Winners Of Facebook Hacking Course

      

Hi Friends finally the time has come, when the winners will be announced for Facebook Hacking Course, Thanks for participating in the contest, I received more entries then I expected, most of them were on our Facebook Fan Page and on the comments section

As I mentioned in the contest declaration article, that I would be only giving two copies of my new Facebook hacking course .

1. Sarwan Baloch(lifelikesarwan@hotmail.com)
2. Hamza Azam
 
So guys, take some time to congratulate contest Winners. If you're one of them, hearty congratulations to you. If you're not one of them, don't worry, there are many more contests to come

An Introduction to Keyloggers And RATS

I have just finished writing my newest book on keyloggers and RATS and the best part is that it will be free of cost, I will launch it very soon.

Read More

How To Secure Your Wordpress Blogs?

Hackers are the person like you and us but the only difference is that they use their skills for the negative and destructive purposes, they use their skills to break a website, they normally destroy all the stuff's, so if you are a admin of a website you should care about the security of the website.
 As you know that the wordpress is a common and most popular plate form for blogging, but the security of the wordpress is always a hot discussion and it need more and more concentration because vulnerability discover everyday. Below are some tips to make your blog secure:

Secure WP-Admin By IP

Let suppose if someone can get the ability(username & Password) to enter into your website WP section, you can restrict this area by your IP. It prevent brute forcing attack and only you can able to control on your website because of IP restriction.

Order deny,allow
Deny from All
Allow from 123.456.789.0
You can allow and deny IP's from a range use this:
order deny,allow deny from all # allow my home IP address allow from XX.XX.XXX.XXX # allow my work IP address allow from XX.XX.XXX.XXX


Protect WP-Config.php File

WP-Config.php file has a great importance on wordpress plate form, it need more care and usually an attacker get the required information about the database of your website from WP-Config file. Basically if you use a strong database user-name and password while your WP-Config security is low than an attacker can get your strong user-name and password from wp-config file, because it contain all the information about the security and other things of your website.

Access .htaccess file is located at the root your WordPress installation open it and paste the following code.

order allow,deny
deny from all



Hide WordPress Version Number

You must hide the version of your wordpress because an attacker may find the available exploit by searching it on different exploit database by version number and it may cause a great harm for your blog so be care about it.

This tag is in the header.php file that displays your current version of wordpress

Copy and paste the code in the functions.php file of your theme and than you are done.


remove_action('wp_head', 'wp_generator');

Remove Error Message From Login Screen 

This is your clever move to remove the error message that an attacker would not able to see if the user-name and password incorrect, update your function.php by this code.

add_filter('login_errors',create_function('$a', \"return null;\"));


Some Other Security Tips

Use your mind because mind is an essential part to secure yourself on the jungle of web.

• Create strong passwords that are not easily be guess or crack.

• Secure your own side(your computer) from different malware.

• Make regular backup of your blog.

• Update your wordpress to latest version

• Use SSH instead of FTP

• Avoid using your account on public places

• You must be ware on different attacks to secure yourself.

About The Author

This post is written by an Irfan Shaeel An Ethical hacker and Penetration tester, Irfan blogs At his blog Ehacking.net

Read More

Finding A Spoofed Website With A Javascript

Lots of people think that Javascript is an inferior language but Javascript is an extremly powerful language and those people who think the other way they either don't know how to use it or are not familiar with it's capabilities, With javascript you can do lots of cool things such as edit any page, make an image fly etc, but it is a waste of time to spend your time on making images fly with javascripts or editing a page.
Anyways coming to the main topic, did you know that javascript can be used to detect if a page is a spoofed website or phishing website or a legit one, well if you don't know just paste the following code in to the address bar and a pop up will appear telling you whether the website is original or not
Here is the Javascript code:

javascript:alert("The actual URL is:\t\t" + location.protocol + "//" + location.hostname + "/" + "\nThe address URL is:\t\t" + location.href + "\n" + "\nIf the server names do not match, this may be a spoof.");

Read More

Web Server Hacking Techniques

Lots of people know use, configure and manage their webservers but only few of them really know how to protect their web server from getting hacked i.e making it hack proof. Today lots of websites are hosted on a dedicated web servers so it's extremely important to make your web server hack proof in order to prevent any theft and data loss, Before I mention techniques used by hackers to compromise a web server and how you can protect your web server you should know what a web server is and how it works.
What is a webserver?

Basically a webserver is a single computer or more used to host websites, For a website to be available to every one (connected to internet) 24/7 it needs to be hosted on a webserver

How webservers work?

Webservers work in a simple manner, When ever you are using browser to surf any page your browser will request that particular page from the webserver and the server sends back the requested page.

 

The above picture illustrates how a webserver works.

How Are Webservers Compromised Or hacked?

There are multiple reasons why a webserver gets compromised or hacked, one of the major reason is installing the webserver with default and lack of updates and weak passwords. Once the server is compromised the hacker can use it to do malicious things online. For Example Hacked webservers can be used to as zombies to for performing a more powerful DDOS attack

Webserver Hacking Techniques

Below mentioned are some of the techniques which can be used by malicious hackers to compromise a webserver.

Orthodox Password Cracking Techniques

1. A hacker can use variety of password Cracking Techniques such as Brute force, Dictionary attacks and rainbow tables to crack weak administrator account passwords, However these attacks create huge logs of presence, so therefore smarter hackers either use a proxy or any other iP hiding method or they use already compromised systems to perform the attack.

2. Man In The Middle Attack

A hacker can also perform a man in the middle attack also known as ARP poisoning to steal credentials of administrator account.

3.  Keyloggers And Trojans

If A hacker can manage to install a trojan or a keylogger on administrator's computer then, the malicious hacker can easily capture the credentials

4. DNS Cache Poisoning Attack

If a hacker can manage to insert fake address records for a domain name into DNS server and can make the webserver accept the fake address record then the hacker or intruder can easily control your browser, This attack is extremely dangerous as it happens without the users knowledge, The topic is quite big and is not possible to explain it here, depending upon readers response I might make a seprate tutorial on this attack

There are many other techniques used by hackers such as Ftp server intrusion, social engineering, exploiting web application bugs which are probably to be explained in the upcoming posts at rha.

Hope you have enjoyed reading the post and have probably got some idea how hackers can attack your web server, In the next post I will continue the series and will introduce some methods you can use to protect your webserver from getting compromised.

Read More