Hash Algorithm Identifier | Identify CryptoHash Types

Hash Algorithm Identifier is a tool which can be used to identify almost all types of hashes. This tool can detect the password hash of various forums like MyBB, phpBB3, Drupal, Joomla, wordpress etc.

I wrote a tutorial earlier on how to identify the different types of hashes and you can see that tutorial here. If you don’t know what a Hash Function is then I recommend you to read about it  here

---

Those who have used Kali Linux for different puposes, they might have come across a tool named hash-identifier and the link to the source of the tool :- https://code.google.com/p/hash-identifier/

But the tool is poorly programmed with a huge if-else-if ladder and method construct and some of them are not correct, exceeding 500+ LOC.

---

Here’s my version of HashIdentifier. (# of lines of code : 210 [With New lines and docstrings])

Screenshot

Installing Required Packages using requirements.txt, Starting HashIdentifier Server on localhost, using the webservice

Using Hash Identifier Web Service

Python Code and Demonstration to Use Hash Identifier Web Service

 

The style and design of the code has been kept same as the original hash-identifier in the Google-code project link given above.

How to Use [Instructions for Linux/Mac users] ?

To use this simply run (The app will start):-

python HashIdentifier.py

To give executable permissions, run :-

 

chmod +x HashIdentifier.py

and then starting it by executing (One’s the executable is made you can start it by typing the following text only):-

 

./HashIdentifier.py

If you don’t understand the steps above then don’t worry. I have included a start.sh [for Linux] and a start.bat [for Windows] files to make your life more easier

To execute the start.sh, type the following in the terminal :-

 

sh start.sh

 

Hash-Algorithm-Identifier Web Service

Hash-Algorithm-Identifier is now on Cloud and provides a web service to use it directly in your apps or so and so. The wrapper for web service is provided asweb.py. The Cloud app service is hosted at http://hashid.badwith.computer/

Usage instructions

./web.py or see --help for more options

 

To use the cloud service send a get (for single hash) or post (for multiple hash) request with the hash appended at the end of the url given above. In case you want the result for multiple hashes then in such cases send the hashes as JSON data.

Javascript

var hash = "3da541559918a808c2402bba5012f6c60b27661c";
 cors_request = new XMLHttpRequest();
 cors_request.onreadystatechange = function() {
 if (cors_request.readyState == 4) {
    console.log(cors_request.responseText);
    }
 }
 cors_request.open("GET", "http://hashid.badwith.computer/" + hash);
 cors_request.send();

Python Sample Example

import requests
hsh = "3da541559918a808c2402bba5012f6c60b27661c"
resp = requests.get("http://hashid.badwith.computer/%s" % hsh)
print(resp.text)

Python Example : Multiple hashes

import json
import requests
hashes = {'hashes': [
 "3da541559918a808c2402bba5012f6c60b27661c",
 "912ec803b2ce49e4a541068d495ab570"
 ]}
resp = requests.post("http://hashid.badwith.computer/", data=json.dumps(hashes))
print(resp.text)

The response is received as JSON data. The Demo usage has been already shown above under the screenshots header..

Thanks to moloch for contributing to the cloud app.

About the Code

As it is evident from the code that I have used regular expressions to identify the hashes. The hashes are being identified because they have certain characteristics and when matched properly they will produce the proper results. Using regular expressions to identify the hash makes the code neat and easy to understand. To understand the regex expressions used in the code, VISIT THIS SITE and paste the Regex Expression in its proper place and thereby you get the explanation. 

Suggestion and feedback are welcome. The tool will be updated with more new features and hashes for identification.

Quick Links

1. Github Project Page : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier
2. Project Wiki : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier/wiki
3. Read Changelog : https://github.com/AnimeshShaw/Hash-Algorithm-Identifier/blob/master/CHANGELOG.md

Thank you,
Sincerely,
Psycho_Coder

Related articles

• 100 Best Open Source Security Tools
• Using Dban to Securely Wipe data from hard disk
• Generate Wordlists in Backtrack 5 R3 using Crunch
• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker
• How To Mount and Unmount a drive on Linux
• How To copy a Very large file to a flash drive in Linux

Continue Reading →

Lightweight Introduction to Cryptography | Terminology, Security Goals and Cryptographic Attacks

Cryptographically secure pseudorandom number generator (Photo credit: Wikipedia)

Hello Everyone ,

Cryptography is a very important topic in this era of communication so I hope that you will understand the importance of this and will be with me for the rest of tutorials .

---

A Note to the Readers :-

Since this is the first tutorial of the series so its more theoretical and I will try to make it interesting but before beginning I have to tell you certain points which should be kept in mind as they will help you throughout the rest of the tutorial . The following you should remember :-

• Read every line carefully and ask yourself what you read .
• Don't skip any parts and read thoroughly .
• Always practice if something is given or explained to you .
• It should be good if you know a little programming or mathematics (Statistics specially) , though I will cover both of them.
• Any Problem regarding my contents then feel free to ask and give suggestions . I am a student too so I might have less experience than many others . For me everyone's suggestion is like a boon .
• This is the most important part . Please try to prove me wrong with whatever I have said (I insist as I can learn a new thing from you .)
  

So now we are good enough to start learning Cryptography ...

---

Terminology

Cryptology

Cryptology is the mathematics, such as number theory, and the application of formulas and algorithms, that underpin cryptography and cryptanalysis. Since the cryptanalysis concepts are highly specialized and complex, we concentrate here only on some of the key mathematical concepts behind cryptography . Cryptology can also be defined as the science of study of, or the use of, methods and procedures for translating and interpreting codes and ciphers; cryptanalysis. Therefore , Cryptology is consists of two parts : a) Cryptography b) Cryptanalysis .

So , in the above definition you came to know about two new terms Cryptography and Cryptanalysis . So what are they , proceed further to know .

Cryptography

Cryptography is a greek word which literally means "secret writing" . Cryptography refers to the art of transforming data and messages to make them secure and immune to attacks .Cryptographycan also be defined as the art of protecting information by transforming it (encrypting it) into an unreadable format, called cipher text. Only those who possess a secret key can decipher (or decrypt) the message into plain text .

Cryptanalysis

Cryptanalysis (from the Greek kryptós, "hidden", and analýein, "to loosen" or "to untie") is the art and science of analyzing information systems in order to study the hidden aspects of the systems . Cryptanalysis is used to breach cryptographic security systems and gain access to the contents of encrypted messages , even if the cryptographic key is unknown .
 

Some More Terms :-

Cipher :- A mapping algorithm that is applied to a fixed number of characters at a time with an intent of concealing the contents of the message.

Code :- A mapping algorithm that is applied to a variable number of characters (according to linguistic entities) at a time with an intent of concealing the contents of the message.

Commercial Code :- A code used in business primarily to reduce cost by shortening messages. It involves no secrecy. The prime example is the 'Philips' Code.

Crib :- A word or phrase that might be expected in the plaintext that can be a "wedge" or test for decryption. More...

Deciphering :- The procedure of turning enciphered text into plain text with prior knowledge of the algorithms or keys involved. This is what the intended message receiver does.

Decryption :- The science of turning enciphered text into plain text without prior knowledge of the algorithms or keys involved. This is what the interceptor or 'cracker' does.

Digraphs :- A plaintext character pairing technique that prevents frequency analysis of commonly occurring pairs such as 'qu'. Note that trigraphs (three characters at a time) is an extension of the theme.

Homophones :- Several replacement letters for the same letter in plaintext

Key :- A word or phrase that modifies the enciphering/deciphering process in such a way that knowledge of the algorithm alone is insufficient to decipher an enciphered message.

Monoalphabets :- A single mapping of plaintext letters to ciphertext letters.

Nomenclature :- Half code and half cipher, it was a list of word/syllable substitutions and cipher alphabet with homophones.

Nulls :- Meaningless letters used to confuse by modifying frequency distributions or predictability. Sometimes used to fill a message to a specific length.

Plaintext :- The original message to be encoded or enciphered

Polyalphabets :- A method where several mappings of plaintext letters to ciphertext letters occur in a message.

Steganography :- The art of concealing a message's existence. One example would be through the use of photographic microdots.

Substitution :- Enciphering by replacing one letter by another.

Transmission Security :- The art of concealing an electrically transmitted message through burst encoding or spread spectrum methods.

Transposition :- Enciphering by shuffling the order of letters.

Purpose Of Cryptography

Cryptography is the science of writing in secret code and is an ancient art; the first documented use of cryptography in writing dates back to circa 1900 B.C. when an Egyptian scribe used non-standard hieroglyphs in an inscription. Some experts argue that cryptography appeared spontaneously sometime after writing was invented, with applications ranging from diplomatic missives to war-time battle plans. It is no surprise, then, that new forms of cryptography came soon after the widespread development of computer communications. In data and telecommunications, cryptography is necessary when communicating over any untrusted medium, which includes just about any network, particularly the Internet.

Cryptography, then, not only protects data from theft or alteration, but can also be used for user authentication. There are, in general, three types of cryptographic schemes typically used to accomplish these goals: secret key (or symmetric) cryptography, public-key (or asymmetric) cryptography, and hash functions, each of which is described below. In all cases, the initial unencrypted data is referred to as plaintext. It is encrypted into ciphertext, which will in turn (usually) be decrypted into usable plaintext. Cryptography is used mainly to achieve the Security Goals and protect them from Cryptographic Attacks . (Discussed below about the Security goals .)

Security Goals

Within the context of any application-to-application communication, there are some specific security requirements, including:

Authentication : The process of proving one's identity. (The primary forms of host-to-host authentication on the Internet today are name-based or address-based, both of which are notoriously weak.)

Privacy/confidentiality : Keeping information secret from all, but those who are authorized to see it. Confidentially is the protection of transmitted data from passive attacks. With respect to the content of data transmission, several levels of protection can be identified . The aspect of Confidentially is the protection of traffic flow from analysis . This requires that an attacker not be able to observe to source and destination, frequency, length or any other characteristics of the traffic on a communication facility .

Integrity : Ensuring the information has not been altered by unauthorized or unknown means. One must have the ability to detect data manipulation by unauthorized parties. Data manipulation includes such things as insertion, deletion, and substitution

Non-repudiation : Non-repudiation prevents either sender or receiver from denying a message. Thus, when a message is sent, the receiver can prove that the message was in fact send by the alleged sender. Similarly, when a message is received, the sender can prove the alleged receiver in fact received that message.

Types Of Cryptography Algorithms

There are several ways of classifying cryptographic algorithms. But in general they are classified into three catagories :-

1. Secret Key Cryptography (SKC)
2. Public Key Cryptography (PKC)
3. Hash Functions
   

Secret Key Cryptography

Symmetric-key algorithms are a class of algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext. The keys may be identical or there may be a simple transformation to go between the two keys. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link. ex. DES , AES .

Secret key cryptography schemes are generally categorized as being either stream ciphers or block ciphers.

1. Stream ciphers:It operate on a single bit (byte or computer word) at a time and implement some form of feedback mechanism so that the key is constantly changing.

2. Block cipher :It is so-called because the scheme encrypts one block of data at a time using the same key on each block . In general, the same plaintext block will always encrypt to the same ciphertext when using the same key in a block cipher whereas the same plaintext will encrypt to different ciphertext in a stream cipher .

Public Key Cryptography

Public-key cryptography refers to a cryptographic system requiring two separate keys, one of which is secret and one of which is public. Although different, the two parts of the key pair are mathematically linked. One key locks or encrypts the plaintext, and the other unlocks or decrypts the ciphertext. Neither key can perform both functions by itself . The public key may be published without compromising security, while the private key must not be revealed to anyone not authorized to read the messages.

Public-key cryptography is widely used . It is an approach used by many cryptographic algorithms and cryptosystems . It underpins such Internet standards as Transport Layer Security (TLS), PGP, and GPG . There are three primary kinds of public key systems: public key distribution systems, digital signature systems, and public key cryptosystems, which can perform both public key distribution and digital signature services .

Hash Functions

This technique does not involve any key. Rather it uses a fixed length hash value that is computed on the basis of the plain text message. Hash functions are used to check the integrity of the message to ensure that the message has not be altered,compromised or affected by virus.

So we see that how different types of cryptography techniques (described above) are used to implement the basic principles that we discussed earlier. In the future article of this series, we’ll cover more advanced topics on Cryptography.


Cryptographic Attacks

Cryptographic Attacks can be broadly classified into two types :-

1. Cryptanalytic Attacks
2. Non-Cryptanalytic Attacks

Cryptanalytic Attacks

Cryptanalytic Attacks are a combination of statistical and algebraic techniques aimed at ascertaining the secret key of a cipher . These methods inspect the mathematical properties of the cryptographic algorithms and aims at finding distinguishers of the output distribution of cryptographic algorithms from uniform distributions . The objective of cryptanalysis is to findthe properties of the cipher which does not exists in a random function . That is what we mean by "distinguishers" , and all attacks are fundamentally distinguishers .

Non-Cryptanalytic Attacks

The type of attacks that do not exploit the mathematical weakness of the cryptographic algorithms fall under this section . The threats to Security goals can be from three threats they are as follows :-

1. Threats To Confidentiality .
2. Threats To Integrity .
3. Threats to Availability .

The image below will make it clear .

References

1. Wikipedia.
2. Cryptography and Network Security by Behrouz A. Forouzan
3. http://www.garykessler.net/

Thank you and I hope you enjoyed this tutorial. Please share this blog post.

Related articles

• Generate Wordlists in Backtrack 5 R3 using Crunch
• 80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker

Continue Reading →

80+ Best Free Hacking Tutorials | Resources to Become Pro Hacker

Note: I have not written this article and I take no credit for the gathering of links or Resources. The original post was posted here and I am just sharing that post in this blog.

---

Learning to become hacker is not as easy as learning to become a software developer. I realized this when I started looking for learning resources for simple hacking people do. Even to start doing the simplest hack on own, a hacker requires to have in depth knowledge of multiple topics. Some people recommend minimum knowledge of few programming languages like C, Python, HTML with Unix operating system concepts and networking knowledge is required to start learning hacking techniques.

Though knowing a lot of things is required, it is not really enough for you to be a competent and successful hacker. You must have a passion and positive attitude towards problem solving. The security softwares are constantly evolving and therefore you must keep learning new things with a really fast pace.

If you are thinking about ethical hacking as a career option, you may need to be prepared for a lot of hard/smart work. I hope these free resources will help you speed up on your learning. If you decide you pursue ethical hacking as a career option, you may also want to read some in depth ethical hacking books.

A lot of people (including me before doing research for this article) think that they can become a hacker using some free hacking tools available on web. Its true that some common types of hacking can be easily done with help of tools, however doing it does not really make you a hacker. A true hacker is the one who can find a vulnerability and develop a tool to exploit and/or demonstrate it.

Hacking is not only about knowing "how things work", but its about knowing "why things work that way" and "how can we challenge it".

Below are some really useful hacking tutorials and resources you may want to explore in your journey of learning to hack

Hacking For Dummies - Beginners Tutorials

These tutorials are not really simple for anyone who is just starting to learn hacking techniques. However, these should be simple starting point for you. I am sure you have different opinion about complexity of each tutorial however advanced hacker are going to be calling this a job of script kiddie (beginner hacker). Even to acquire the skills of a script kiddie you need to have good understanding of computer fundamentals and programming.

1. Cybrary - For those looking to learn ethical hacking skills online, Cybrary provides the perfect platform to do so. Cybrary is a free online IT and cyber security training network that provides instruction in the form of self-paced, easy-to-follow videos. Featuring courses on topics such as Penetration Testing and Ethical Hacking, Advanced Penetration Testing, Post Exploitation Hacking and Computer and Hacking Forensics, Cybrary provides instruction from the beginner to the highly-advanced level of hacking. Additionally, Cybrary offers supplemental study material along with their courses free of charge. With their in-depth training videos and study guides, Cybrary ensures that users develop the best hacking skills.
2. Hacking Tutorials for Beginners - By BreakTheSecurity.com
3. How to learn Ethical hacking - By Astalavista.com
4. Penetration Testing Tutorial - By Guru99.com
5. Backtrack Penetration Testing Tutorial
6. Introduction to Penetration Testing
7. Information Gathering with Nmap
8. Simple How To Articles By Open Web Application Security
9. The Six Dumbest Ideas in Computer Security
10. Secure Design Principles
11. 10 steps to secure software

Cryptography Related Tutorials

Cryptography is must know topic for any aspiring security professional or a ethical hacker. You must understand how encryption and decryption is done. You must understand why some of the old encryption techniques do not work in modern computing world.

This is a important area and a lot of software programmers and professional do not understand it very well. Learning cryptography involves a lot of good understanding of mathematics, this means you also need to have good fundamentals on discrete mathematics.

1. Introduction to Public Key Cryptography
2. Crypto Tutorial
3. Introduction to Cryptography
4. An Overview of Cryptography
5. Cryptography Tutorials - Herong's Tutorial Examples
6. The Crypto Tutorial - Learn How to Keep Secret Secret
7. Introduction to cryptology, Part 1: Basic Cryptology Concepts

Websites For Security Related Articles And News

These are some websites, that you may find useful to find hacking related resources and articles. A lot of simple tricks and tips are available for experimenting through these sites for improving yourself to become advanced hacker.

In recent years, many people are aspiring to learn how to hack. With growing interest in this area, a lot of different types of hacking practices are evolving. With popularity of social networks many people have inclined towards vulnerability in various social networks like facebook, twitter, and myspace etc.

Continuous learning about latest security issues, news and vulnerability reports are really important for any hacker or a security professional. Some of the sites that keep publishing informative articles and news are listed here.

1. http://www.astalavista.com/
2. http://packetstormsecurity.com/
3. http://www.blackhat.com/
4. http://www.metasploit.com/
5. http://sectools.org/
6. http://www.2600.com/
7. DEF CON - Hacking conference
8. http://www.breakthesecurity.com/
9. http://www.hacking-tutorial.com/
10. http://www.evilzone.org/
11. http://hackaday.com/
12. http://www.hitb.org/
13. http://www.hackthissite.org/
14. http://pentestmag.com
15. http://www.securitytube.net/
16. https://www.ssllabs.com/

EBooks And Whitepapers

Some of the research papers by security experts and gurus can provide you a lot of information and inspiration. White papers can be really difficult to read and understand therefore you may need to read them multiple times. Once you understand the topic well, reading will become much faster and you will be able to skim through a lot content in less time.

1. Handbook of Applied Cryptography - This ebook contains some free chapter from one of the popular cryptography books. The full book is also available on amazon at Cryptography Book.
2. Network Penetration testing Guide
3. How to hack anything in Java
4. Mcafee on iPhone and iPad Security
5. A Good Collection of White papers on security and vulnerabilities - This site contains collection of white papers from different sources and some of these white papers are really worth referring.
6. Engineering Principles for Information Technology Security
7. Basic Principles Of Information Protection
8. Open Web Application Security Project - OWASP is one of the most popular sites that contains web application security related information .

Videos & Play Lists

Those who like to watch video tutorials, here are few I liked. However there are many small video available on youtube. Feel free to explore more and share with us if you like something.

1. Cryptography Course By Dan Boneh Stanford University
2. Open Security Training- Youtube Playlist of More than 90 hours. I have found this to be the biggest free training available for security related topic.
3. OWASP AppSec USA 2011: Youtube Playlist containing compilation of OWASP conference highlight in 2011.
4. Defcon: How I Met your Girlfriend - Defcon is one of the most popular hacker conference. The presenters in this conference are well know inside the hacking industry.
5. Defcon: What happens when you steal a hackers computer
6. Defcon: Nmap: Scanning the Internet
7. Public Key Cryptography: Diffie-Hellman Key Exchange
8. Web application Pen testing
9. Intro to Scanning Nmap, Hping, Amap, TCPDump, Metasploit

Forums For Hackers And Security Professionals

Just like any other area, forums are really great help for learning from other experts. Hundreds of security experts and ethical/non-ethical hackers are willing to share their knowledge on forums for some reason. Please keep in mind to do enough research before post a question and be polite to people who take time to answer your question.

1. Stackoverflow for security professionals
2. http://darksat.x47.net/
3. http://forums.securityinfowatch.com/
4. http://forums.cnet.com/spyware-viruses-security-forum/
5. http://www.hackforums.net/forumdisplay.php?fid=47

Vulnerability Databases And Resources

Vulnerability Databases are the first place to start your day as a security professional. Any new vulnerability detection is generally available through the public vulnerability databases. These databases are a big source of information for hackers to be able to understand and exploit/avoid/fix the vulnerability.

1. http://www.exploit-db.com/
2. http://1337day.com/
3. http://securityvulns.com/
4. http://www.securityfocus.com/
5. http://www.osvdb.org/
6. http://www.securiteam.com/
7. http://secunia.com/advisories/
8. http://insecure.org/sploits_all.html
9. http://zerodayinitiative.com/advisories/published/
10. http://nmrc.org/pub/index.html
11. http://web.nvd.nist.gov
12. http://www.vupen.com/english/security-advisories/
13. http://www.vupen.com/blog/
14. http://cvedetails.com/
15. http://www.rapid7.com/vulndb/index.jsp
16. http://oval.mitre.org/

Product Specific Vulnerability Information

Some of the very popular products in the world require a special attention and therefore you may want to look at the specific security websites directly from vendors. I have kept Linux. Microsoft and apache in this list, however it may apply to any product you may be heavily using.

1. Red Hat Security and other updates Site
2. Microsoft Products Security Bulletin
3. Apache Foundation Products Security Repository
4. Ubunut Software Security Center
5. Linux Security Repository

Tools And Programs For Hacking / Security

There are dozens of tools available for doing different types of hacking and tests. Tools are really important to become more productive at your work. Some of the very common tools that are used by hackers are listed here. You may have different choice of tools based on your own comfort.

1. nmap
2. NSS
3. Hping
4. TCPDump
5. Metasploit
6. Wireshark
7. Network Stuff
8. Nikto

Summary

I have tried to compile some of these resources for my own reference for the journey of learning I am going to start. I am not even at a beginner level of becoming hacker but the knowledge of this field really fascinates me and keeps me motivated for learning more and more. I hope will be able to become successful in this.

A lot of people use their knowledge skills for breaking stuff and stealing. I personally think that doing harm to someone is a weak choice and will not have a good ending. I would recommend not to use your skills for any un-ethical endeavor. A single misuse of your skill may jeopardize your career since most companies do a strict third party background check before they hire a ethical hacker or a security personal.

There are dozens of companies looking for ethical hackers and security professionals. There are really good number of opportunities in this area and its really niche compensation segment. You will be easily able to get a decent job without even acquiring all the expert level skills to become a pro hacker.

Continue Reading →

Generate Wordlists in Backtrack 5 R3 using Crunch

 

In this post I will discuss How to generate wordlists in Backtrack 5 R3 using Crunch. Though this video was made long ago but the procedure is same for the latest version of backtrack which is known as Kali Linux now. Watch the Video and I hope that you will find this useful.

Okay! Here's a bit of Explanation :-

Crunch is a tool that is pre-installed with backtrack. It is a very usefull tool  that helps you to generate wordlists for bruteforcing, according to your need. So, How we do it?

Follow the steps below :-

Step 1:

 
Open Backtrack terminal and write the following:-

cd /pentest/passwords/crunch

Now to use crunch we will first move to the folder above.

Step 2:
 

Write in the terminal :-

./crunch 7 7 acbd143 -t EHF@@@@ -o EHFlist.lst

Step 3:
 

Enter in the above will give you the message that the wordlist has been created (when 100% is written on the terminal screen)

Step 4:
 

Navigate to the /pentest/passwords/crunch folder and you will find the file EHFlist.lst, rename this to EHF.txt and open it and you will see the resultant words of Step 2

Explanation:-

"7 7 acbd143" - this means that the password length will be 7 charecters and it will contain the charecters a,c,b,d,1,4,3

"EHF@@@@" - It means that the passwords will contain the first three charecters same that is EHF, and the rest of the charecters @@@@ will be repeated with the charecters "a,c,b,d,1,4,3"
This will generate the while of the list.

So , using crunch you have a lot better flexibility and you have the option to make it the way you want

Watch the Video for more Clear Description 

 

Continue Reading →

Links to Practise and Sharpen your CTF Skills

 

Practice CTF List / Permanant CTF List

 

Here's a list of some CTF practice sites and tools or CTFs that are long-running.

Whether they're being updated, contain high quality challenges, or just have a lot of depth, these are probably where you want to spend the most time.

   http://hax.tor.hu/
   https://pwn0.com/
   http://www.smashthestack.org/
   http://ringzer0team.com/
   http://www.hellboundhackers.org/
   http://www.overthewire.org/wargames/
   http://counterhack.net/Counter_Hack/Challenges.html
   http://www.hackthissite.org/
   http://exploit-exercises.com/
   http://vulnhub.com/

Others

   http://damo.clanteam.com/
   http://p6drad-teel.net/~windo/wargame/
   http://roothack.org/
   http://bright-shadows.net/
   http://www.mod-x.co.uk/main.php
   http://scanme.nmap.org/
   http://www.hackertest.net/
   http://net-force.nl/
   http://securityoverride.org/ 

 

Some good concepts, but "canned" vulnerabilities (string matching on input) will frustrate knowledgeable hackers and teach newbies the wrong lessons

Meta

   http://www.wechall.net/sites.php (excellent list of challenge sites)
   http://ctf.forgottensec.com/wiki/ (good CTF wiki, though focused on CCDC)
   http://repo.shell-storm.org/CTF/ (great archive of recent CTFs)

Webapp Specific

   http://demo.testfire.net/
   http://wocares.com/xsstester.php
   http://crackme.cenzic.com/
   http://test.acunetix.com/
   http://zero.webappsecurity.com/
   http://ha.ckers.org/challenge/
   http://ha.ckers.org/challenge2/

Forensics Specific

   http://computer-forensics.sans.org/community/challenges
   http://www.dc3.mil/challenge/
   http://forensicscontest.com/

Recruiting

   http://rtncyberjobs.com/
   http://0x41414141.com/

Paid Training

   http://heorot.net/

Downloadable Offline Games

   http://www.badstore.net/
   http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
   http://www.owasp.org/index.php/Owasp_SiteGenerator
   Damn Vulnerable Web App
   Stanford SecureBench
   Stanford SecureBench Micro
   Damn Vulnerable Linux (not currently live? local mirror)
  

http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10


This Info was taken from here : http://captf.com/practice-ctf/

Continue Reading →

The Hackers Manifesto - Conscience of a Hacker

The Conscience of a Hacker
By
+++The Mentor+++

Written on January 8, 1986
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

       Another one got caught today, it's all over the papers.  "Teenager
Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...
       Damn kids.  They're all alike.

       But did you, in your three-piece psychology and 1950's technobrain,
ever take a look behind the eyes of the hacker?  Did you ever wonder what
made him tick, what forces shaped him, what may have molded him?
       I am a hacker, enter my world...
       Mine is a world that begins with school... I'm smarter than most of
the other kids, this crap they teach us bores me...
       Damn underachiever.  They're all alike.

       I'm in junior high or high school.  I've listened to teachers explain
for the fifteenth time how to reduce a fraction.  I understand it.  "No, Ms.
Smith, I didn't show my work.  I did it in my head..."
       Damn kid.  Probably copied it.  They're all alike.

       I made a discovery today.  I found a computer.  Wait a second, this is
cool.  It does what I want it to.  If it makes a mistake, it's because I
screwed it up.  Not because it doesn't like me...
               Or feels threatened by me...
               Or thinks I'm a smart ass...
               Or doesn't like teaching and shouldn't be here...
       Damn kid.  All he does is play games.  They're all alike.

       And then it happened... a door opened to a world... rushing through
the phone line like heroin through an addict's veins, an electronic pulse is
sent out, a refuge from the day-to-day incompetencies is sought... a board is
found.
       "This is it... this is where I belong..."
       I know everyone here... even if I've never met them, never talked to
them, may never hear from them again... I know you all...
       Damn kid.  Tying up the phone line again.  They're all alike...

       You bet your ass we're all alike... we've been spoon-fed baby food at
school when we hungered for steak... the bits of meat that you did let slip
through were pre-chewed and tasteless.  We've been dominated by sadists, or
ignored by the apathetic.  The few that had something to teach found us will-
ing pupils, but those few are like drops of water in the desert.

       This is our world now... the world of the electron and the switch, the
beauty of the baud.  We make use of a service already existing without paying
for what could be dirt-cheap if it wasn't run by profiteering gluttons, and
you call us criminals.  We explore... and you call us criminals.  We seek
after knowledge... and you call us criminals.  We exist without skin color,
without nationality, without religious bias... and you call us criminals.
You build atomic bombs, you wage wars, you murder, cheat, and lie to us
and try to make us believe it's for our own good, yet we're the criminals.

       Yes, I am a criminal.  My crime is that of curiosity.  My crime is
that of judging people by what they say and think, not what they look like.
My crime is that of outsmarting you, something that you will never forgive me
for.

       I am a hacker, and this is my manifesto.  You may stop this individual,
but you can't stop us all... after all, we're all alike.

+++The Mentor+++

Continue Reading →