How to hack an IP addess of a remote computer

What can you do with an IP address?
Well you can hack a computer using it's IP address.
You can find the location of the computer using its IP address.

Things required:
1)  PHP script to catch the IP.
2) .txt file to store the IP.
you can download them from here.

Procedure:
Step 1: First create an account in any free webhosting site.
          examples are www.110mb.com
                              www.drivehq.com
                              www.t35.com
                              www.my3gb.com
Step 2: Extract the IP finder script you have downloaded.
Step 3: Now Upload the files onto the free web hosting site.
Step 4:Give the link of ip.php script to your friend.

When he clicks the link, his IP address will be strored in the ip_log.txt file.

DEMONSTRATION:

Here i have uploaded my scripts on to www.my3gb.com

and i clicked the ip.php link.
Now my IP address is stored in the ip_log.txt file

You can check out this with www.showmyip.com

Finding the location of the computer:
Now pick the IP address you got from the victim and open www.ip2location.com
here enter the IP address in the box and click "find location".
Thats it..

Read More

Is your Account safe-Gmail 2 step verification

Source: Official blog of Google(googleonlinesecurity)

Even if your Password Hacked they cant do anything with your hacked account,Google provided Advanced 2 step verification ,activate and ** the script kiddies.......

Most of us are used to entrusting our information to a password, but we know that some of you are looking for something stronger,They developed an advanced opt-in security feature called 2-step verification that makes your Google Account significantly more secure by helping to verify that you're the real owner of your account. Now it's time to offer the same advanced protection to all of our users.

2-step verification requires two independent factors for authentication, much like you might see on your banking website: your password, plus a code obtained using your phone. Over the next few days, you'll see a new link on your Account Settings page that looks like this:

Take your time to carefully set up 2-step verification—expect it may take up to 15 minutes to enroll. A user-friendly set-up wizard will guide you through the process, including setting up a backup phone and creating backup codes in case you lose access to your primary phone. Once you enable 2-step verification, you'll see an extra page that prompts you for a code when you sign in to your account. After entering your password, Google will call you with the code, send you an SMS message or give you the choice to generate the code for yourself using a mobile application on your Android, BlackBerry or iPhone device. The choice is up to you. When you enter this code after correctly submitting your password we'll have a pretty good idea that the person signing in is actually you.

It's an extra step, but it's one that significantly improves the security of your Google Account because it requires the powerful combination of both something you know—your username and password—and something that only you should have—your phone. A hacker would need access to both of these factors to gain access to your account. If you like, you can always choose a "Remember verification for this computer for 30 days" option, and you won't need to re-enter a code for another 30 days. You can also set up one-time application-specific passwords to sign in to your account from non-browser based applications that are designed to only ask for a password, and cannot prompt for the code.

Read More

Read More

Trojans and RATs- Know The Facts

What are TROJANS?

A Trojan is a program that pretends to be legitimate program, while It is malicious in nature and is infecting the system in background. It  provides complete access of that system to the Attacker.

How Trojans work?

Trojans work on client server basis.  The client will reside on hacker’s system and the server will be on victim’s computer. When the victim clicks the server, client listens to the connections through the specified ports and gives the access to the victim’s system.

Ports

Ports are the end points that provide communication between computers or networking devices.

Physical ports- example usb ports,serial port etc

Virtual ports- Virtual ports provide a virtual connection between the computer systems. These ports are the ones we need for communication on internet. Different Trojans use different ports.  These are referenced using some numbers. There are  65535 ports.

Direct connection Trojans

If the Trojan is direct connecting Trojan then attacker can connect to the victim directly and can get access to the victim machine, but the scenario is not always that easy. Victim can be behind a router, in that case direct connection Trojans will not any provide any access to the victim computer. One more disadvantage is we need to know the IP address of the victim.

HACKER-->server-->VICTIM

Example: PRORAT

Reverse connection Trojans

When the  Victim is behind a router, direct connection Trojans will not  provide any access to the victim computer. Here comes the need of reverse connection Trojans. In this case, the victim will be connected to the hacker using the server file. This is Very useful if the person sits behind a router . After infecting the victims PC, the trojan will automaticly connects to the hacker.

HACKER<--Server<--VICTIM

Example: Darkcomet

Port forwarding

If the hacker does not connect to the Internet directly (with a modem) and he sits behind a router, he needs to forward the trojan ports in his routers configuration if he is doing a reverse connection. This is called portforwarding.  The basic idea of port forwarding is to instruct our router to allow external connections to our PC. It varies from router to router based on its company and version.

Dynamic IP address

Most of the computers today do not have a static IP address, So  using a service like no-ip which gives you a name like hacker.no-ip.org  which can be pinged from anywhere on the internet and it will give your current IP address. Set your reverse connection trojans to connect to this name.

Read More

Fb spam with hacker

Hi, after a Long time came to Post one of the serious issue roaming with us,I tried to get this to You as clear as possible to show How danger is this......As a long gap to this blog i learnt some  of the techniques to reverse engineer an malware (i.e) how it infects,how it places their infections,how to get rid of this and all.....So Keep Proceed to read this Post and get rid of this Things...

Recently I logged in to my Facebook account as normal Purpose,Recently  I had a chat from one of my Friend asusual  i continue chat with him,but i didnt know he is infected or hacked by some of the Facebook spam (Since Lot more there)..suddenly he left from chat and dropped a link,I don't know whats happens, finally i concluded that its a spam link but its not a spam link its actually a severe Trojan (You'll know at the end of this post),because he doesn't knows as much in internet and confused of this link,I came across some of the Facebook spam ,so i Like to spread how curious this infection to my friends so researched that Trojan according to my basic Knowledge and delivered to You, continue with me

Observation 1:

The chat we had

Observation 2:

Then i clicked that link,Really i shocked,check This Image....

Then i noticed one Youtube Page is opened with title"my facebook name IS IN THE LEADING ROLE.SHOCKING PERFORMANCE"  and have Likes ,i shocked my name is in the youtube page and some video is there related to me(actually nothing there) finally i noticed its a phishing page, LOL suddenly i switched My  session to VM (virtual Machine)...

Observation 3:

And i started to search some of the clarification whether its original or not,I opened that Page in my VM and checked again and i noticed two things

I Tried to Play this File and its asked to download the Flash Player and asked to install to view this video,LOL i already had Flash Player,and i noticed the IP its 46.147.149.162,and Had a clarification with nslookup that this IP is not related to Youtube The original servers of Youtube are

Its ok where this IP located i trace that IP in IPLOOKUP and found some interesting,

So i continued to download that file....and had a virus scan in virustotal.com,Check the Virustotal Report Here

Click To view The virus scan report

Observation 4:

And i executed that File in my VM ,It started their Process by unpacking ,and got placed in their respective Locations,And suddenly my Internet Speed is drastically downs,I cant even Browse Google that much slow,Its started Making connections to their servers,so i Gone through the Process and noticed a bulk of curious Services and process running behind

Oh boy how many crap process are running these are all make my internet downs,then i started to research all of them The process,Most of the process are running from TEMP folders,In a simple term no EXE files or Process are not run from TEMP folders except Installation.....But these Files are currently running from these locations on every Startups, 

Observation 5:

Then i started exploring Startups in registry and found interesting

Yes,these trojans occupy their Locations in RUN key,These made executing on every startups

Observation 6:

Then i continued to trace their services and their Successful Connections established and found that all trojans we noticed had a connection with their remote servers,actually they send something to the respected IPs

NOTE: i never opened any Browsers and i didnt run any services related to Internet but still many Process trying to communicate with their servers and sending something,

Observation 7:

And i eagerly wants to know what makes my internet connection down,Then i noticed some annoying thing running background

Gosh! abulk of packets sending and receiving through some IPs these made my internet connection down,

Actually what they are sending means Its executed in Your system and start sending your confidential things to their respected servers,Like it acts like a Keylogger in Our computer and send our Logs ,Logins to their servers like bank accounts,email accounts our chat logs,not only as a keylogger ,the attackers controls your whole system and take you remote view without your knowledge,If you have webcam means you are viewed by the attacker without your knowledge its a simple example These files acts as a backdoor and make a path to the attacker

Then i traced that IP 68.9.127.143

and i eagerly want to shows how curious it is ,we just downloaded one file Flash-player.exe and executed but its got unpacked to many files and start executing see this

Really this is a serious infection,One thing i have to tell on main Process of this trojan is it hacks your facebook account and start sending this Link to your friends without your knowledge Then what this chain continues.....I hard to kill this trojans.........Finally i killed all of the infections but still i have a loss ,I lost my VM because its corrupted the registry files,but its just a VM.....LOL

Summary of this infection:

Memory Processes Infected: 9

Memory Modules Infected: 0

Registry Keys Infected: 10

Registry Values Infected: 13

Registry Data Items Infected: 3

Folders Infected: 1

Files Infected: 39

Process of this trojan

• It will takes your system as botnets
• It will uses your Internet as Proxies(Mainly Hackers do this for Illegal purpose)
• Act as a Keylogger(Which records Keystrokes and sends)
• Hacker remotely views Your system and contols your system
• crash your computer
• Hacker downloads our Confidential files without our knowledge
• Steals your data

How to Avoid:

• Never ever try some catchy things in social-network sites..
• Scan the links from Online scanners like urlvoid.com.
• Scan the untrusted files which are downloaded from internet in sites like virustotal.com , novirusthanks.org
• Scan the files with your updated antivirus
• Dont directly download files from untrusted Links.
• Avoid using Torrents(if you are not trusted)
• Dont click on Nasty ads like free smilies, online games ,etc more are there
• Update your Antivirus and stay safe

all the credits of this TUT is to Mr Hworm 

Read More