Installing Kali

Around April 2014, www.backtrack-linux.org officially stopped supporting backtrack downloads. This was mainly due to the release of Kali 1.0.6 which fixed majority of the bugs in the OS. Although Backtrack is still available through torrents, it’s better to move on to newer and better things, namely, Kali.
In a nutshell, mathematics tells us the difference between windows 8 and windows 8.1 is 0.1, Similarly, Backtrack and Kali are not that different. Kali is the like the next revamped version of BackTrack. If you prefer to keep using Backtrack, you’re not exactly missing out on something huge (yet). But still, it’s always better to use up to date software, nobody knows that better than us hackers. Backtrack ruled the hacking universe for nearly 8 years (released in 2006) and now the torch is in the hands of Kali. So, here we’ll be taking a brief look at the two operating systems, their differences and advantages of Kali over Backtrack and finally how to install Kali.
Differences between Kali & BackTrack
Like I said, Kali is not so different than Backtrack. At first look, you’ll probably notice the slight GUI change. The tools are in different places but it shouldn’t take long to get used to. One major difference beginners may not notice is that Kali is built on Debian Linux instead of Ubuntu Linux. The Debian vs Ubuntu debate is a whole other topic, so we’re not getting into that. Plus, you don’t need to fill your head with unnecessary information. Kali can be thought of as the next iteration of Backtrack. The developers are the same, the functionality is almost the same and the GUI change is definitely for the better.
The advantages of Using Kali Over BackTrack
•’Some’ new tools.
•The new GNOME interface.
•Regular updates, updated tools like Metasploit, p0f etc.
•A build specifically designed for the ARM architecture (read: ‘android smarphones compatible’).
•All tool directories are in the PATH variable, so any tool can be called from anywhere.
(Also now that backtrack has no future, we don’t have that much of a choice)
There’s no game changer advantage of Kali over Backtrack. But now that Backtrack is no longer going to update, vulnerabilities will start popping up in the OS which will be fixed in Kali but not Backtrack. The last thing a hacker needs is to get hacked him/herself. Let’s install Kali now. If you’ve installed Backtrack earlier, the installation process of Kali is practically identical.
Step 1: Download & Burn Kali
Head over to: http://www.kali.org/downloads/
There are quite a few options, the only ones you need to worry about are 64 bit or 32 bit and torrent or direct download. Check out the properties page of your ‘My Computer’. If your architecture (OS and processor) are 64 bit, download the 64 bit one. If you’re not sure, you may simply download the 32-bit version which works on all systems. (If you have 4GB or less RAM, 32 bit or 64 bit doesn’t make a difference). The download is around 3GB in size.
Below on that page you’ll see two more versions, ARMEL and ARMHF. They are relevant when installing Kali on ARM hardware devices (like Android smartphones and tablets). But, right now we’re trying to get Kali running on a PC.
Once we’ve got the ISO file, you can either burn it to a DVD to install as a permanent OS on your system or you can create a bootable USB Drive using software like UNetBootin. (See the tutorial on Backtrack for exact instructions)
Step 2: Install Kali
We’ll be installing Kali on a Virtual machine. The two best virtualization systems are VMWare and Virtual Box. They are both equally good, but VMWare is paid. So, for a beginner hacker I recommend using Virtual Box. On startup, just like BackTrack, you can log in as “root” with a password of “toor”. Then, type “startx” to start the X-Windows system.
Using a virtual machine may not always be ideal. The main disadvantage is performance. Running an OS on top of another OS is bound to cause lagging. A system with 4GB RAM should handle it sufficiently well as long as no other programs are running. For optimal performance, 6GB (or more) RAM is recommend.
Further, for wireless hacking using a virtual machine, we need an external wireless card or adapter. They are usually small pen drives using which you can connect to a wifi network. Also, they must be compatible with aircrack-ng, the main wifi hacking software.
As mentioned before, you may also install it alongside your present OS so that both of them can mind their own business one at a time. To do that, you can use your burned DVD or USB drive and simply boot with the booting device jacked in. (You may need to alter the Booting Sequence through the BIOS menu).
Once the booting begins, you can click on the Install Kali button and follow the steps in the install wizard.
The disadvantages of using a VM are the advantages of using a dual boot system. Kali will run faster with less resources, you will not need an additional wireless card and you will not have the additional complexities of working in a VM. But installing another permanent OS may not be ideal for everyone. You may choose whichever method you like. If you have used another Linux distribution with the GNOME interface, you’ll notice that the pull-down menus at the top of the desktop look familiar, just like Backtrack. Also just like backtrack, we can find all the same tools (and some new ones) in the same upper left corner applications menu categorized in the same way. One interesting menu is the “Top Ten Security Tools” menu. You’ll find that it includes some of the most popular tools such as nmap, Metasploit, sqlmap, Wireshark, and aircrack-ng among others. Now you’re all set and you can start hacking with Kali Linux!
*Since Kali officially supports ARM hardware, almost all android devices can run Kali. There’s an app called ‘Linux Deploy’ on the play store which does all the heavy lifting for us. All we need to do, is set a few options and hit install. The requirements for installing Kali on android phones are : Minimum android version 2.1 (rooted), 5GB free space in any one place (internal or external storage), decent internet speed and some patience.
Here’s the URL for the Linux Deploy app:
https://play.google.com/store/apps/details?id=ru.meefik.linuxdeploy
And here’s the official tutorial for getting Kali up and running on your smartphone:
http://www.kali.org/how-to/kali-linux-android-linux-deploy
Linux Deploy basically lets the user select which Linux distribution they want to install, the processor architecture, mirror URL, installation path etc. If you simply want to get it up and running quickly, Linux deploy provides defaults that almost always work. Although very improbable, even if something does go wrong, the installation of Kali on your android phone is completely reversible. On hitting the Install button, Linux Deploy will start downloading the image file and then go on to install it.
For exact instructions, head to the official tutorial URL given above.
A few pointers: Make sure you select Kali Linux under the distribution tab. The download is approximately 2GB in size, so plan accordingly. There are two architecture types, ARMEL and ARMHF. ARMEL is for ARMv4 instruction set and ARMHF is for ARMv7 instruction set for the phone’s processor. The majority of phone today have ARMv7 (or above), but if you have a relatively old model, you may wish to google up your phone’s specifications to find out which one you can run. One last thing, around 4GB minimum is recommended for the image size but if you plan on installing a lot of tools you can manually change the image size in Linux Deploy.

Installing Backtrack

How to Install BackTrack 5(contents)
►Download the BackTrack 5 ISO
►Setting up a Virtual Machine
►Installing BackTrack 5
►BackTrack Login
►(Optional) Creating a Bootable USB Drive
►Download the BackTrack 5 ISO
Head over to: http://www.BackTrack-linux.org/downloads/ Then click the download button.
After that, you need to pick the version of BackTrack that you want. Pick the latest one, it’s BackTrack 5 R3 at the time of writing this tutorial. The window managers(KDE and Gnome) are both pretty much equal, choose any. Pick the architecture according to your system’s specs(Right click on My computer to find out, 32 bit or 64 bit) . We want the ISO file type because we can use it on a DVD, a USB flash drive, and install on a virtual machine. Direct download or torrent download is up to you. The file is little over 3 GBs, so it may take some time depending on your internet speeds.
(You’re now setting up a whole new operating system, which takes time, So I suggest you read this tutorial before beginning once completely, and then refer to it if you get stuck, it’s relatively easy)
►Setting up a Virtual Machine
A virtual machine (VM) is the software implementation of a physical computer. In other words, it’s having another computer on your current computer. If you have never used a virtual machine it is a good time to start. VMs are excellent when it comes to practicing your hacking techniques as they provide somewhat of a safe closed environment, such that any damage, if it occurs is contained within the dummy operating system, which can then be simply restarted to start afresh.
To start, you’re going to need to get VM software. There are many out there, here are a few popular ones.
VMware Player (Windows/Linux) – Free
VirtualBox (Windows/Mac/Linux) – Free
Whichever VM software you go with, make sure it has a way to network with other VMs. If you don’t want to spend the money, go with VirtualBox. If you plan to get serious with penetration testing, you might want to consider getting a VMware Workstation license. It is full of useful tools and goodies such as sharing VMs and remote access and easy to work with. The easiest to install is ‘Windows Virtual PC’, it will do for beginner purposes. These programs are very similar in function. You shouldn’t have trouble following the basic setup instructions.(Google any Virtual machine software and install it)
After everything is installed and running, click “Create new virtual machine”. (Depending on which one you install, the instructions might be a little different. If you look around there will definitely be similar options).
Next you’re going to select “Installer disc image file” then browse for the BackTrack 5 ISO.
Select the operating system as linux, and the version as Ubuntu.
Give the virtual machine a name such as “BackTrack 5 R3” and select a location for where you want to save the virtual machine files.
When asked how much you want the virtual disk drive to be, you want at least 25 GB. This will be the most demanding requirement of BackTrack 5. Although the BackTrack-linux wiki says you need at least 20 GB, I found you will run out of space by the time you install updates or any other software (Feel free to put in even 5-15 Gb, if you simply want to look around. The OS is not the big, the tools are). Then, you will have the option of storing the virtual disk as a single file, or split into multiple files. Creating a virtual disk as a single file will allocate all of the space right away. Splitting into multiple files means the drive files will grow as you need them. So if your hard drive space is limited on your host system, go with multiple files. If you have a massive drive, and not worried about space, go with a single file.
And that’s it! The virtual machine is ready to go. The recommended minimum RAM is 512 MB, however you can try lower if you need to.
Power on the virtual machine and you will be ready to install BackTrack.
►Installing BackTrack 5
If you are installing on a hard drive, you will need to burn the BackTrack 5 ISO on to a DVD or a USB Drive.
First turn on your machine, then insert your DVD or USB Drive. Then press the key that allows you to select your boot drive. You may have to go into the bios to enable this. Most often, F12 will work. Select either your DVD drive, or your USB Drive to boot from it. (You may simply use the ISO file also. Windows virtua PC, for example gives an option to simply select an ISO file and start up directly)
After a few moments, you will see BackTrack Live CD menu. Press enter on ‘BackTrack Text – Default Boot Text Mode’.
Wait about 10 seconds, and you will come to BackTrack shell console. Type the command “startx” to load the GUI.(If you directly used the ISO file without burning it to anything, your operating system will be now ready. If you prefer to burn the file to a DVD or pen drive follow the steps below)
After another few moments, you will come to the desktop of BackTrack. Double click on the “Install BackTrack” to begin the install process.
After you select your time zone, and language, you then have to partition your drive. If you are using a virtual machine, go ahead and use the whole drive. If you are dual booting, you will have to specify your partition for your two operating systems.
Continue through the installer, and then click finish. BackTrack will then install on to your system. This process takes about 10-15 minutes.
►BackTrack Login
After it is finish, restart your system.
After restarting, you will come to a login screen.
The default root name for BackTrack is “root” and the password is “toor”. After typing in the root username and password, you will come back to the BackTrack shell. Type “startx” to enter the GUI desktop, and we’re done ! I recommend you look around get a feel of all the tools and applications that come pre-installed on the amazing BackTrack OS.
►(Optional)Creating a Bootable USB Drive
Required Items:
A USB flash drive with minimum space of 4 GB.
BackTrack 5 ISO
UNetbooin – ( http://unetbootin.sourceforge.net/ )
UNetbootin is a program that allows you to create bootable USB drives for linux distros and Windows. UNetbootin will download the distribution or use an ISO file you selected from your hard drive.
Once UNetbootin is downloaded you can run it by double clicking (Windows), plug in your USB Drive.
Start UNetbooin and select the “diskimage” option, then select your BackTrack 5 ISO.
Select your USB Drive, then click “OK”.
(WARNING: This will format your USB Drive and remove all previous data.)
Now you should be able to boot off of your USB Drive with BackTrack 5.

More On Hacking WiFi

This article is fairly basic but it should give you some good background information of where and how to start and how WiFi hacking works.
Before all that, let’s take a look at some background information about the stuff involved in hacking WiFi.
IP Addresses:
People starting off in networking often get confused with this and is one of the most important and vital parts of information you will use and need. Each computer system has 2 types of the so called IP Addresses. Internal and External.
External IP Address is what your ISP assigns to your modem. The external IP Address is NOT required in Wireless Hacking.
Internal IP Address is what will be used in wireless network hacking and is the IP Address which the actual hardware router assigns to each computer. Unless specified in the router/computer settings, IP Addresses are dynamic and so will change nearly every time the computer disconnects and reconnects to the router the IP will be different.
Basic software for someone interested in Networking is an IP Scanner. Most Networking software e.g. Cain, which I will go into further, includes an IP Scanner. There are lots of Scanners out there and a quick search on google will bring up a few good ones too.
Wireless Network Hacking:
The are several different types of encryption out there but since this is a basic guide I will focus on just one and mention the other.
The one I will be focusing on here is WEP (Wired Equivalent Privacy) encryption. Hopefully, you’re not protecting your network with this, if you are, I guarantee you will soon be in a hurry to change it. See for yourself, Read on ! WEP has been demonstrated to have numerous flaws and therefore the industry is basically forcing people to change to WPA/WPA2 encryption (by limiting speed between computer and router to 54mbps on wireless routers).
The exact details of how the WEP encryption works are a bit too technical to be discussed here, All you need to know is that WEP is extremely vulnerable. (If possible, change it to WPA/WPA2 ASAP!)
MAC Filtering:
Before WPA/WPA2 came to the market and was added as a standard encryption method to routers, many people resorted to Mac Filtering as an extra layer of security.
A MAC address is just an identification string made up of numbers and characters which every device that connects to a router has. So that is all Network Adapters. MAC filtering works by only allowing computers with a certain MAC address to connect to the router. However this can be easily overcome by spoofing your MAC address with simple software which I will go into later.
The fastest and most effective way to hack a wireless WEP Network is with a piece of incredible software called Aircrack-ng (http://www.aircrack-ng.org/).
(For more info on Cracking WEP, press the back button and check out the tutorial on “Cracking WEP”.)
Once you’re in the network. The real fun begins.
Intercepting Network Information:
When information is sent anywhere on a network, the information is converted to fixed sized “packets”. These are the packets and these are what you will be intercepting.
We will look at the main type of attack which is also the easiest.It uses a piece of software called Cain & Abel (http://www.oxid.it).
Once installed Run the application. It may come up on some Anti-Viruses and May also come up with a message claiming your firewall is restricting its access. In most cases both these are errors.
You have 2 toolbars at the top. The top one with File/View/Configure/Tools/Help and the second one. The 2 main buttons you will need are located on the second toolbar and are the second and third from the left. One that looks like a motherboard (Starts/Stops Sniffer) and the other one that looks like a Nuclear icon (Starts/Stops APR).
Go ahead and click the Sniffer button located on the second toolbar second from the right. Then go ahead and click the Sniffer tab and make sure hosts is selected at the bottom tab. Then right click anywhere in the white area and click “Scan MAC addresses”. Click OK. Once this is done, if there are other computers on your network they should appear in the listbox. Highlight them all and then right click, selecting “Resolve Host-Name”. This is basically an IP scanner as I mentioned before. Giving the Internal IP Address and the Host-Name on the right to help you identify your slave.
Now you need to find out your gateway address which is the IP Address of your router. Go into CMD and type IPCONFIG and look for the gateway address. An example would be 192.161.1.1
Once thats done. Click on APR on the bottom tab. The page should now be divided into 3, with aload of APR tools on the left and then 2 separate listboxs on the right. Click on the top listbox and you will notice that on the second toolbar, that there is a blue plus icon 7 from the right. Click that.
Now a pop up with 2 listboxes will appear. On the left select your gateway Address and then on the right select your victims IP Address. Then select OK. You will now notice that they appear in the top listbox. Click on them and make sure its highlighted. Now click the Nuclear icon on the second toolbar 3 from the left. It should now start poisoning the other computer meaning all the traffic to and from that computer is going through your computer. This is called ARP spoofing. It is a computer hacking technique whereby an attacker sends fake (“spoofed”) Address Resolution Protocol (ARP) messages onto a Local Area Network. ARP spoofing allows us to intercept data frames on a LAN.
If the person is active on the computer using the network you will see the second listbox start filling up with routing packets. If you click the password tab at the bottom. Any unencrypted websites they enter their password in, will show up in that box. HTTPS/SSL websites which are encrypted will show up as usually a random string or nothing at all. Often when someone is spoofing a slave. If they visit a HTTPS website, it may come up with a warning message with commercial browsers as the SSL encryption cannot verify with the server since the software tries to replace it with a fake one. This can lead to suspicion of intrusion with the slave.
Analysing the Packets:
Now that we have all this data streaming through our computer we need another piece of software to analyze it. This is where Wireshark comes in (http://www.wireshark.org/).
Wireshark is fairly basic to use. Install it and run it. Then click on the first icon on the second toolbar. Check the box with the most packets running through it and click start.
You should now have a stream of packets flowing through. There are countless things you can now analyse and view from your slave. You have all the data which is going to and from there computer. Viewing it and analysing it can be simple but also tricky depending what your trying to find out.
Theres plenty more information on how to use Wireshark on the Wireshark wiki (http://wiki.wireshark.org/).
From here you can develop your skills and further your knowledge on networking. This sheds a light on how vulnerable our virtual privacy really is. It’s really not surprising so many people regularly use softwares like VPN’s and proxies.

Hacking WPA

WPA/WPA2 supports many types of authentication beyond pre-shared keys. aircrack-ng can ONLY crack pre-shared keys. So make sure airodump-ng shows the network as having the authentication type of PSK, otherwise, it’s simply uncrackable (yet). But most Networks do use PSK only, so your chances are good. Before continuing on just take a look at what type of protection the network has.
The only time you can crack the pre-shared key is if it is a dictionary word or relatively short in length. Conversely, if you want to have an unbreakable wireless network at home, use WPA/WPA2 and a 63 character password composed of random characters including special symbols. This is because in this Hack our only option is to use a Dictionary attack, that means literally test each and every word in a text file and checking whether it is the password. A simple google : “Dictionary attack list” will give you a text file containing all the known words, Pick the one that’s the biggest.
There is another important difference between cracking WPA/WPA2 and WEP which is the approach used to crack the WPA/WPA2 pre-shared key. Unlike WEP, where statistical methods can be used to speed up the cracking process, only plain brute force techniques can be used against WPA/WPA2. That is, because the key is not static, so collecting IVs(more packets) like when cracking WEP encryption, does not speed up the attack. The only thing that does give the information to start an attack is the handshake between client and AP. Handshaking is done when the client connects to the network and attempts to authorize. Since the pre-shared key can be from 8 to 63 characters in length, it effectively becomes impossible to crack if the password is set to anything unusual, since even an 8 character password is almost impossible to brute-force.
This means that the passphrase must be contained in the dictionary you are using to break WPA/WPA2. If it is not in the dictionary then aircrack-ng will be unable to determine the key.
Also, there is no difference between cracking WPA or WPA2 networks. The authentication methodology is basically the same between them. So the techniques you use are identical.
There’s pretty much no steps in this tutorial. All you need is the .cap file and a dictionary list.
Check out the WEP cracking tutorial, complete till step 10. Then you’ll have your .cap file which contains information about handshakes that aircrack uses to crack the key.
After you get the .cap file open up Aircrack -ng, just on the first screen find and select your .cap file, select WPA Encryption option and find and select your dictionary list. If the password is in the dictionary list, you’ll see the magic happen and the key will appear.
You can simply try googling for a Dictionary WordList, there are tons out there .Try as many as you can, and if possible compile several into one and let aircrack do it’s thing overnight. Again, cracking WPA/WPA2 is much harder so you need probability on your side to have a real chance at getting the password.
I’ve noticed that in many cases, the WPA key is simply the mobile number of our naive victim. It’s usually 10 characters, easy to remember/type and luckily for us, relatively easy to crack.
(A tutorial on creating your own wordlists easily with ‘Crunch’ can be found in the Expert category)

Hacking WEP

Tools Required:
1. CommView for WiFi: http://tamos.com/download/main/ca.php
2. Aircarck-NG GUI: http://aircrack-ng.org/
1. Install CommView. While installation you maybe asked whether you want to install the application in VoIP mode or Standard mode. Both mode will work fine for our case. But I usually used the VoIP mode. It will automatically seraches and installs the available drivers needed for making the wirless adapter to enable the packet capture (by turning on promiscuous mode). Just allow it to install the needed drivers an you are good to go to the next step. And please note that while using CommView, your WiFi networks will get disconnected. Don’t panic, you are doing right!
2. After the installation, start the application and click on the left arrow on the left side.
3. You will be prompted with a new window. Click on the Start Scanning button.
4. In the right column, all the available networks around you will be shown. Just click the network you want to get the password, and click on “Capture”. Please note that, this tutorial is for WEP networks only!
5. Now the newely opened windows will be closed and you can now see that the CommView started capturing the packets.
6. Click on Settings> Options> Memory Usage. Change the value of maximum packets in buffer to 20000.
7. Now you can click on the logging tab. Select “Auto Logging”. Enter 2000 in the “Maximum Directory Size” and 20 in the “Average Log File Size”. We just told the CommView to capture *.ncp packets with each file of 20MB size and store it in the directory we chosed.
8. Again go to “Logging” tab and select “Concatenate Logs” to join all the split logs of 20 MB we just created. And now we have one *.ncf file.
9. Go to File>Log Viewer> Load CommView Logs> and choose the *.ncf file that we just got form the above Concatenation step.
10. Click File> Export> Wireshark/Tco dump format. This will create a .cap file
11. Go to the Aircrack application folder and then traverse to the bin file inside. Double click on Aircrack-ng GUI.exe in the application, choose the *.cap file we just created in the step 10.
12. And that’s it! If you sufficient data to crack the password, you will get the password. It is advisable to proceed from step 8 to 11 only after receiving enough packets. You will need a minimum of 100000 packets to start the cracking. So after step 7, it is advisable to leave the system alone for 2-3 hours and then proceed to the further steps!
NOTE:
Recently CommView became a paid software with a rather ridiculous price tag. But, no worries. There are more than enough alternatives. Some of them are mentioned below and can be used to obtain the .cap file as explained above:
•Cain $ Abel:
http://www.oxid.it/cain.html
•WireShark:
http://www.wireshark.org/
For about a couple dozen more, check out the wikipedia page (link below )listing almost every packet analyzer:
http://en.wikipedia.org/wiki/Comparison_of_packet_analyzers
They all work the same way, basically all we need is a means to get the .cap file and after that the role of packet analyzers is over. For most purposes WireShark is more than enough, so kindly check out this one first. On a seemingly unrelated note, the war against piracy wages on and packet analyzers have become victims too. Proprietary softwares like CommView continue to be easily available on torrent websites which shows just how harmful hacking can be to a company.

Limits Of Legality

Anyone serious about learning hacking should make sure to go through all the relevant laws in their jurisdicitions. For those who are not so serious, it is even more important. Simply goofing around may be enough to rack up a hefty fine, probation or even a sentence. In germany, for example, simply owning a tool that can be used for hacking, is a crime. One may actually be convicted for downloading a freaking app. In the same country, a professional penetration tester or a 12 year old may be regarded as criminal hackers just because s/he downloaded Cheat Engine (I’m serious) or BackTrack OS. This is not to single out Germans but to show that imperfect laws still exist in almost every country’s constitution (Germans, don’t worry. I have a lot more laws to insult from all over the world. But we’ll leave these for another day) This problem depends on your geography only a little, but it is mostly global.
Why bother with all this legal nonsense? If you’re not the type to spend your life fighting pointless politics or start protesting around to change existing laws, you need to follow them. After all, what choice do we have? Jail? Sure, why not. If you aren’t against something, then by definition, you support it. Anyways, let’s leave politics for another website.
When it comes to hacking, no matter where you live, practically doing it means walking a fine line. But, before anything else, before the law too, you need to look after yourself and make sure you are aware of every possible consequence of performing a hack or anything even remotely related. From running batch files, which can wreck your computer to hacking a school’s server which can get you expelled to leaking NSA secrets which can open the eyes of the world, you need to tread carefully. When it comes to hacking, there is no universal definition of right and wrong. It’s different for the government, it’s different for the anonymous hackers group and it will be different for you and me. While we’re on this, you may have heard about the “criminal” anonymous hacktivist group and their “illegal” and “unethical” activities in the news and media somewhere. Take a wild guess, who’s definition of right or wrong does the media follow?.. The obvious can be surprising. Change your viewpoint and you can change your world.
Coming back to the limits of legality, what all is legal for an average joe who wants to learn hacking? Although the exact answer will depend on your address (another bug in the matrix..), there are some general things you should keep in mind while learning and carrying out different hacking techniques, no matter where you live. These are not only to keep you out of jail but also to protect you from yourself. Since our lives will just keep on getting more and more dependent on technology, hacking is no longer just about hacking. Plus, it won’t hurt to double check what you’re doing won’t get you in trouble.
•Know what you’re doing.
Whatever the hacking method you’re trying to do, it can never hurt to know a little more than what you need. You just might end up saving yourself a lot of trouble. Just one misplaced command in a batch file virus could spell disaster. As a rule of thumb: If you don’t know what you’re doing, don’t do it. In the world of hacking, it’s easy to get carried away, specially when you try out something new, it works and you want more. Skipping the learning phase and moving straight to the doing phase is what turns potential hackers into script kiddies. In professional penetration testing, a small mistake in typing the IP address may result in you “hacking” into a whole different company on the other end of the globe. Clearly, they may not care about the difference between “pentesting” and “hacking” and your boss will find a lawsuit waiting to greet him. Actually, typos don’t really lead to lawsuits. The point is, a big firm can probably get away with a little mistake. You can’t. If you hack into some server or network where you don’t have permission, there is no justification for what you’re doing there (if you’re caught). Now THIS, looks more like lawsuit material.
•Know the consequences of what you’re doing.
This is an extension of the previous point. Before performing any hack, you should always try to visualize every step. See it in your mind, what all you need to do and what exactly is the expected outcome. You should try to avoid involving someone else’s property or devices when learning hacking. If you stick to what you know, you should always be able to predict what will happen. That will leave only typos and genuine errors. Hacking is not all that dangerous and unpredictable if you know what you’re doing.
•Don’t hack anyone without their knowledge.
It may be only a fun little trick for you, but for the other person it could be an invasion of privacy or perhaps a massive violation of all the trust they put in you, for the more dramatic ones. Not all hacking techniques can be tried on yourself for practice. Most can, but still some like those involving networking need more systems. It’s great if you can find a willing and trust-worthy friend and try hacking eachother for learning. If you ever consider trying larger and more elaborate hacks, taking written permission from all the involved parties is a good idea. For example (students), asking your computer teacher permission to simulate a DDOS attack in the computer lab, or perhaps the local cyber cafe. Another example, hacking public (protected) WiFi networks is illegal. You could try knocking on your neighbour’s door and advising them to switch over from WEP to WPA. This is what puts the “ethical” in “ethical hacker” and the chances of them giving you the new password by simply asking also increase.
•Know when to stop.
Companies hire penetration testing firms to check the security of their networks but almost always want them to stay away from private and confidential information, even if they have access. If someone were able to “guess” the facebook password of someone, it doesn’t give them the right to exploit their ability without regard for anyone else. With each passing moment, our lives are getting more and more integrated with technology making it extremely important to know when to stop.
•Know the law.
In normal hacking, you will probably never need to be worried about legal trouble but it won’t hurt to double check. To be extra sure, you can google up the constitution of your country or search for relevant laws regarding hacking.
That’s pretty much all a beginner hacker needs to know about the legal side of hacking. Once again, anything you do on your own computer that affects nobody else is usually safe (for others). As the world is increasingly interconnected, everyone shares the responsibility of securing cyberspace. Hence, it is better to be despised for anxious apprehensions, than ruined by superficial security (a little bit).

R.A.T’s

Here is an introduction to Remote administration tools. These are generally called RATs, and yes they have a vicious bite. although this page doesn’t teach you how to blast open a RAT straight away, here you will learn everything you will need to start a ‘plague’. RATs form an entire class of hacking including trojan infections, backdoors etc. But to go further, we need to clear up the basics first so, here we go.
What’s a RAT?
RAT = Remote Administration Tool. It is mostly used for malicious purposes, such as controlling remote PC’s, stealing victims data, deleting or editing some files. One can infect someone else by sending them a file called “Server”. If and when this server file is opened, it burrows itself deep in the system and starts to run in the background. Further, it may also send the attacker a message every time it is active like when a computer is turned on.
How are they spread?
Some RATs can spread over P2P (peer to peer) file sharing services (Torrents, mostly..), messenger and email spams(MSN, Skype, AIM etc.) while other may tag along hiding behind some other software. The user installs something, clicks “Next” 5 times and voila! Without anyone ever finding out the RAT has compromised a system.
How is the server controlled?
Once installed, the RAT server can be controlled via what’s called a RAT client. Basically it’s just an application that tracks your RAT’s movements. It tells you how many systems are infected, information on their system, versions of OS and other softwares, their IP address etc. It shows a whole list of IP addresses which may be connected to immediately. After connecting, you can make the computer do pretty much anything (except maybe, do hula dance XD) – Send a keylogger, uninstall their antivirus, crash the system etc.
What is port forwarding?
If you’re a gamer or are used to downloading torrents, you must’ve heard “Port Forwarding” as a way to increase download speeds, reduce lag etc. Port forwarding is the redirecting of computer signals to follow specific electronic paths into your computer.If the computer signal can find its way into your computer a few milliseconds quicker, it will add up to be a possibly dramatic speed increase for your game or your downloading. Don’t start jumping around just yet, your internet connection is probably already optimized for maximum performance (It is so, by default).
Let’s take an example: That pencil-thin network cable (that goes into the network adapter) at the back of your computer contains 65,536 microscopic pathways inside it. Your network cable is just like a major highway, except your network cable has freaking 65,536 lanes, and there is a tollboth on each lane. We call each lane a ‘port’.(FYI, 2^16 = 65,536. So, that tells us 2 bytes = 16 bits in all is sort of the “width” of network cables, which gives us 65,536 different possible combinations – hence the same number of ports.)
Your internet signal is comprised of millions of tiny little cars that travel on these 65,536 lanes. We call these little cars “transfer packets”. Computer transfer packets can travel very quickly (just under the speed of light actually), but they do observe a stop-and-go set of rules, where they are required to stop at each major network intersection as if it were a border crossing between countries, or connecting to a different ISP. At each intersection, the packet must do three things:
►Find an open port,
►Pass the identification test that will allow it through that port, and if not,
►Move to the next port and try again, until it is allowed to pass through the toll.
In some cases, packets sent by hackers will be caught and held at the intersection, where they will then be dissolved into random electrons. When this happens, it is called “packet filtering” or “packet sniping”. Likewise, if a hacker gains control of a much used port, he can control every bit of information that passes through it – Read it, modify or even delete.
All in all, Port forwarding is when you command your network router to proactively identify and redirect every packet to travel on specific electronic lanes. Instead of having every packet stop at each port in turn until it finds an open port, a router can be programmed to expedite the process by identifying and redirecting packets without having them stop at each port. Your router then acts like a type of hyper-fast traffic policeman who directs traffic in front of the tollbooths.
Can an antivirus catch a RAT?
Yes. Actually, Hell Yes! As a hacker, you will find antiviruses blocking your path at every damn step. (But we are white hats, right? No matter how annoying, it’s there to protect us, so be happy). But, like every problem, this too has a solution – Encryption. It’s called making your server “FUD” – Fully Undetectable. For example, typical encrypted formats, say password protected .zip or .rar files (if they contain malicious softwares) can be caught by an AntiVirus. Making a program FUD does pretty much the same thing, except it does so like a drunkard with OCD (Obsessive-compulsive disorder). What I mean is, running the software through an encryption program again and again so that nothing can recognize what it is and it can pass off as random harmless noise. Something called “Hex Editing” is a well known way to go about doing this. This is a whole different topic in itself. So, more on this later.
Legal or illegal?
Well, some RATs are legal, and some are not. Legal are the ones without a backdoor, and they have abillity to close connection anytime.(Backdoor is something that gives the attacker access to the victim’s system without their knowledge). Plus these are not really referred to as RAT’s, that’s just our (hacker’s) dirty language Illegal ones are used for hacking and they may possibly steal data (or worse).
A few examples are written below:
Legal:
►TeamViewer – Access any remote computer via Internet just like sitting in front of it – even through firewalls.
►UltraVNC – Remote support software for on demand remote computer support.
►Ammyy Admin – Like TeamViewer, Ammyy Admin is another reliable and friendly tool for remote computer access.
►Mikogo – Mikogo is an Online Meeting, Web Conferencing, Remote Support tool where you can share your screen with several participants in real-time over the Web.
The above tools while very useful and very legal, require a green light from both the parties involved. That’s the main difference between the ones above and the ones below:
Illegal (or barely legal):
►Spy-Net
►Cerberus Rat
►CyberGate Rat
►SubSeven
►Turkojan
►ProRat
These are all used for one purposes – Causing trouble, to say the least. RATs like the ones above are meant to be stealthily. After all, no hacker will want their victims to get a message like: “Congratulations! You have been infected!”(Or maybe let the AntiVirus find it). Use any of these on an actual victim, and you will get a ticket to jail, or at least a fine. But these are actually used, and mostly without anyone ever suspecting anything wrong. The thing is, hacking is becoming much more of a serious business than a game. A RAT that simply crashes the OS or formats the hard disk gives nothing to the attacker, So why bother doing it in the first place ? RATs today are evolving (pun unintended). They are becoming more like “parasites” instead of predators.
They may be used for DDOSing (by creating massive botnets with tens of thousands of slave computers), clicking ads in the background(the usual click fraud), increasing blog and youtube “views”, even using the compromised systems to “earn money online”, by pushing surveys, exploiting the websites which offer a pay-per-install model, even “mining” bitcoins (Bitcoins are just a fancy new online currency. Bitcoins can be earned by devoting CPU power, then converted into real money, hence their potential exploitation by using RATs). (Don’t bother googling this. Like every “Online money making” offer, whether it works or not, this too is a waste of your time. No offence to the BitCoin Foundation :-D)
Whats DNS host?
The Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the Internet or a private network. It associates various information with domain names assigned to each of the participants. Most importantly, it translates domain names meaningful to humans into the numerical (binary) identifiers associated with networking equipment for the purpose of locating and addressing these devices worldwide.
What all can a RAT do?
Here is list of basic features:
• Manage files. (Delete/Modify)
• Control web browser(Change homepage, open a website etc.)
• Get system informations(OS Version, AV name, RAM Memory, Computer name, Network Addresses etc.)
• Get passwords, CC numbers or private data etc. (via Keylogger)
• View and control remote desktop (Take screenshot or a snap from the webcam)
• Record camera, sound (Control mic and camera)
• Control mouse, keyboard input.
• Pretty much everything you can do on your own computer, except play GTA V remotely. (Although technically, you can do that too)