[TUT][More System wise] ~ General information for Dummies 03-23-2014, 10:43 PM
#1
![[Image: res0pij.png]](http://i.imgur.com/res0pij.png)
+--+--+--+--+--+--+--+
---|.:Table of Content:.|---
+--+--+--+--+--+--+--+
- Chapter 1.
- Rainbow tables
+--+--+--+--+--+--+--+
- Chapter 2.
- Snow steganography
+--+--+--+--+--+--+--+
- Chapter 3.
- Image steganography
+--+--+--+--+--+--+--+
- Chapter 4.
- Password Cracking Techniques
+--+--+--+--+--+--+--+
- Chapter 5.
- Password Attacks
+--+--+--+--+--+--+--+
- Chapter 6.
- Man-in-the-middle-attack (MITM)
+--+--+--+--+--+--+--+
- Chapter 7.
- Rootkits.
+--+--+--+--+--+--+--+
- Chapter 8.
- Steganography
+--+--+--+--+--+--+--+
- Chapter 9.
- The complexity of a password!
+--+--+--+--+--+--+--+
- Chapter 10
- Footprinting
+--+--+--+--+--+--+--+
+--+--+--+--+--+--+--+
Chapter 1
- Rainbow tables
+--+--+--+--+--+--+--+
Let's get started, A rainbow table is a precomputed table for reversing cryptographic hash functions, usually for cracking password hashes. Tables are usually used in recovering a plaintext password up to a certain length consisting of a limited set of characters. It is a practical example of a space/time trade-off, using more computer processing time at the cost of less storage when calculating a hash on every attempt, or less processing time and more storage when compared to a simple lookup table with one entry per hash. Use of a key derivation function that employs a salt makes this attack unfeasible.
-Wikipedia
+--+--+--+--+--+--+--++--+--+--+--+--+--+--++--+--+--+--+--+--+--++--+--+--+--+--+--+--+
How can I create a Rainbow table? And how do I crack something with it?
+--+--+--+--+--+--+--++--+--+--+--+--+--+--++--+--+--+--+--+--+--++--+--+--+--+--+--+--+
It's actually quite simple, Winrtgen allows you to create Rainbow tables.
You can download the tool from oxid, I think a lot of you are familiar with oxid due to a lot of you used to use "Cain & Abel".
Winrtgen is a graphical tool and am very friendly for everyone.
Download link: Press me
+--+--+--+--+--+--+--++--+--+--+--+--+--+--++--+--+--+--+--+--+--++--+--+--+--+--+--+--+
Now let's take a look about how to crack passwords using "rainbow tables". We will be using Rainbowcrack for cracking passwords. Rainbow crack basically "builds/provokes" Rainbow tables, and will then use them to utilize a password cracking attack.
Read more about it's tables & techniques here.
http://www.project-rainbowcrack.com/index.htm
+--+--+--+--+--+--+--+
Chapter 2.
- Snow steganography
+--+--+--+--+--+--+--+
Snow steganography even known as "Whitespace steganography".
Snow is basically a program, which was made to hide data/all kind of messages/important information in ASCII format by attaching whitespace at the end of the lines.
You can read more about it here:
http://www.darkside.com.au/snow/
Quote:Because spaces and tabs are generally not visible in text viewers, the message is effectively hidden from casual observers. And if the built-in encryption is used, the message cannot be read even if it is detected.
- Darkside
Interesting algorithm? The program Snow uses the encryption algorithm, so called "ICE". Let me explain.
ICE (AKA) Also known as "Information Concealment Engine", Ice are a block cipher.
You must be thinking right now, WHAT THE HELL ARE A "BLOCK CIPHER", well, patient.
So a "Block Cipher" are given a appropriate input, but will still arrive with the same output. That's called "Deterministic Algorithm".
Read more about block cipher's here:
http://en.wikipedia.org/wiki/Block_cipher
Back to the ICE algorithm, The ice encryption algorithm uses a similar constitution as the DES (Data Encryption Standard) Which also are a symmetric key algorithm.
http://www.darkside.com.au/snow/ Describes how it works and how to perform it as well.
+--+--+--+--+--+--+--+
Chapter 3.
- Image Steganography
+--+--+--+--+--+--+--+
Image Steganography can be done using run@Time and a lot of other applications & programs, but I'm not cognizant about these applications so I will be using "QuickStego".
QuickStego camouflages text and import the text in the picture itself.
So only those who uses QuickStego can read the camouflaged message, "possibly other applications, similar to QuickStego can read the message as well".
There are tons of images which contains secret information, especially porn images. It can be brilliant way for the so called "paedo's or dealers" to pass messages to each others with getting detected.
The message can then get removed after the dealer or customer has read it and all the proof has been deleted.
A flaw with QuickStego are, that it does not encrypt the text, but hides it very well in the picture. However if you want to make the message unreadable even if it's found, you can use another application called QuickCrypto. QuickCrypto also got the feature to hide files in the images.
Also something very useful to know is that, The bigger image, the more text you can hide in the image. Don't worry, the application will tell you when you reach the limit.
QuickCrypto can be found here, along with it's features:
http://quickcrypto.com/benefits.html
QuickStego can be found here, along with it's features:
http://quickcrypto.com/free-steganography-software.html
+--+--+--+--+--+--+--+
- Chapter 4.
- Password Cracking Techniques
+--+--+--+--+--+--+--+
- Dictionary Attacks
When utilizing a (Dictionary attack) you load the "Dictionary file" through the program which will crack W/E you're cracking.
The dictionary file which you are using or going to use, is a text file which is heavy loaded with loads of dictionary words. The "Cracking program" will then load and try all the dictionary words against your target.
- Hybrid Attack
A "Hybrid Attack" are as the name, it's a "hybrid", literaly a combination between dictionary words, symbols and numbers.
When you run a "Hybrid Attack" the cracking application adds random Symbols and numbers to all the words which are loaded in the dictionary file, which we described above.
- Syllable Attack
You can call this a hybrid as well, It's a mixed attack between the two attacks (Dictionary attack & Brute force attack).
- Brute Forcing Attacks
When bruteforcing, the application will try every possible key till it identifies the data as correct.When bruteforcing NT hashes it will consume more time as it's harder than the LM ones.
- RuleBased attacks
This attack will only be used if you know anything about the victims password. For example you *accidently* did a biit "Shoulder surfing" when you was at a IT company.
You accidently watched an employers screen and saw that his password was 9 characters long and you decided to "hack" this guy.
In this case, you got a bit advantage because you collected information about your target before attacking.
Rulebased attacks uses the techniques (Syllable attacks, Brute force attacks and dictionary attacks.
+--+--+--+--+--+--+--+
- Chapter 5.
- Password Attacks
+--+--+--+--+--+--+--+
- Active Online Attack.
There also exist three types of (Active Online Attacks) - (Hash Injection, Phising, Password guessing and keylogging/rat(ing). It's also one of the easiest ways to gain "remote" access to a system with UID 0 aka root or at least administrator priviliges.
- Passive Online Attack
Passive attack basically means that the system you're attack wont get modified in any possible way, when attacking it. But about the attack, "Passive Online Attack(s)" are mainly used to monitor or at least record some data. There is not only "one" so called (passive-online-attack) There are actually three of them (From what I know about). They're called (Replay, MITM, Wire Sniffing).
- Offline Attack.
This type of attack will only happen if the hacker checks his chances to access the passwords which in this case would be stored in the system itself. Well it's kind of obvious that, if the login credentials are stored in a file, which WOULD be readable, it's very east to access it compared to a file who are encrypted.
This kind of attack are very time consuming for you and the techniques used in this attack would be: Rainbow, Distributed network and pre-computed hashes.
- Non-Electronic Attack
This attack would probably be the most easiest attack to perform (Not necessary!), Non-electronic attacks basically means that you don't need any electronic skills nor any devices.
You could to Dumpster diving, Social engineering(Which a lot of you probably already are familiar with) and lastly shoulder surfing as I mentioned in an example above.
+--+--+--+--+--+--+--+
- Chapter 6.
- Man-in-the-middle-attack (MITM)
+--+--+--+--+--+--+--+
Man-in-the-middle also known as (MITM) is a passive Online Attack and a third party attack, let me explain how it works.
If two parties interact with each others, than the MITM attack can take place. And when that happens the third part takes place.
So the two parties basically communicates with each others while the third party "eavesdrops" which then passes the data away to the next one.
So now the "third party" also needs to sniff from both ends, (the two parties).
Here's a picture I made to show how it works.
![[Image: my6ytdL.png]](http://i.imgur.com/my6ytdL.png)
Some good threads 'bout Man in the middle attacks (mitm)
http://hackforums.net/showthread.php?tid=3845120
http://www.hackforums.net/showthread.php?tid=3845159
may have screwed this chapter up, but will re-write it when I get time.
+--+--+--+--+--+--+--+
- Chapter 7 part 1/2.
- Rootkits.
+--+--+--+--+--+--+--+
Rootkits are a kind of malware that hackers uses to gain remote access to the system itself. Most hackers uses a rootkit to backdoor the system and can then perform the kind activity they choose to perform from the rootkit. The whole task for the rootkit is to gain UID 0 permissions, which corresponds "root".
But mostly the hacker uses a rootkit to backdoor the system after he obtained root access.
Most rootkits are designed and developed to hide themself(itself), which means that it can be very hard for the victim to actually find the rootkit and prune(delete) it from the system.
A very well known rootkit would be the one called "Jynx2", you can read more about the kit at "blackhat library".
Note: It exist a whole bunch of different types of rootkit(s).
+--+--+--+--+--+--+--+
- Chapter 7 part 2/2.
- Types of Rootkits
+--+--+--+--+--+--+--+
I will now here, describe a few different types of rootkit, wich can be very good to keep experience within.
- Application-level rootkit
This rootkit basically replaces files, modifies the application with injected code etc.
- Library-Level rootkits
The library-level rootkits usually hooks, patch or at least push aside the systems protection, so the kit can remain stealthly. So the protection alerts gets modified and turned into fake ones, so the kit can still remain stealthly.
- Firmware rootkit
This rootkit hides it self in a firmware, but am using a platform firmware in order to make it's own persistent malware image in uncommon places like the BIOS or in the hard-drive.
- Boot-loader-level rootkit
Boot-loader-level rootkit am also known as bootkit. So the bootkit basically replaces the boot loader with a new one. In-fact you can activate the boot-loader before the computer is fully launched.
- Hypervisor-level-rootkit
This level of rootkit are made by exploiting the hardware functions and features..
I did not go into detail, but I'm sure you understands, if you still really wants to go further into the subject go here: http://en.wikipedia.org/wiki/Rootkit
+--+--+--+--+--+--+--+
- Chapter 8
- Steganography
+--+--+--+--+--+--+--+
Types of Steganography (Image Steganography, Web steganography, Audio Steganography, Video Steganography, Folder Steganography, Document steganography, Whitespace Steganography, c++ source Steganography, natural text steganography, Hidden OS Steganography, DVDROM steganography and Spam/email steganography.. I may missed a few as I'm no expert.)
So as you saw, there exist a whole bunch of different techniques and types of Steganography, however I definitely wont descibe them all, but I did cover (Snow steganography and Image steganography).
But to the point..
Steganography is mainly used to "camouflage" a message, to make no one be able to read it but the rectify receiver of the message. So basically, just you and the rightfully receiver should be able to read it, no one else.
+--+--+--+--+--+--+--+
- Chapter 9.
- The complexity of a password!
+--+--+--+--+--+--+--+
This may not be something useful for attacking, but you should now about password complexity. To not be a victim yourself for this kind of attacks you should not use a password which are a "Word" nor just numbers.
The essentials in creating a very complex and good password are long and complicated.
The passwords who are very hard for your memory to remember are often a very good password to use, but not just that. The password should contain letters, special characters (not needed) but at least a combination of letters and numbers. So if you used to had the password "football" change that to something similar to this (not exactly this, but something similar!), F0OTb41l132.
That's a complicated & complex password as it uses uppercase & lower case letters, numbers, and normal letters. All in one combination. This can be hard to remember at start, but that's what brain are used to right? To train it even better!
+--+--+--+--+--+--+--+
- Chapter 10
- Footprinting
+--+--+--+--+--+--+--+
Footprinting is an important area in hacking and not everyone knows about that. It's the process you will go through before hacking the target, collecting useful information about it which will give you an advantage while taking the step to hack it.
There's a term you'll be using very often while talking about footprinting and while performing it as well. The term is "blueprint", a blueprint in footprinting are basically the result of the target or the system itself.
I'm not sure if I can give you an exact way to actually perform this kind of, can I call it attack? The reason behind "Why I can't really tell" you are because, there is not exact way of collecting the needed information as there are no exact way on how to perform it. You can do things such as finding out the OS, web sertber versions, WHO IS and so on.
You just need to be patience young grasshopper.
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
