Tuesday 1 May 2012
Botnets
The main drivers for botnets are for recognition and financial gain.
The larger the botnet, the more ‘kudos’ the harder can claim to have
among the underground community. The bot herder will also ‘rent’ the
services of the botnet out to third parties, usually for sending out
spam messages, or for performing a denial of service attack against a
remote target. Due to the large numbers of compromised machines
within the botnet huge volumes of traffic (either email or denial of
service) can be generated. However, in recent times the volumes of
spam originating from a single compromised host have dropped in order
to thwart anti-spam detection algorithms – a larger number of
compromised hosts send a smaller amount of messages in order to evade
detection by anti-spam techniques.
Botnets have become a significant part of the Internet, albeit
increasingly hidden. Due to most conventional IRC networks taking
measures and blocking access to previously-hosted botnets,
controllers must now find their own servers. Often, a botnet will
include a variety of connections and network types. Sometimes a
controller will hide an IRC server installation on an educational or
corporate site where high-speed connections can support a large
number of other bots. Exploitation of this method of using a bot to
host other bots has proliferated only recently as most script kiddies
do not have the knowledge to take advantage of it.
Several botnets have been found and removed from the Internet. The
Dutch police found a 1.5 million node botnet and the Norwegian ISP
Telenor disbanded a 10,000-node botnet. In July 2010, the FBI
arrested a 23-year old Slovenian held responsible for the malicious
software that integrated an estimated 12 million computers into a
botnet. Large coordinated international efforts to shut down botnets
have also been initiated.It has been estimated that up to one quarter
of all personal computers connected to the internet may be part of a
botnet.
Botnet lifecycle
Tuesday 1 May 2012 by w4r-b0y · 0
Thursday 5 April 2012
Htaccess File Explained
Intro
Hypertext Access,
commonly shortened to htaccess, is a configuration file
which controls the directory it is placed in and all the subdirectories
underneath it. It’s an incredibly useful feature which allows webmasters to control
how many aspects of their website works. You can redirect pages, change the
extensions of pages, password protect directories and much much more.
In this htaccess
guide I will show
you some of the basic tricks and tips which will help you with your website.
So what is htaccess?
The
htaccess file is a configuration file which is used on Apache based web servers
to control many features of the server. The file itself is just a small basic
text file and can be edited via your hosts file manager or alternatively you
can download the file, edit it and reupload it.
If
you have installed a script before then chances are you have had to edit the
.htaccess file at one point or another. The .htaccess file gives you a lot of
control and lets you easily redirect pages, password protect directories and
much more. Before I go through some tutorials which show you how to use
htaccess, I think it is necessary to show you how you edit the file.
Where is the .htaccess
file?
The
first thing you need to do is find out if your host actually lets you edit
htaccess files. Because of security problems which can arise, many hosts stop
their customers from editing it the .htaccess file. Therefore you should check
the Frequently Asked Questions area of your host to see if you have permission
to edit the file (failing that, email them).
Some operating systems
may not show the .htaccess file on your computer so you may need to make sure
settings show hidden files as well. Likewise some FTP Clients will not show the
.htaccess file when you connect to your host so you need to make sure that your
FTP is set up to show hidden files too (I personally use FileZilla and that shows .htaccess by default).
Better safe than sorry
The
.htaccess gives you a lot of control over what happens on your site but
accidents do happen so make sure you keep a backup or best create a copy of the
htacess file of the last working .htaccess file you used before attempting to
modify it in anyway. This way you can recover quickly from a site crash!
Htaccess
is also extremely sensitive. A missing semi colon, incorrect letter or an extra
backslash can mess everything up so you need to make sure that what you enter
is correct 100%. Don’t let this scare you off though, as long as you take your
time and make sure everything is input correctly you can enter just a few lines
to htaccess to achieve things which most php scripts take a page to do.
To
learn more about htaccess simply click on one of the articles at the right hand
side. Good luck
How do you edit the .htaccess file?
Before
you upload an .htaccess file to your server, make sure there is not already one
there. Your host panel or perhaps a script you have uploaded may have already
changed the htaccess for some reason so you don’t want to overwrite it as doing
so could change something important on your site. For example, in cpanel, you
can setup 301 redirects very easily but this tool is simply a script which
changes the .htaccess for you. So even though you may not realise it, when you
use the redirect script via cpanel, it updates your .htaccess file for you and
it’s the .htaccess file which controls the redirect for you (the redirect tool
just makes it easier for those who are not familar with .htaccess).
So
if there is an .htaccess file there already, you want to download that and edit
it before reuploading. This will ensure that nothing you have setup previously
is changed.
If there is no .htaccess
file there then you need to create one. Thankfully, this is very easy to do.
All you need to do is open a text editor and save a blank document as .htaccess.
Save the file exactly as it is stated there in bold ie. there is no writing
before the extension. You need to save it as .htaccessand not htaccess.txt or
document1.htaccess or whatever.
When
uploading you should always :
·
Upload in ASCII mode, not binary
·
CHMOD the file to 644 (this isn’t absolutely necessary per say but
it’s advisable, it means your server can access it but it can’t be seen via a
browser).
Also, after editing your .htaccess file serveral times it
may look a little complicated so I recommend adding a comment above the longer
parts of code so that you know what each section is for when you look at the
file again at a later date. To add a comment to the file you simply start the
line with #, any code written after the # in the line will not be executed and
is simply a reference for you in the future (and anyone else who may be working
on your website ie. co-admin or whatever).
Htaccess Supersession
The
most common place to upload an .htaccess file is the root ie. the home page of
your website. This is because so many things can be controlled from the top
level. However, there are many occasions when you will need to upload an
.htaccess file to a sub directory. For example, if you want to password protect
a directory you need to place the .htaccess file in the directory you want to
protect.
The
important thing to remember is that any code in a subdirectory .htaccess file
supercedes the one in the directory above. However, it only supercedes it when
there is a clash. I’ll explain this with an example.
Lets say your root
.htaccess and your subdirectory .htaccess file both state how a 404 error should be treated. If someone tries to
view a page which has been deleted within the subdirectory then the user will
be redirected according to the rule stated in the subdirectory .htaccess file
ie. it supercedes the htaccess on the home page. If, however, the user tries to
view an incorrect url in the root directory, the root .htaccess file will
dictate what will happen.
How to stop someone looking
at your htaccess file
One of the first things
you want to do is make sure no one tries to look at your .htaccess file. This
is actually very easy to do, all you need to do is make use of the Files option.
Just
enter the code below to block people seeing your .htaccess file.
# Block people seeing the htaccess file
<Files .htaccess>
order deny,allow
deny from all
</Files>
How to redirect your 404 error to a custom
page
A
404 error message is the standard HTTP standard response code which is returned
when the visitor cannot communicate with the server. This is a very common
error on the web and it occurs when you are trying to visit a page which has
either been deleted or has been moved somewhere else. For example, if you
change the structure of your website and move a certain directory to a
different part of your site, anyone trying to visit the old page url will get a
404 error message.
A
404 error message usually looks something like this :
Not Found
The requested URL /index.php was not found on
this server.
Additionally, a 404
Not Found error was encountered while trying to use an ErrorDocument to handle
the request.
Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7a mod_bwlimited/1.4 PHP/5.2.6 Server at yourwebsite.com Port 80
Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7a mod_bwlimited/1.4 PHP/5.2.6 Server at yourwebsite.com Port 80
If
a visitor comes to your site and sees a standard 404 error message it’s
unlikely they will make the effort to see any part of your site. Therefore it
is very important to create a 404 page on your site and redirect traffic from
incorrect urls.
Thankfully,
htaccess makes this very easy. First of all you need to create a 404 error
page. So for example, you would create a page at
http://www.yoursite.com/404.php which says something like :
It appears you are looking for something which
isn’t there. Either you have entered an incorrect URL or we have messed up. Why
not visit our home page or alternatively, search for what you are looking for
in the search box below.
Whilst
a 404 error page does not send the visitor to the exact page they want, it does
point them in the right direction and it means they are more likely to stay on
your site.
Once
you have your 404 page setup, all you need to do is send visitors to incorrect
url’s to this page. To do this just add the following line to your .htaccess
file :
ErrorDocument 404
/404.php
You can place the 404
error template anywhere you want. For example you could place all error
messages in a folder called errormessages
ErrorDocument 404
/errormessages/404.php
How to setup a 301 Redirect
A 301 HTTP response
status code is a way of telling search engines that a page, pages, directory or
entire website has been permanently moved to another place on the web. This is
very useful if you have changed the structure of your websites url’s or if you
have moved domain. You can also redirect your entire site.
Whereas a 301 code tells
search engines that something has been permanently moved, a 302 code tells
search engines that something has been temporarily moved. This is useful if you
only want to redirect a page for a short period of time. To do a 302 redirect
simply change the 301 part to 302.
You
can also use 303, which is means ’seeother’ and the page has been replaced by
something else. Again, to do this simply substitute 301 with 303 in the
tutorials below.
How to setup a 301
Redirect
The
basic code for redirecting is :
Redirect 301
old_location new_location
The old location of the
file has to be the absolute path from the root of your server. The new location
should use http. So for example, if you want to move a file called productreview.html from the root of your site to a
subdirectory called products you would use :
Redirect 301
/productreview.html http://www.yoursite.com/products/productreview.html
How to setup a 301
Redirect
If
you have moved your domain to another site you may want to redirect the whole
site. To so this you simply use the following code :
Redirect 301 /
http://www.newdomainname.com/
Change the Default
Directory Page
When
you load a directory on the web, for example www.yoursite.com or
www.yoursite.com/articles/, the apache server usually looks for the index.html
file. If it can’t find that it will look for index.php or index.cgi. Index.html
is usually the page with the highest priority and the one which is loaded
first.
It
is possible to change the default directory index page. Say, for example, you
wanted visitors to go to notice.html instead of index.html. All you have to add
to your .htaccess file is
DirectoryIndex
notice.html
This
can be extended so that the server looks for other files if it cannot find the
first one.
DirectoryIndex
notice.html index.cgi index.php index.html
Priority
goes from left to right. So the server would look for notice.html. If that file
is not there it will look for index.cgi, then index.php and then index.html.
You can do to this within any directory on your
site. Simply upload an .htaccess file with the above code. Remember, this will
supercede the .htaccess file at the root of your domain.
Force users to use the WWW or Non-
WWW version of your domain
To
avoid duplicate content in search engines you can force users to use either the
www or the non-www version of your website domain. This avoids search engines
such as Google indexing two versions of your domain, something which is quite
common because people link to both www and on-www versions of a domain (known
as the www/non-www canonical issue).
It
really doesn’t matter if you use www.yoursite.com or yoursite.com. I personally
use www on most sites I own however many people prefer to drop it, it’s really
up to you.
Force users to use
http://www.yoursite.com
To
force users to use the www version of your domain all you have to do is add the
following code to your .htaccess file (just replace yoursite.com with your
domain name).
# Redirect non-www urls to www
RewriteEngine on
RewriteCond %{HTTP_HOST} !^www\.yoursite\.com
RewriteRule (.*) http://www.yoursite.com/$1 [R=301,L]
Alternatively
you can use :
# Redirect non-www urls to www
RewriteEngine on
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule (.*) http://www.example.com/$1 [R=301,L]
Force users to use
http://yoursite.com
To
force users to use the non www version of your domain all you have to do is add
the following code to your .htaccess file (just replace yoursite.com with your
domain name).
# Redirect www urls to non-www
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www\.yoursite\.com [NC]
RewriteRule (.*) http://yoursite.com/$1 [R=301,L]
Alternatively
you can use :
# Redirect www urls to non-www
RewriteEngine on
RewriteCond %{HTTP_HOST} !^example\.com
RewriteRule (.*) http://example.com/$1 [R=301,L]
Notes about this technique
Many
popular scripts, particular content management systems (CMS’s) edit the
.htaccess file and add their own redirection so you may not have to add any of
the code noted above. Infact, by adding the redirection code noted above you
could actually mess things up.
For example, the popular
blogging script WordPress adds redirection to the .htaccess
file. You simply chose the correct domain name in the admin panel and it takes
care of everything else. And if you do add the code to the .htaccess file it
messes things up a little. It does still redirect non-www to www (and vice
versa) but it just redirects the visitor to the home page (ie.
http://yoursite.com/folder1/page1 would redirect to http://yoursite.com/ instead
of http://www.yoursite.com/folder1/page1).
If
this sounds a little confusing, don’t worry. Just remember that certain scripts
already apply a redirection and so trying to add a redirection code to the
.htaccess file can mess things up, at the very least it will unlikely work the
way you want it to.
Deny a user by IP Address
There
may come a time when you unfortunately need to ban someone from visiting your
website completely. This is very easy to do using htaccess and can be useful if
there is a spammer or disgruntled member attacking your site (something which
unfortunately happens a lot to forum and blog owners).
To
ban someone completely all you need to do is add the following code to your
.htaccess file. Simply replace the ip address below with the ip of the person
you want to ban
#ban users from
visiting the site
order allow,deny
deny from 123.45.6.7
allow from all
If
you want to ban more people you simply add more lines, like this :
#ban users from
visiting the site
order allow,deny
deny from 123.45.6.7
deny from 987.65.4.3
deny from 56.45.34.456
allow from all
How to Stop Directory Listing
If
you have a lot of files in a directory but there is no index file, your server
will list all the files in that server. This can cause a lot of problems. For
example, one of the most common directories which webmasters forget to hide is
the images folder. This allows everyone to view all the images in their images
folder. This isn’t usually a major problem though you may have more important
files in a directory, perhaps important documents or software.
You
can stop this from occurring from using the following code :
IndexIgnore *
The
* is a wildcard and stops the server from listing any type of file. You can of
course only stop certain files or file types from being listed.
For
example :
IndexIgnore *.gif *.jpg
*.png accounts.doc
The above code would
stop all gif, jpg and png graphics files from being listed. The accounts.doc
document would be blocked too however all other .doc files would be shown. Basically
the IndexIgnorecommand lets you decide what files in a directory
visitors can see.
You
can upload an .htaccess file for every directory you want to stop people
viewing but it’s more practical to place everything in your main .htaccess file
(ie. your root .htaccess). To do this all you need to do is include the path to
the folder(s) you want to protect.
So
to block people viewing the files at www.yoursite.com/images/ and
www.yoursite.com/banners/ you would the following code to your .htaccess
:
IndexIgnore /images/*
IndexIgnore /banners/*
Password Protect a
Directory
Password
protecting a directory is easy to do, all you have to do is :
1.
Add some code to your .htaccess file
2.
Create a file called .htpasswd
3.
Select a username and generate an encrypted password and then add
them to your .htpasswd file
Code to add to your
Htaccess
You
need to add the following code to your .htaccessfile.
AuthType Basic
AuthName "
Name
of your secure area”
AuthUserFile /
fullpath/to/your/directory/.htpasswd
require valid-user
You
need to edit the file accordingly.
·
Name of your secure area = You can call this anything you want ie.
Secure Area or Members Area or whatever.
·
Full Path To Your Directory = This is the absolute path to the
directory where your .htpasswd file is saved.
Here’s
an example :
AuthType Basic
AuthName "Private Area"
AuthUserFile /home/mysite/.htpasswd
require valid-user
Create a file called
.htpasswd
You create a .htpasswd
file the same way you created the
.htaccess file. All you need to do is create a blank document and save it as
.htpasswd.
For
security reasons, it is best to place this file above the root of your domain
ie. place it in something like /home/mysite/ instead of
/home/mysite/public_html.
Create a username and
password
The
username and password added to your .htpasswd file is in the format :
username:encryptedpassword
So
my generated password might be something like
Kevin:nDh54k4Nc.C5c
So
how do I encrypt my password in this way? Well there are a number of ways but
the quickest and easiest is to use one of the many encryption sites on the web.
Just use any of the scripts below to generate your encrypted password.
Once
you have your username and password, simply add the line to your .htaccess
file. Now go and test it out and see if your directory is now password
protected
Some things to note :
·
To give additional users access to a directory simply add another
line with a username and encrypted password
·
Only the password is encrypted, the username is not encryped
Thursday 5 April 2012 by w4r-b0y · 0
Saturday 31 March 2012
First thing to keep in mind: If your computer hasn't crashed yet, it will in the future! So instead of waiting for fate to strike, take some precautions now:
1) BACK-UP! Buy some decent DVD-R discs and put everything useful in them. When you have more useful stuff, backup again. Do this often.
2) Keep your computer healthy. Use an antivirus, an anti-spy, and a firewall. Keep them updated. Check regularly for Windows critical fixes.
Saturday 31 March 2012 by w4r-b0y · 0
Tuesday 20 March 2012
So say somehow somewhere we ended up choosing a target to start wreaking havoc upon. All we need is an IP Address. Theres plenty of papers out there that go into how to obtain an IP Address from the preferred mark of your choice. So I'm not going to go into that subject. Alright so say we got the targets IP Address finally. What do we do with this IP Address. Well first ping the IP Address to make sure that its alive. In otherwords online. Now at the bottom of this document ill include some links where you can obtain some key tools that may help on your journey through the electronic jungle. So we need to find places to get inside of the computer so we can start trying to find a way to "hack" the box. Port Scanners are used to identify the open ports on a machine thats running on a network, whether its a router, or a desktop computer, they will all have ports. Protocols use these ports to communicate with other services and resources on the network.
Tuesday 20 March 2012 by w4r-b0y · 0
Monday 19 March 2012
How to edit meta tags of audio and video files using VLC Player.
What are meta tags..??
In simple words, Audio and Video files contains some information about Title, Artist, Album, Genre, Date, Publisher, and more..
There are many meta tag editor available. But here is the way to edit them with VLC media player which is very popular media player at this time.
VLC media Player can be used to edit meta tags of both audio files as well as video files. :)
So, here is the way, just follow these simple steps:-
1) Open the media file in VLC Media Player and Click on Tools>>Media Information.
2) Thats it.!!Now you can edit all the meta tags and save them.
Alternative Method:-
There are many tools available out all over the internet, I found a tool named Mp3 Tag Editor which is Good to Edit MP3 file's meta tag. Download It here.
But VLC Media Player can edit almost every Audio and video file's Meta Tags.
Enjoy..!!!
What are meta tags..??
In simple words, Audio and Video files contains some information about Title, Artist, Album, Genre, Date, Publisher, and more..
There are many meta tag editor available. But here is the way to edit them with VLC media player which is very popular media player at this time.
VLC media Player can be used to edit meta tags of both audio files as well as video files. :)
So, here is the way, just follow these simple steps:-
1) Open the media file in VLC Media Player and Click on Tools>>Media Information.
2) Thats it.!!Now you can edit all the meta tags and save them.
Alternative Method:-
There are many tools available out all over the internet, I found a tool named Mp3 Tag Editor which is Good to Edit MP3 file's meta tag. Download It here.
But VLC Media Player can edit almost every Audio and video file's Meta Tags.
Enjoy..!!!
Monday 19 March 2012 by w4r-b0y · 1
Sunday 18 March 2012
List of Some Basic BASH Commands:-
I'd like to point out to everyone before reading that this list is very far from completion and does not include all of the extendable possibilities. When I say this, nmap isn't a built-in command until you install nmap. These commands just stand for those that come with a Linux/UNIX BASH installation.
A
adduser Add a user to the system
addgroup Add a group to the system
alias Create an alias •
apropos Search Help manual pages (man -k)
apt-get Search for and install software packages (Debian)
aspell Spell Checker
awk Find and Replace text, database sort/validate/index
Sunday 18 March 2012 by w4r-b0y · 0
Saturday 17 March 2012
Misconceptions About Computer Worms And An Insight Into There Creation
Intro
There are a few misconceptions that some members have about Internet Worms and their behavior.all too often i hear people saying "Oh it looks like you have been infected by some kind of worm" and almost 99% of the time they are completely wrong. So here goes my attempt to clear up a few things on worms.
Definition
A computer worm is a self-replicating Malware computer program. It uses a computer network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. This is due to security shortcomings on the target computer.
REF:en.wikipedia.org/wiki/Computer_worm
Saturday 17 March 2012 by w4r-b0y · 0
Q: What is hacking?
A: The terms "hack" are also used to refer to a modification of a program or device to give the user access to features that were otherwise unavailable, such as DIY circuit bending. It is from this usage that the term "hacking" is often incorrectly used to refer to more nefarious criminal uses such as identity theft, credit card fraud or other actions categorized as computer crime
Q: What is cracking?
A: Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system. A common approach is to repeatedly try guesses for the password. The purpose of password cracking might be to help a user recover a forgotten password (though installing an entirely new password is less of a security risk, but involves system administration privileges), to gain unauthorized access to a system, or as a preventive measure by system administrators to check for easily crackable passwords. On a file-by file basis, password cracking is utilized to gain access to digital evidence for which a judge has allowed access but the particular file's access is restricted.
by w4r-b0y · 0
Subscribe to:
Posts (Atom)