Hash Algorithm Identifier | Identify CryptoHash Types

Hash Algorithm Identifier is a tool which can be used to identify almost all types of hashes. This tool can detect the password hash of various forums like MyBB, phpBB3, Drupal, Joomla, wordpress etc.

I wrote a tutorial earlier on how to identify the different types of hashes and you can see that tutorial here. If you don’t know what a Hash Function is then I recommend you to read about it  here

---

Those who have used Kali Linux for different puposes, they might have come across a tool named hash-identifier and the link to the source of the tool :- https://code.google.com/p/hash-identifier/

But the tool is poorly programmed with a huge if-else-if ladder and method construct and some of them are not correct, exceeding 500+ LOC.

---

Here’s my version of HashIdentifier. (# of lines of code : 210 [With New lines and docstrings])

Screenshot

Installing Required Packages using requirements.txt, Starting HashIdentifier Server on localhost, using the webservice

Using Hash Identifier Web Service

Python Code and Demonstration to Use Hash Identifier Web Service

 

The style and design of the code has been kept same as the original hash-identifier in the Google-code project link given above.

How to Use [Instructions for Linux/Mac users] ?

To use this simply run (The app will start):-

python HashIdentifier.py

To give executable permissions, run :-

 

chmod +x HashIdentifier.py

and then starting it by executing (One’s the executable is made you can start it by typing the following text only):-

 

./HashIdentifier.py

If you don’t understand the steps above then don’t worry. I have included a start.sh [for Linux] and a start.bat [for Windows] files to make your life more easier

To execute the start.sh, type the following in the terminal :-

 

sh start.sh

 

Hash-Algorithm-Identifier Web Service

Hash-Algorithm-Identifier is now on Cloud and provides a web service to use it directly in your apps or so and so. The wrapper for web service is provided asweb.py. The Cloud app service is hosted at http://hashid.badwith.computer/

Usage instructions

./web.py or see --help for more options

 

To use the cloud service send a get (for single hash) or post (for multiple hash) request with the hash appended at the end of the url given above. In case you want the result for multiple hashes then in such cases send the hashes as JSON data.

Javascript

var hash = "3da541559918a808c2402bba5012f6c60b27661c";
 cors_request = new XMLHttpRequest();
 cors_request.onreadystatechange = function() {
 if (cors_request.readyState == 4) {
    console.log(cors_request.responseText);
    }
 }
 cors_request.open("GET", "http://hashid.badwith.computer/" + hash);
 cors_request.send();

Python Sample Example

import requests
hsh = "3da541559918a808c2402bba5012f6c60b27661c"
resp = requests.get("http://hashid.badwith.computer/%s" % hsh)
print(resp.text)

Python Example : Multiple hashes

import json
import requests
hashes = {'hashes': [
 "3da541559918a808c2402bba5012f6c60b27661c",
 "912ec803b2ce49e4a541068d495ab570"
 ]}
resp = requests.post("http://hashid.badwith.computer/", data=json.dumps(hashes))
print(resp.text)

The response is received as JSON data. The Demo usage has been already shown above under the screenshots header..

Thanks to moloch for contributing to the cloud app.

About the Code

As it is evident from the code that I have used regular expressions to identify the hashes. The hashes are being identified because they have certain characteristics and when matched properly they will produce the proper results. Using regular expressions to identify the hash makes the code neat and easy to understand. To understand the regex expressions used in the code, VISIT THIS SITE and paste the Regex Expression in its proper place and thereby you get the explanation. 

Suggestion and feedback are welcome. The tool will be updated with more new features and hashes for identification.

Quick Links

1. Github Project Page : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier
2. Project Wiki : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier/wiki
3. Read Changelog : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier/blob/master/CHANGELOG.md

Thank you,
Sincerely,
Psycho_Coder

Related articles

• 100 Best Open Source Security Tools
• Using Dban to Securely Wipe data from hard disk
• Generate Wordlists in Backtrack 5 R3 using Crunch
• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker
• How To Mount and Unmount a drive on Linux
• How To copy a Very large file to a flash drive in Linux

Continue Reading →

Cryptography | Identify Different types of Hashes

Cryptographically secure pseudorandom number generator (Photo credit: Wikipedia)

Hello Everyone,

If you are a hacker or a computer Geek or programmer or a general enthusiast regarding computing then you might have come across the term hash or cryptographic hash functions. Many a times even people call hashes as encryption which is absolutely wrong. This is going to be a short tutorial and we will be dealing with how to identify the various types of hashes that we come across. I hope after reading this tutorial you will have some idea that how to identify hashes.

Reader's Note:-

I assume the following while making this tutorial:-

1. You know basics of cryptography. If you don't then read this.
2. You have some experience with programming (though not required much in this tutorial bit its good to know as they will help you understand better).
3. You know basics of PHP [optional].

Let's Begin

---

Identifying MD5

MD5 hash : It is one of the most common type of hash function and it is used in many sites and is applied in different fields. Used in phpBB v2.x, Joomla version below 1.0.13 and many other forums and CMS.

Reasons for a hash to be MD5

Length: 32 characters.
Description: They are always 32 characters in length (16 Bytes).They are always hexadecimal (Only use characters 0-9 and A-F)
Algorithm: Same as the md5() function in PHP.

Example :- f5d1278e8109edd94e1e4197e04873b9

 

MD5 (UNIX) : Used in Linux and other similar OS.

Length: 34 characters.
Description: The hash begins with the $1$ signature, then there goes the salt (up to 8 random characters; in our example the salt is the string "12345678"), then there goes one more $ character, followed by the actual hash.
Algorithm: Actually that is a loop calling the MD5 algorithm 2000 times.

Example:- $1$12345678$XM4P3PrKBgKNnTaqG9P0T/

 

MD5 (APR) : Used in Linux and other similar OS.

Length: 37 characters.
Description: The hash begins with the $apr1$ signature, then there goes the salt (up to 8 random characters; in our example the salt is the string "12345678"), then there goes one more $ character, followed by the actual hash.
Algorithm: Actually that is a loop calling the MD5 algorithm 2000 times.

Example:- $apr1$12345678$auQSX8Mvzt.tdBi4y6Xgj.

 

MD5 (phpBB3) : Used in phpBB 3.x.x.

Length: 34 characters.
Description: The hash begins with the $H$ signature, then there goes one character (most often the number '9'), then there goes the salt (8 random characters; in our example the salt is the string "12345678"), followed by the actual hash.
Algorithm: Actually that is a loop calling the MD5 algorithm 2048 times.

Example: $H$9123456785DAERgALpsri.D9z3ht120

 

MD5(Wordpress) : Used in Wordpress sites.

Length: 34 characters.
Description: The hash begins with the $P$ signature, then there goes one character (most often the number 'B'), then there goes the salt (8 random characters; in our example the salt is the string "12345678"), followed by the actual hash.
Algorithm: Actually that is a loop calling the MD5 algorithm 8192 times.

Example:- $P$B123456780BhGFYSlUqGyE6ErKErL01

Identifying Salted MD5

Salted MD5 - Used in a large amount of applications to increase hash parity and to increase the time it takes to crack.

General Description : They consist of two blocks connected by a colon, the first is the hash the second is the salt. The first part of the salted hash is hexadecimal, the second is variable case alphanumeric. They first part will always be 32 characters long. The second part can be any length.

md5($pass.$salt) :Used in WB News, Joomla version 1.0.13 and higher.
Length: 16 bytes.

Example:- 6f04f0d75f6870858bae14ac0b6d9f73:1234

 

md5($salt.$pass) : Used in osCommerce, AEF, Gallery and other CMS.
Length: 16 bytes.

Example:- f190ce9ac8445d249747cab7be43f7d5:12

 

md5(md5($pass)) : Used in e107, DLE , AVE, Diferior, Koobi and other CMS.
Length: 16 bytes.

Example:- 28c8edde3d61a0411511d3b1866f0636

 

md5(md5($pass).$salt) :Used in vBulletin, IceBB.
Length: 16 bytes.

Example:- 6011527690eddca23580955c216b1fd2:wQ6

 

md5(md5($salt).md5($pass)) : Used in IPB.
Length: 16 bytes. 

 

Example:- 81f87275dd805aa018df8befe09fe9f8:wH6_S

md5(md5($salt).$pass) : Used in MyBB.
Length: 16 bytes. 

 

Example:- 816a14db44578f516cbaef25bd8d8296:1234

 

md5($salt.$pass.$salt) : Used in TBDev.
Length: 16 bytes.

Example:- a3bc9e11fddf4fef4deea11e33668eab:1234

 

md5($salt.md5($salt.$pass)) : Used in DLP (More info. :- Here).
Length: 16 bytes. 

 

Example:- 1d715e52285e5a6b546e442792652c8a:1234

Identifying SHA

SHA-1 : Used frequently on the internet and is one of a large family of Secure Hash Algorithms.Used in many forums and CMS.
Length: 20 bytes.
Description :They are always 40 Characters in length (160 bits).They are always hexadecimal (Only use characters 0-9 and A-F).
Algorithm: Same as the sha1() function in PHP. 

 

Example: 356a192b7913b04c54574d18c28d46e6395428ab

sha1(strtolower($username).$pass) : Used in SMF.
Length: 20 bytes.

Example:- Admin:6c7ca345f63f835cb353ff15bd6c5e052ec08e7a

 

SHA-256(Unix) : Used in Linux and other similar OS.
Length: 55 characters.
Description: The hash begins with the $5$ signature, then there goes the salt (up to 8 random characters; in our example the salt is the string "12345678"), then there goes one more $ character, followed by the actual hash.
Algorithm: Actually that is a loop calling the SHA-256 algorithm 5000 times.

Example: $5$12345678$jBWLgeYZbSvREnuBr5s3gp13vqiKSNK1rkTk9zYE1v0

SHA-512(Unix) :Used in Linux and other similar OS.
Length: 98 characters.
Description: The hash begins with the $6$ signature, then there goes the salt (up to 8 random characters; in our example the salt is the string "12345678"), then there goes one more $ character, followed by the actual hash.
Algorithm: Actually that is a loop calling the SHA-512 algorithm 5000 times. 

 

Example:- $6$12345678$U6Yv5E1lWn6mEESzKen42o6rbEmFNLlq6Ik9X3reMXY3doKEuxrcDohKUx0Oxf44aeTI​xGEjssvtT1aKyZHjs

Identifying Salted SHA

sha1($salt.sha1($salt.sha1($pass))) : Used in Woltlab BB.
Length: 20 bytes.

Example: cd37bfbf68d198d11d39a67158c0c9cddf34573b:1234

Identifying Other hash types

MySQL < 4.1 : These aren't used very often but still come up on very often because people have no idea what to do with them, they are used in older versions of MySQL.

Length : 16 characters(8 bytes)
Description :They are always hexadecimal (Only use characters 0-9 and A-F).

Example:- 606727496645bcba

MYSQL5 : Used in newer versions of MYSQL to store database user passwords.
Length: 41 characters
Description :They are always capitalized. They always begin with an asterisk .

 

Example:- *C8EB599B8E8EE7BE9F1A5691B7BC9ECCB8DE1C75

DES(Unix) : Used in Linux and other similar OS.
Length: 13 characters.
Description: The first two characters are the salt (random characters; in our example the salt is the string "Iv"), then there follows the actual hash.

Example:- IvS7aeT4NzQPM

Domain Cached Credentials :Used for caching passwords of Windows domain.
Length: 16 bytes.
Algorithm: MD4(MD4(Unicode($pass)).Unicode(strtolower($username)))

Example:- Admin:b474d48cdfc4974d86ef4d24904cdd91

I hope this information is useful to you and I belief that this post will help many others. 

References : Here

Related articles

• Lightweight Introduction to Cryptography | Terminology, Security Goals and Cryptographic Attacks
• 100 Best Open Source Security Tools
• Generate Wordlists in Backtrack 5 R3 using Crunch
• Using Dban to Securely Wipe data from hard disk
• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker

Continue Reading →

Using Dban to Securely Wipe data from hard disk

"DBAN is free erasure software designed for the home user. It automatically deletes the contents of any hard disk that it can detect. This method can help prevent identity theft before recycling a computer. DBAN is also a commonly used solution to remove viruses and spyware from Microsoft Windows installations. "

--- Original Site < http://dban.org/ >

About its short commings and drawbacks read the info from the original site (link given above)

So lets move directly into how to use it. The tool comes in a iso format and you can either write it on CD/DVD or on flash drive. I would recommenend you to use it on a flash drive since its on 15 mb in size and if you use a CD or DVD then its wasted.

I will first show you how to use dban by creating a Virtual machine for ir. I am using Virtual Box which comes by default in fedora 19 (I am using fedora 19 at present).

So first download the iso file from here : http://sourceforge.net/projects/dban/files/dban/dban-2.2.8/dban-2.2.8_i586.iso/download

The file is only ~15 MB in size and so the download will be quick.  I downloaded it here :-



Now download and install virtual box or VMware Player which ever you wish to use. I am using Virtual Box. If you don't have them already then you can download them from the following :-

Virtual Box : https://www.virtualbox.org/wiki/Downloads

VMware Player: https://my.vmware.com/web/vmware/free#desktop_end_user_computing/vmware_player/6_0

The application I am using is called Boxes and is more like Virtual Box and comes installed with Fedora 21. So open Boxes and click new.



You will get the following screen :-



Click on Continue and the following screen will appear :-



As you can see Virtual Box have already listed the ISO's but if it doesn't shows up then you can Click on Select File and Choose the DBAN ISO file



After you choose open the following screen will appear :-



If you wanna customize then click on customize. After you do so you will :-



But in our case there is nothing to customize we are wiping data. You will probably perform it on your complete HDD and so it unnecessary. If you have done this much then click on Create on Top right corner (in case of Virtual Box)



The following screen will appear showing the different DBAN options and its main interface:-



Click on the blue screen to enter the VM. If you press Enter autonuke setting will start which is the default and the recommended option. To see the other cmmands available press F3. You will see the following :-



We will go with the default option and we will press enter on the first screen screen that appears. After we do so will see the following :-





Now its will list all your HDD or flash drives attached. Now select the drive you want to wipe and press SPACE to select it. You can use UP and DOWN keys to select other drives (if any). After you have done this press F10 to start the process.



You will be able to see the time remaining to complete, no. of rounds or number of steps etc etc.Once the process s complet a black screen will come with the confirmation that the data has been wiped clean :)

---

Install using Flash Drive

To use dban using a flash drive you first need to write it onto the drive itself.

To write the ISO in flash drive I would recommened you to use Universal USB Installer if you're on Windows Since it comes with a pre loaded config for DBAN ISO and so it will be better imho. Linux users can use Unetbootin.

After you have done so simply boot your system and from Boot Options run using the flash drive and the rest i like I explained above after you create the VM.

Thats all for today and I hope you like the tutorial.

 

 

Related articles

• How To Mount and Unmount a drive on Linux
• Generate Wordlists in Backtrack 5 R3 using Crunch
• How To copy a Very large file to a flash drive in Linux
• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker

Continue Reading →

100 Best Open Source Security Tools

English: A candidate icon for Portal:Computer security (Photo credit: Wikipedia)

Whether you’re a network administrator, security professional, or an end user, it’s important that you keep your system clean and secure. There are a variety of high quality open source security tools available, and many of them are free. Check out this list to find 100 of the best of them.

 

General

These tools offer a variety of useful security functions.

1. Untangle: Untangle will provide you with spam, virus, and spyware protection, as well as Web filtering, firewall, and more.
2. Network Security Toolkit: This tool combines a variety of open source apps that will help you stay on top of traffic, intrusions, and more.
3. Bastille Linux: With this tool, you’ll answer questions about your security, and will get a custom lockdown for your machine.
4. OSSIM: OSSIM brings together a number of open source security tools to give you network details and stay on top of intrusions.
5. ProShield: Use Proshield to get a scan of your system for up to date software and malware.
6. Hardened Linux: This Linux distribution will help you improve your security.
7. eBox Platform: Use this network management framework for content filtering, proxy, firewalls, and more.sa
8. Kismet: Kismet offers wireless network detection, intrusion detection, and packet sniffing, all in one.
   

Monitoring

With these tools, you’ll get constant monitoring of your security.

1. Nessus: Use this free scanner to stay on top of your vulnerabilities.
2. Nagios: This host and network monitoring tool will let administrators handle outages before clients and users are affected.
3. AWStats: Use AWStats to get a look at attacks on your server.
4. Honeytrap: With this tool, you’ll get advanced warning about attacks.
5. The Multi Router Traffic Grapher: Use this tool to monitor your SNMP network devices.
6. Snort: Snort is an incredibly effective intrusion detection system.
7. BASE: This tool works well with Snort to make your intrusion detection data more easy to understand.
8. Internet Secure Access Kit: This suite will help you restrict and monitor access on your network.
9. Afick: Afick will help you stay on top of changes to your system.
10. Network Security Analysis Tool: Use this tool to scan your network for vulnerabilities.
11. Nagios: This program will monitor your enterprise network services, environmental factors, host resources, and point out potential vulnerabilities.
12. JbroFuzz: With this tool, you can test the integrity of your network.
13. Yet Another Security Monitoring Interface: This web based application will help you take a look at the data flow in your router.
14. ettercap: Ettercap will monitor your LAN, staying on top of content, live connections, and other potential attacks.
15. Metasploit: Often used by hackers, you can test your system with this tool.
16. SNARE: Make use of this tool that collects and analyzes your event log data.
17. Nikto: Nikto will scan your web servers for problems and dangerous files.
    

Email & Spam

Use these tools to keep your email secure.

1. Spam Assassin: This anti-spam tool will help you keep your email neat and clean.
2. Tiger Envelopes: This email encryption tool works with a variety of programs, including Thunderbird and Outlook.
3. Anti-Spam SMTP Proxy Server: Use this application to filter out spam and viruses.
4. Spamato: With this client-side spam filter, you can keep the junk out of your Outlook, Thunderbird, and other popular email clients.
5. phPOP3clean: Use this scanner to look for worms, spam, blacklisted words, as well as blacklisted domains.
6. Thunderbird: This open source email program has a variety of tools for keeping spam and viruses at bay.
7. Mailsaurus: This email client will encrypt all of your data so that no one can read your email.
8. MailCleaner: With this filtering application, you can keep the spam and viruses out.
9. Web Stat: Want to know how much spam you’re blocking? Use this tool that will display your level of blocked spam graphically.
   

Anti-Virus

With these tools, you can protect your computer and network from viruses.

1. FullControl: This software will stay on top of all the programs running on your computer and verify their integrity.
2. ClamAV: Make use of this excellent antivirus tool to keep your machine free of viruses.
3. ClamWin: If you want to take advantage of ClamAV on your Windows machine, make use of this tool.
4. Moon Secure Antivirus: This antivirus scanner also features a firewall.
5. Winpooch Watchdog: Winpooch will stay on top of spyware, trojans, and viruses.
6. Softlabs AntiVirus: Using this antivirus tool, you can scan your email for phishing and viruses.
   

Firewall

Use these firewall tools to keep unwanted intruders and items out of your system.

1. SELinux: Using SELinux, you can set mandatory access control features for Linux.
2. m0n0Wall: This tool offers both firewall and VPN.
3. ShellTer: ShellTer offers a firewall with SSH protection.
4. Endian Firewall Community: Use this tool to turn an old PC into an appliance that provides a variety of security functions.
5. FirewallPAPI: This system will stay on top of your network traffic.
6. SmoothWall Express: Use SmoothWall to turn a PC into a firewall appliance for your network.
7. WIPFW: Use this tool to monitor and filter packets entering your network.
8. Fail2Ban: Fail2Ban will stay on top of log files and look for failure prone IPs, which will be blacklisted.
9. Vyatta: Turn to Vyatta to get an enterprise class firewall for free.
10. ISP-FW: With this server side firewall application, you can get packet filtering and monitoring.
11. Firewall Builder: This tool will make it easy to establish rules for your firewall.
12. AppArmor: Create policy-based profiles to control access to applications with AppArmor.
13. Firestarter: Make use of this firewall if you want to get your firewall security up and running in a hurry.
14. Linux Embedded Appliance Firewall: This firewall tool will help you shore up your security.
15. IPCop: With this tool, you can turn any PC into a firewall appliance to get your network secure.
    

Files & Data

Keep your files, data, and transfers secure with these tools.

1. Darik’s Boot and Nuke: If you want to wipe out a hard drive, just boot up with a disk containing this tool.
2. Packet Generator: Use this tool to optimize the routing schematics for your network.
3. Paros: Paros intercepts data, offering a way to evaluate web application security.
4. Cyberduck: With this tool, you can transfer files to remote computers and networks.
5. WinSCP: Use this SFTP and FTP client for secure file transfes.
6. Eraser: This tool will eliminate files by overwriting them several times, so that they can’t be read using digital forensic tools.
   

Encryption & Cryptography

Make use of these encryption and cryptography tools to stay secure.

1. KeyCzar: Use this toolkit to make cryptography easier to use in applications.
2. Cameloid: Keep your voice connections safe with this encryption tool.
3. GNU Privacy Guard: This encryption tool uses a number of different encryption algorythms.
4. TrueCrypt: Use TrueCrypt to encrypt a partition or drive, or create a virtual encrypted disk within a file.
5. Cryptonit: Secure your files and address books with this encryption tool.
6. Checkpoint Commander: This tool will both encrypt and completely erase your files.
7. AxCrypt: AxCrypt is a simple encryption tool that will allow you to encrypt files with just a few clicks.
8. Magikfs: You can hide your files using this tool with a steganographic filesystem.
9. FreeOTFE: This tool will create secure virtual drives on your PC.
10. Cryptology: Cryptology offers encyption that integrates into Windows Explorer right-click menus.
    

Passwords

With these tools, you can keep your passwords handy and secure.

1. KeePass: Use this password safe to keep all of your passwords safe and encrypted.
2. CiphSafe: This tool will encrypt your usernames and passwords for popular Internet websites.
3. Password Safe: Password Safe will help you create strong passwords and can store multiple password databases.
4. Keep It Secret! Keep It Safe!: With this tool, you can store your important usernames and passwords in an encrypted file.
   

Remote Access

Use these tools for secure remote access.

1. OpenSSH: With this tool, you can safely operate a remote host.
2. Stunnel: Stunnel will encrypt your TCP connections inside SSL connections.
3. OpenVPN: Get safe VPN access using this tool.
4. SSL-Explorer: This web-based VPN server will allow you to use a standard browser.
5. Open SSL: This tool uses Transport Layer Security and Secure Socets Layer protocols to keep you safe.
6. strongSwan: strongSwan offers an IPsec-based VPN tool for Linux.
7. PuTTy: Get remote access with this telnet/SSH client.
8. UltraVNC: Use this tool to get safe and secure remote access.
   

Networking

These tools will help you operate a more secure network.

1. Nmap: Nmap will help you stay informed of all of the hardware that is connected to your network.
2. Wireshark: Using Wireshark, you can take a look at all of the traffic that passes over your Ethernet network.
3. Bro: Bro offers network intrusion detection that will passively monitor your network traffic for anomalous traffic behavior.
4. Network Simulator and Network Animator: With this tool, you can test your network flow to prevent bottlenecks and promote better routing.
5. OCS Inventory NG: This tool will provide you with a list of hardware and software on your network.
6. Netcat: Netcat is a simple utility that will help you read and write data across UDP or TCP network connections.
7. Angry IP Scanner: This tool will scan IP adresses and ports on your network.
8. Ossec HIDS: With this intrusion detection system, you’ll find out when your network is being attacked.
9. TcpDump: If you’re looking for a light, secure packet sniffer, check out this tool.
10. The Network Visualizer: Get graphic information on your network activity using this tool.
    

Miscellaneous

Check out these tools for even more open source security applications.

1. Tripwire: Find out when changes are made to your system by using this tool.
2. Firefox: A very popular web browser, Firefox offers a variety of secure options and add ons.
3. The Sleuth Kit: With this kit, you can recover deleted files.
4. JAP: This tool will allow you to browse the Internet anonymously.
5. iSAK: Using this tool, you can filter out specific types of websites.
6. Advisory Check: This tool will read RSS and XML security feeds to monitor the security of the software you’re using.
7. Babel: Babel will let you know about all of the security flaws that you have in your system.
   

Originally Posted on : http://www.mastersincriminaljustice.com/blog/2008/100-best-open-source-security-tools/

 

Related articles

• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker
• Lightweight Introduction to Cryptography | Terminology, Security Goals and Cryptographic Attacks
• Crawling Net-Security.org Archive Magazines using Python
• List Of Steganography Tools
• Generate Wordlists in Backtrack 5 R3 using Crunch
• Recommended Books to become a Java Hero from Java Zero

Continue Reading →

List Of Steganography Tools

 

 

Image Steganography:

• F5 is a steganography algo for hiding information in JPEG images. Westfeld A. F5ea steganographic algorithm (high capacity despite better steganalysis). In: Moskowitz I, editor. Information hiding. vol. 2137 of lecture notes in Computer Science. Berlin/Heidelberg: Springer; 2001. p. 289e302. 
• JPHIDE and JPSEEK are programs which allow you to hide a file in a jpeg visual image. 
• Jsteg is an open steganography software on Internet. It uses the LSB of DCT coefficients to hide secret information. 
• Mr Hide is a steganography tool for hiding information inside images. 
• OpenPuff is a professional steganography tool, with unique features you won't find among any other free or commercial software. OpenPuff is 100% free and suitable for highly sensitive data covert transmission. 
• OpenStego is an open-source software distributed under the terms of the GNU General Public License v2.0. 
• Perturbed Quantization: the sender hides data while processing the cover object with an information-reducing operation that involves quantization, such as lossy compression, downsampling, or A/D conversion. 
• Steghide is a steganography program that is able to hide data in various kinds of image- and audio-files. The color-respectively sample-frequencies are not changed thus making the embedding resistant against first-order statistical tests. 
• Steghide Online: Web page for Steganography using Steghide.
• StegoBlue: LSB Steganography on Bitmaps in Python.

Audio Steganography:

• MP3Stego will hide information in MP3 files during the compression process. The data is first compressed, encrypted and then hidden in the MP3 bit stream. 

Network Steganography:

• SteganRTP is a steganography tool which establishes a full-duplex steganographic data transfer protocol utilizing Real-time Transfer Protocol (RTP) packet payloads as the cover medium. The tool provides interactive chat, file transfer, and remote shell access. 
• HCovert is a steganographic communications tool used to create a covert channel using a HTTP GET request to convey it's message to a webserver and webserver log parsing to retrievethe message. This tool will both send as well as recieve messages.
• Netcross is a tunneling software particularly useful in restricted (read firewalled) network environments, which is able to establish IP tunnels exploiting Domain Name Resolution requests/responses. 
• Cctt, "Covert Channel Tunneling Tool" - is a tool presenting several exploitation techniques allowing the creation of arbitrary data transfer channels in the data streams authorized by a network access control system.
• Cooking channels - is a set of two python scripts (CGI and client) allowing to build a communication channel over HTTP cookies.

Image Steganalysis - Feature Extractors*:

• Merged Features - T. Pevny and J. Fridrich, Merging Markov and DCT features for multi-class JPEG steganalysis. In E.J. Delp and P.W. Wong, editors, Proceedings SPIE, Electronic Imaging, Security, Steganography, and Watermarking of Multimedia Contents IX, volume 6505, pages 3 1 - 3 14, San Jose, CA, January 29 / February 1, 2007. 
• PPD - Daniel Lerch-Hostalot, David Megías. LSB matching steganalysis based on patterns of pixel differences and random embedding Computers & Security, Volume 32, February 2013, Pages 192-206. 
• Rich Models - J. Fridrich and J. Kodovsky, Rich models for steganalysis of digital images, IEEE Transactions on Information Forensics and Security. 
• SPAM - T. Pevny and P. Bas and J. Fridrich Steganalysis by subtractive pixel adjacency matrix. Steganalysis by subtractive pixel adjacency matrix, Princeton, NJ, September 7-8, 2009. 

A lot of feature extractors implemented in Matlab can be found here.
Network Steganalysis

• Cctde is a first implementation of the Gray-World.net Covert Channel and Tunneling over the HTTP protocol Detection : GW implementation theoretical design paper.

Steganalysis - Classifiers:

• Ensemble Classifiers - J. Kodovský, J. Fridrich, and V. Holub, Ensemble Classifiers for Steganalysis of Digital Media. IEEE Transactions on Information Forensics and Security, Vol. 7, No. 2, pp. 432-444, April 2012.
• LibSVM - Chang, Chih-Chung and Lin, Chih-Jen. A library for support vector machines. ACM Transactions on Intelligent Systems and Technology. 2:27:1--27:27, 2011.

Article Taken from here : http://steganography.daniellerch.me/p/software.html

Continue Reading →

Crawling Net-Security.org Archive Magazines using Python

English: A candidate icon for Portal:Computer security (Photo credit: Wikipedia)

(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. I wrote to code to download all the magazines, save then in a folder and then create an archive of the folder. Manually downloading them is boring and I am lazy enough to avoid getting my hands on them. So I wrote a little code which does the work for me. I will be crawling all the mags from this page. For the purpose of crawling I used requests and lxml libraries and so if you're using this code make sure you install these two packages using pip.

Without further adieu, I will give you he code now. 

Working Screenshot

Related articles

• Math Expression Parser in Java
• Visual Stack Application in Java
• 3D Rotating Square with WebGL in Three.js
• PiXMatch - A Picture Matching Game in VB.NET
• Image to ASCII ART converter in Java
• Insertion Sort using Binary Search in Python

Continue Reading →

80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker

Note: I have not written this article and I take no credit for the gathering of links or Resources. The original post was posted here and I am just sharing that post in this blog.

---

Learning to become hacker is not as easy as learning to become a software developer. I realized this when I started looking for learning resources for simple hacking people do. Even to start doing the simplest hack on own, a hacker requires to have in depth knowledge of multiple topics. Some people recommend minimum knowledge of few programming languages like C, Python, HTML with Unix operating system concepts and networking knowledge is required to start learning hacking techniques.

Though knowing a lot of things is required, it is not really enough for you to be a competent and successful hacker. You must have a passion and positive attitude towards problem solving. The security softwares are constantly evolving and therefore you must keep learning new things with a really fast pace.

If you are thinking about ethical hacking as a career option, you may need to be prepared for a lot of hard/smart work. I hope these free resources will help you speed up on your learning. If you decide you pursue ethical hacking as a career option, you may also want to read some in depth ethical hacking books.

A lot of people (including me before doing research for this article) think that they can become a hacker using some free hacking tools available on web. Its true that some common types of hacking can be easily done with help of tools, however doing it does not really make you a hacker. A true hacker is the one who can find a vulnerability and develop a tool to exploit and/or demonstrate it.

Hacking is not only about knowing "how things work", but its about knowing "why things work that way" and "how can we challenge it".

Below are some really useful hacking tutorials and resources you may want to explore in your journey of learning to hack

Hacking For Dummies - Beginners Tutorials

These tutorials are not really simple for anyone who is just starting to learn hacking techniques. However, these should be simple starting point for you. I am sure you have different opinion about complexity of each tutorial however advanced hacker are going to be calling this a job of script kiddie (beginner hacker). Even to acquire the skills of a script kiddie you need to have good understanding of computer fundamentals and programming.

1. Cybrary - For those looking to learn ethical hacking skills online, Cybrary provides the perfect platform to do so. Cybrary is a free online IT and cyber security training network that provides instruction in the form of self-paced, easy-to-follow videos. Featuring courses on topics such as Penetration Testing and Ethical Hacking, Advanced Penetration Testing, Post Exploitation Hacking and Computer and Hacking Forensics, Cybrary provides instruction from the beginner to the highly-advanced level of hacking. Additionally, Cybrary offers supplemental study material along with their courses free of charge. With their in-depth training videos and study guides, Cybrary ensures that users develop the best hacking skills.
2. Hacking Tutorials for Beginners - By BreakTheSecurity.com
3. How to learn Ethical hacking - By Astalavista.com
4. Penetration Testing Tutorial - By Guru99.com
5. Backtrack Penetration Testing Tutorial
6. Introduction to Penetration Testing
7. Information Gathering with Nmap
8. Simple How To Articles By Open Web Application Security
9. The Six Dumbest Ideas in Computer Security
10. Secure Design Principles
11. 10 steps to secure software

Cryptography Related Tutorials

Cryptography is must know topic for any aspiring security professional or a ethical hacker. You must understand how encryption and decryption is done. You must understand why some of the old encryption techniques do not work in modern computing world.

This is a important area and a lot of software programmers and professional do not understand it very well. Learning cryptography involves a lot of good understanding of mathematics, this means you also need to have good fundamentals on discrete mathematics.

1. Introduction to Public Key Cryptography
2. Crypto Tutorial
3. Introduction to Cryptography
4. An Overview of Cryptography
5. Cryptography Tutorials - Herong's Tutorial Examples
6. The Crypto Tutorial - Learn How to Keep Secret Secret
7. Introduction to cryptology, Part 1: Basic Cryptology Concepts

Websites For Security Related Articles And News

These are some websites, that you may find useful to find hacking related resources and articles. A lot of simple tricks and tips are available for experimenting through these sites for improving yourself to become advanced hacker.

In recent years, many people are aspiring to learn how to hack. With growing interest in this area, a lot of different types of hacking practices are evolving. With popularity of social networks many people have inclined towards vulnerability in various social networks like facebook, twitter, and myspace etc.

Continuous learning about latest security issues, news and vulnerability reports are really important for any hacker or a security professional. Some of the sites that keep publishing informative articles and news are listed here.

1. http://www.astalavista.com/
2. http://packetstormsecurity.com/
3. http://www.blackhat.com/
4. http://www.metasploit.com/
5. http://sectools.org/
6. http://www.2600.com/
7. DEF CON - Hacking conference
8. http://www.breakthesecurity.com/
9. http://www.hacking-tutorial.com/
10. http://www.evilzone.org/
11. http://hackaday.com/
12. http://www.hitb.org/
13. http://www.hackthissite.org/
14. http://pentestmag.com
15. http://www.securitytube.net/
16. https://www.ssllabs.com/

EBooks And Whitepapers

Some of the research papers by security experts and gurus can provide you a lot of information and inspiration. White papers can be really difficult to read and understand therefore you may need to read them multiple times. Once you understand the topic well, reading will become much faster and you will be able to skim through a lot content in less time.

1. Handbook of Applied Cryptography - This ebook contains some free chapter from one of the popular cryptography books. The full book is also available on amazon at Cryptography Book.
2. Network Penetration testing Guide
3. How to hack anything in Java
4. Mcafee on iPhone and iPad Security
5. A Good Collection of White papers on security and vulnerabilities - This site contains collection of white papers from different sources and some of these white papers are really worth referring.
6. Engineering Principles for Information Technology Security
7. Basic Principles Of Information Protection
8. Open Web Application Security Project - OWASP is one of the most popular sites that contains web application security related information .

Videos & Play Lists

Those who like to watch video tutorials, here are few I liked. However there are many small video available on youtube. Feel free to explore more and share with us if you like something.

1. Cryptography Course By Dan Boneh Stanford University
2. Open Security Training- Youtube Playlist of More than 90 hours. I have found this to be the biggest free training available for security related topic.
3. OWASP AppSec USA 2011: Youtube Playlist containing compilation of OWASP conference highlight in 2011.
4. Defcon: How I Met your Girlfriend - Defcon is one of the most popular hacker conference. The presenters in this conference are well know inside the hacking industry.
5. Defcon: What happens when you steal a hackers computer
6. Defcon: Nmap: Scanning the Internet
7. Public Key Cryptography: Diffie-Hellman Key Exchange
8. Web application Pen testing
9. Intro to Scanning Nmap, Hping, Amap, TCPDump, Metasploit

Forums For Hackers And Security Professionals

Just like any other area, forums are really great help for learning from other experts. Hundreds of security experts and ethical/non-ethical hackers are willing to share their knowledge on forums for some reason. Please keep in mind to do enough research before post a question and be polite to people who take time to answer your question.

1. Stackoverflow for security professionals
2. http://darksat.x47.net/
3. http://forums.securityinfowatch.com/
4. http://forums.cnet.com/spyware-viruses-security-forum/
5. http://www.hackforums.net/forumdisplay.php?fid=47

Vulnerability Databases And Resources

Vulnerability Databases are the first place to start your day as a security professional. Any new vulnerability detection is generally available through the public vulnerability databases. These databases are a big source of information for hackers to be able to understand and exploit/avoid/fix the vulnerability.

1. http://www.exploit-db.com/
2. http://1337day.com/
3. http://securityvulns.com/
4. http://www.securityfocus.com/
5. http://www.osvdb.org/
6. http://www.securiteam.com/
7. http://secunia.com/advisories/
8. http://insecure.org/sploits_all.html
9. http://zerodayinitiative.com/advisories/published/
10. http://nmrc.org/pub/index.html
11. http://web.nvd.nist.gov
12. http://www.vupen.com/english/security-advisories/
13. http://www.vupen.com/blog/
14. http://cvedetails.com/
15. http://www.rapid7.com/vulndb/index.jsp
16. http://oval.mitre.org/

Product Specific Vulnerability Information

Some of the very popular products in the world require a special attention and therefore you may want to look at the specific security websites directly from vendors. I have kept Linux. Microsoft and apache in this list, however it may apply to any product you may be heavily using.

1. Red Hat Security and other updates Site
2. Microsoft Products Security Bulletin
3. Apache Foundation Products Security Repository
4. Ubunut Software Security Center
5. Linux Security Repository

Tools And Programs For Hacking / Security

There are dozens of tools available for doing different types of hacking and tests. Tools are really important to become more productive at your work. Some of the very common tools that are used by hackers are listed here. You may have different choice of tools based on your own comfort.

1. nmap
2. NSS
3. Hping
4. TCPDump
5. Metasploit
6. Wireshark
7. Network Stuff
8. Nikto

Summary

I have tried to compile some of these resources for my own reference for the journey of learning I am going to start. I am not even at a beginner level of becoming hacker but the knowledge of this field really fascinates me and keeps me motivated for learning more and more. I hope will be able to become successful in this.

A lot of people use their knowledge skills for breaking stuff and stealing. I personally think that doing harm to someone is a weak choice and will not have a good ending. I would recommend not to use your skills for any un-ethical endeavor. A single misuse of your skill may jeopardize your career since most companies do a strict third party background check before they hire a ethical hacker or a security personal.

There are dozens of companies looking for ethical hackers and security professionals. There are really good number of opportunities in this area and its really niche compensation segment. You will be easily able to get a decent job without even acquiring all the expert level skills to become a pro hacker.

Continue Reading →