We all Just Luv Google.. Now dun we, kids?

WOW! Seems that Google isn't for safe-only nerds after all... Oh now, don't get so hasty... :D

I'm compiling up this site-hacking using Google syntax list... Just gonna spice things up over here first ;). Here you go :D.

Now, be kind and tell me how easy it was defacing some MySqLs :P.
Hacks are hacks, to hack a hack is hacking, but hacking isn't to hack :D . I-Hack - Computers and Technology Weblog

I Want a Freakin LinuX!

This just can't be.. I'm supposed to be a hacker, but I have a MS.. That's BS IMO. I have to do something about this.. *Depressed*.. *Too much distributions to choose from* :D//

Hacks are hacks, to hack a hack is hacking, but hacking isn't to hack :D . I-Hack - Computers and Technology Weblog

A Word about Adwares

Hiya!

Thought long b4 I make a post today, settled with adwares. An adware is a program that usually executes on startup which reacts to an event or on a certain time to show you an advertisement or just pop something up that would also be for advertising purposes.

Some examples of adwares would be, showing an affiliate page on 12 o'clock, open up an advertising page on an internet explorer click and another example which I really like the idea of is show a page as the #1 result in major search engines, which BTW, I was infected with :D.

Anyhow, this post isn't to only examine adwares but also improve their quality. Ok, seriously, I won't ever click an ad which just keeps showing up..!! So, what I want to, by this post, think of some new ways to embed ads and show them in a way where the user could hardly notice this is an evil work of an adware.

The first idea I got is related to the mIRC IRC client. Most of the world's programmers practicaly live on it. What I thought is to make an adware that will make it seem that this is just a link from a member on the irc channel.

The second idea I got is making a [searchengine] result clone, printing out your site as the first, highlighting the keywords that were used in the search query, in the title all the serach query, in the desc. make some kindof sentence.

The third idea is about the instant messaging clients. An adware could print a message-like string which has something like "yo dude try this link out" formatted with a contact's name and a messenger-like format.

There are lots more, just keepin them for later blog entries :D . My last words; think smarter not harder, making an adware that pops an ad every damn 30 seconds won't be of any help, I look for the fastest way to delete it, not click it out ;) . Be creative..!! :D



Hacks are hacks, to hack a hack is hacking, but hacking isn't to hack :D . I-Hack - Computers and Technology Weblog

Having Fun With Pinball **Coded in ASM**

Hi,

This is the 3rd blog entry today, the more the better :D. Pinball has always been, between some of my family "members" and I, as a competition. "Yay! I just whooped your ass!", my sis would usually say :D . But not for long...

Basically, what I'm talkin about right now, is memory editing on a shallow level. So, ::i sigh:: and start hacking :D .

The computer's memory, or Windows' altleast is divided into addresses, each address is assigned a unique value. So, what we'll be doing is trying to edit the value of these addresses. I'll divide this process into steps. In the first step, we get, didn't say try as I won't take a no for an answer, the pinball's window handle using the FindWindow() API function. In this API function, the first parameter is the window's class and the second is the window's title. Only putting one is nec. the other can be NULL. I'll use the window title, it's easier to get :D. '3D Pinball for Windows - Space Cadet'. [That's the title:D].

Now, that we have pinball's window handle, we'll use GetWindowThreadProcessId() to get the process id of pinball. It takes the window's handle as the first parameter and the second one as a pointer to a variable that will store the process Id.

Next, we need to get access to Pinball's process so we can edit it's memory. OpenProcess() does that for us. In the first parameter, we put in the type of access we need. I'm too lazy, so I'll just put in PROCESS_ALL_ACCESS, granting us every damn hacking provilege we need. In the 2nd parameter just put false :P , and in the the third, we put in pinball's process ID we got using GetWindowThreadProcessId(). OpenProcess() returns a handle to the process, this handle can make us do anything at this point.

To do the actual editing, we use WriteProcessMemory() . The first parameter of WriteProcessMemory() should have the pinball's process handle we got from OpenProcess(). In the second parameter we put in the memory address we want to edit. For the mean time I'm not gonna go in how I'm gonna get the specific address that pinball's score is stored in. In the 3rd parameter we put in a pointer to a variable that has the new value. The 4th parameter is the number of bytes to write and the forth is just NULL in my world :D .

Overall, here is the hack's code, in ASM.

.586
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\user32.inc
includelib \masm32\lib\user32.lib ; calls to functions in user32.lib and kernel32.lib
include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib

.data

windowname db '3D Pinball for Windows - Space Cadet',0
addy db '007ACB72',0
value db '5555555',0

.data?

pid dd ?


.code
start:
Invoke FindWindow,0,addr windowname

Invoke GetWindowThreadProcessId,eax,addr pid

Invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,pid

Invoke WriteProcessMemory,eax,007ACB72h,addr value,8,NULL

Invoke ExitProcess,0


end start

That's all. This is supposed to give an xtra boost to your pinball score :D. Have fun! I know I will..


Hacks are hacks, to hack a hack is hacking, but hacking isn't to hack :D .
I-Hack - Computers and Technology Weblog

Run a Program On Windows Startup

Hiiiii,
Aaah at last I figured it out. Been tryin forever now :D. 2 days ago I was working on this buggy program that I wanted to run on startup. Ugh! I thought I'd just ask Google and it'll hand it over, but for some reason it didn't. So I had to go on and dig it up by myself. In an hour, all what I concluded was that it was a registry-related matter, which I kinda knew : . So, just I just ran my regedit, and again, dugg up the answers I wanted. First of all, I took a look at a program that executes with the Windows Startup, the so damnly buggy Windows Messenger, not Windows LIVE Messenger, I'm talking about that old, life disasturous messenger :D. Anyways, so I searched for msmsgs.exe and after something like 99 Ctrl+F3 (Next result..) I found it..Ugh at last...!!Why was it so hard to find..??
Anyways to make a program run on startup add a String Value to this Registrey addy:
"My Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
For the name value in the String, dunno, just add the name of th exe, BUT in the Data value I'm positive you have to add your excutable's path. Quotes aren't nec.
Congrats, you just figured out how to hack your registries to make a program run on startup. Just imagine if that was a virus, spyware, adware or malware :D. That's a suggestion ;) :p , Just dun send it to me, eh!!

I-Hack - Computers and Technology Weblog

Sending E-mails Using Telnet

Hi,

Just took a look at my e-mail and damn is it spammed! Where do all these people get e-mails from??! So, this inspired me to give you an idea of how to send e-mails using telnet, witht the SMTP protocol.

First of all I hope you know what telnet is, BTW: I'm talking about Windows telnet :D . If you don't, I'll tell you why we need it now. It is as [protocol here] client. You just open it, connect to a site or IP, define the port and just send messages by yourself and see the responses. There will be a special blog entry for telnet, so don't worry if you son't get it yet.

Now to the real part. First of all, you need to have an SMTP server that allows you to send e-mails.
So here we go, open up run and put this in "telnet yoursmtpserver 25".

You'll get a response similar to "220 yoursmtpserver ESMTP Postfix".
Now put in "HELO yoursmtpserver"[ENTER] <--Identify who you are You should get a "250 HELLO yoursmtpserver" Now put in "MAIL FROM:[youremail]"[ENTER] <--The from part :D You should get something similar to "250 OK" Now type "RCPT TO:[recieveremail]" <--The to part =D Another "25o ok" Here comes the whole message part. Type in "DATA" response: "354 End data with ."
Here is the message part, remember when you want t end the email use [enter].[enter] ;).
Type in
"Subject: [subject] [enter]
From: [sender][enter]
To: [rcpt][enter]
[enter]
Here relies the e-mail's text :D. I like to hack and I G2g GooooooD Bye![enter]
[enter].[enter]"
response:"250 Ok: queued as [number]"
then type "QUIT"[enter]
response: "221 Bye"

That's it. You just sent an e-mail using telnet! Cool,maybe, hard, naa.


I-Hack - Computers and Technology Weblog

Brute Forcing: Strings making Visual Basic Example

Hi,

I just re-read by previous blog entry and could honestly say it kinda of makes no sense. So, I thought I'd write a simple code snippet to give you a small look at what it might look like. Because of my no time to spare status and not really into coding heavily at this sole moment I had to write it in VisualBasic. But plz know I would never endorse using it =) .

Long story cut short here's the code **This snippet suposedly open a passwords.lst in passwords directory and writes in 30000000 strings into a file. Each string has 10 characters. These strings only have numerical and alphabetical characters. BTW: 30000000 is actually nothing for a 10 characters string**::

Open "D:\passwords\passwords.lst" For Binary As #1
Dim int1, int2, int3, int4, int5, int6, int7, int8, int9, int0 As Integer
Dim all As String
Dim chars(62) As Variant
chars(0) = Chr(48)
chars(1) = Chr(49)
chars(2) = Chr(50)
chars(3) = Chr(51)
chars(4) = Chr(52)
chars(5) = Chr(53)
chars(6) = Chr(54)
chars(7) = Chr(55)
chars(8) = Chr(56)
chars(9) = Chr(57)
chars(10) = Chr(65)
chars(11) = Chr(66)
chars(12) = Chr(67)
chars(13) = Chr(68)
chars(14) = Chr(69)
chars(15) = Chr(70)
chars(16) = Chr(71)
chars(17) = Chr(72)
chars(18) = Chr(73)
chars(19) = Chr(74)
chars(20) = Chr(75)
chars(21) = Chr(76)
chars(22) = Chr(77)
chars(23) = Chr(78)
chars(24) = Chr(79)
chars(25) = Chr(80)
chars(26) = Chr(81)
chars(27) = Chr(82)
chars(28) = Chr(83)
chars(29) = Chr(84)
chars(30) = Chr(85)
chars(31) = Chr(86)
chars(32) = Chr(87)
chars(33) = Chr(88)
chars(34) = Chr(89)
chars(35) = Chr(90)
chars(36) = Chr(97)
chars(37) = Chr(98)
chars(38) = Chr(99)
chars(39) = Chr(100)
chars(40) = Chr(101)
chars(41) = Chr(102)
chars(42) = Chr(103)
chars(43) = Chr(104)
chars(44) = Chr(105)
chars(45) = Chr(106)
chars(46) = Chr(107)
chars(47) = Chr(108)
chars(48) = Chr(109)
chars(49) = Chr(110)
chars(50) = Chr(111)
chars(51) = Chr(112)
chars(52) = Chr(113)
chars(53) = Chr(114)
chars(54) = Chr(115)
chars(55) = Chr(116)
chars(56) = Chr(117)
chars(57) = Chr(118)
chars(58) = Chr(119)
chars(59) = Chr(120)
chars(60) = Chr(121)
chars(61) = Chr(122)
Do While i < 30000000

int0 = Int((62) * Rnd + 0)
int1 = Int((62) * Rnd + 0)
int2 = Int((62) * Rnd + 0)
int3 = Int((62) * Rnd + 0)
int4 = Int((62) * Rnd + 0)
int5 = Int((62) * Rnd + 0)
int6 = Int((62) * Rnd + 0)
int7 = Int((62) * Rnd + 0)
int8 = Int((62) * Rnd + 0)
int9 = Int((62) * Rnd + 0)
all = chars(int1) & chars(int2) & chars(int3) & chars(int4) & chars(int5) & chars(int6) & chars(int7) & chars(int8) & chars(int9) & chars(int0) & vbCrLf
Put #1, , all
i = i + 1
Loop

This is it, just put it in any event and u'll get a rainbow file maker ;) . Cheers..!!

Brute Forcing: The HOW TO(make the strings)

Hi,

In the last blog entry, or something like that, I talked about what u have to make sure of b4 u start brute forcing a string or password off. Mainly, I mentioned speed, efficiency and stealth. BTW: I'm open for suggestions =D . Anyways, after all this talk, u'r probably wondering "When the hell is this idiot gonna tell me how to brute force". Too bad, I won't as I too am still learning and just mentioning what I know. BUT I am gonna mention the way I'll brute force if I need to. Ima put em into steps for ya guys:

(In Code):

1. Make a single dimentioned array with all the VALID characters that can be used in the string or password you're brute forcing for. I'd use the chr() function if I were you :P .(Efficiency).
2. Make a loop. This loop should loop the exact number of possiblities possible for the string to be. (Efficieny and speed too).
3. Listen up, this is the important part. In the loop you'll have to make an attempt for an x number of random numbers where x is the number of characters allowed in the string. "Blog" has 4 characters and so on. These random numbers should have a minimum number of 0 (the array's first entry) and a maximum number of i where i is the number of entries in the blog :D .
4. Assign each random number to a variable.
5. Then use these variables to make a string, in PHP, i'd make the string like this:
   "$string="thearray[rndvar]"."thearray[2rndvar]";" and so on.

By these steps I dearly hope you understood anything, heck! I know I did :D . Right now, your supposed to get a picture of how to make the strings to brute force. Still didn't make up my mind about what the next blog entry should be about, argh just gonna have to figure that out later ;) . Cheers! .

Things To make sure of, b4 u start to Brute Force!

Hiya,

Back today to mind storm about the things that have to link up altogether so you can accomp. a powerful brute force attack =) . Among these things, these things stand-out in ma mind:

• Speed: Brute Forcing usually means trying MILLIONS of strings up upon one string to check if you found what you're looking. These MILLIONS can add up to make you sit on your computer for years :D . So you have to make sure you're using fast protocls(internet), use the best performing language to code your brute forcer.
  
  
• Efficiency: As I've already said, Brute Forcing is alot of work. So, you have to cut short anything that can get cut short. In brute forcing, what you do is try a chain of characters and check if it's correct. Now, to make your code efficient, you have to make sure you're not trying extra characters for example and not waiting for extra responses to be recieed which aren't really nec.
  
  
• Stealth: To Brute Force, you're usually gonna be sending hundreds, heck, millions of messages to web servers. These messages are usually logged by security softwares. These logs can find everything about you as they log in your IP address.Using it, they can find out where you live, what your name is. Now, there are many things you can do about that. You can use a snooped IP address or you can just use a computer in an internet cafe =D .

That's all for now. G2G . Hope you liked this blog entry. Next topic in this series will be "Brute Forcing: The technique".

.:A Word About Brute Forcing:. *Just a cheesy intro*

You have probably heard about brute forcing before, wether you're a hacker, cracker, web master or just read the news papers. Heck! I'm positive you have an idea about what the hell I'm talkin about. According to Wikipedia brute forcing is a trivial but very general problem-solving technique, that consists of systematically enumerating all possible candidates for the solution and checking whether each candidate satisfies the problem's statement. In the last past years, brute forcing has been given a bad reputation. It was more of a loser's way to find out a password, but it never worked and he was always tracked down using logs.
Well, in most occasions that's true =p . But this isn't always true.

In general, for those that aren't familiar with brute forcing, is to try all possibilities of a string with X number of characters untill you track down the correct string you need. For example, let's say I have a password made of 5 integers *0-9*. So basically i'll need to try out the strings "00000" to "99999". There is no chance I can't track down the string/password I wanted using this way. Later in my blog entries, I'll show you how to brute force in an 3133t3 manner so that you can never get tracked down. I know this blog entry isn't anything big but I just needed to clear things out before I start the Brute Forcing serial.

PS: Not all the upcoming posts will necc. be parts of the Brute Forcing serial ;) .