The power of google

This post is being written after a long time since the previous one. Because of lack of time and mood. But this one is definitely one of the most important.

The most powerful search engine of the world- Google.com is indeed powerful. But, like every power, Google is also a double edged sword.

The search engine can be used to reveal password files of various sites, most of which are encrypted by the DES algorithm, and can be cracked right away. This will give access to various ftp servers, and who knows? may be even many telnet servers, or proxy servers of the corresponding sites.

In this post, I'll tell about the various search techniques in Google, which also work in many other search engines.

inurl (also allinurl) - This keyword is used to search for a specific string in the url(Uniform Resource Locator) of the sites being searched. Those with a positive match are listed in the search results.
for example,

inurl:google.com

will list all results, which have google.com in the url.

site - This keyword is used to search for a specific kind of site. Type of site is specified by the extension of the site. It may be .edu(Educational institution), .com(Commercial organization), .org(non profit organization), .gov(Governmental organization), .net(Network), .mil(Millitary network) and the others are normally country abbreviations(e.g. .jp for Japan, .in for India, .br for Britain etc.)
for example,

site:mil

will list all sites, with mil extension. This one is actually a U.S. millitary network.

filetype - This keyword is used to access certain file extensions in sites. This one is particularly useful for accessing password files. The password files are normally in the pwd, pw, mdb, xls extensions. The pwd files will store maintenance or service passwords.
for example,

filetype:mpg

will search for mpeg video files in the sites being searched. Other extensions can be searched in this way.

index of - This keyword is used to search for directory listings. It is also useful for searching certain types of files. It is particularly useful, if it is known, which directory, a certain type of file is stored in a web server. For example, the _vti_pvt folder will store service.pwd, which happens to store the service passwords.
for example,

index of /

will search for the directory listing of vulnerable sites.

OR - An uppercase OR acts as logical OR
intitle (also allintitle) - The intitle keyword is used to search for pages, which have the specified string in the title tags.

link - This keyword will search for the sites, which have link to the specified site.
for example,

link:www.google.com

will search for sites, which have a link to the site www.google.com

related - This keyword will list all pages, which are similar to the specified web page.

info - This keyword will show information, that Google has about the specified website.

Well, that's all folks, I have included enough information in this post, that will be enough to search for password files, and break into servers, but always remember - Intelligence is a double edged sword. Which edge you end up using, is on to you.

Cracking the windows OS

Ever thought about cracking into the windows box, without having to know the Admin password???

Well, here comes the ophcrack live CD. The ophcrack has been the best windows password cracker, in the open source world till date, which utilizes rainbow tables, to crack windows password. Now, the ophcrack comes with a live CD, which runs a version of slackware, which is a sort of Linux, and then extracts the password hash, from the file, which stores the windows registry. Then, it cracks the password with the help of rainbow tables. I came to know about the live CD issue from another post in a blog. More the RAM of the computer, more is the crackable length of the password. Till now, it can crack passwords upto 14 characters, which is the maximum number of characters allowed in the password by windows. Yes, though the MD5 algorithm supports 128 characters long a password, but the windows front end limits the password to 14 characters.

So, windows is broken.....

Original post
ophcrack

Password cracking - The brute force method

The brute force method of password cracking, basically consists of generating every possible combination of all the characters that can be used in the password, and then encrypt each to be checked for a positive match with the original encrypted password.

The brute force method of password cracking, basically consists of generating every possible combination of all the characters that can be used in the password, and then encrypt each to be checked for a positive match with the original encrypted password.

For example, if the encrypted password for my application is hyrulsjcl, and the original password be abcd(don't try this for my account... it's only a dummy example...). Then I try out all combinations, of all characters, in this case, lowercase alphanumeric characters, the combinations being: a, b, c, d, e, f.... z, aa, ab, ac, ad, ..... az, aaa, aab, aac, .... In this way, therewill be a positive ID for abcd, which will encrypt to hyulsjcl and password cracking will be complete.

One of the biggest shortcomings of this technique is that it is a very time taking process. Generating every possible combination, and then encrypting them takes a hell lot of time. As, we have to try out all possible combinations, the hackers had invented new hybrid technique for brute force, in which not every combination is tried out in sequence. Those password crackers, also termed smart brute force crackers check for the hash (the encryption) pattern, and then accordingly choose the next string to be matched for a positive ID.

So, here is a graphic description of how this all goes...

Brute force is not a very easy thing, when it comes to cracking real big passwords. But again, everything has its pros and cons...

a sample brute force cracker - It cracks passwords encrypted by DES, typically, a linux password is encrypted with the DES (Made by me of course ;-)).

a brute force string generator - It simply generates strings. It's got a fast algorithm. Lack of time led to not developing a cracker with it. Very soon, I'll upload that program. It will crack MD5 and DES passwords for linux.

NOTE: 1. You are downloading these files from: http://xtremehcl.googlepages.com The official website of HCl.
2. The original copy of this post is in the official HCl website's this page
Keep watching.....

Password cracking - A brief intro to how they work and to bypass them...

Passwords are everywhere...

Take any application, and it is probably very likely protected by some security measure (most likely a password). Passwords have become the most widely used, and one of the most dependable security measures in present cyber society. Take your email account. It is saved by a password. Your social account - may be in orkut or myspace or any other social network is protected by a password. Your own Operating system is probably password protected. Even your screen saver is protected by a password. Passwords are virtually everywhere. You simply cannot avoid them.

Since this blog is largely about bypassing these passwords, we shall first know how these passwords work. That is the very basis of all types of hacking and cracking.

So, let's end all the crap talk and jump to the real thing...

Passwords, are basically encrypted and stored in a separate file, which is checked, when authentication mechanism comes into play. The algorithm of encryption varies from system to system. In case of operating systems, it is stored in such a location where only the superior most user has access. In case of *nix platforms, it's the /etc/shadow or the /etc/passwd file. In case of windows NT, it's in the registry, or the SAM database. The passwords are encrypted using a predefined algorithm and then stored in these files. When the user has to be authenticated, the authentication program is run and the user has to enter the password, which is then encrypted to match with the already encrypted password present in the file. If it gives a positive ID the user is authenticated, otherwise, access is denied. In case of passwords in online accounts, the password may not be stored in the local computer. It is stored in the remote computer's password database. So, when you login to your computer, the password database used is (may be not in some cases, if your computer is a terminal to another server machine.) present in the local computer. In case of online accounts, as in the case of mail accounts, the password you enter is checked with the one in the server's database.

The very fact that the password is stored in a file in some storage media, is the vulnerability, that is exploited. All we have to do is get the file, and then crack the password. But again, we need to know the algorithm used to encrypt the password. "How to do that?" is the next question that comes in the mind. Fret not. The Internet has the answer to this. Once we get to know the algorithm, we can directly switch over to cracking the passw0rd. It is taken for granted that the reader knows programming. Even if the reader expertise any specific programming language's knowledge, still it is mandatory to learn C. It is the most powerful language I have come to know about, in the sense that it gives control over every single bit, in any memory location.


Now I shall tell about the various techniques of cracking passwords.

There are basically three different ways of cracking a password:

(1) Dictionary based cracking - Where we try out common passwords.

(2) Brute force cracking - Where we try all possible combinations of letters, numbers, and/or special characters.

(3) Rainbow tables - These are my favorite type of attack. It uses a database of preencrypted passwords, using a certain algorithm. This is used as a substitute to brute force, as brute force is a very tedious process, it takes a lot of time to crack a password. As the maximum amount of time is consumed in encryption of passwords, what we do is, encrypt the passwords, and store them in a database. When we have to crack a password, we have to do a simple lookup in the database. This makes the process real fast. The time consumption, thus becomes a one time affair - in the generation of these databases.

A more elaborate descriptions of these methods, along with sample programs is expected to be provided in a later post. Keep checking in...