Avoid Spammy Links By Using 5 URL Expanders

When URL shorteners first came about, spammers used them to disguise malicious links. Now that social networks like Twitter have propelled shortened URLs into widespread use, people are more comfortable clicking through. However, there are still occasions in which you confront possibly dubious links.
We’ve found five URL expansion services that will give you some peace-of-mind when browsing. Take a look through the gallery for our choices, and let us know in the comments about any other sites you use.

• 1. Where Does This Link Go?

The best-looking service for its minimalist design, Where Does This Link Go? is an elegant solution to a simple problem -- determining the destination of a disguised URL.

The info this site returns is basic, but it worked perfectly for all the links we threw at it, so we're happy campers.

• 2. LongURL

In addition to showing where the shortened URL points,

LongURL will dish up meta keywords and a meta description for the content, meaning you're clued-up before you click through.

• 3. URL X-ray

With a cool name and dark looks, URL X-ray is what the cool kids use.

As well as the web version, there's a free bookmarklet that sits on your browser bar, ready to identify short URLs all over the web.

• 4. LinkPeelr

This service will "peel" shortened URLs to reveal the destination.

Then you can click through, if you so wish.

• 5. Sucuri

Security company Sucuri offers a free link-checking service. Simply head over to the site, stick in your short URL and wait for the verdict.

As well as the destination reveal, Sucuri also runs the link through safe site checkers for extra peace-of-mind.

Read more »

Posted in: cyber attack,cyber security,internet tips tricks

uCertify E312-50-v6 CEH Course Review : Ethical Hacking and Countermeasures

The only purpose I started this blog 4 years ago was to make it easy for aspiring ethical hacking students learn the everything in simplified & arranged manner. It consumed plenty of my  time when I first started of & everything was scattered all over the web. And because this ‘Hacking’ industry have its Black & White hat areas, It was really hard to find any mentors for learning. So today I am reviewing one of the most organized learning system from uCertify named E312-50-v6 Prepkit.

You might be already aware that there are several exam to begin with in career in ethical hacking. Now, CEH v6 is one of the exam that most of the  aspirants have to deal with first this exam to learn & understand Ethical Hacking and Countermeasures.

uCertify E312-50-v6 is a preparation kit offered by uCertify.com, makes it very easy  to prepare yourself for CEH v6 exam, which guarantees success in the exam. Just to let you know I have personally tried using  the full version of this Prepkit, only to tell you how good or bad this Prepkit  is.

And I must say – They have covered every single detail that any ethical hacking student must know. More interesting thing I would like to specially mention is, ‘Even If you are an absolute beginner they have provided all the modules to make it easy to learn‘

Even if you have no idea what is Linux is & how it works ? The Prepkit have answer for that too !!

uCertify E312-50-v6 Prepkit Overview

As I told this Prepkit deals with basics of Ethical Hacking and Countermeasures, They have tried to make you understand everything with the Study Help modules. You get number of Exam Standard/Objectives, Articles, How To’s, Notes & Key terms which you can understand about before you are heading for the  tests.

You get numerous practice tests, some diagnostic tests & interactive tests for checking your level of understanding the topics covered. Moreover you can also add custom tests for making it more challenging to learn ethical hacking. All the tests are properly timed to check whether you are preparing well according to the timeline.

What else you ever need to prepare yourself ?

Well, they have provided you to store test histories, reports to analyze while you progress with the learning. Prepkit covers much more smaller details and modules than mentioned here, and everything is well organized in very usable interface accessible on your home PC. I personally feel this Prepkit was good enough for any student to pass CEH exam. You never need to opt for very expensive educational institutes , No need for any mentor.

The Prepkit alone will get the job done for you. All you have to do is Download the Prepkit, Practise & Practice until you are fully prepared for EC Council CEH v6.

uCertify offers such Prepkits for many of different exams and subjects related to Computers & web, You can know more about them by visiting Official website of uCertify.

Click here to get uCertify E312-50-v6  Prepkit.

Read more »

Posted in: cyber attack,cyber security,Hacking,Hacking Books,Hacking Tools,Hacking-Tutorials,social engineering

BROWSER FINGERPRINTING

In this post, I am going to introduce Browser Fingerprinting and I will also demonstrate on how theBrowser Autopwn exploit works. To introduce you first, that over the time, the privacy on the internet has become the prime concern of the users. So in how many ways you think you are carrying this privacy? Or that your activities aren’t being tracked on the web? It’s by-far very true that disabling cookies or using private browsing keeps you from being uniquely identified. But to bring it to your notice, lol! you can still be uniquely pointed out. Wondering how?

“Its more like, hey dude! I don’t even need your damn IP and cookies to find you out.”

Actually, the modern web browsers that we use, send too much of small bits of information to the websites such as the screen size, colour schemes, detailed browser version, fonts installed, the order in which they are installed, font size, OS information and a whole bunch of similar info. So, these innocent looking information in bits, figure out the unique users on their website. Though this has been raised as an issue by most security researchers, still this technique is being used by some bank and credit card companies to identify if its a legitimate user or not. They call this technique, Client-less Device Identification.

So far so good, I will now show you how browser fingerprinting has been used by attackers for getting into the victim’s computer probably making use of social engineering as well.

Let’s assume that the victim has been using some older versions of the browser (might be IE6,7 or Firefox 4 and so on). The attacker uses the exploit to generate a random URL which serves as the lethal weapon against the victim. All the attacker has to do, is convince or persuade the victim to go to that URL, which might involve something of social engineering. The attacker can as well publish that URL on the web and wait for some connection. As soon as a user, which hereby becomes the victim, goes to that URL, he/she sees a loading notification and on the other end, the attacker can see a session that gets created. His job done. Thereby he exclaims, “WHOOPIE!”. Now he has the complete unbound access of the victim’s computer.

To show you the demo snaps, I opened up Metasploit Framework console, used the browser_autopwnexploit as shown:

Type ‘show options‘ to get the list of default options to use the exploit. LHOST must be the IP address of the attacker. SRVPORT is the port to listen on. I used port 80. URIPATH can be anything. After setting up the option, fire the exploit by typing ‘exploit‘. Check the snap below:

As soon as we type ‘exploit‘, the exploit starts the server, generates random URLs and starts listening at port 80. The URL that’s listed at the end would be like ‘http://192.168.244.1/abhimanyu‘ ( This acts as what we call ‘payload’). The moment the user goes to the URL on his computer, that has been generated on the attacker’s side, exactly the same thing happens as I explained before the demo, eventually creating a session.

So this works out very fine and think over how Browser Fingerprinting plays its role. Note that, the attacker doesn’t even know the victim’s IP initially, even though the attacker successfully creates the session using the exploit.

Disclaimer: This is for educational purpose and to make you aware of the scenarios of various different security breaches. The administrator or the authors of prohackersden will not be responsible for any misuse of this post.

Read more »

Posted in: browser hacks,cyber attack,cyber security,footprinting,Hacking,Hacking-Tutorials

SOCIAL ENGINEERING

Social Engineering is something that is not done through the using the technical hacking strategies. It’s about convincing the authenticity of your exploit. So, when is this used? Exactly when the attackers can’t find the vulnerability for their exploits. Right? Its like playing trickery for the purpose of gathering crucial information from the target users. They might be Human Based or Computer Based.

If it’s Human Based, we have the Shoulder Surfing in this. It like silently peeping into the keyboard while someone is typing the password. If it might be possible that the attacker calls the victim and convinces him to have the permission from authorized source to his system. The victim in turn gets convinced and provides most crucial data to the attacker. The attacker might also make the target believe that he is the employee or the contractor, thus providing him with all the required details. It’s also possible that the attacker goes for the social network profile of the victim, chooses one of his friends (say X) and later convinces the victim that he is the friend of X and he needs to know this.

If it’s Computer Based, the most important source for this attack are the email attachments which convinces the users to open it, promising to be from a trusted source. The moment the user opens it, results in the execution of the malicious code contained in the attachment. The another types of social Engineering technique are the Phishing and the Spear Phishing, the technique that was used to hack theInternational Monitory Fund(IMF) days back. What was done in the case of IMF, according to the sources, that an email was sent from within the IMF to the two groups of employee with the subject “2011 Recruitment Plan” and this was intriguing enough to make them click on the attachment or the links. As an attachment was a file named 2011 recruitment plan.xls, that contained the 0-day Exploit, installing a backdoor through Adobe flash Vulnerability. So this indeed is very actively popular Social Engineering strategy these days. You can take a look for further details @ http://www.castigliola.com/index.php?option=com_content&task=view&id=125&Itemid=1

Read more »

Posted in: cyber attack,cyber security,Hacking,Hacking-Tutorials,social engineering

IP STEALING AND EMAIL TRACING

Each device on a computer network is provided with a unique number notation, through which they communicate with each other. These number notations are known as IP addresses and the standard used for the communication is called as IP or Internet Protocol standard. There are two versions of IP: IPv4and IPv6. Until now, we have been using IPv4 for providing IP addresses, which uses 32 bit notation, but due to growth of more and more internet users, there are issues and testing on implementing IPv6, that uses 128 bits for the addressing, so its hard to get exhausted.

IP STEALING

So, what if we know the IP address of someone you are talking on Instant Messengers? IP addresses are as personal to the owners as are their phone numbers. Using an IP address of someone, you can trace out the general location of the person where he lives. This is on the individual point of view, but with an IP of a target website, the attacker can go for even most serious DDoS attacks. The difference being, you can get the IP address of a website by simple ping command on the command prompt as ‘ping websitename’

To know your own IP: http://www.whatismyip.com/

To find the IP of a particular domain: http://domains.whois.com/domain.php?action=whois

To get an IP address of someone, you just have to make a user click on the link posted by you, either on the Instant Messengers or Emails. So to do it,

1. Go to the DOWNLOADS section, download the file named ‘IP Stealing Script’.
2. Create a blank text file named ip.txt
3. Upload both these files to some web diectory through FTP. Provide ip.txt the CHMOD as 777. Suppose the attacker uploaded it to some directory ‘x’ and he got the link as http://www.website.com/x/ip-stealing-script.php
4. Now the attacker directs the victim to click on the link, or he anyhow flatter him to click on it. (SOCIAL ENGINEERING)
5. The moment the victim clicks on the link, he/she gets redirected to some website specified in the script, as I mentioned ‘google.com’ in it. But behind this everything, the attacker’s job is done.
6. The attacker goes to the say http://www.website.com/x/ip.txt and sees something like this:

Now that you got the victim’s IP, you can easily trace him back through websites likehttp://www.geobytes.com/IpLocator.htm

EMAIL TRACING

In Email tracing, now that you knew how to trace an IP, you just need to know the IP address of the sender’s computer. I am using Gmail to demonstrate this. Now, what you need to do is

1. Open one of your Gmail Inbox mail.
2. You can see a button on top right corner of the mail, expand it as:
3. Now click on the ‘Show Original’ option, you can see something like this:
4. Now that you have the IP address of the sender, you can trace it with HTTP://WWW.GEOBYTES.COM/IPLOCATOR.HTM

Disclaimer: This is for educational purpose and to make you aware of the scenarios of various different security breaches. The administrator or the authors of thecybersaviours will not be responsible for any misuse of this post.

Hope this post was as interesting, keep enjoying!!

Read more »

Posted in: cyber attack,cyber security,Email Hacking,Hacking,Hacking-Tutorials,ip Hacks