search for ccna answer

Thursday, November 17, 2016

PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers

Created by @SamyKamkar ||
Source code:

When PoisonTap (Raspberry Pi Zero & Node.js) is plugged into a locked/password protected computer, it:
  • emulates an Ethernet device over USB (or Thunderbolt)
  • hijacks all Internet traffic from the machine (despite being a low priority/unknown network interface)
  • siphons and stores HTTP cookies and sessions from the web browser for the Alexa top 1,000,000 websites
  • exposes the internal router to the attacker, making it accessible remotely via outbound WebSocket and DNS rebinding (thanks Matt Austin for rebinding idea!)
  • installs a persistent web-based backdoor in HTTP cache for hundreds of thousands of domains and common Javascript CDN URLs, all with access to the user’s cookies via cache poisoning
  • allows attacker to remotely force the user to make HTTP requests and proxy back responses (GET & POSTs) with the user’s cookies on any backdoored domain
  • does not require the machine to be unlocked
  • backdoors and remote access persist even after device is removed and attacker sashays away
Live demonstration and more details available in the video: 

PoisonTap evades the following security mechanisms:


PoisonTap is built for the $5 Raspberry Pi Zero without any additional components other than a micro-USB cable & microSD card, but can work on other devices that can emulate USB gadgets such as USB Armory and LAN Turtle.
(incredible HTML5 canvas animation by Ara)
Point of Contact: @SamyKamkar //
Released: November 16, 2016
Source code and download:

Monday, November 7, 2016

How hacker crack your password

Original Title: Beware! This are the 6 ways by which hackers crack your Password

If your bank account or online accounts like Gmail, Yahoo, Facebook or Twitter has ever been hacked, you should know that the cyber criminals use specific trick to get into your account. With passwords being the central theme of almost all your accounts, hackers prefer to go after your password to hack into your financial as well as online accounts.

If your account is hacked, the criminals probably used one of the 6 below given ways to crack your account. If you study these methods you can prepare yourself better to repel such hacks and control your accounts easily.

Brute force attack

Brute force is about overpowering the computer’s defenses by using repetition. Brute force attack is a random trial and error method hack repeated till the password is finally cracked. Hackers randomly keep applying names and numbers to crack password through this pattern. Sometimes, a lot of guesswork is also used to decode password. Arithmetic numbers, birth date, pet’s name, favourite actor’s name are the password that users commonly use.

Dictionary Hacking

Dictionary hacking is also a form of brute force attack. But in Dictionary hack, hackers use various permutations and combinations of dictionary words. They repetitively use the dictionary software and try various combination of words to crack your password. A report says, over 50 percent of the passwords are cracked through this process.

Brute force dictionaries always start with simple letters “a”, “aa”, “aaa”, and then eventually moves to full words like “dog”, “doggie”, “doggy”. These brute force dictionaries can make up to 50 attempts per minute in some cases.


Phishing is another most commonly used tool of hackers to to acquire  usernames and passwords. Also, phishing is the most used method because it takes just a trick to fool the victim into divulging his/her login credentials. Most trojans spread through phishing while sometimes hackers create cloned websites or fake internet address is created wherein you are asked to fill in your username and password details.

Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication.

Spidering attack

Another hacking tool is the Spidering attack. Just as the name suggests, hackers also crawl your website like a spider and collect all the common information. Cyber criminals normally use spidering attack to target big companies.

A spider is a tool that crawls a website looking for all the available content. There’s a few different ways to discover content:

– Static Content
– Dirbuster
– HTTP Method
– Ascension Fuzz
– Query Fuzz
– Cookie Fuzz
– Robots.txt / Sitemap.xml
– RIA Checks
– UserAgent
– Regexp path/url
– Public cache search
– /status

Keylogger attack

This hacking tool is very similar to Phishing and is generally spread through malware infection. The victim is usually trapped into installing a keylogger on his/her PC/Laptop by clicking on an attachment is sent to victim email. The moment you download the attachment, it scans through your browser. Once installed, the keylogger records all your Internet activity which is than relayed back to the command and control servers.

Rainbow Table

While you might think of Rainbow Tables as eclectic colorful furniture, those aren’t the ones we are going to discuss. The Rainbow Tables that we are talking about are used to crack passwords and are yet another tool in the hacker’s ever growing arsenal.

This method requires a good knowledge of computers and coding.Rainbow Tables are basically huge sets of precomputed tables filled with hash values that are pre-matched to possible plaintext passwords. The Rainbow Tables essentially allow hackers to reverse the hashing function to determine what the plaintext password might be. It’s possible for two different passwords to result in the same hash so it’s not important to find out what the original password was, just as long as it has the same hash. The plaintext password may not even be the same password that was created by the user, but as long as the hash is matched, then it doesn’t matter what the original password was.

The use of Rainbow Tables allow for passwords to be cracked in a very short amount of time compared with brute-force methods, however, the trade-off is that it takes a lot of storage (sometimes Terabytes) to hold the Rainbow Tables themselves, Storage these days is plentiful and cheap so this is not a big issue for hackers. You can also get  precomputed Rainbow Tables for cracking passwords of vulnerable operating systems such as Windows XP, Vista, Windows 7, and applications using MD5 and SHA1 as their password hashing mechanism (many web application developers still use these hashing algorithms).

Credits to Vijay Prabhu
Do drop in your comments about the above six methods of password cracking.

Saturday, November 5, 2016

Find ip address in windows 7 using command prompt

The fastest way to check your computer ip address in windows 7 using cmd.exe

At Start, search for cmd.exe. Select to run the cmd.exe

Type ipconfig in the cmd.exe. Then press enter.

You may see some result shown in the command prompt. Search for wireless if you are currently connected to wireless network, else look for local area network Ethernet adapter

Congratulations. The IPv4 as shown is the computer local area network ip address. And this is the easiest and fastest way to find ip address in windows 7 using command ipconfig.