exploits added
  • mdk3 and airdrop deauth
Overall Features
  • manage interfaces and MACspoofing
  • set up sniffing
  • serve up phishing or malicious web pages
  • launch karmetasploit
  • grab WPA handshakes
  • de-auth clients
  • manage IPtables
 Download PwnStar Here For Free

PySQLi Python SQL Injection Framework - Download!!

PySQLi is a python framework designed to exploit complex SQL injection vulnerabilities. It provides dedicated bricks that can be used to build advanced exploits or easily extended/improved to fit the case. PySQLi is thought to be easily modified and extended through derivated classes and to be able to inject into various ways such as command line, custom network protocols and even in anti-CSRF HTTP forms.

PySQLi is still in an early stage of development, whereas it has been developed since more than three years. Many features lack but the actual version but this will be improved in the next months/years.
 

ExploitShield Browser Edition - Download!!

ExploitShield Browser Edition protects against all known and unknown 0-day day vulnerability exploits, protecting users where traditional antivirus and security products fail. It consists of an innovative patent-pending vulnerability-agnostic application shielding technology that prevents malicious vulnerability exploits from compromising computers.
Includes "shields" for all major browsers (IE, Firefox, Chrome, Opera) and browser all components such as Java, Adobe Reader, Flash, Shock-wave. Blocks all exploit kits such as Black-hole, Sakura, Phoenix, Incognito without requiring any signature updates. ExploitShield is 100% install-and-forget anti-exploit solution. ExploitShield Browser Edition. The ZeroVulnerabilityLabs website maintains a real-time list of detected threats and their Virus-Total results.
 

Hashkill Password Cracker Tool V0.3.1 - Download For Linux!!

Hashkill is an open-source hash cracker for Linux that uses OpenSSL. Currently it supports 4 attack methods (dictionary, bruteforce, hybrid). Hashkill has 35 plugins for different types of passwords (ranging from simple hashes like MD5 and SHA1 to passworded ZIP files and private SSL key passphrases).

Multi-hash support (you may load hashlists of length up to 1 million) and very fast GPU support on Nvidia (compute capability 2.1 cards also supported) and ATI (4xxx, 5xxx and 6xxx). 

The latest update includes 9 new plugins: bfunix, drupal7, django256, sha256unix, mssql-2012, o5logon, msoffice-old, msoffice, luks. Of them msoffice-old is currently supported on CPU only, the rest are GPU-accelerated. Improved bitmaps handling in non-salted kernels addded, so that huge hashlists would be cracked at faster speeds. Now Thermal monitoring can now be disabled using -T 0 command-line argument.
 


WAppEx V2.0 Exploitation Tool - Download!!

WAppEx is an integrated Web Application security assessment and exploitation platform designed with the whole spectrum of security professionals to web application hobbyists in mind. It suggests a security assessment model which revolves around an extensible exploit database. Further, it complements the power with various tools required to perform all stages of a web application attack.

 Updates in 2.0

  • Following tools added:
    • Manual Request
    • Dork Finder
    • Exploit Editor
    • Hidden File Checker
    • Neighbor Site Finder
  • 24 new payloads for LFI, RFI, and PHP Code Execution vulnerabilities added:
    • Directory Explorer
    • CodeExec Bind
    • 3 connect-back shells
    • Code Execution
    • MySQL Dump
    • ServerInfo
    • 4 command execution payloads
  • Bug-fixes:
    • Find Login Page crashed on start
    • Problem with software registration
    • Stop button did not work when retrieving data from SQL server
    • Problem with saving SQL results
    • Crashed when closing Find Login Page
    • Status icons were not displayed properly in exploit tabs
      
The features:
  • An exploit database covering a wide range of vulnerabilities.
  • A set of tools useful for penetration testing:
    • Manual Request
    • Dork Finder
    • Exploit Editor
    • Hidden File Checker
    • Neighbor Site Finder
    • Find Login Page
    • Online Hash Cracker
    • Encoder/Decoder
  • Execute multiple instances of one or more exploits simultaneously.
  • Execute multiple instances of one or more payloads (for every running exploit) simultaneously.
  • Test a list of target URL’s against a number of selected exploits.
  • Allows you to create your own exploits and payloads and share them online.
  • A number of featured exploits (6) and payloads (39) bundled within the software exploit database:
    • Testing and exploiting of Local File Inclusion vulnerabilities
    • Testing and exploiting of Local File Disclosure vulnerabilities
    • Testing and exploiting of Remote File Inclusion vulnerabilities
    • Testing and exploiting of SQL Injection vulnerabilities
    • Testing and exploiting of Remote Command Execution Inclusion vulnerabilities
    • Testing and exploiting of Server-side Code Injection vulnerabilities
   


    

Unhide Forensic Tool - Download For Windows or Linux!!

Unhide is a forensic tool to find processes hidden by rootkits, Linux kernel modules or by other techniques. It detects hidden processes using six techniques:

  • Compare /proc vs /bin/ps output
  • Compare info gathered from /bin/ps with info gathered by walking thru the procfs. ONLY for Linux 2.6 version
  • Compare info gathered from /bin/ps with info gathered from syscalls (syscall scanning).
  • Full PIDs space ocupation (PIDs bruteforcing). ONLY for Linux 2.6 version
  • Compare /bin/ps output vs /proc, procfs walking and syscall. ONLY for Linux 2.6 version
  • Reverse search, verify that all thread seen by ps are also seen in the kernel.
  • 6- Quick compare /proc, procfs walking and syscall vs /bin/ps output. ONLY for Linux 2.6 version.
  • Unhide-TCP
 Unhide-tcp is a forensic tool that identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.
      
How to Use ?
  • -f    Write a log file (unhide.log) in the current directory.
  • -h    Display help
  • -m  Do more checks. As of 2010-11-21 version, this option has only effect for the procfs, procall, checkopendir and checkchdir tests.
  • -r   Use alternate version of sysinfo check in standard tests
  • -V  Show version and exit
  • -v   Be verbose, display warning message (default : don't display). This option may be repeated more than once.
Compiling :
gcc –static unhide.c -o unhide
gcc -Wall -O2 –static unhide-tcp.c -o unhide-tcp
gcc -Wall -O2 –static -pthread unhide-linux26.c -o unhide-linux26
gcc -Wall -O2 -static -o unhide_rb unhide_rb.c

 Download Here For Windows

 Download Here For Linux

The Social-Engineer Toolkit (SET) - Download!!

The Social-Engineer Toolkit (SET) version 4.7 codename “Headshot” has been released. This version of SET introduces the ability to specify multi-powershell injection which allows you to specify as many ports as you want and SET will automatically inject PowerShell onto the system on all of the reverse ports outbound.

What’s nice with this technique is it never touches disk and also uses already white listed processes. So it should never trigger anything like anti-virus or white-listing/blacklisting tools. In addition to multi-powershell injector, there are a total of 30 new features and a large rewrite of how SET handles passing information within different modules.

See The Bottom Of The Post For The Download Link!!

Change log for version 4.7
  • removed a prompt that would come up when using the powershell injection technique, port.options is now written in prep.py versus a second prompt with information that was already provided
  • began an extremely large project of centralizing the SET config file by moving all of the options to the set.options file under src/program_junk
  • moved all port.options to the central routine file set.options
  • moved all ipaddr.file to the central routine file set.options
  • changed spacing on when launching the SET web server
  • changed the wording to reflect what operating systems this was tested on versus browsers
  • removed an un-needed print option1 within smtp_web that was reflecting a message back to user
  • added the updated java bean jmx exploit that was updated in Metasploit
  • added ability to specify a username list for the SQL brute forcing, can either specify sa, other usernames, or a filename with usernames in it
  • added new feature called multi-powershell-injection – configurable in the set config options, allows you to use powershell to do multiple injection points and ports. Useful in egress situations where you don’t know which port will be allowed outbound.
  • enabled multi-pyinjection through java applet attack vector, it is configured through set config
  • removed check for static powershell commands, will load regardless – if not installed user will not know regardless – better if path variables aren’t the same
  • fixed a bug that would cause linux and osx payloads to be selected even when disabled
  • fixed a bug that would cause the meta_config file to be empty if selecting powershell injection
  • added automatic check for Kali Linux to detect the default moved Metasploit path
  • removed a tail comma from the new multi injector which was causing it to error out
  • added new core routine check_ports(filename, ports) which will do a compare to see if a file already contains a metasploit LPORT (removes duplicates)
  • added new check to remove duplicates into multi powershell injection
  • made the new powershell injection technique compliant with the multi pyinjector – both payloads work together now
  • added encrypted and obfsucated jar files to SET, will automatically push new repos to git everyday.
  • rewrote the java jar file to handle multiple powershell alphanumeric shellcode points injected into applet.
  • added signed and unsigned jar files to the java applet attack vector
  • removed create_payload.py from saving files in src/html and instead in the proper folders src/program_junk
  • fixed a payload duplication issue in create_payload.py, will now check to see if port is there
  • removed a pefile check unless backdoored executable is in use
  • turned digital signature stealing from a pefile to off in the set_config file
  • converted all src/html/msf.exe to src/program_junk/ and fixed an issue where the applet would not load properly.
        Download Here For Free

Recon-Ng Web Reconnaisance Framework - Download!!

Recon-Ng is a full-featured Web Reconnaissance framework written in Python. Recon-ng has a look and feel similar to the Metasploit Framework, reducing the learning curve for leveraging the framework.
Complete with independent modules, database interaction, built in convenience functions, interactive help, and command completion, Recon-ng provides a powerful environment in which open source web-based reconnaissance can be conducted quickly and thoroughly. If you want to conduct reconnaissance, use Recon-Ng!
 

Snort 2.9.4.1 Network Intrusion Detection System - Download!!

Snort is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) . Snort having the ability to perform real-time traffic analysis and packet logging on Internet Protocol (IP) networks. Snort performs protocol analysis, content searching, and content matching.

 This program can be used to detect probes or attacks, including, but not limited to, operating system fingerprinting attempts, common gateway interface, buffer overflows, server message block probes, and stealth port scans. Snort can be configured in three main modes: sniffer, packet logger, and network intrusion detection.

The 7 Big Improvements on Snort 2.9.4.1
1.  Updated File processing for partial HTTP content and MIME attachments.
2.   Addition of new config option max_attribute_services_per_host and improve memory usage within attribute table.
3.  Stream API updates to return session key for a session.
4.  Handle excessive overlaps in frag3.
5.  Reduce false positives for TCP window slam events.
6.  Disable non-Ethernet decoders by default for performance reasons. If needed, use --enable-non-ether-decoders with configure.
7.  Updates to provide better encoding for TCP packets generated for respond and react.

Snort 2.9.4.1 Can Be Downloaded Here For Free! Listed Below!!

 Download Snort 2.9.4.1

Phrozen Key-logger Lite - Version 1.0 - Download!!

Phrozen Keylogger Lite is finally available, developed by Dark comet RAT developer. Phrozen Key-logger Lite is a powerful and user friendly key-logger especially created for Microsoft Windows systems. Phrozen Key-logger Lite is compatible with all currently supported versions of Windows, which effectively means Windows XP to the recently released Windows 8.

It captures all keystrokes from any type of keyboard (PS/2, USB and even Virtual Keyboards). The captured keystrokes are stored into a local database. There they are sorted by their process name and the active window into a log. Phrozen Key-logger Lite is running silently in background. When the program is successfully installed on a computer, it will capture all keystrokes fully stealthily and the program will remain hidden from every user. It will not slow down the computer it is installed on.

Just press the so-called “Magic Shortcut” and enter your personal password and the logs will be made visible in a new window. You can easily manage, export, delete, mark as important, mail, etc. these logs.

Phrozen Keylogger Lite also gives you the possibility to manage black listed words. When such a word is entered via keystrokes you will immediately be sent a mail which contains the entire context in which that ‘black listed word’ appears. This is a very useful feature: suppose you have forbidden your son to go to a specific gambling site and he does go there against your wishes, you then immediately get a mail that warns you of this transgression.

Download Phrozen Key-Logger For Free Now. Listed Below!

 Download Phrozen Keylogger Lite v1.0

Check Out My New Features On This Blog!!!

I have put a couple new features to this blog. Including a Clock, Wikipedia Look-Up, Translate Language, A poll, Google +1 Button, & All This Is On The Right Side Of The Page!!

Thursday, March 28, 2013

Wednesday, March 27, 2013

Hackers, Always One Step Ahead

Due to the 12 most recent events listed here:

1.  Hackers break into International Atomic Energy Agency Servers on Nov. 27, 2012
2.  Hackers Steal More Than $450,000 from Burlington City Bank on October 14, 2012
3.  Cyber Attack on Iran's Internet System on October 03, 2012
4.  Chinese Hackers Attack on White House Computers on October 01, 2012
5.  Bank Of America Website Under Cyber Attack From Islamic Hackers on Sept. 19, 2012
6.  Antisec Hackers Hack FBI Laptop and Leak 12 Million Apple Device Records on Sept. 04, 2012
7.  Anonymous Hackers Leaks Personal Information of 500 Israeli Officials on Nov. 19, 2012
8.  Anonymous Hackers Hacked Former CIA Director on Nov. 10, 2012
9. Anonymous Hacks 20 Million Accounts to Promote Operation Jubilee on October 26, 2012
10. U.S. Ambassador Claimed to be Hacked by Russians on April 01, 2012
11. 3 U.S. Cities Under Attack By Hacker, Hacking the Key Infrastructure Systems on Dec. 15 2012
12. North Korea Using China IP Address to Hack U.S. and South Korea.

Due to all of events, it is pretty simply to understand that hackers are always one step ahead. If all this events happen within a years time (From April 2012 - March 2012). They what is next? What do the hackers have planed? There are hackers all over the world but The Most Famous Regions is: Pakistani, Indian, Albania, Indonesian, U.S.A, Israeli, China, & North Korea. The Most Famous Groups of Hacking is: TESO, LulzSec, Anonymous, Hackweiser, GlobalHell, NCPH, UGNazi, Masters of Deception & TeaMp0isoN.

These Hackers above are the best in the business. And more and more hackers form groups every year. I always wanted to become a hacker. At this time, I am learning the basics. I want to be a Gray/Black hat hacker.

Hackers will build to a point where there will be army of hackers. A hacker is a hobby to some people and others, it is a job. Some may make it white hat job or black hat job. Hacking is serious to some people and others, it is a game. Hackers are rebels. Hackers are Smart. Hackers are always one step ahead.

Human Rights Activists Targeted by Hacker!!

Tibetan and Uyghur activists are once again targeted with a new malware, specially designed for Android devices. This is the first documented attack that targets Android smartphones. A targeted malware attack on Android phones that seems to come from a China IP Address. The attack relied heavily on social engineering, a kind of verbal manipulation, to hack into their targets’ devices.

 Malware seeks to steal information like contacts, call logs, and SMS of people who work in the field of human rights. A command function that shows up prior to posting stolen data to the command-and-control server at the URL: hxxp://64.78.161.133/*victims's_cell_phone_number*/process.php.

 On March 24, the attackers infiltrated the email account of a high-profile Tibetan activist, and used that account to send a spear-phishing email to their contacts list. Once the victim opens the attachment on her Android phone, the file installs an application called "conference" that will display some information about the Geneva conference. The target is reading the message, malicious software they had inadvertently installed would report back to a command-and-control server, before collecting information from the phone. 

 

Are Researcher say "The attackers relied entirely on social engineering to infect the targets. History has shown us that, in time, these attacks will use zero-day vulnerabilities, exploits or a combination of techniques."

Web Browser Tips & Tricks: Google Chromo Problems, Make It Behave with 2 Extensions

chrome ram extension
 Google Chrome Logo

 Chrome or Firefox? This is the hottest question in technology browser community. Personally, I think both browsers are great, but have been using Firefox more often because it is easier to print and it does not hog all my RAM like Google Chrome does! Don’t get me wrong, I’m not saying Firefox is a lightweight browser, it’s most definitely not, but for some reason, Chrome was incredibly sluggish on my machine, and used much more RAM than Firefox ever did.Sounds familiar? If Chrome is not running well on your computer, RAM could be one of the reasons for it.

 There are other reasons this could happen, of course, but by reducing your browser’s RAM usage you can at least find out if that was the problem or not. We’ve already told you about ways to keep Firefox from getting unbearably slow, and now it’s Chrome’s turn. You might be thinking that installing more extensions is not the way to go, and you’re right, installing many browser extensions is bad for performance, but it only takes one good extension to help speed up your browser.

One-Tab

 As a chronic multiple tab user, I’ve been through many extensions that were supposed to help me deal with my addiction. While anything that reduces the clutter and RAM hog that are multiple tabs is a relief, some extensions are simply better than others. And One-Tab is one of the good guys. It’s the easiest way I’ve found so far to create tab groups, save them, and share them. After installing One-Tab, you’ll find its funnel icon sitting in your toolbar. Click it to create a group of all your open tabs. That’s about all you need to know about the basic use of One-Tab. But does it really help reduce RAM usage? 

According to One-Tab’s website, the extension can reduce RAM usage by 95%, giving a 1980MB to 99MB reduction as an example. But how does it fare in real life? I checked Chrome’s RAM usage on my computer with 13 open tabs, and again after bundling them up with One-Tab, having only One-Tab’s bundle page open. Naturally, there would be a drop ion RAM.

My tabs were not very resource-hungry ones, but Chrome was still using around 560MB of RAM with all of them open. After bundling them up with One-Tab, Chrome was using only 200MB. It saves RAM, you might be thinking, you closed all those tabs! Well, you’re right, One-Tab doesn’t do anything revolutionary, but it does the job, and does it very well. You’re not limited to one bundle of tabs – every time you click the One-Tab button, a new bundle will be created, and will appear above the previous bundle in One-Tab’s window. This options provides a URL as well as a QR code if you want to open the tabs on your mobile device.

chrome addon ram
 One-Tab makes it super easy to save several regularly-used bundles, and access the tabs within quickly, without the clutter of multiple open tabs.


The Great Suspender

The Great Suspender might be the RAM-saving trick you’re looking for. There are several things The Great Suspender can do for you: suspend individual tabs you’re not currently using but don’t want to close, suspend all tabs in your current window, and suspend inactive tab after you haven’t used them for a while.

When a tab is suspended, all you have to do to reload it is click anywhere on the page. You can also create a white-list for domains you never want suspended through the extension’s Settings page. The Settings page also includes the option to automatically unsuspend tabs when they gain focus, and lets you choose the length of inactivity period for a tab before it’s automatically suspended.

  I tested this with 13 active tabs, which I then suspended using The Great Suspender. Before suspending, Chrome was using 521MB or RAM on my computer. After suspending all tabs except for one, RAM usage was reduced to 359MB.The one tab that wasn’t suspended was the Tweet-Deck Chrome app tab, which apparently cannot be suspended, so you should keep in mind that not every tab you use can be suspended.

TRY IT, YOURSELF & TELL US IT THE COMMENT AREA.
Do you find Chrome’s performance lacking on your computer, or do you think it’s superior to other browsers such as Firefox? How do you go about reducing Chrome’s RAM extension usage? Share your tips and ideas in the comments!

How Hackers Hack Your Computer with Basic Skills!!

  When people think of hackers they immediately think of the worst but there are many different types of hackers and most of them has done a great deal to improve and develop software, the Internet and electronic devices. They have created and pushed the boundaries of everything from the Internet to computers and have changed how we use them in our daily lives.There are Six Kinds Of Hackers:

 No. 1: "White Hat Hacker", They are the good guys of hackers.These hackers create new programs or improve on existing ones, finding new ways for the software to function or make it function better. 

No.2: "Black Hat Hacker", They are the bad guys of hackers. Black Hat hackers are the complete opposite of "White Hats." Black Hats break into security systems in order to steal credit card numbers, vandalize websites or otherwise do harm.
 
No.3:"Gray Hat Hacker", They are the middle guy between good guy and bad guy. Grey Hat hackers are morally ambiguous. They act in their own self-interests and do not think about the legal repercussions of their actions. They do not actively seek to break the law, but are not concerned if such is the outcome.

No. 4: "Hacktivist", Hacktivists are individuals who hack websites to further some form of political or social agenda.

No. 5: "Script Kiddie",  Script Kiddies are faux-hackers. They use pre-packaged, pre-written software to slip past internet security protocols and are generally looked down upon in the various hacking communities.

No. 6: "Cyber-terrorists", As the name implies, cyberterrorists use computers to engage in acts of terrorism, often times using DoS (Denial of Service) attacks to crash government websites.

 Hacking Skills - You must have the patience and will to understand programming languages. There are dozens of programming languages and they have evolved through the years, so start out with learning the basics. You can begin learning the programming language C then progress to other languages like Pascal or Fortran. Then move on to learning Perl, XHTML and other programs used on the Internet. Understanding computer hardware is also a must as well as all the components that a computer system needs. You need to understand banking systems, and other systems used in the financial world because this is where you'll learn the kinds of security that are in place to protect the system and its clients. Learning all these basic skills will put you in the right direction to get you started in hacking computers, from its hardware to the programs it uses.

Tips -  You can find tips on the web from other hackers and you can join in forums and discussions to keep you updated.

Top Websites
1. CyberXtreme: Hacking and Warez. CyberXtreme is an impressive forum with a significant hacking section, but also entire sections on technology, graphics and even a tech support area. Here you’ll find cracks, secret codes, free download packages (some containing cracked software which may be illegal to download in your area, so be careful). The forum is very protective of its content, so you’ll have to register with a valid email address before you can even get a glimpse of the content that’s on the forums. Check it out at: http://www.cyberxtreme.info/forum/

2.  EvilZone Hacking Forums. EvilZone,, isn't exactly the most inviting – it is easily one of the largest forum communities that you’ll find on the subject of hacking. With over 6,500 members and over 100,000 posts (and counting), this community likely has the skills and knowledge to answer any programming question you could possibly have. Just be careful about coming across as a “noob” – these guys don’t handle newcomers with kid gloves, so be careful. Check it out at: http://www.evilzone.org

3. Hack A Day. While I certainly don’t want to offer a nod to any blogs that may be considered competition, you really have to give credit where credit is due when it comes to a particular niche like hacking – and Hack a Day definitely offers an amazing library of information for anyone looking for specific categories like cellphones, GPS or digital cameras. You’ll find all hacks organized by category in the right column. Check it out at: http://hackaday.com/

4.  Hack In The Box. If any site could be classified as the most comprehensive site to learn how to hack, this would be it. Hack In The Box is more about security and ethical hacking than anything else – and that’s more than obvious reviewing the classes and conferences listed on the main page. The manage page is an informational portal that includes information from all other areas, including recent forum posts, conference updates, E-zine and news articles and a lot more. To be honest, there’s so much information stuffed on the main page that it’s almost overwhelming. Check it out at: http://www.hackinabox.org/

5.  Hack This Site! As always, saving the best for last – I’d like to introduce Hack This Site! This website is one of the coolest, free programmer training sites where you can learn how to hack accepting one of the challenges. The site designers offer various “missions,” where you need to figure out the vulnerability of a site and then attempt to use your new-found hacking skills (you’ve carefully studied all of the articles on the site, right?) to hack the web page. Missions include Basic, Realistic, Application, Programming and many others. Check it out at: http://www.hackthissite.org/




Java Enabled Browers are at Higher Probability of Being Hacked!!

Oracle has released emergency patches multiple of times in recent months for Java for one after another set of vulnerabilities. About 100 million computers reported to be vulnerable to unauthorized access via different flaw in Java software. Department of Homeland Security's US-CERT already warned users to disable Java permanently to stop hackers from taking control of users' machines.

 Most browser installations use outdated versions of the Java plug-in that are vulnerable to at least one of several exploits used in popular web attack toolkit. Exploit kits are a very common tool for distribution of many Java-based threats.

Java Vulnerability: CVE-2013-1493
Vulnerability Version: 1.7.15 & 1.6.41
Vulnerable: 93.88%
Exploit Kits With Live Exploits: Cool

Java Vulnerability: CVE-2013-0431
Vulnerability Version: 1.7.11 & 1.6.38
Vulnerability: 84.89%
Exploit Kits With Live Exploits: Cool

Java Vulnerability: CVE-2012-5076
Vulnerability Version: 1.7.07 & 1.6.35
Vulnerability: 74.06%
Exploit Kits With Live Exploits: Cool, Gong Da, & MiniDuke

Java Vulnerable: CVE-2012-4681
Vulnerability Version: 1.7.06 & 1.6.34
Vulnerability: 70.01%
Exploit Kits With Live Exploits: Blackhole 2.0, Redkit, CritXPack, & Gong Da

***All Prior JRE Versions Below Those Listed Are Also Vulnerable.

Web-sense showed that only 5.5% of Java-enabled browsers have the most up-to-date versions of the software. Most browsers are vulnerable to a much broader array of well-known Java holes, with over 75% using versions that are at least six months old. All this doesn't mean that Java is an insecure language or platform, or that web sites built on Java E-E are any less secure than other platforms.

Tuesday, March 26, 2013

North Korea Attacks Both The Cyber-World and Threatens The U.S. & South Korea With Nukes

North Korea is attacking the U.S. and South Korea with computers and they are threatening the U.S. and South Korea with Nukes. So, North Korea wants to start a Cyber-Warfare and a Warfare with South Korea and United States fighting side by side against North Korea, because South Korea and the U.S. are allies. North Korea is behind all the hacking that we where blaming on China. North Korea was using a Chinese IP Address to hide there IP Address. North Korea is threatening the United States and South Korea with there Nukes. They are asking for war. North Korea needs to stop this before the U.S. and South Korea takes action and destroys North Korea into small pieces of glass.

National News Section Coming Soon!!

I will have a new section for different topics Including National News and Updates on the North Korea Topic. It will be a small section and I will update on this section whenever a new topic comes up. It is good to keep up to date in today's world.

The Pebble Smart-Watch Review

The Pebble smartwatch is capable of loading applications and can be ... 
The Pebble Smart-Watch

 
a Kick starter-borne Bluetooth-enabled smart-watch that pairs with your smartphone to display notifications, manage apps, and even control song playback. The Pebble is priced at $150, which may sound like a lot, but many popular timepieces cost as much or more — and all they do is tell time. The Pebble, on the other hand, pairs with any Android and iOS devices running version 2.3 Gingerbread or iOS 5 and above to provide at-a-glance access to many of its functions. Windows Phone, BlackBerry, and Palm users are currently out of luck.

 As futuristic as it might sound, the underlying process is actually incredibly simple. The Pebble pairs with your device over Bluetooth and displays the notification that is simultaneously appearing on your phone. it's compatible with any iOS or Android app that supports notifications. What's more, its side-mounted buttons can be used to pause, play, or change tracks when you're listening to music, and you can answer or reject a call with a simple press.

 The Pebble's potential far exceeds its current manifestation. As time goes on, developers can build deeper integration into their apps, such as exercise apps that use its built-in accelerometer to detect how many steps you've taken or the distance you've traveled. At its core are the Pebble's native iOS and Android apps, which serve as the gateway to new firmware updates, downloadable watchfaces, and apps. There are currently 10 unique watch-faces, as well as Snake - The Famous game from smart phones of decades past. The Snake is near-impossible to play with the Pebble's tiny built-in controls. For iPhone, the Pebble relies on iOS' built-in notification control panel.

 The Pebble is otherwise well-constructed and designed, though it lacks any striking visual flair; especially in the case of the stock black version. The main interface is similarly straight-forward, navigable through the up, down, and enter button. The battery life is fantastic, delivering upon the company's promise of up to 7 days per charge. Each Pebble ships with a custom-built USB charging cable, which snaps to the left side using magnetized contacts. The back-lighting of the 167x144 resolution ePaper display is fairly dull, but it's more than sufficient for low-light use.

 This is great overall, the future of the Pebble is going to get bigger and bigger. Rumors of Apple's entry into the market and Samsung confirming development of a new smart-watch of its own, the Pebble could find itself with some stiff competition. It has the energy efficiency, low cost and early momentum that will make it big. The Smart-Watch has a category all its own. I would rate it 5 out of 5 Stars

T-Mobile Gets The IPhone!!

The top-of-the-line iPhone and Android, big players AT&T, Verizon, and Sprint are slowly losing their grip on the market share. Both the iPhone and the yet-to-be released Samsung Galaxy S4 this Spring: T-Mobile. T-Mobile gets the IPhone and the Galaxy S4 in May.

T-Mobile has been out of the iPhone game entirely since Apple's handset made its debut in 2007. But it seems like it's finally wriggled in on the action, at least for the iPhone 5. Starting April 12th, customers will be able to buy the handset for just $99 up front and set it up on the provider's newly-established LTE network  — provided its available within the city. However, consumers should recognize that it's still the unlocked iPhone price, fortified with monthly payments of $20, and part of T-Mobile's "un-carrier" plan.

The Samsung Galaxy S4 will be available on T-Mobile starting May 1st and also work on the company's LTE network. No price has been disclosed yet. T-Mobile's strategy is a little different from an out-and-out contract plan.

What do you think of T-Mobile getting the IPhone and the Galaxy S4?  Let us know in the comments!

BIOSHOCK INFINITE Review

Bio-Shock Infinite aims so damn high – fittingly, since its alternate-reality 1912 city of Columbia literally floats atop clouds – that it’s a wonder it successfully hits any of its lofty goals at all. Rank-and-file bad guys you’ll be shooting at? Some of them seem borderline comical, like the Patriot robots modeled after George Washington, who Columbia’s residents revere as a god. Then there are the Handymen -- intimidating 10-foot-tall proto-cyborgs who freaked me out the first time I thought I'd escaped them but, in fact, hadn’t. They’re much more agile than they look, even if they’re essentially bullet-spongy Big Daddies on P.E.D.s. Elizabeth successfully wields a key role in both the narrative and game-play.

Given that this is a single-player-only game, is that one play-through all you should expect? I'd say not – the 80 plot-buttressing Voxaphone recordings and other lore-lifting collectibles offer Bio-Shock Infinite at least one more run worth of exploration, optionally while playing in 1999 Mode. Unlocked after completing the campaign on any difficulty, 1999 ups the challenge exponentially by severely reducing the amount of money available (and thus the number of times you can pay to revive when killed in combat), notably slowing down your shield’s recharge time, and of course making enemy attacks hurt more.

On the way out, I'm forced to seriously question which is the better game. In total, Bio-Shock Infinite is a brilliant shooter that nudges the entire genre forward with innovations in both storytelling and game-play. It trips over itself in a couple of spots, but not in any way that should keep you from embracing it with your utmost enthusiasm.

 BioShock Infinite wallpaper - Game wallpapers - #10203

L.A. Noire Review - Guest Post by Chris Brown

LA Noire – Game Review | PlayEject  
Rockstar Games Presents L.A. Noire


L.A. Noire is a single-player detective game from Rockstar Games set on the infamous streets and in the smoke-filled backrooms of postwar Los Angeles. Amid the postwar boom of Hollywood's Golden Age, Cole Phelps, an L.A.P.D. detective, is thrown headfirst into a city drowning in its own excess. Corruption is rampant, the drug trade is exploding, and murder rates are at an all-time high. In his fight to climb the ranks, as well as do what's right, Phelps must unravel the truth behind a string of arson attacks, racketeering conspiracies, and brutal murders. In doing so, he must also battle the L.A. underworld and even members of his own department to uncover a secret that could shake the city to its rotten core. Crime doesn't pay.
Chris Brown's quotation "A very good game, It is rated M for Mature. You play as an old detective, I like the missions and the free roam."

Release Date: May 17, 2011
MSRP: 59.99
M for Mature: Blood and Gore, Nudity, Sexual Themes, Strong Language, Use of Drugs, Violence.
Genre: Adventure
Publisher: Rockstar Games
Developer: Team Bondi

Guest Author: Chris Brown
Editor: Bruce Miller

AT&T Hacker Andrew Auernheimer Sentenced

Self-described troll and Grey hat AT&T Hacker Andrew "Weev" Auernheimer, 26, has been sentenced to 41 months/3.5 Years in prison for exploiting an AT&T security hole three years ago, and releasing thousands of iPad owners email addresses. According to authorities, they obtained the ICC-ID and e-mail address for about 120,000 iPad users.

 Each charge carried with it a potential prison terms of five years. He will serve 41 months in a federal prison, with concurrent probation for three years. He also owes restitution to the U.S. Treasury to be dispersed to AT&T in the amount of $73,000.

 Auernheimer compared his prosecution to that of Aaron Swartz. In January, Internet activist Aaron Swartz committed suicide while facing trial for allegedly stealing millions of scholarly journal articles from the digital archive JSTOR using MIT's network. Swartz faced a potential sentenced of more than 30 years in prison.

Feds Do Not Need A Court Warrant to Track Your Car with GPS Device

The America government is claiming that authorities do not need court warrants to affix GPS devices to vehicles to monitor their every move. it's been more than a year since a Supreme Court decision established that affixing a GPS tracking device to a vehicle constitutes a search under the constitution.

The drug-related conviction of nightclub owner Antoine Jones.The GPS locator was installed the day after the warrant expired and while the vehicle was outside of the department's jurisdiction, and DC police tracked Jones for nearly a month after installation before arresting him. 

According to my researchers "Requiring a warrant and probable cause before officers may attach a GPS device to a vehicle, which is inherently mobile and may no longer be at the location observed when the warrant is obtained, would seriously impede the government's ability to investigate drug trafficking, terrorism, and other crimes. Law enforcement officers could not use GPS devices to gather information to establish probable cause, which is often the most productive use of such devices."

Shortly after a 2010 Rite Aid heist, officers tracked the Dodge Caravan and arrested the brothers. Inside the vehicle, they discovered the pharmacy’s surveillance system and drugs in the vehicle that was monitored for 48 hours with a GPS device. Privacy and civil rights advocates are siding with the Katzin brothers, arguing that GPS tracking is a powerful technology that allows for persistent surveillance. This act means the GPS device has to be used with caution and oversight.

North Korea Hackers hacked the US and South Korea using a Chinese IP Address

A previous cyber-attack on South Korea had been traced to North Korea using a Chinese IP address. At the time, North Korea blamed the US for the hacking. Officials stressed that the IP address did not reveal who was behind the attack, as hackers can route their attacks through addresses in other countries to obscure their identities.

A Massive South Korea Cyber Attack with Chinese IP Address

A couple days ago there was reported massive Cyber Attack on South Korea that was responsible for shutting down networks of South Korean banks and TV broadcasters. Police are still investigating the cyber attack  but the country's Communications Commission has revealed that the hacking originated from a Chinese IP address.

Symantec Security team analyze the code used in the cyber attacks against South Korea and they discovered an additional component used in this attack that is capable of wiping Linux machines.  The malware, which it called Jokra, contains a module for wiping remote Linux machines. 'The included module checks Windows 7 and Windows XP computers for an application called mRemote, an open source, multi-protocol remote connections manager.' Symantec said. 

Are Researchers say that "The malware specifically looks for login credentials saved by two specific SSH clients: mRemote and SecureCRT. It uses any stored root credentials to log into remote Linux servers: for AIX, HP-UX, and Solaris servers it deletes the MBR. If it is unable to delete the MBR, it instead deletes various important folders." The malware also attempts to shut down two South Korean antivirus products made by the companies Ahnlab and Hauri.




How Hackers Can Track Your Smart or Prepaid Phone

 Smart Phone are means of communications with over 5 billion users worldwide in 2010. About 80 of those are GSM subscribers. Hackers can listen to broadcast communications that could reveal your physical location to a passive adversary. Some researchers found a flaw in AT&T and T-Mobile cell towers that reveals the location of phone users. They can determine
whether a target is within a given geographic area as large as about 100 square km's or as small as one square kilometer. It can also be used to pinpoint a target's location but only when the attacker already knows the city, or part of a city, the person is in. 


Location Leaks on the GSM Air Interface. A GSM cellular network is composed of 15 main logical
entries. The entries relevant to this work are as follows: The Visitor Location Register (VLR), The Base Station System (BSS), and The Mobile Station (MS.For More Information on the attack and how they attack check out this link: http://www-users.cs.umn.edu/~foo/research/docs/fookune_ndss_gsm.pdf

Cell phone towers have to track cell phone subscribers to provide service efficiently. Your cell phone network has to at least loosely track your phone within large regions in order to make it easy to find it. The messages contain I.D. codes. In order to match the codes to the cell phone number, researchers called the phone three times. The code that appeared three times in the same time period in which researchers were listening in is most likely the code of the cell phone. From there you can use the I.D. to determine if you’re around a certain area or if you’re on a particular cell tower.

 The process requires a feature cellphone and a laptop, running the open-source Osmocom GSM firmware and software respectively, along with a cable connecting the two devices. It also uses a separate cellphone and land-line. The equipment and use the laptop output to monitor the broadcasts that immediately follow over the airwaves to page the target phone.

T-Mobile Wi-Fi Calling App is a Tool For Hackers

T-Mobile devices having a default Wi-Fi Calling feature that keeps you connected in areas with little or no coverage using Wi-Fi connection. But this feature lets millions of Android users vulnerable to Man-in-the-Middle attack. To become a man-in-the-middle would be for the attacker to be on the same open wireless network as the victim, such as at a coffee shop or other public space.

 The flaw could potentially allow hackers to access and modify calls and messages made by T-Mobile users on certain Android smartphones.
T-Mobile uses regular VoIP for Wi-Fi Calling instead of a connection that encrypted, something that aids in its vulnerability. The certificate validation had not been fully implemented, so without this proper verification, hackers could have created a fake certificate and pretend to be the T-Mobile server. T-Mobile released a security update to its Android users on March 18 that resolved the issue.

Saturday, March 23, 2013

New Posts Coming Soon!!

New Posts Coming Soon!! I have leads on new video games and Hacking.

Saturday, March 2, 2013

Samsung Galaxy Note 8.0


 The Samsung Galaxy Note 8.0

 Samsung has introduced the new 8-inch Galaxy Note 8.0. The Galaxy Note 8.0 is an Android 4.1.2 Jelly Bean-based tablet with an 8-inch 1280 x 800 display, delivering a pixel density of 189ppi — slightly higher than the iPad mini's 7.9-inch 163ppi display. It's powered by Samsung's 1.6GHz quad-core Exynos 4 processor, 2GB of RAM, and comes with 32GB or 64GB of storage. The Galaxy Note 8.0 will initially offer cellular connectivity via HSPA+ — supplemented, of course, by Wi-Fi.

The Note 8.0 comes with the company's S Pen stylus, which is optimized for an array of baked-in apps, like Samsung's S Note and handwritten email software. Samsung's new 8-inch tablet is also a phone. The international HSPA+ variant of the Galaxy Note 8.0, however, is that it can make and receive phone calls. Pricing information has not yet been disclosed. But the release date is between March - April.

New Batman: Arkham City and Darksider 2 Xbox 360 Bundle


The All-New Batman: Arkham City and Darksiders 2 Xbox 360 Bundle


Xbox 360 with a 250GB hard drive and two games: Darksiders II and Batman: Arkham City. The Spring Value Bundle will set you back $299.99, and can be bought at most major retailers. Darksiders II will come as a physical copy, while Batman: Arkham City is included as a digital download code. Plus, you’ll be getting a month of Xbox Live included. Bought separately at MSRP, the bundle would cost $380.


Friday, March 1, 2013

Hacker Lulzsec sentencing Postponed Again

Remember Hector Xavier Monsegur a.k.a Lulzsec hacker Sabu ?  That undercover double agent working for the FBI. Once again Authorities abruptly postponed his sentencing due to his continued cooperation with the feds. All told, he faced a maximum time behind bars of 124 years associated with his guilty plea on ten counts of bank fraud and one count of identity theft.
When he was a active member of LulzSec, the group hacked into sites belonging to the CIA, Serious Organised Crime Agency, Sony Pictures Europe and News International. "It's widely believed that Monsegur will receive a reduced sentence for signing a plea agreement and serving as an informant".  Monsegur, an unemployed father of two, led the loosely organized group of hackers from his apartment in a public housing project in New York.

Hacker attacks Microsoft for next Xbox release Info

Hacker raided by FBI after leaking Microsoft next Xbox release information FBI agents this week raided the home of a Australian hacker who recently leaked a slew of details about Microsoft's next release of Xbox console. “They just took all my computers my hard drives, all of my technology, they took my bank cards, credit cards, bank statements,” he said. He had claimed to know about the next Xbox and PlayStation, claimed to really have two prototype versions of the next Xbox. The suspect, identified as Dan Henry a.k.a SuperDaE and he tweeted about the raid on his twitter and  uploaded a warrant copy. Last year he sold a next-gnen Xbox development kit on eBay for $20,100.00

ABC Hacked!!

ABC was hacked after the anti-lslam Politician Interview. The Australian Broadcasting Corporation (ABC) is investigating data breach after Lateline interviewed Dutch anti-Islam politician Geert Wilders. A hacker going by the handle "Phr0zenMyst" has claimed to have hacked a web site associated with the ABC television program Making Australia Happy, leaking the details of its users online. The files contain the personal email addresses, locations and genders of almost 50,000 of registered users of ABC websites, including encrypted versions of their login passwords. The data was posted in 10 separate pastebin's which can be accessed online.

Does Anyone What to be a Video Game Tester?

Do you want to be a Video Game Tester?
A Video Game Tester is a person that gets paid to test and review new game and game consoles before the release dates. And you get to keep the game and game consoles. So how do you get a video game tester job. Well, Here is my guide to becoming a video game tester.

1. Make contacts with game developers. Testing jobs don't usually show up in the classifieds section of your local news papers. Developers often give the jobs to people that actively seek them out and have proven experience.

2.  Explain your level of gaming experience. Mention in your resume how many consoles you own, how many games you play, what types of games you play and how many hours a day you play. You want to prove you're passionate about video games.

3.  Talk about how you want to improve the quality of video games. Start by discussing the role of the tester and how important it is to the development of video games. Prepare examples of your gaming method and how you're able to understand the differences between mistakes and glitches while you're playing. Show your analytical skills by talking about games you currently have and describe some of the glitches or errors you may have come across.

4.  Search for jobs using the keywords "quality assurance." Many of the smaller game developers don't employ in-house testers and instead farm the work out to testing firms. These firms don't advertise under "video game tester wanted"--that would generate too many applications from unqualified individuals looking to get paid simply for playing video games. Game companies are looking for analytical people who can operate software and report on any errors or problems with the software.

5.  Report glitches or errors. If you spot an error the producer missed in a video game, report it. Let them know what the error is, how it affects the game play and, if possible, solutions to fix the problem. This could help you generate a contact within that studio that can help get your foot in the door.

6.  Keep sending out resumes. Game developers produce thousands of video games every year from the major console titles to mini browser games. Keep sending your resume to every producer possible, whether or not they are currently looking for testers.

7.  The pay is roughly $25/hour. You can up to $5,600 a month for working 56 hours a week. Making an extra $67,200 per year.

8.  Check out www.becomeagametester.com
Check is website out! Buy the book for the real fine details. Trust this website only. I have tried other sites and they do not work. The book is $47 for the Holiday price. Plus you get a membership. Buy the book for there website.