Ani Shell DDoser, Mass Mailer, Web Fuzzer

Ani-Shell is a simple PHP shell with unique features like Mass Mailer , A simple Web-Server Fuzzer , and a DDoser. Ani-shell has immense capabilities and have been written with some coding standards in mind for better editing and customization.

Features of Ani-Shell

• Shell
• Plateform Independent
• Mass – Mailer
• Small Web-Server Fuzzer
• DDoser
• Design

alt="anishell"

 Default Login password for anishell

Username : lionaneesh
Password : lionaneesh

As it is writeen in PHP it is OS independent and also uses less resources. It is just the first edition of the Ani-shell we hope there are many improments and additions.
Download Ani-Shell v1.0 (ani-shellv1.0.rar) here

Continue Reading

BackTrack 4

Backtrack4 is the highest rated and acclaimed Linux security distribution to date. BackTrack is a Linux-based penetration testing arsenal that aids security professionals in the ability to perform assessments in a purely native environment dedicated to hacking. Regardless if you’re making BackTrack your primary operating system, booting from a LiveDVD, or using your favorite thumbdrive, BackTrack has been customized down to every package, kernel configuration, script and patch solely for the purpose of the penetration tester.

it contains about 300 pre installed tools :)
official change log for bt4 r2

• Kernel 2.6.35.8 – *Much* improved mac80211 stack.
• USB 3.0 support.
• New wireless cards supported.
• All wireless Injection patches applied, maximum support for wireless attacks.
• Even *faster* desktop environment.
• Revamped Fluxbox environment for the KDE challenged.
• Metasploit rebuilt from scratch, MySQL db_drivers working out of the box.
• Updated old packages, added new ones, and removed obsolete ones.
• New BackTrack Wiki with better documentation and support.
• Our most professional, tested and streamlined release ever.

 yes i would totally recommend you guys to use backtrack instead of other distros reason:
Backtrack is owned by offensive security they guys update it regularly+it has biggest community support in terms of hacking distros.

problem with backi was lack of hardware support.

you can download BACKTRACK from here(vmware&iso)

Continue Reading

What Is Ddos Attack And How Does It Work?

What Is Ddos Attack And How Does It Work?

Many of people in illusions that Website hacking and Attacking is very Difficult and only some hackers and professionals can Do It... Now that's absolutely wrong thinking... Its as Easy as alphabetic.


First of all We all should know What are the Different Methods Of attacking Websites...
There are Generally Three Methods of Attacking an Website...

1. Ddos Attack
2. Shell Scripts Attack

3. Javascript Attack or Attack through Scripting.

Note: SQL and other techniques comes in the Hacking Websites Part Not in attacking Part. Attacking is simply for fun or intentionally causing damage to the Website..

Ddos Attack

What is a Distributed Denial of Service (DDoS) attack?

Have you ever tried to make a telephone call but couldn't because all the telephone circuits were busy? This may happen on a major holiday and often happens on Diwali,New year etcc.

The reason you couldn't get through is because the telephone system is designed to handle a limited number of calls at a time.

So upto now you will Got an Idea What is Ddos(Distibuted Denial of Service) Attack.
Basically Ddos attack is an attack which makes the Network So congested such that no further Requests are delivered.

This is Done by making a number of connections to the Websites through Different Computer or Networks. Also can be done from One Computer by making Connections through Different Ports as there are 64k ports available in Windows OS.


How Attacker Launch a Ddos Attack?

Over past years Denial of service attack has made huge amount of damage,Many of the have been victimed of this attack

Its Real,On February 6th, 2000, Yahoo portal was shut down for 3 hours. Then retailer Buy.com Inc. (BUYX) was hit the next day, hours after going public. By that evening, eBay (EBAY), Amazon.com (AMZN), and CNN (TWX) had gone dark. And in the morning, the mayhem continued with online broker E*Trade (EGRP) and others having traffic to their sites virtually choked off.

This attack also recently hit twitter on 6th August 2009,lot of people had trouble on logging on twitter,It was brought down by denial of service attack,They tired up there server so no one can get on log on it.Websites like facebook, eBay etc have also been victim of this attack.

First, Attackers build a network of computers that will be used to produce the volume of traffic needed to deny services to computer users. We'll call this an "attack network".

To build this attack network, Attackers look for computers that are poorly secured, such as those that have not been properly patched, or those with out-of-date or non-existent anti-virus software. When the Attackers find such computers, they install new programs on the computers that they can remotely control to carry out the attack.

These days, however, the process of building an attack network has been automated through self-propagating programs. These programs automatically find vulnerable computers, attack them, and then install the necessary programs. The process begins again as those newly compromised computers look for still other vulnerable computers.

Once an attack network is built, the intruder is ready to attack the chosen victim or victims. Some information security experts believe that many attack networks currently exist and are dormant, passively waiting for the command to launch an attack against a victim's computers. Others believe that once a victim has been identified, the attack network is built and the attack launched soon afterward.

So guys i think this is enough for today hope you all now familer with Ddos attack in future post will we show how to do Ddos attacks with various hacking tools like Serve Attack Pro and LOIC (Low Orbit Ion Cannon) and other exploits.

and if you want to try ddos then comment here and tools wil b delievr to your inbox

Continue Reading

What is exploit and how to use it?

What is an exploit

An exploit is a computer programm, which circumvent computer security. There are many ways to exploit security holes. If a computer programmer make a programming mistake in a computer program, it is sometimes possible to circumvent security. The coding of such programs, which attack (hack) the programming mistakes or security holes is the art of exploitation or exploit coding. Some common exploiting technics are stack exploits, heap exploits, format string exploits, ...


What is an stack exploit

A stack exploit occurs, if you can write more than the size of a buffer located on the stack into this buffer. If you can write more data, as the size of the buffer (more than 1024 bytes in this example) a stack overflow occurs. For example:

main(int argc, char **argv)
{
// This buffer is located at the stack
char buf[1024];
// i is located on the stack
int i;

// A 6 byte stack buffer overflow
for(i=0;i<1030;i++) buf[i] = 'A' // Another example // if argv larger than 1024 a overflow occur strcpy(buf, argv[1]); } Why a stack overflow is a security threat ? The assembler instruction 'call' push the return address on the stack. 'call' jump into a function in our example the function is main. If the function returns with the assembler instruction 'ret', it returns to the function pointer at the stack. If you can overflow the stack you can overwrite the return address located at stack. You can return to another location. The location should a pointer to a shellcode address. Read alephonestack.txt for more information. You can download it at my papers section. What is a shellcode

Shellcode are machine instructions, which launch a shell for example. A shellcode looks like this:

char shellcode[]="\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62 \x69\x89"
"\xe3\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24\xb0\x0b\ xcd\x80";

Every char is a machine instruction. \xcd\x80 is 'int 80' for example. After an overflow occur we need a address to return. This shellcode launch a shell. If you point to the shellcode (after a stack overflow for example), the machine instructions are launched and spawns a shell. Compile this program. It tests the shellcode and spawns a shell:

// Compile this program with gcc sctest.c -o sctest and start it: ./sctest
// now you have someting like
// sh-2.03$


#include

char shellcode[]=
"\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\ x69\x89"
"\xe3\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24\xb0\x0b\ xcd\x80";
int
main()
{
void (*dsr) ();
(long) dsr = &shellcode;
printf("Size: %d bytes.\n", sizeof(shellcode));
dsr();
}

read alephonestack.txt for basic shellcode coding

What are heap overflows

If the heap is overflowed a heap buffer overflow occurs.
A heap overflow looks like that:

// It dynamically create a 1000 byte buffer on the heap.
main(int argc, char **argv)
{
// pointer points to a heap address
char *pointer = malloc(1000);
char *pointer2 = malloc(200);

// Overflowed, if argv[1] is larger than 1000 bytes.
// The buffer pointer 2 is overflowed if pointer
// contains more than 1000 bytes.
strcpy(pointer, argv[1]);

// Free dynamically allocated data
free(pointer)
free(pointer2);
}


Format String exploit's ?

If you control the format string in one of the printf, syslog or setproctitle function, a exploitation is possible. Format strings are something like "%s", "%x", "%d", ... For example:

main(int argc, char **argv)
{
char *buf = "TEST";

// The wrong way
// The user can control the format string
printf(argv[1]);

// You should code:
printf("%x", argv[1]);
}

Continue Reading