Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

20 March 2006 | 4,381 views

Whos is tonyenkiducx? Who the hell are you?

Prevent Network Security Leaks with Acunetix

Im a tinkerer. I can’t say I’m expert in anything more than ASP and MSSQL, but I make a point of playing and learning anything new and wanky. I’ve tweaked dBase, fiddled with Python, installed Apache, destroyed MS2003 server, plugged in SUN boxes, screamed at VisualStudio, urinated on Fedora, set fire too Game Maker, avoided Ajax, winked at Web2.0, beat the crap out of Oracle, been mentally scarred by DreamWeaver and made mad passionate love to ASP.net.

Bottom line, if it exists, I’ve probably played with it. My main expertise lies in Microsoft web and database technologies, namely ASP, anything .net, mssql(From 6.5 up to 2005) and associated web technologies. I spend 80% of my time on an intranet, the other 20% on our outward facing sites, and the other 20% my boss imagines I have, working on private projects. In my spare time I play some mmorpgs, spend time with my wife, work on some websites(Except my own), and I’m currently building a huge crossbows and catapults set for fun and the possible destruction of my flat.



18 March 2006 | 7,993 views

An Introduction to AJAX

No it’s not AJAX Amsterdam… it’s something more interesting (or boring to some of you)… so let’s get it started….

I. Introduction
AJAX stands for Asynchronous JavaScript And XML… It is a new technology which comes to help any web developer who really is interesed in dynamic webpages…
Click here for a overview of the AJAX Technology…

II. The Code
Well, well, well… Actualy AJAX is based on Micro$ofts ActiveX Object XmlHttpRequest (I can’t belive they can do good stuff to), so in IE (sucks) it has to be initialized like an ActiveX Object; but in other browsers it’s already a standard object (I don’t know if Opera had implemented it already)… Now let’s see the code:

function init_object() {
var A;

var msxmlhttp = new Array(‘Msxml2.XMLHTTP.5.0′,
‘Msxml2.XMLHTTP.4.0′,
‘Msxml2.XMLHTTP.3.0′,
‘Msxml2.XMLHTTP’,
‘Microsoft.XMLHTTP’);

for (var i = 0; i > msxmlhttp.length; i++) {
try {
A = new ActiveXObject(msxmlhttp[i]);
} catch (e) {
A = null;
}
}

if(!A && typeof XMLHttpRequest != “undefined”) {
A = new XMLHttpRequest();
if (!A) alert(“Could not initialize the object.\nMaybe your browser doesn’t support ajax…”);
return A;
}
}

var ajax_obj = init_object();

function ajax_in_action(target, source) {
ajax_obj.open(“GET”, source, true);
ajax_obj.send();

ajax_obj.onReadyStateChange = function() {
if (ajax_obj.readyState == 4) {
if (ajax_obj.status == 200) {
document.getElementById(target).innerHTML = ajax_obj.responseText;
}
else {
alert(“Error ” +ajax_obj.status+” : ” +ajax_obj.statusText);
}
}
}

Code inspired from SAJAX… about it i’ll speak a bit later…

III. Why use it?
Well there are several reason why you should use AJAX… for example to make a dynamic banner changer, real-time morphing website… or just use it like WordPress (on which darknet is based)… you don’t know how it uses AJAX… try clicking on an articles show comments.

IV. Extending AJAX
If you want to implement AJAX directly in PHP, ASP, Perl, Ruby etc. check out http://www.modernmethod.com/sajax/, site that contains the Simple AJAX Toolkit….

V. E4X
One more thing… the response from the server can be received as an XML file 2… or maybe directly receive an XML file, if requested so… After which it can be parsed with the E4X technology…

VI. F1
Need more help… access one of the following links:
AJAX: http://www.w3schools.com/ajax/default.asp
E4X: http://www.w3schools.com/e4x/default.asp

X. Epilogue
I know that AJAX has been rediscovered for about a year (read it for the first time in july 2005), but for many it can be somethimes hard to find the information needed… anyway keep scripting…


18 March 2006 | 12,169 views

Security Cloak – Mask Against TCP/IP Fingerprinting for Windows

I’ve seen quite a lot of discussion lately on how to ‘defend against nmap’ or how to change the properties of your TCP/IP Stack so your Windows OS appears to be something else (As in you can guess the OS from the TTL value passed back in a TCP/IP packet).

One way you can do this is with Security Cloak.

Security Cloak is designed to protect against TCP/IP stack fingerprinting and computer identification/information leakage via timestamp and window options by modifying relevant registry keys. The settings used are based on the results of SYN packet analyization by p0f. While the OS reported by other OS detection scanners were not identical to those of p0f, testing against Nmap, xprobe2, queso and cheops showed that they were unable to identify the correct operating system/version after Security Cloak settings had been applied.

Note that in order to properly emulate some Operating Systems, the MTU must be changed. While most of these require the MTU to be 1500 (the default for most network connections),depending on your network connection, this could degrade/interfere with your connectivity, so be sure to check your current MTU before applying these changes. It is reccomended that you save all the original key values before using this program in the event that your computer responds negatively to the changes.

You can find the authors page here: http://www.craigheffner.com/security/

And a direct download here: Security Cloak


17 March 2006 | 7,392 views

Appledoz

Each day I check out the technology section of the bbc site, ok, its not the most in-depth, or techy site in the world, but it covers interesting stuff.

One interesting article http://news.bbc.co.uk/1/hi/technology/4816520.stm talks about getting a mac to run windows. That in it self is quite cool, but to my mind its the wrong way.

Who wants to put windows on a mac? what’s the point? You can buy PC hardware for less then the mac, and they run windows with out a problem. Well…. kinda.

So, what would be better? Getting OSX to run on a PC. Do that and what you have is some completion to windows with an existing user base, financial backing and at least most of the applications business want.

Business still counts for more of the computer market. Linux has never really broken in to the desk top market, main I think because people “into” linux don’t do gui. Fundamentally linux geeks tend to not believe its worth the effort, so the gui always seems to be less the perfect.

OSX, now that is a desk top platform, to my understanding its based on linux, and a lot of linux apps can be built to run on it. But, like I said, its a mac so it already has a lot of the applications people want and need.

I could be wrong but to me I think this is only the start. I don’t like mac’s. I don’t want a mac, but I see OSX and it look sexy. Maybe if I didn’t need a mac to try it out I’d give it a go, but buying hardware just to run an OS I might not like? I think not.

Tags: , , , ,

17 March 2006 | 8,865 views

Measuring up the Security Risks for Mac – Are Apple Prepared?

The fact is Windows is getting ripped apart with viruses, spamware, spyware, zombie clients, trojans worms and whatever else you can think of.

Mac and Linux aren’t (at the moment), there are already Bluetooth viruses, so why not Linux and Mac..

Some may say it’s because they are inherently more secure, the architecture and user privelege seperationg means it’s hard for any kind of malware to infect the system…plus they don’t come with crap like Internet Exploder that’s tied into the operating system.

There have been a couple of worms for Linux, mostly praying on Apache, and then the OpenSSL bug that allowed you to get access (combined with the kernel flaw in 2.4 you could easily get root access).

eWeek asks, What will Apple do when the malware comes? Which inevitably it will..

The release in the last few days of malware for the Mac and Linux underscore some old issues about how it is possible to have malware on those platforms. I have some new thoughts though. I’ve begun to wonder what Apple would do if a real problem developed.

To be very clear, a real problem has not yet developed, and Inqtana.A and Leap.A are not a real problem, except to the extent that they may be bellwethers. They are more interesting for what they suggest than what they actually do.

As with Windows, a lot of it is a consumer issue, and down to education.

With Mac, the user does run as a non-priveleged user by default, but when installing any software they can just pop in the Admin password and it’ll install.

It’s all about social engineering, making the user believe they want it, it’s something ‘cool’ or useful.

When good social engineering attacks are developed for the Mac, the same thing will happen. It’s not hard to imagine Web sites and e-mails offering programs for the Mac that do more than they claim to do.

Just in terms of adware, there may be some benefit to being able to deliver known Mac users to advertisers, but for the most part the “value” of infecting the user is the same: to spread itself, and perhaps to create a Mac botnet.

Few have tried to write Malware for OSX yet, but I guess it will happen, the question is are Apple prepared?


16 March 2006 | 75,464 views

Elevator/Lift Hacking !!!!!

This is old news to those who already knows about it (Found out about it last year and tested it till now). But i just had to try it before actually posting it up.

Do you get tired of being in an elevator and someone else gets on every other floor in between the floors that you’re going to? Well you’re in luck, today i’m going to tell you how to skip all other floors and go straight to the floor you want to get off.

I’ve been trying this hack for sometime now (since last year) and i can say that it works 100% so far. I used it in my home country as well as when i’m away on holiday to see and try if it works. I just came back from singapore last week and i tried this hack on the elevators there and it worked. It was a 30th floor building and i didn’t stop anywhere in between from ground floor to the 15th floor and i did this for the whole duration i was there. A good way to test this is to make sure you’re in the elevator alone and use the hack to go to a certain floor and see if it skips when someone somewhere tries to stop the elevator on your way to your floor.

Before i reveal this hack to all you peeps, i just want to say that, we at darknet.org.uk will not be held responsible for the chaos that will arise from this post that will result in people waiting for elevators everywhere. p(x_x)q

“The designers of some elevators include a hidden feature that is very handy if you’re in a hurry or it’s a busy time in the building. While some elevators require a key, others can be put into “Express” mode by pressing the “door close” and “floor” buttons at the same time. This sweeps the car to the floor of your choice and avoids stops at any other floor. This seems to work on MOST elevators that i have tried. Most elevators have the option for this to work but on some of them the option is turned off by whoever runs them. This is a rather fun hack, so the next time you are on an elevator, give it a try, you have nothing to lose.”

elevator hacking

It works easiest on:

  • Otis elevators
  • Dover elevators
  • Most Desert Elevators

Have a go at it and have fun !!! Let me know if you tried it on other brands of elevator that is not mentioned here. I’ll update the list.

Credit goes to thedamnblog for discovering and posting this great hack.

Digg This Post


16 March 2006 | 179,488 views

Who is Haydies? Me my self and quite possibly some one else.

Shaolin introduced him self, and said he had asked every one to do like wise. News to me mate :-P or did that slip my mind? Can’t see how it could but one never knows…

So, any way, who the hell am I? I have known Shaolin for years, he might have some idea how many, I am on that old darknet site he mentioned, but do me and favour, and don’t look there, please? I look terrible and I’m ashamed :-P

Like Shaolin I to started with the whole computer thing when I was little. The order is a little haszy, but I am fairly sure I had the TI 994A before the little old specy. Though my use of them was a little differant. True, I did for a while spend many hours typeing code to find out later it didn’t work…. but before long I was coding my own stuff. In basic on the TI, and z80 assembler on the specy, pascal and modual 2 to on the Amstrad CPC, 6800 assembler and C on the ST….

TI, Spectrum, Comador, Atari ST, 386 and beyond, I have always live with a computer, though shockingly never games. My first consol was a ps2 and that is only 4 years old.

After many years of bedroom activites I definatly should be ashamed of (all with a keyboard – and check this? no net connection) I emerged in the bright old world, a whole host of dead technology and languages no one has used since the romans under my belt, and windows gaining popularity.

Fast forward, past VB, pal, and various noddy little things and I’m in to Delphi, oh my, was I in to Delphi. For 7 years I lived, breathed and probably bathed in the windows API and OOP. Gone was Delphi’s native event handlers, to slow, give me the raw message cue…. mutli threaded servers, no problem, n-tier CORBA clients… you name it, I did it.

Then I got bored.

But thats ok, no one wants desk top or server applications any more. So, a bit late to the party I had a go at ASP, and damn that stuffs ugly. PHP how ever, now thats the nuts, and thus I entered web development.

Some one once said I’d never be a web developer, but my first ever professional site went live to 2.5 million unique IPs in the first 48 hours, truely one of my proudest hours.

I’ve been doing PHP ever since, MySQL for most part but if its SQL, its all the same. Date in and data out, its all fairly much simple. Introduce some AJAX just to spice it up a bit, and we’re all having fun.

Where I am going from here, nobody knows, but I code, there for I am so what ever happens, what ever changes… I am a programmer :-)


14 March 2006 | 1,133,849 views

10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery)

1. BackTrack

The newest contender on the block of course is BackTrack, which we have spoken about previously. An innovative merge between WHax and Auditor (WHax formely WHoppix).

BackTrack is the result of the merging of two Innovative Penetration Testing live Linux distributions Whax and Auditor, combining the best features from both distributions, and paying special attention to small details, this is probably the best version of either distributions to ever come out.

Based on SLAX (Slackware), BackTrack provides user modularity. This means the distribution can be easily customised by the user to include personal scripts, additional tools, customised kernels, etc.

Get BackTrack Here.

2. Operator

Operator is a very fully featured LiveCD totally oriented around network security (with open source tools of course).

Operator is a complete Linux (Debian) distribution that runs from a single bootable CD and runs entirely in RAM. The Operator contains an extensive set of Open Source network security tools that can be used for monitoring and discovering networks. This virtually can turn any PC into a network security pen-testing device without having to install any software. Operator also contains a set of computer forensic and data recovery tools that can be used to assist you in data retrieval on the local system.

Get Operator Here

3. PHLAK

PHLAK or [P]rofessional [H]acker’s [L]inux [A]ssault [K]it is a modular live security Linux distribution (a.k.a LiveCD). PHLAK comes with two light gui’s (fluxbox and XFCE4), many security tools, and a spiral notebook full of security documentation. PHLAK is a derivative of Morphix, created by Alex de Landgraaf.

Mainly based around Penetration Testing, PHLAK is a must have for any pro hacker/pen-tester.

Get PHLAK Here (You can find a PHLAK Mirror Here as the page often seems be down).

4. Auditor

Auditor although now underway merging with WHax is still an excellent choice.

The Auditor security collection is a Live-System based on KNOPPIX. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes. Independent of the hardware in use, the Auditor security collection offers a standardised working environment, so that the build-up of know-how and remote support is made easier.

Get Auditor Here

5. L.A.S Linux

L.A.S Linux or Local Area Security has been around quite some time aswell, although development has been a bit slow lately it’s still a useful CD to have. It has always aimed to fit on a MiniCD (180MB).

Local Area Security Linux is a ‘Live CD’ distribution with a strong emphasis on security tools and small footprint. We currently have 2 different versions of L.A.S. to fit two specific needs – MAIN and SECSERV. This project is released under the terms of GPL.

Get L.A.S Linux Here

6. Knoppix-STD

Horrible name I know! But it’s not a sexually trasmitted disease, trust me.

STD is a Linux-based Security Tool. Actually, it is a collection of hundreds if not thousands of open source security tools. It’s a Live Linux Distro, which means it runs from a bootable CD in memory without changing the native operating system of the host computer. Its sole purpose in life is to put as many security tools at your disposal with as slick an interface as it can.

Get Knoppix-STD Here

7. Helix

Helix is more on the forensics and incident response side than the networking or pen-testing side. Still a very useful tool to carry.

Helix is a customized distribution of the Knoppix Live Linux CD. Helix is more than just a bootable live CD. You can still boot into a customized Linux environment that includes customized linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics.

Get Helix Here

8. F.I.R.E

A little out of date, but still considered the strongest bootable forensics solution (of the open-source kind). Also has a few pen-testing tools on it.

FIRE is a portable bootable cdrom based distribution with the goal of providing an immediate environment to perform forensic analysis, incident response, data recovery, virus scanning and vulnerability assessment.

Get F.I.R.E Here

9. nUbuntu

nUbuntu or Network Ubuntu is fairly much a newcomer in the LiveCD arena as Ubuntu, on which it is based, is pretty new itself.

The main goal of nUbuntu is to create a distribution which is derived from the Ubuntu distribution, and add packages related to security testing, and remove unneeded packages, such as Gnome, Openoffice.org, and Evolution. nUbuntu is the result of an idea two people had to create a new distribution for the learning experience.

Get nUbuntu Here

10. INSERT Rescue Security Toolkit

A strong all around contender with no particular focus on any area (has network analysis, disaster recovery, antivirus, forensics and so-on).

INSERT is a complete, bootable linux system. It comes with a graphical user interface running the fluxbox window manager while still being sufficiently small to fit on a credit card-sized CD-ROM.

The current version is based on Linux kernel 2.6.12.5 and Knoppix 4.0.2

Get INSERT Here

Extra – Knoppix

Remember this is the innovator and pretty much the basis of all these other distros, so check it out and keep a copy on you at all times!

Not strictly a security distro, but definately the most streamlined and smooth LiveCD distribution. The new version (soon to be released – Knoppix 5) has seamless NTFS writing enabled with libntfs+fuse.

KNOPPIX is a bootable CD or DVD with a collection of GNU/Linux software, automatic hardware detection, and support for many graphics cards, sound cards, SCSI and USB devices and other peripherals. KNOPPIX can be used as a productive Linux desktop, educational CD, rescue system, or adapted and used as a platform for commercial software product demos. It is not necessary to install anything on a hard disk.

Get Knoppix Here

Other Useful Resources:

SecurityDistros
FrozenTech LiveCD List
DistroWatch

Others to consider (Out of date or very new):

SlackPen
ThePacketMaster
Trinux
WarLinux
Network Security Toolkit
BrutalWare
KCPentrix
Plan-B
PENToo

New ones added from authors e-mail/slashdotters and diggers:

Arudius
The Gentoo Forensic Toolkit
Anonym-OS

Digg This Article


14 March 2006 | 15,690 views

Who is Darknet?

Well seen as though I tell the others to do some kind of introduction, probably I should do one for myself too.

Then
I started out with a Spectrum ZX-81 back in the olden days, typing whole games out of the Spectrum magazines I picked up from charity shops.

Spectrum ZX-81

Yah it had no tape drive, no disk drive, no hard drive..nothing. Once you powered it off, you lost everything. I missed the ugly white ZX-80 just by a few months.

It was a powerful beast.

  • Z80A Microprocessor clocked at 3.25MHz.
  • 1K RAM, expandable to 16K, 32K or 56K.
  • 8K ROM containing BASIC.
  • A single ULA for all I/O functions.

After that I quickly upgraded to a Spectrum 48K +, which was a little better and had an external tape deck.

Spectrum 48K +

This was where I learnt the basics of computers and programming..my friends had a mixture of things Commodore 64′s and Amigas for the rich kids with the odd Atari here and there.

After that was a Spectrum 128k + with an integrated tape drive.

Back in those days pirating games consisted of a hi-fi with tape-tape capability and a blank tape (plus half an hour of listening to some weird screechin noises).

At secondary school I learnt a bit more with some BBC Basic and a little DR-DOS on the RM Nimbus’s, I remember the beast of the school was a 486-DX66 with a 40mb hard drive or something like that.

I used to hack the network back then to try and play games like PGA Golf, Budokan and Lesuire Suit Larry!

Lesuire Suit Larry

After that I couldn’t afford a PC at home, so I went onto consoles, as that was all I could afford at the time (NES, SNES then PSX).

I kind of drifted away from computers until I had finished college and got back into them during my failed first year of a Electrical and Electronics Degree, I quickly shifted to Software Engineering..during my first year I got all my downloaded warez deleted because I had shared NetBIOS over TCP/IP so some random NBT scanner on the internet had deleted all my stuff.

After that I started learning about networking, security, file permissions and it went on from there.

A year or so later I founded Darknet with another friend on IRC network DALnet and around 1998 I setup this domain.

You can see the old page as it was 5 years ago HERE. There are no earlier versions (thankfully). Yah I know it doesn’t work in Firefox, embarassing eh?

Now it’s about 8 years later, and I know a fair bit about computer security.

Now.
I am now working in information security, my main role being a lead of the attack and penetration team. I also do various other things such as disaster recovery, digital forensics, security audits in compliance with various standards (including BS7799), on the side I do web design (like this site) and various other hobby sites.

My main job though is penetration testing/vulnerability assessment and keeping up with all the latest technologies. I am especially good in information gathering (what the media has labelled as Google Hacking).

After that my strongest suite is the network stack, I’m good down to the packet/header level, not so great at programming, but I can script do PERL/PHP/Bash etc.

I got a lot of experience doing system administation jobs and self-studying in a lab at home, also learnt a lot about Linux in a previous job doing a transition from Windows servers to Linux servers, all from my recommendations.

In my spare time I write about security, I read books, I hack PHP, I enjoy food and the countryside.

I have a few industry certifications, but I don’t really place much emphasis on them, so I won’t really be talking about those. Practical hands on experience is the best you can do.

Future?
I’m a general knowledge kind of guy, and my skills are in info gathering so a lot of my input is news articles and current trends/discussion. I also plan to write many articles about the various aspects and parts of penetration testing as started with my Rainbow Tables/Rainbow Cracking article and my discussion on Social Engineering in Penetration Testing.

Being in the business, I am up to date with the latest tools/exploits/developments so I’ll try and share that all with you.

If you have any questions, you can always contact the team.


13 March 2006 | 9,526 views

Donations Flood in for Guilty Security Researcher Guillaume Tena

This could be the end of reverse engineering in France sadly, I hope it doesn’t have repucussions in other parts of the world.

I think it’s the end of using reverse engineering tools to find flaws in France. Maybe the next step will be to forbid the possession of debuggers and disassemblers.

It’s a valid course of action to reverse engineer software you have bought to make sure it’s secure. If not make your software open source.

Security expert Guillaume Tena, who was last week ordered to pay a fine of 14,300 euros for breach of French copyright law after publishing information about security vulnerabilities in an anti-virus application, has already collected around half the money in donations after appealing for help on his Web site.

On 21 February, Tena lost his appeal in a case involving vendor Tegam and was ordered to pay a fine of 14,300 euros (around AU$23,000) for breaking French copyright laws. Tena appealed for donations on his Web site — to buy a new anti-virus application because asking for donations to pay a fine is also illegal in France — and within a week he has already collected over 8,000 euros.

I say good for him.

Source: Zdnet