Metasploit Pro 4.5.0

Metasploit Pro 4.5.0 Release - Penetration Testing Software

 

Metasploit Pro 4.5.0 delivers completely new capabilities for running full-featured social engineering campaigns as well as significant improvements to the web application scanner. Metasploit Pro users can run sophisticated social engineering campaigns leveraging techniques like phishing and USB drops, watch results in real-time, and present reports containing clear risk analysis and remediation advice for the human attack surface.

Metasploit 4.5.0 includes 95 new exploits, 72 new auxiliary modules, and 13 new post modules over the 4.4.0 release, for a grand total of 180 new modules, all of which are detailed below. In addition, 56 reported bugs were resolved between 4.4.0 and 4.5.0.

Modules that are new since the 2012112801 update (the last update in the 4.4.0 line) includes modules targeting the Tectia SSH server, Metasploit, Nessus, Eaton NSM, Nexpose, Microsoft Windows, SIP, Adobe Indesign, Apple Quicktime, BlazeVideo, and Ektron. They are listed immediately below.

The update for 4.4.0 to 4.5.0 will be published shortly after the release of the 4.5.0 installer, and these release notes will be updated to reflect that update's availability.Dowload Here

Security Awareness Training: Why Every Business Needs It

The need for security awareness training is more important than ever. Every company that plans to stay competitive must make this type of training mandatory for every employee. The reason for a stringent and complete training program and the need for every employee to be aware of security is the surprising direction from which security threats may come. The security threat that companies face comes as much from within as it does from outside corporate spying.

Definition of the Direction of Threats
The threat from outside is usually better understood by company management than the threat from within. The internal threat is not just from unhappy employees. The employee who is unaware and untrained is the biggest threat. Employees who have not undergone security awareness training hurt the company by visiting Internet sites that have active malware. They often respond to emails that are phishing attacks and often keep their login and password information stored in an unprotected manner. Some uninformed employees may never think of the damage they do when discussing company projects in social gatherings, both on company time and outside the confines of the company facilities.
Why the Level of Training Intensity Must Be High
The only way to ensure that employees are not damaging the company, inadvertently or knowingly, is to set up company mandatory security training awareness programs. Every existing employee must be required to take this training when the program is started. New employees should be required to undergo security awareness training before starting their new job. This training should also require successful completion of a test to ensure a working knowledge of this vital topic has been received and understood. Update training should be required on a recurring basis as well.

Training should be much more than an hour or two of classroom training. The company needs its own website that is dedicated to the security awareness of the company. Each employee should receive random hints and reminders by email, and posters on security should be posted in prominent places throughout the company facilities.
In this manner every company can have an increased level of confidence that each employee is knowledgeable of company policies, procedures on the matter of security for any information relating to the personnel, and products or projects of the company. This type of security awareness training is the only way that employees will know, understand and put to use best practices expected by company management.
Getting Started with Security Awareness Training
At the beginning, if the company does not have personnel trained in the curriculum for this training, it may be desirable for select employees to attend outside training in order to learn what is needed. By having the company's own personnel return to oversee this type of training sets the tone about the seriousness of this type of training.

Peter Wendt is a writer from Austin, TX, that has researched a lot on the topic of malware and computer security, and highly recommends this security awareness training program for businesses and employees.

How I Hacked A Remote Computer By Just IP Address

Hacking a remote computer is always a hot topic among hackers and crackers, a newbie hacker or someone who wants to learn hacking always ask these questions that how to hack into a computer by just knowing the IP address. Although we have discussed so many methods before and I always insist to learn some basic commands, protocols and their usage. This is my story like I have hacked into a remote by just using IP address (I have not downloaded any file even I have not cleared the logs). This story was not planned it just happened and I am sure you will like it and you will learn a lot of things if you don't know the basic commands and protocols.

It was Saturday night and I was working hard on social engineering toolkit remote attack (WAN,Internet attack) that is why I was playing with my router for port forwarding and other stuffs, remember my ISP using a dynamic mechanism so I have created DNS server to get the static IP. It was almost night and I have decided to get some sleep and than I have saved my browser tabs so that next time I will use them.

Its Sunday evening I have opened my browser and the previous tabs open automatically and then I got pop up window it asked about the user-name and password of my router I have looked to the address bar the IP address was same as it was saved by me, I was shocked that my ISP has not changed my WAN IP (remember ISP using dynamic IP), after this I have open a website about whatismyip and I have seen that my IP is different it means the window that ask about user name and password is the IP of another computer.

Just got an idea why not to brute force it and get the access on the victim router, hydra has been discussed before, but before brute force I have decided to use guessing technique and I than I have entered so many combination but failed than I just used the default user name and password huurraaah I was in.

Security was very low, than I did a quick nmap scan to get the open ports (remember I have turned off the firewall of victim router). According to the nmap result ftp and telnet was open and then I realized how vulnerable this victim is.

I came across to my terminal and open telnet to the victim by using the default password and I was in and now I was able to take control of this computer but this was not include in the plan.

FTP (file transfer protocol), I came to my terminal again and this time I have used FTP command with the same combination of user name and password and successful. Remember FTP access means you can download and upload files on remote computer means full access. You can use some GUI ftp client but I used command.

Countermeasure

Always use a strong password
Turn on your Firewall (both on router and computer)