#hacker tutorials

New Post has been published on http://www.kerrylcacho.com/?p=2363

4 Crazy Things You can do with Notepad and Scare Your Friends

Notepad is a very basic, common and well known text editor. Many think that we can’t do anything awesome with it as it was to old and boring. Today I will show 5 notepad tricks you can do and scare your friends.

I want to add a small Note: The following tricks do not harm your computer. However if you want to get out of the trick just restart your computer or just delete the notepad file you saved.

4 Crazy Things You can do with Notepad and Scare Your Friends

#1. Continuously Toggle On-Off the Caps Lock button:

First open the Notepad by pressing windows key and letter ‘r’ together and then type Notepad. Cope the code here into the the text editor. Set wshShell =wscript.CreateObject(“WScript.Shell”) do wscript.sleep 150 wshshell.sendkeys “CAPSLOCK” loop Now save the file with a .vbs extension rather than the standard .txt extension. Now send this file to your friend and ask them to open it.

#2. Continuously Pop open the DVD Drive:

This trick will sure make your friend go crazy.

First open the Notepad by pressing windows key and letter ‘r’ together and then type Notepad. Cope the code into the the text editor. Set oWMP = CreateObject(“WMPlayer.OCX.7”) Set colCDROMs = oWMP.cdromCollection do if colCDROMs.Count >= 1 then For i = 0 to colCDROMs.Count – 1 colCDROMs.Item(i).Eject Next For i = 0 to colCDROMs.Count – 1 colCDROMs.Item(i).Eject Next End If wscript.sleep 4000 loop Now save the file with a .vbs extension rather than the standard .txt extension. Now send this file to your friend and ask them to open it.

#3. Hack keyboard to make it type something you want continuously:

First open the Notepad by pressing windows key and letter ‘r’ together and then type Notepad. Cope the code into the the text editor. Set wshShell = wscript.CreateObject(“WScript.Shell”) do wscript.sleep 100 wshshell.sendkeys “I tricked you.” loop Change the text in I tricked you to something you want. Now save the file with a .vbs extension rather than the standard .txt extension. Now send this file to your friend and ask them to open it.

#4. Show an error message you want and shut down the computer:

New Post has been published on http://www.kerrylcacho.com/?p=2344

This is how you can join Anonymous hacktivist group

BY VIJAY PRABHU

Want to join the Anonymous hacking collective? Here is how you can do it.

‘Anonymous’ The name says it all. These hackers without faces or identities have been at the forefront of online revolution since 2003 when the group was born as an idea on the image boarding website, 4Chan. The idea was to fight against all the evils of Internet that come in the garb of business.

Anonymous has no central leadership. In fact, there is no hierarchy in the group. Wikipedia describes Anonymous as “an Internet gathering” with “a very loose and decentralized command structure that operates on ideas rather than directives”.

The group which is represented by men and women wearing the esoteric Guy Fawkes mask became known for a series of well-publicized publicity stunts and distributed denial-of-service (DDoS) attacks on government, religious, and corporate websites who they believe to involved in cyber wrong doings.

Be it net neutrality, pedophilia, Ferguson killings, whaling, big game hunting or terrorist attacks, Anonymous has been at the forefront of organizing online movements. Right now it is fighting ISIS for their deadly terrorist attacks on Paris but simultaneous Anonymous is also carrying out several unpublicised operations.

If you want to be a join Anonymous, sorry we have bad news for you. You can’t “join” Anonymous. Not because you’re not wanted or welcome, but because, as a new recruiting video explains, it’s “not an organization. It is not a club, a party or even a movement. There is no charter, no manifest, no membership fees”.

However, you can easily be a part of the Anonymous says the man in Guy Fawkes mask. If you share the common goal of Anonymous — which is change the world for the better — then you’re “in”

The video also explains how to get in touch with other people in Anonymous, and — just as importantly — how to protect your identity and privacy. Tips include using a different browser purely for Anonymous and creating new accounts for an Anonymous pseudonym on Facebook and Twitter.

Remember there is no name, fame or money in joining the Anonymous because everything is behind a veil of mask. You should join if you truly believe in the principle of being the change you want to bring.

New Post has been published on http://www.kerrylcacho.com/?p=2336

Become an Android Developer : Here is how you can create your first Android App

BY ABHISHEK AWASTHI

Follow this 7 step guide to create your first Android App

Android is no doubt a great platform for users as well as developers. Thanks to Android Studio and continuous support from Google. And in case you were thinking to begin creating Android apps but did not have much idea of the know-how, you can follow this article to get your doubts clarified.

Programming Language

Android apps are developed in Java. You do not need to be an expert, but you should be good in specific areas, e.g. you need to have good knowledge of AWT and Swing for developing a GUI for your app. Getting easy with following topics before starting will make the development phase more enjoyable.

>> Event Handling. >> Swing. >> Constructors. >> JDBC. >> Classes, Objects and Methods. >> Packages. >> Abstraction. >> Polymorphism. >> Inheritance.

You’ll also need to learn basics of the Extended Markup Language(XML).

Places to Learn From

You can Learn Basics of Java and Android Development from these websites.

1. TreeHouse 2. Tutorials Point 3. Udacity( Android development for beginners) 4.Youtube 5.EdX

Steps to get an app built

1. Ideation

First of all an idea is required to be worked on. You’ll need to have a clear view of what your app will be for and what it will do. A good idea will be to start small and gradually add sophistication. Don’t make it so boring that you don’t want to make it but try to avoid any complex functions as far as possible. Ideally, the app will only require one ‘screen’ (activity) and will involve some simple interactions so that something happens when the user presses a button. Consider it a challenge to make something that’s genuinely useful with the minimum amount of code.

2. Choosing your IDE

The most common way to build Android apps is to use Android Studio and Java. This is the official method recommended by Google and it will afford you a lot of flexibility while ensuring there’s plenty of support if things go wrong. This is also the method you will need to know if you ever plan on becoming a professional developer.

There are numerous other options for your IDE and language too however. You may pick Unity and C++ for instance if you want to make a game. Basic4Android is an IDE focused on rapid development that lets you code with BASIC rather than Java. There’s even an IDE that runs on Android called AIDE.

3. Collecting Resources

Resources mean images and other material you will use in your app. You can download numerous images and use them but be aware not to violate someone’s copyright. 4. Building the layout of your app in IDE

Now you’re going to create your layout in Android Studio using the ‘designer’. This is a tool that lets you simply drag and drop the widgets (also called ‘views’) where you want them on the page. You’ll need to start a new project in Android Studio to do this but there will still be no coding necessary at this point (except maybe a little XML). To start a new project select File > New > New Project. Follow the steps selecting a name for your project and for your activities and choose ‘Empty Activity’.

5. Writing the core code

Now comes the more challenging part – adding the code. You know the basics of Java and you have your widgets/views already in place. Now you’re going to open the Java file for your main activity and simply create some ‘onClick’ events to add code that will run only when users click a specific button or otherwise take a specific action.

6. Implementing more complexity

By now though, you should have some of the basic functionality in place so that your app responds to button clicks (in one way or another) and perhaps stores some variables.

Next is to add the more advanced functionality that will be specific to your app. For example, you might want your app to play music when a button is clicked. Maybe you want to add some flashy animations. Or perhaps you need to know how to transition from one activity to the other.

7. Final review and publishing

New Post has been published on http://www.kerrylcacho.com/?p=1775

Trojanized and Pirated Assassins Creed app

During our daily research, we recently came across Android malware disguising itself as an Assassins Creed app, which is a popular paid gaming application. The malware in question will install a pirated version of the Assassins Creed game that functions normally, making end user oblivious to the malicious activities it performs in background.

Application information:

New Post has been published on http://www.kerrylcacho.com/?p=1772

Defaced websites leading to Dokta Chef Exploit Kit and CVE-2014-6332

Defacing websites has been the main stay for hacktivist groups to spread their message. During recent research, we found multiple compromised websites containing a malicious link to a “lulz.htm” page, which in turn leads the user to a Dokta Chef Exploit Kit (EK) hosting site. This appears to be a new tactic whereby a hacktivist group has escalated their activities by attacking users who visit defaced sites. This is out of character for such groups that generally seem more interested in disrupting private sector compliance with government entities, than targeting end users.

New Post has been published on http://www.kerrylcacho.com/?p=1564

Anatomy of Heartbleed Bug

By Nilanjan De There has been a lot of buzz about Heartbleed[1] in the news recently. In this blog post, we have tried to put together the important things that one should know about Heartbleed. What is Heartbleed?

Heartbleed is the popular name given to the recently found vulnerability(CVE-2014-0160) in OpenSSL – an open-source encryption library. More specifically, this is a bug in the OpenSSL Heartbeat protocol which results in a vulnerable server to leak or bleed confidential content in its memory space (and hence the name ‘Heartbleed’).

What’s Heartbleed bug?

OpenSSL is the most popular open-source library providing implementations of various cryptographic functions and SSL/TLS protocols. The SSL protocol has a feature called “Heartbeat” using which a client can check whether its connectivity to the server is still present or not. This avoids the overhead of setting up a new SSL connection and thus saves processing power and improves performance. This is done by sending a Heartbeat request with a small payload (data) and the size of the data which is then sent back by the server. (somewhat similar to ICMP echo and reply)

(Read More: 3 Reasons why Automated Vulnerability Scanning does not work)

Unfortunately, some versions of OpenSSL, do not actually check the size of the string sent by the client and trust on the client provided size and sends back the response by copying the block of memory as per the size provided by the client. This can be misused by any rogue client who can request a Heartbeat response with a size more than what it sends as shown in the below comic and thus read a lot bigger chunk of memory (upto 65536 bytes) than it requested. Since OpenSSL handles encryption and decryption, in many cases, the memory may contain confidential plaintext for example usernames, passwords, emails or cryptographic keys which can allow an attacker to decrypt any encrypted traffic encrypted using the key. The bug even affects vulnerable clients which may be attacked by rogue servers.

(Read More: Bypassing Captcha using Python and Tesseract OCR engine)

XKCD has nicely summarized the Heartbleed bug in the following comic in layman terms.

You may also check this video to understand how the attack works.

Download Free Checklist: How to assess your Penetration Testing Vendor?

Who are at risk?

OpenSSL versions 1.0.1 to 1.0.1f(both inclusive) are VULNERABLE

OpenSSL version 1.0.1g is NOT VULNERABLE OpenSSL branch 1.0.0 and 0.9.8 are NOT VULNERABLE

If you are running a vulnerable version of OpenSSL as listed above, you are vulnerable and should immediately take steps to mitigate the risk.

In case you are not sure about your OpenSSL version, you can check your site using the Netcraft browser plugin.

Alternately, you may check your site here or here.

Another option is to run your favourite Vulnerability Assessment tool against your site or get it tested by us or any other Penetration testing vendor.

(Read More: Challenges in automated testing of session management)

What is the fix?

In case you find that your servers are vulnerable to Heartbleed bug, you should do the following: 1.Upgrade to the latest OpenSSL version and any other packages which may have been compiled/linked with OpenSSL. If upgrading is not possible, you need to recompile the older version of OpenSSL using the compile time option -DOPENSSL_NO_HEARTBEATS in order to mitigate the vulnerability. 2.Stop all the affected services. 3.Revoke old certificates and keys and generate new ones. 4.Restart all the affected services 5.Understand your application profile and change any other critical information which you suspect may have been leaked. For example, change all application passwords or force your users to change their passwords at next login.

Note: You need to do the above in the exact order as specified.

For more information, check the official Heartbleed Bug site[2]

(Read More: REST APIs and Next Generation Threats: Part 1)

References:

[1] “Heartbleed – Wikipedia, the free encyclopedia.” 2014. 29 Apr. 2014 <http://en.wikipedia.org/wiki/Heartbleed>

New Post has been published on http://www.kerrylcacho.com/?p=1500

DroidJack RAT: A tale of how budding entrepreneurism can turn to cybercrime