Sniffers - Tool and Softwares: Network Sniffers

Sniffers - Tool and Softwares: Network Sniffers

 

 

SMAC is a Windows MAC Address Modifying Utility that allows users to change MAC address for most Network Interface Cards (NIC) on the Windows 2000, XP, and 2003 Server systems. This is irrespective of whether the manufactures of the cards permit the change. It must be noted that SMAC does not burn a new address on the hardware and the new MAC addresses the user change will sustain from reboots..

SMAC has 2 modes of operation: [WBEM ON] and [WBEM OFF]. If the "Windows Management Instrumentation (WMI)" service is running, it will be running on [WBEM ON] mode. Otherwise, it is on [WBEM OFF] mode. The [WBEM ON] mode shows more information. The tool also allows the user to log and track SMAC activities.

SMAC takes advantage of the NdisReadNetworkAddress function in the Microsoft Device Driver Development Kit (DDK.) NdisReadNetworkAddress(...) is called by the network adapter driver to obtain a user specified MAC address in the registry. After the driver confirms that there is a valid MAC address specified in the registry key, the driver then programs the MAC address to its hardware registers to override the burnt-in MAC address.

SMAC was designed originally as a security vulnerability testing tool for MAC address authorization and authentication systems, Intrusion Detection Systems and MAC address based software licenses testing tool. When changing MAC address, the user must ensure that they assign MAC addresses according to IANA Number Assignments database.

Mac Changer

• MAC changer is a Linux utility for setting a specific MAC address for a network interface.
• It enables the user to set the MAC address randomly. It allows specifying the MAC of another vendor or setting another MAC of the same vendor.
• The user can also set a MAC of the same kind (e.g.: wireless card).
• It offers a choice of vendor MAC list (more than 6200 items) to choose from

MAC changer is a Linux utility for setting a specific MAC address for a network interface. It enables the user to set the MAC address randomly. It allows specifying the MAC of another vendor or setting another MAC of the same vendor. The user can also set a MAC of the same kind (e.g.: wireless card). It offers a choice of vendor MAC list (more than 6200 items) to choose from. The latest version is 1.3 and it offers more than 35 wireless cards as well.

Usage Examples:

# macchanger eth1

Current MAC: 00:40:96:43:ef:9c [wireless] (Cisco/Aironet 4800/340)

Faked MAC: 00:40:96:43:ef:9d [wireless] (Cisco/Aironet 4800/340)

# macchanger -A eth1

Current MAC: 00:40:96:43:39:a6 [wireless] (Cisco/Aironet 4800/340)

Faked MAC: 00:10:5a:1e:06:93 (3Com, Fast Etherlink XL in a Gateway 2000)

Iris is an advanced data and network traffic analyzer, a "sniffer", that collects, stores, organizes and reports all data traffic on the network. Iris has advanced integrated technology that allows it to reconstruct network traffic, all with a push of a button.

Iris can reconstruct raw data in packets and turn it into complete HTTP, SMTP and POP3 sessions in their original format. The user can view both outgoing and incoming email messages, web browsing sessions, instant messenger exchanges, non-encrypted web-based email and FTP transfers. Using this, the user can set up automated screens to monitor the Web-browsing patterns of the network. With Iris, the user is able to read the actual text of an email - as well as any attachments - exactly as it was sent. Iris will reconstruct the actual html pages that network users have visited and even simulate cookies for entry into password-protected websites.

Iris provides a larger variety of statistical measurements such as pie charts and bar graphs, and provides information on protocol distribution, top hosts, packet-size distribution and bandwidth usage. Iris' Packet Editor gives the ability to create custom or spoof packets and to send them across the Internet, to specific ports or addresses, or repeatedly across the network. Iris has a fast packet injector that handles up to 9000 packets per second.

Iris can be easily configured to only capture specific data through any combination of packet filters. Packet filters can be based on the hardware or protocol layer, any number of key words, MAC or IP address, source and destination port, custom data and size of the packets

NetIntercept from Sandstorm enterprises belongs to the category of Network Forensics Analysis Tools (NFAT) that is gaining popularity these days. Using a network forensics tool a user can spy on people's email, learn passwords, determine Web pages viewed, and even spy on the contents of a person's shopping cart. The tremendous power these forensic tools have over today's networks makes them subject to abuse. The difference is in range or depth of network monitoring. These tools can be used for full content network monitoring - not just filters.

NetIntercept 1.2 captures LAN traffic using a standard Ethernet interface card placed in promiscuous mode and a modified UNIX kernel. The capture subsystem runs continuously, whether or not the GUI is active. NetIntercept performs stream reconstruction on demand. When the user selects a range of captured network traffic to analyze, NetIntercept assembles those packets into network connection data streams. The reconstructed streams are then presented to the NetIntercept analysis subsystem for identification and analysis. Once TCP streams are reconstructed and parsed, some of the objects that they contain need to be stored for long periods of time. Examples of such objects are web pages, files transferred by FTP, and e-mail attachments.

Besides controlling data capture and analysis, the GUI offers sophisticated search criteria. A user can find one or many network connections according to the time of day, source or destination hardware or Internet address, source or destination TCP or UDP port name or number, username associated with the connection, electronic mail sender, recipient(s) or subject header, file name or World Wide Web URI associated with the transfer, specific protocols or content types recognized in the connection's contents. Once a connection has been identified, the user can drill down to view the search criteria extracted from it

Read More

How to hack FTP Servers: Locate Anonymous FTP Servers using FTPScanner

How to hack FTP Servers: Locate Anonymous FTP Servers using FTPScanner

FTPScanner: The FTPScanner application will locate FTP servers that allow Anonymous connections to occur. These servers must be using the default FTP port of 21 in order for the scanner to detect the server. The biggest concern with FTP is that the data be sent unencrypted (also known as clear text). An attacker that intercepts this clear text can easily read all data within the communication.

Read More

How to scan a target for open ports and services using Netcat, SuperScan, Strobe

How to scan a target for open ports and services using Netcat, SuperScan, Strobe

Netcat: The netcat application has many uses; one is the ability to scan a target for open ports and services. Another utility, cryptcat, is almost identical except that it operates with encryption.

From a DOS prompt, type the following with the syntax of:

Other useful commands for Netcat

The –v option instructs netcat to run in verbose mode, allowing you to see the progress of the scan.

The –r option instructs netcat to randomize local and remote ports in an attempt to elude any intrusion detection systems.

The –w2 option instructs netcat to wait 2 seconds between each port scanned to help elude any intrusion detection systems.

The –z option instructs netcat to operate in a zero-I/O (Input/Output) mode. It is best to use the –z when scanning with netcat.

The 1-1024 instructs netcat to scan port 1-1024.

*Note: 7, 13, 17, 9, and 19 as these ports can easily be used to create a Denial of Service (DoS). These ports should not be open to the Internet.

SuperScan: SuperScan has the ability to discover which ports are open on the target. Identifying the open ports tells an attacker what ports are available for potential exploit.

Accept the default installation of SuperScan. The installation will occur and the SuperScan application will start.

Strobe: The Strobe application identifies ports open on the target. By identifying the ports available this gives an attacker a potential hole to attempt to punch through and compromise the computer and/or network. Remember that all commands in Linux are case sensitive.

For the Windows-based version install and execute with the following syntax:

./strobe (Target IP)

From the Linux directory containing the compressed file type tar –zxvf strobe103.tar.gz. The files will uncompress into a new directory named strobe. Change to the new directory by typing cd strobe and pressing Enter. From the new directory type make install and press Enter.

To execute Strobe against the target in this example: ./strobe 172.16.1.40

The Strobe application will now execute against the target.

Read More

Anonymizers- Make your web surfing anonymous

Anonymizers- Make your web surfing anonymous

• Anonymizers are services that help make your own web surfing anonymous.
• The first anonymizer developed was Anonymizer.com, created in 1997 by Lance Cottrell.
• An anonymizer removes all the identifying information from a user's computers while the user surfs the Internet, thereby ensuring the privacy of the user.
  
  
  Many anonymizer sites create an anonymized URL by appending the name of the site the user wishes to access to their own URL, e.g.:
  http://anon.free.anonymizer.com/http://www.yahoo.com/
  After the user anonymizes a web access with an anonymizer prefix, every subsequent link selected is also automatically accessed anonymously. Most anonymizers can anonymize at least the web (http:), file transfer protocol (ftp:), and gopher (gopher:) Internet services.
  
  
  However, anonymizers have the following limitations:
  • HTTPS. Secure protocols like "https:" cannot be properly anonymized, since the browser needs to access the site directly to properly maintain the secure encryption.
  • Plugins. If an accessed site invokes a third-party plugin, then there is no guarantee that they will not establish independent direct connections from the user computer to a remote site.
  • Logs. All anonymizer sites claim that they don't keep a log of requests. Some sites, such as the Anonymizer, keep a log of the addresses accessed, but don't keep a log of the connection between accessed addresses and users logged in.
  • Java. Any Java application that is accessed through an anonymizer will not be able to bypass the Java security wall.
  • Active X. Active-X applications have almost unlimited access to the user's computer system.
  • JavaScript. The JavaScript scripting language is disabled with url-based anonymizers
  Some anonymizer sites are:
  • Anonymizer.com
  • Anonymize.net
  • @nonymouse.com
  • Iprive.com
  • MagusNet Public Proxy
  • MuteMail.com PublicProxyServers.com
  • Rewebber.de
  • SilentSurf.com
  • Surfola.com
  • Ultimate-anonymity.com
    
    

Read More

Bypassing Firewall using Httptunnel http://www.nocrew.org/software/httptunnel.html Httptunnel creates a bidirectional virtual data path tunneled in HTTP requests. The requests can be sent via an HTTP proxy if so desired. This can be useful for users behind restrictive firewalls. If WWW access is allowed through a HTTP proxy, it's possible to use httptunnel and telnet or PPP to connect to a computer outside the firewall. Here is how htc sends data to the destination: 1. Open TCP connection to hts 2. Send HTTP POST with a large Content-Length 3. Send TUNNEL_DATA packets until POST Content-Length would be exceeded. 4. Send TUNNEL_PADDING packets to exactly satisfy Content-Length - 1 5. Send TUNNEL_DISCONNECT (1 byte) 6. Close TCP connection 7. Go to step 1 Here is how htc gets data from the destination. 1. Open TCP connection to hts 2. Send HTTP GET 3. Wait for response from hts 4. Read TUNNEL_DATA, then TUNNEL_PADDING, TUNNEL_DISCONNECT packets 5. Close TCP connection 6. Go to step 1 Tunnel creation and destruction This can be useful for users behind restrictive firewalls. If WWW access is allowed through a HTTP proxy, it's possible to use httptunnel and, say, telnet or PPP to connect to a computer outside the firewall.

Bypassing Firewall using Httptunnel

http://www.nocrew.org/software/httptunnel.html

Httptunnel creates a bidirectional virtual data path tunneled in HTTP requests. The requests can be sent via an HTTP proxy if so desired. This can be useful for users behind restrictive firewalls. If WWW access is allowed through a HTTP proxy, it's possible to use httptunnel and telnet or PPP to connect to a computer outside the firewall.

Here is how htc sends data to the destination:

1. Open TCP connection to hts
2. Send HTTP POST with a large Content-Length
3. Send TUNNEL_DATA packets until POST Content-Length would be exceeded.
4. Send TUNNEL_PADDING packets to exactly satisfy Content-Length - 1
5. Send TUNNEL_DISCONNECT (1 byte)
6. Close TCP connection
7. Go to step 1

Here is how htc gets data from the destination.

1. Open TCP connection to hts
2. Send HTTP GET
3. Wait for response from hts
4. Read TUNNEL_DATA, then TUNNEL_PADDING, TUNNEL_DISCONNECT packets
5. Close TCP connection
6. Go to step 1

Tunnel creation and destruction

This can be useful for users behind restrictive firewalls. If WWW access is allowed through a HTTP proxy, it's possible to use httptunnel and, say, telnet or PPP to connect to a computer outside the firewall.

Read More

HTTPort - Bypass an HTTP proxy

HTTPort - Bypass an HTTP proxy

http://www.htthost.com/ HTTPort allows you to bypass an HTTP proxy, which is blocking you from the Internet. With HTTPort you may use the following software (just a sample list, not limited to !) from behind an HTTP proxy: e-mail, IRC, ICQ, news, FTP, AIM, any SOCKS capable software, etc. etc.

The basic idea is that you set up your Internet software in such a manner, that it considers your local PC to be a remote server it needs. This is where HTTPort enters. It intercepts connection from this software and runs the connection through the proxy - this is called a tunneling. Your software should use TCP/IP. HTTPort does not work with UDP/IP. There are two ways you can set up your software for use with HTTPort:

1. If your software uses a single (small range of) fixed server with a single (small range of) fixed port: For instance your software would like to connect to some.server.com:some_port. Create a new HTTPort mapping, with any local port, preferably above 1024, remote server of "some.server.com" and remote port of "some_port". Point your software to 127.0.0.1:mapped_local_port as if it was the original server it needs.
2. If your software can connect through SOCKS4 proxy: Point your software to 127.0.0.1:1080, which is a built-in HTTPort SOCKS4 server.

Read More

Ultra Surf: Bypass firewall and proxies–World’s best bypass technology

Ultra Surf: Bypass firewall and proxies–World’s best bypass technology

what exactly it is?
It is the flagship software product from UltraReach Internet Corp. for Internet anti-censorship. It enables users inside countries with heavy Internet censorship to visit any public web sites in the world safely and freely. it enables users to browse any website freely just the same as using the regular IE browser while it automatically searches the highest speed proxy servers in the background.

What does it means??

• 100% freedom to have 100% information in most secure way.
• It means no matter where you are you can access 100% free version of internet I mean no firewalls no restriction nothing….
• Almost all schools, universities and corporate offices raise firewalls to filter out not work related sites, now those firewalls will be of no use or they have to change their plans.
• Everybody can access various social networks like Orkut, Youtube, Myspace, Hi5,Facebook, Linkedin etc. which are blocked almost in 99% schools and offices.
• 100% real time and it’s encryption is better then any online banking system.

How to get going??
It’s very simple you have to just-

• download an exe file
• then extract it
• and run
• Set proxy if u have any (generally in offices internet are provided through proxies, you can find that, through tools>>internet options>>Connections>>LAN Settings>> there you are with proxy server for your LAN and it’s port
• Just copy that to proxy settings of Ultrasurf.
• Then a window will pop up, says some thing in Chinese, just close this window
• And open fresh internet explorer
• There you are, you can surf any information.
• For office people: beware don’t spread words to your colleagues keep this info as limited as you can, coz if system people got to know about it then they’ll take your comp for scrutinizing.

Useful tips:

When u download fresh version u need to tweak proxy settings of Ultra Surf. do that manually, also sometimes proxy setting of Ultra Surf get vanished automatically.. do check for proxy setting and feed it manually. For any kind of browser Proxy IP address is 127.0.0.1 with port :9666 and For Ultra Surf it depends upon your network.

Read More

How to bypass a Keylogger: How to fool a Keylogger

How to bypass a Keylogger: How to fool a Keylogger

These days Agents spy on u everywhere, in college, at work, maybe a trojan virus on your home PC which keylogs your paswords and mails it to someone else. If u think u r being logged, try this:

Whenever u have to type a password, never type the complete password in one go, ie, if your password is WINDOWS, u should type NDOW, then move cursor to start of the password field using the mouse ONLY, then type WI, then move cursor to end using the mouse and type S. This way the logger will record your keystrokes as ndowwis instead of WINDOWS.

Additionally you can also use spaces with you passwords as spaces are not readable. Use 2-3 spaces after or in the end (as prefix) for all your passwords. Gmail, yahoo and so many other services supports spaces in password field.

Read More

How to access blocked websites and How to protect your privacy online: Download Loki Network VPN Client Free here

How to access blocked websites and How to protect your privacy online: Download Loki Network VPN Client Free here

Loki Network Project is free VPN service and SSL based free VPN server. It is an opportunity to protect your private data (IP address, e-mail/FTP/HTTP passwords, web-sites visited, uploaded/downloaded files and etc...) and bypass certain Internet access limitations you may have at your location.

An example, free Public Loki VPN Service allows you:

• Protect your data from being intercepted by various network sniffers in your LAN segment
• Safely bypass traffic interception and analyses on corporate, ISP or even country level firewall
• Bypass any limitations in visiting web-sites or any other Internet services (if access to Loki VPN Servers is not blocked directly).

Loki Network Project can suggest two scenarious to protect your private data:

• To use our Public VPN Service that includes set of Loki VPN Servers located in different countries. Guest access to our public service is free to use.
• To create your custom service based on your own copy of VPN Server installed on your dedicated or home server. Community version of Loki VPN Server Desktop Edition is free for download and use.

According to all scenarious you have to download and install our free VPN Client software used to help you to create your own security schema.

Loki VPN Client installation credentials:

Version 1.6.1.47

OS Windows All

Size 4 MB

DOWNLOAD HERE

Loki VPN Client features:

• Easy to install. Just download Loki VPN Client from this site and start installation.
• Easy-to-use interface to create your own security profile.
• Flexible engine to avoid problems with local and external traffic by detailed analysis of your network configuration.
• Allow customization of security and quality of service as needed for specific applications and network services.

Loki VPN Client allows you to surf the Internet anonymously and hides your real location (IP address). Everything you do through the Loki VPN Client is done from the name of theLoki VPN Server and from its IP address. Connection between your computer and Loki VPN Server is secured with SSL. However, to protect your anonymity you still have to be careful about any data you fill in web forms and network applications you use locally (any locally running application still have the complete access to your real IP address). Please note that if you are connected as Guest, you can't send mail through Loki VPN Server to avoid spam from our servers.

In general, where are two most common ways to be connected to the Internet (see picture below)

• Direct connection to Internet Service Provider(ISP). Here you may have different possibilities like ADSL, Dial-Up, GPRS\EDGE and etc (low part of picture).
• Connection through Local Area Network (high part of picture).

A Loki Network provides you with a private connection to your end destination in both cases. We provide you with a secure tunnel to the Loki VPN Server. To do this a tunnel is created through an untrusted network (the internet). Everything in the tunnel is encrypted. It no longer matters that someone can sniff your packets. All they will see is an unreadable series of letters and numbers. Additionally, anyone snooping around on your connection will not be able to discern the final destination or the type (web, email, chat, video) of service you are connected to.

An example, if you're using Internet from your workplace to visit any entertaining sites you may feel safe because your network administrator won’t see more than encrypted HTTPS (by default Loki VPN Clients tunnels through TCP port 443 which is typically opened in most of firewall configurations) connection to one of the Public Loki VPN Servers and he won’t be able to report you. You also get complete access to the entire Internet even if corporate firewall is configured to block access to some certain services or web-sites

In the first case your Internet Service Provider has the opportunity to view and analyze all your traffic. It is your e-mail, web sites you visit, files you upload/download, messengers and chats you use. ISP also can close for you some network services like external SMTP.

In second case your traffic can be analyzed in two locations. First on Local Internet Gateway and second on ISP side. Local Internet Gateway here has the same opportunities to control your traffic as Internet Service Provider at the previous case. As you can see on picture all your traffic is open and shown by green arrow. In some network configurations (Ethernet hub, Wi-Fi, etc…) your traffic can be also intercepted by computers located in the same LAN segment.

Loki Network can help you to hide your private traffic from inspection. Once connection is established and user name and password are valid Loki VPN Client starts redirecting all (or some, according current advanced configuration) your network packets through the established SSL tunnel to the Loki VPN Server which acts as Internet Gateway (NAT). For example, only Loki VPN Client can secure ICQ messanger and do not secure Microsoft Messenger, to secure Firefox and do not secure Internet Explorer in one configuration and security schema. According to such feature you can start both browsers and use Firefox only for restricted internet sites. By this way all third-party internet service can used as secured service using Loki VPN.

Project Loki can help you to hide and secure your traffic from inspection and to hide your IP address from sites you visit using our free Public VPN Service based on set of Loki VPN Servers located in different countries.

• You can hide and secure all your Internet activities. e.g. browsing, FTP, web email, chat and do not change your local network activity.
• You can secure and hide only one network service, e.g. secure ftp or web browsing and to left another network services without any changes. By this way you can hide also opportunity to hide and secure any activity because your system administrator or Internet Service Provider will see a lot of open traffic and a little bit connection to our server through https protocol.
• You can hide and secure only one application, e. g. secure ICQ Messanger and to left all another network traffic without any changes. If ICQ service is restricted in your office network, you will be able to use ICQ through our free VPN service.
• You can browser Internet from IP address of our server and could use local network services available only for computer located in special country. For example, you can see USA online TV channels using connection to our public server located in USA.
• You can see a lot of Web pages and to use Internet services that is restricted by your governement.

Guest access to our Public VPN Service is available and free to use. Also Guest account is used by default after installation of Loki VPN Client. Number of Guest users is limited and you will see message 'server is busy' if no additional Guest user is allowed at this moment.

Guest account credentials:

Login: Guest

Password: Guest

Loki VPN Server

Loki VPN Server is a full-featured SSL based VPN solution that easy to install, configure and use. It includes a lot of different configuration like remote access, WI - FI security, anonymous access to internet and etc. Loki VPN Server offers cost-effective, simplified alternative to other VPN technologies that is not oriented to common user and very hard to install and use.

Loki VPN Server is capable of strong (128 bit) cryptograph and will negotiate SSL connections of the highest strength available between Loki VPN Clients and Loki VPN Server.

Loki VPN security model is based on SSL, the industry standard for secure communications via the internet and supports flexible client authentication methods based on certificates.

Community version of Loki VPN Server Desktop Edition is available here to downoad.

Read More