HOW SECURE YOUR SOCKET

STORY BEHIND HTTPS

Secure Sockets Layer (SSL) is the most widely used technology for providing a secure communication between the web client and the web server. Most of us are familiar with many sites such as Gmail, Yahoo etc. using https protocol in their login pages. When we see this, we may wonder what’s the difference between http and https. In simple words HTTP protocol is used for standard communication between the Web server and the client. HTTPS is used for a SECURE communication.

What exactly is Secure Communication ?

Suppose there exists two communication parties A (client) and B (server).

Working of HTTP

When A sends a message to B, the message is sent as a plain text in an unencrypted manner. This is acceptable in normal situations where the messages exchanged are not confidential. But imagine a situation where A sends a PASSWORD to B. In this case, the password is also sent as a plain text. This has a serious security problem because, if an intruder (hacker) can gain unauthorised access to the ongoing communication between Aand B , he can see the PASSWORDS since they remain unencrypted. This scenario is illustrated using the following figure

Now lets see the working of HTTPS

When A sends a PASSWORD (say “mypass“) to B, the message is sent in an encrypted format. The encrypted message is decrypted on B‘s side. So even if the Hacker gains an unauthorised access to the ongoing communication between A and B he gets only the encrypted password (“xz54p6kd“) and not the original password. This is shown below

How is HTTPS implemented ?

HTTPS is implemented using Secure Sockets Layer (SSL). A website can implement HTTPS by purchasing an SSL Certificate. Secure Sockets Layer (SSL) technology protects a Web site and makes it easy for the Web site visitors to trust it. It has the following uses

1. An SSL Certificate enables encryption of sensitive information during online transactions.
2. Each SSL Certificate contains unique, authenticated information about the certificate owner.
3. A Certificate Authority verifies the identity of the certificate owner when it is issued.

How Encryption Works ?

Each SSL Certificate consists of a Public key and a Private key. The public key is used to encrypt the information and the private key is used to decrypt it. When your browser connects to a secure domain, the server sends a Public key to the browser to perform the encryption. The public key is made available to every one but the private key(used for decryption) is kept secret. So during a secure communication, the browser encrypts the message using the public key and sends it to the server. The message is decrypted on the server side using the Private key(Secret key).

How to identify a Secure Connection ?
In Internet Explorer, you will see a lock icon   in the Security Status bar. The Security Status bar is located on the right side of the Address bar. You can click the lock to view the identity of the website.

In high-security browsers, the authenticated organization name is prominently displayed and the address bar turns GREEN when an Extended Validation SSL Certificate is detected. If the information does not match or the certificate has expired, the browser displays an error message or warning and the status bar may turn RED.

So the bottom line is, whenever you perform an online transaction such as Credit card payment, Bank login or Email login always ensure that you have a secure communication. A secure communication is a must in these situations. Otherwise there are chances of Phishing using a Fake login Page.

I Hope this helps. Please pass your comments.

GAIN ACCESS TO UNPROTECTED WEBCAMS

HACK UNPROTECTED  WEBCAMS




In this article I will show you how to use a simple google Dork to access unprotected webcams online.There are thousands of unprotected webcams available online, Since many Webcams use known protocols to transmit live vedio streams over the web, it's often very easy to search for publicly accessible webcams



1.First of all open your internet browser and visit Google.com

2.Search on Google for the following Keyword "inurl:/view.index.shtml"



3. Next Choose a webcam and Enjoy

FACEBOOK USERS BEWARE!

Facebook invasion 

 

Think giving out basic personal information on Facebook is harmless? You might need to rethink, as a reformed burglar has given details on how a criminal can use your user account as a tool for committing a crime. "The information people give out on Facebook, when linked up with other information freely available on the internet, is an absolute goldmine for criminals," the Daily Mail quoted Michael Fraser, a reformed burglar who presents the BBC's ''Beat The Burglar''  programme.

TRACE A MOBILE NUMBER

YOUR UNDER SURVEILLANCE

With the rapid growth of mobile phone usage in recent years, we have often observed that the mobile phone
has become a part of many illegal and criminal activities. So in most cases, tracing the mobile number
becomes a vital part of the investigation process. Also sometimes we just want to trace a mobile number for reasons like annoying prank calls, blackmails, unknown number in a missed call list or similar.

Even though it is not possible to trace the number back to the caller, it is possible to trace it to the location of the caller and also find the network operator. Just have a look at this page on tracing Indian mobile numbers
from Wikipedia. Using the information provided on this page, it is possible to certainly trace any mobile
number from India and find out the location (state/city) and network operator (mobile operator) of the caller.
All you need for this is only the first 4-digit of the mobile number. In this Wiki page you will find all the mobile number series listed in a nice tabular column where they are categorized based on mobile operator and the zone (state/city). This Wiki page is updated regularly so as to provide up-to-date information on newly added mobile number series and operators. I have used this page many a time and have never been disappointed.

If you would like to use a simpler interface where in you can just enter the target mobile number and trace the desired details, you can try this link from Numbering Plans. Using this link, you can trace any number in the world.

By using the information in this article, you can only know “where” the call is from and not “who” the caller is. Only the mobile operator is able to tell you ”who” the caller is. So if you’re in an emergency and need to find out the actual person behind the call, I would recommend that you file a complaint and take the help of police.

I hope this information has helped you!

HOW TO CRACK FTP PASSWORDS

Cracking FTP Passwords Using Brute Force Attack

What is brute forcing?

In layman language, brute forcing means using a tool that picks passwords from a wordlist and tries them one by one until one works.

How to make a wordlist?

A wordlist can consist of all possible combinations of letter, numbers, and special characters. It can have some common or default passwords. You can download the wordlist generators or google the wordlists for brute forcing and configure them according to yourself.

How fruitful attack can be?

If we are try all possible combinations of letter, numbers, special characters, theoretically chances of success are 100%. But practically it is not possible to try every combination because it can take a lot of time. This attack just depends on the time you give, processing power and of course your luck.

Tool I will be using?
  

• THC Hydra

Step 1 

Download THC Hydra from here

Step 2
(a) Make a username wordlist consisting of some common usernames like this
(b) Get a wordlist of passwords
(c) Copy both wordlists to your hydra folder

Step 3

(a) Open the command prompt and change directory to your hydra folder using cmd command.

(b) Type "hydra" without quotes and it will show you the options to use.

(c) Now to start attack,

Type "hydra -L userslist.txt -P passlist.txt xxx.xxx.xxx.xxx ftp" and press enter

where userslist.txt is the list of usernames, passlist.txt is the list of passwords and xxx.xxx.xxx.xxx is the IP address of target, Now it will start cracking

To use a single username instead of wordlist , Replace capital L with small l , like this

Type "hydra -l username -P passlist.txt xxx.xxx.xxx.xxx ftp"

Note : Ftp port must be open.

Warning: I highly recommend you to use a chain of proxies to spoof your identity because proper logs of user's IP addresses who try to connect to ftp server is made on the server. Here is an example of the same. 

Countermeasures to protect you from this attack:

1. Use strong passwords
2. Enable Auto ban of IPs or any other option like this.