Friday, May 22, 2020

HTML5 Games On Android

On my last hollidays, I made two HTML5 games, and published on android market. Nowadays javascript has powerful libraries for doing almost everything, and also there are several compilers from java or c code to javascript, converting opengl c code to html5 canvas, but definitely, javascript execution is slower than dalvik applications, and of course much slower than arm c libs. For improving the speed of sounds and images loader, I have used javascript asynchronous execution and scheduling priority has been controlled with setTimeout/setInterval which deprioritize or priorize a code block. This games are published on the android market here: Android Planets and here: Far Planet More articles
  1. Hacking Xbox One
  2. Como Convertirse En Hacker
  3. Hacker Etico
  4. Hacking Health
  5. Etica Hacker

DSniff


"dsniff is a collection of tools for network auditing and penetration testing. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI." read more...

Website: http://www.monkey.org/~dugsong/dsniff/

Related news


Thursday, May 21, 2020

CEH: 10 Hacking Tools For Hackers


There are a lot of hacking tools available over the internet but mostly we need some of them. In this blog you'll learn about hacking tools which are typically used in the world of hacking by penetration testers.

SmartWhois

SmartWhois is an information-gathering program that allows you to find all available information about an IP address, hostname, or domain, including country, state or province, city, name of the network provider, administrator, and technical support contact information. SmartWhois is a graphical version of the basic Whois program.

SocksChain

SocksChain is a tool that gives a hacker the ability to attack through a chain of proxy servers. The main purpose of doing this is to hide the hacker's real IP address and therefore minimize the chance of detection. When a hacker works through several proxy servers in series, it's much harder to locate the hacker. Tracking the attacker's IP address through the logs of several proxy servers is complex and tedious work. If one of the proxy servers' log files is lost or incomplete, the chain is broken, and the hacker's IP address remains anonymous.

NeoTrace, VisualRoute, and VisualLookout

NeoTrace, VisualRoute, and VisualLookout are all packet-tracking tools with a GUI or visual interface. They plot the path the packets travel on a map and can visually identify the locations of routers and other internet working devices. These tools operate similarly to traceroute and perform the same information gathering; however, they provide a visual representation of the results.

Visualware's eMailTrackerPro

Visualware's eMailTrackerPro ( www.emailtrackerpro.com/ ) and MailTracking ( http://mailtracking.com/ ) are tools that allow an ethical hacker to track email messages. When you use these tools to send an email, forward an email, reply to an email, or modify an email, the resulting actions and tracks of the original email are logged. The sender is notified of all actions performed on the tracked email by an automatically generated email.

IPEye

IPEye is a TCP port scanner that can do SYN, FIN, Null, and XMAS scans. It's a command line tool.
IPEye probes the ports on a target system and responds with closed, reject, drop, or open. Closed means there is a computer on the other end, but it doesn't listen at the port. Reject means a firewall is rejecting the connection to the port (sending a reset back). Drop means a firewall is dropping everything to the port, or there is no computer on the other end. Open means some kind of service is listening at the port. These responses help a hacker identify what type of system is responding.

IPSecScan

IPSecScan is a tool that can scan either a single IP address or a range of addresses looking for systems that are IPSec enabled that means the system has IPSec enabled while disabled means that it either has IPSec disabled, the compatibility issue or the configuration issue that not reveal to you that it has IPSec enabled. Indeterminable means that the scanner isn't sure if IPSec is enabled or disabled.

Icmpenum

Icmpenum uses not only ICMP Echo packets to probe networks, but also ICMP Timestamp and ICMP Information packets. Furthermore, it supports spoofing and sniffing for reply packets. Icmpenum is great for scanning networks when the firewall blocks ICMP Echo packets but fails to block Timestamp or Information packets.

SNMP Scanner

SNMP Scanner allows you to scan a range or list of hosts performing ping, DNS, and Simple Network Management Protocol (SNMP) queries. This tool helps you to find out the current information about the device of SNMP nodes in the given network.

hping2 tool

The hping2 tool is notable because it contains a host of other features besides OS fingerprinting such as TCP, User Datagram Protocol (UDP), ICMP, and raw-IP ping protocols, traceroute mode, and the ability to send files between the source and target system.

THC-Scan, PhoneSweep, and TeleSweep

THC-Scan, PhoneSweep, and TeleSweep are tools that identify phone numbers and can dial a target to make a connection with a computer modem. These tools generally work by using a predetermined list of common usernames and passwords in an attempt to gain access to the system. Most remote-access dial-in connections aren't secured with a password or use very rudimentary security.
Related links

  1. Hacking Mac
  2. Tutorial Hacking
  3. Whatsapp Hacking
  4. Herramientas Hacking
  5. Python Desde 0 Hasta Hacking - Máster En Hacking Con Python
  6. Google Hacking
  7. Hacking Wifi

Top10 Java Script Blogs To Improve Coding Skills

10 Top JavaScript Blogs to Improve Coding Skills
 

The Best JavaScript Blogs

With two decades of improvement, JavaScript has become one of the most popular programming languages of all time. The journey started in 1995 when Brendan Eich created JavaScript in just 10 days. From there, it has seen multiple revisions, drafts, and growth in the form of frameworks, API's, modules, etc. Today, we will go forward and list the top JavaScript blogs from the internet so that you can enjoy the lastest development in the field of JavaScript.

According to RedMonk programming language rankings and GitHut.info, JavaScript is leading the pack in the terms of repositories and the most discussed programming language on StackOverFlow. The numbers itself speaks about the future of JavaScript as it has grown beyond the initial capabilities of simple DOM manipulations.

Learning JavaScript, on the other hand, can be a tricky proposition. New libraries, features, API's or Style Guide, pop up almost every day. The speed of iteration is beyond imagination, and that is why reading leading JavaScript blogs are the best approach to keep up with new changes.

Slack-clone-angularjs

JavaScript is blessed with experts that regularly contribute to the community using live streams, videos, blogs, podcasts, conferences and open source projects. An example of a cool experienced Javascript programmer is evilsoft who broadcasts awesome Javascript projects weekly on LiveEdu..

Some blogs are just gold even when they are not updated frequently. To help you reach the best content on JavaScript, let's list the best JavaScript blogs on the internet. The following blogs have a huge fan following and contain epic JavaScript content.

10 Top JavaScript Blogs to Improve Coding Skills

1. David Walsh Blog

David Walsh is a renowned name in the JavaScript world. He started his career with DZone, but his first real break came while working for SitePen as a Software Engineer. His blog composes of topics related to JavaScript, personal thoughts, guides and much more. The blog design is captivating and is going to hook you up on the first visit. Currently, he is working as a Senior Web Developer at Mozilla.

top javascript blogs

2. DailyJS

DailyJS is one of the best JavaScript blogs on the internet. The blog was started by Alex R. Young, an entrepreneur and Node.js expert in 2009. However, there are recent changes that don't sound great. Currently, the blog is no longer updated, but that does not make the content useless at all. The blog covers diverse content on JavaScript including frameworks, API's, libraries, etc.

2-daily-js

3. SitePoint

SitePoint is one of the leading web development portals since 2000. The main attraction of SitePoint is the collection of highly detailed articles. They are aimed at teaching something new to the readers. JavaScript, on the other hand, is one of the leading topics on the website where experts around the world contribute regularly. The rate of the new blog post is high, and you won't find a blog post that doesn't teach you something new. Truly, a great learning place for any JavaScript developer.

3-Sitepoint

4. JavaScript.com

Not technically a blog, but if you love JavaScript, then you need to follow the website's offerings. JavaScript.com news section is an aggregator for excellent JavaScript news, tutorials, guides, and much more. All you need to do is move to their news section and discover tons of new content surrounding JavaScript. The domain is owned by CodeSchool and is mainly utilized to contribute to the community and a landing page to their courses.

4-JavaScript

5. Brendan Eich

What's the best place to find JavaScript knowledge? The inventor? Well, you are right. Brendan Eich, the creator of JavaScript, keeps his blog with filled with his musings and other excellent thought processes about JavaScript. You can also find videos on the blog. Virtually, the blog is the mind of JavaScript where you understand it in an entirely different manner.

5-brendan-eich

6. JavaScript Playground

JavaScript Playground is yet another great place to get started with all the different JavaScript frameworks, API, and libraries. The focus is to work with the JavaScript ecosystem and provide high quality blog articles, screencast, and podcast for the audience. They also blog about different JavaScript guidelines, tips, and tricks.

6-JavaScript-Playground

7. Superhero.js

If you are looking for a superhero to fetch you the best resources on JavaScript, then you have finally found one. Superhero.js is a simple website that aims to collect everything related to JavaScript including videos, articles, presentations, etc. The content is divided into meaningful sections such as "Understanding JavaScript", "Organize Your Code", etc. Also, the page is regularly updated with new information.

7-superhero

8. JavaScript Jabber

Another "not a blog entry" into the list — JavaScript Jabber is a weekly podcast on JavaScript. Each podcast is around 1 hour of jabber and will sure have something for you to learn. They keep their tab on everything related to JavaScript, including core concepts to popular Framework discussions.

8-JavaScript-Jabber

9. Medium JavaScript Collection

Is medium a blog? Technically, not, but it contains high quality JavaScript articles. Medium is a way to connect to the audience so be ready to read many opinions on how JavaScript should have been, and what's wrong with JavaScript. Other than the ramblings, it hosts amazing JavaScript content such as Speed Up Web Apps.

9-JavaScript-collection-medium

10. Smashing Magazine

Smashing Magazine is one of the oldest websites covering web designing and development. They have a dedicated section for JavaScript, which is constantly updated with tutorials of high caliber. The tutorials surround other web development ideas such as UX, Productivity, etc.

10-smashing-magazine

Conclusion

Here are the ten best JavaScript blogs to improve your coding skills. The blogs and mix of other content types will help you to keep up with new changes in JavaScript field, and improve yourself accordingly.

If you are new to JavaScript and want to get started as soon as possible, check out the JavaScript learn section on LiveEdu.tv. And, yes, it is the most popular programming language on LiveEdu.tv which can benefit from your attention! Also, don't forget to leave a comment on how the JavaScript category page can be improved. We are listening!

Dr. Michael J. Garbade

About Author Dr. Michael Jurgen Garbade is the founder of LiveEdu.TV, Kyuda, Education Ecosystem. He is future Venture Capitalist, Future Politician and always on the lookout for the Next Big Challenge. Obtained Masters in business administration and physics, and a Ph.D. in finance with professional work experience in high-paced environments at Fortune 500 companies like Amazon and General Electric. Expertize: Python, PHP, Sencha Touch & C++, SEO, Finance, Strategy & E-commerce. He speaks English and German and has worked in the US, Europe, and Asia. At Education Ecosystem he is the CEO and runs business operations.

Continue reading

  1. Hacking Growth Sean Ellis
  2. Seguridad Y Hacking
  3. Growth Hacking Pdf
  4. Hacking To The Gate Lyrics

How To Start | How To Become An Ethical Hacker

Are you tired of reading endless news stories about ethical hacking and not really knowing what that means? Let's change that!
This Post is for the people that:

  • Have No Experience With Cybersecurity (Ethical Hacking)
  • Have Limited Experience.
  • Those That Just Can't Get A Break


OK, let's dive into the post and suggest some ways that you can get ahead in Cybersecurity.
I receive many messages on how to become a hacker. "I'm a beginner in hacking, how should I start?" or "I want to be able to hack my friend's Facebook account" are some of the more frequent queries. Hacking is a skill. And you must remember that if you want to learn hacking solely for the fun of hacking into your friend's Facebook account or email, things will not work out for you. You should decide to learn hacking because of your fascination for technology and your desire to be an expert in computer systems. Its time to change the color of your hat 😀

 I've had my good share of Hats. Black, white or sometimes a blackish shade of grey. The darker it gets, the more fun you have.

If you have no experience don't worry. We ALL had to start somewhere, and we ALL needed help to get where we are today. No one is an island and no one is born with all the necessary skills. Period.OK, so you have zero experience and limited skills…my advice in this instance is that you teach yourself some absolute fundamentals.
Let's get this party started.
  •  What is hacking?
Hacking is identifying weakness and vulnerabilities of some system and gaining access with it.
Hacker gets unauthorized access by targeting system while ethical hacker have an official permission in a lawful and legitimate manner to assess the security posture of a target system(s)

 There's some types of hackers, a bit of "terminology".
White hat — ethical hacker.
Black hat — classical hacker, get unauthorized access.
Grey hat — person who gets unauthorized access but reveals the weaknesses to the company.
Script kiddie — person with no technical skills just used pre-made tools.
Hacktivist — person who hacks for some idea and leaves some messages. For example strike against copyright.
  •  Skills required to become ethical hacker.
  1. Curosity anf exploration
  2. Operating System
  3. Fundamentals of Networking
*Note this sites





Related word

Wednesday, May 20, 2020

CLOUDKiLL3R - Bypasses Cloudflare Protection Service Via TOR Browser


CLOUDKiLL3R bypasses Cloudflare protection service via TOR Browser !

CLOUDKiLL3R Requirements :
  • TOR Browser to scan as many sites as you want :)
  • Python Compiler

CLOUDKiLL3R Installation ?
Make sure that TOR Browser is up and running while working with CLOUDKiLL3R .
Make sure that the IP AND PORT are the same in TOR Browser preferences > advanced > Networks
Include the files below in one folder :
  • FILTER.txt
  • CK.pl
Make Sure The Modules Below Are Installed If NOT > use this command to install one : pip install [module name]
  • argparse
  • socks
  • socket
  • requests
  • sys

Contact :
Twitter.com/moh_security


Related news


  1. Python Hacking
  2. Hacking Articles
  3. Hacking Health
  4. Grey Hat Hacking
  5. Master Growth Hacking
  6. Hacking Tools
  7. Funnel Hacking Live
  8. Como Convertirse En Hacker
  9. Paginas De Hacking
  10. Curso Hacker
  11. Google Hacking Search
  12. Tools Hacking

Brutality: A Fuzzer For Any GET Entries

Brutalitys' Features
  • Multi-threading on demand.
  • Fuzzing, bruteforcing GET params.
  • Find admin panels.
  • Colored output.
  • Hide results by return code, word numbers.
  • Proxy support.
  • Big wordlist.
Screenshots:

Brutality's Installtion

How to use Brutality?

Examples:
   Use default wordlist with 5 threads (-t 5) and hide 404 messages (–e 404) to fuzz the given URL (http://192.168.1.1/FUZZ):
python brutality.py -u 'http://192.168.1.1/FUZZ' -t 5 -e 404

   Use common_pass.txt wordlist (-f ./wordlist/common_pass.txt), remove response with 6969 length (-r 6969) and proxy at 127.0.0.1:8080 (-p http://127.0.0.1:8080) to fuzz the given URL (http://192.168.1.1/brute.php?username=admin&password=FUZZ&submit=submit#):
python brutality.py -u 'http://192.168.1.1/brute.php?username=admin&password=FUZZ&submit=submit#' -f ./wordlist/common_pass.txt -r 6969 -p http://127.0.0.1:8080

ToDo List:
  • Smooth output.
  • Export file report.
  • Modularization.

Related news
  1. Ethical Hacking Course
  2. Hackers Informaticos Contactar
  3. Growth Hacking Que Es
  4. Windows Hacking
  5. Growth Hacking Definicion
  6. Hacking Quotes
  7. Libro Hacker
  8. Hacking Raspberry Pi

Top 20 Best Free Hacking Apps For Android |2019|

 20 Best Free hacking apps For Android |2019|. 

Android is now one of the most popular operating systems. So, hackers have also started using Android devices for their tasks. Now Android devices are used for penetration testing and other hacking activities including IT security administrator, Wi-Fi hacking and network monitoring. There are several hacking apps or Android devices. So, we have curated a list of best hacking apps for Android.


Before you start using these apps, you must take a backup of your important data. I also recommend the use of these apps on a separate device. Using this on your primary phone is not recommended. It is because many of these apps require a rooted device and app can also harm your phone.


Note: Hacking apps can be used for educational and malicious purpose. But we never encourage malicious operations. We are listing the apps here just for educational purpose. You should only use these apps to learn. We do not support any unethical use of these apps.

1.  AndroRAT

AndroRAT stands for Android RAT. RAT is the short form of Remote Administrative Tool and it allows an attacker to remotely control and fetch information from a device. AndroRAT does the same thing. It has a server developed in Java/Swing but the Android application has been developed in Java Android.

AndroRAT allows you to connect information like call logs, contacts, messages, location and more. You can remotely monitor sent and received messages send texts, use the camera, open a URL in the browser, make phone calls and remotely monitor the device.

The connection to the server can be triggered by an SMS or a call. From the server GUI, you can check all the connected clients and access information.

As the app allows silent remote access, it is not available on Play Store.

                Download APK

2. zANTI

zANTI is a known penetration testing suite of applications you can install locally on Android smartphone. This tool brings scanning tools Diagnostic features and Reporting tools. You can use this malicious software to attack a network and check for any loopholes in your network. This tool is used to test redirect and SSL stripping attacks. You can edit request and response messages from web servers, the host takes websites from your Android phone and more.


                  Download 

3. FaceNiff

FaceNiff is another good Android hacking that allows you to intercept the traffic of your WiFi network. You can use this tool to snoop what people are doing on the network you are. You can snoop on services like Facebook, Twitter, Amazon, YouTube and more. This is one of the notable too for steal cookies from the WiFi network and gives the attacker unauthorized access to other people's account.

This app requires a rooted device. So, you can only use the app if you have a rooted phone.

Download APK

4. Droidsheep

Droidsheep is also a similar app that helps security analysts understand what is happening in your Wi-Fi network. Like Face Sniff, this app can also hijack the web session profiles over a network and supports most of the services and websites.

The primary difference between Droidsheep and FaceSniff is that Droidsheep works with almost all the websites while FaceSniff has limited support.

                     Download APK

5. Hackode

Hackode is another good hacking apps for Android. It is not a single app but a collection of tools for ethical hackers and penetration testers. The app comes with three modules including Reconnaissance, Scanning and Security Feed. You can use this app for SQL Injection, Google hacking, MySQL Server, Whois, Scanning, DNS Dif, DNS lookup, IP, MX Records, Security RSS Feed, Exploits etc.

The app is still in beta, but available in Play Store.

                  Download Here

6. cSploit

cSploit is also a good security tool for Android. It comes with several options like cracking Wi-Fi password, installing backdoors, finding vulnerabilities and their exploits. If you are looking for a good hacking app or hacker app for Android, you should try this one for sure.

                  Download APK

7. DroidBox

DroidBox is also a similar kind of app that allows you to do the dynamic analysis of Android applications. You can use this app to get information like hashes of APK package, network traffic, SMS & phone calls, Incoming/outgoing network data, Listing broadcast receivers and more.

                    Download

8. Nmap

If you are into security or hacking, I am sure you already know the name of this too. Like the desktop tool, Nmap for Android also allows you to scan

It works on both on non-rooted and rooted phones. If you are a beginner, you should try this app and learn from it.

                      Download

9. SSHDroid

SSHDroid is SSH tool developed for Android. It lets you connect to a remote computer and run terminal commands, transfer and edit files. The app also provided features like shared-key authentication, WiFi autostart whitelist, extended notification control etc,

This app is available on Play Store.

                    Download

10. Kali Linux NetHunter

Kali Linux NetHunter is an open source penetration testing platform for Android. It officially supports Nexus and OnePlus devices. It provides the ultimate penetration testing platform that allows you to perform a wide range of attacks.

                     Download

11. APKInspector

APKInspector allows you to perform reverse engineering on an APK. you can use this to get a deep insight or APK and get the source code of any Android app. You can do modifications in the APK and visualize the DEX code to erase the credits and license.

                 Download APK

12. Shark for Root

Shark for Root is an advanced hacking tool for security experts and hackers. It can work as a traffic snipper. You can use the tcpdump command on rooted devices. It works on Wi-Fi, 3G, and FroYo tethered mode.

                    Download

13. dSploit

dSploit is an Android network penetrating testing suit. You can download and install it on your device to perform network security testing. It supports all Android devices running on Android 2.3 Gingerbread or higher. You need to root this phone for using the app. After rooting the phone, you need to download BusyBox from Google Play Store

The app comes with several modules including Port Scanner, Inspector, RouterPWN, Trace, Login Cracker, Packet Forger, Vulnerability Finder, and MITM.

                      Download

14. WPScan

WPScan is a WordPress vulnerability scanner for Android. This app is used to scan WordPress based websites and find possible vulnerabilities. WPScan is a popular desktop tool but this WPScan for Android is not related to that. So, do not think of it as an official WPScan app.

                      Download

15. Network Mapper

Network Mapper is a network scanner tool for network admins. It used to scan the network, lists all devices connected and find Open ports of various servers like FTP servers, SSH servers, SMB servers etc on the network. The tool is available on Play Store.

                     Download

16. Andosid

Andosid is like LOIC for the desktop. This tool is used to perform DOS attacks from Android mobile phones. You can use this tool to set a target URL and perform a DOS attack in one click. The tool will start flooding target URL with fake requests.

                     Download

17. DroidSQLi

DroidSQLi app allows attackers to perform SQL Injection on a target URL. You just need to find a target URL and this tool will start the fully automated SQL Injection attack.

                     Download

18. AppUse

AppUse is a Virtual Machine developed by AppSec Labs. It is a freely available mobile application security testing platform that comes with lots of custom made tools by AppSec Labs. If you want to sue your Android phone as your penetration testing tool, this one is for you.

                   Download

19. Network Spoofer

Network Spoofer is also a good hacking app for android. It lets you change the website on other people's computer from your Android phone. Connect to a WiFI network and then choose a spoof to use with the app. this tool is to demonstrate how vulnerable a network is. Do not try this on any unauthorized networks.

                 Download

20. DroidSheep Guard

As the name suggests, DroidSheep Guard works against DroidSheep. It monitors Android devices' ARP-table and tries to detect ARP-Spoofing attack on your network. It does not require a rooted device.

               Download


@EVERYTHING NT


Related links
  1. Hacking Wifi
  2. Herramientas Hacking
  3. Que Estudia Un Hacker
  4. Paginas De Hacking
  5. Hacking Roblox
  6. Programas Para Hackear
  7. Como Convertirse En Hacker
  8. Cómo Se Escribe Hacker
  9. Hacking System
  10. Aprender Seguridad Informatica
  11. Hacking Significado
  12. Hacking Day
  13. Elladodelmal

What Is Cybercrime? What Are The Types Of Cybercrime? What Is Cyberlaw In India?

What is cyber crime?

Cybercrime is the use of computers & networks to perform illegal activities such as spreading viruses,online  bullying,performing unauthorized electronic fund transfers etc. Most cyber crimes are committed through the internet.
Some cyber crime also be carried out using mobile phones via Sms and online chatting applications.

TYPES OF CYBERCRIME

The following list presents the common types of cybercrimes-

1-Computer Fraud-Intential deception for personal gain via the use of computer system.

2-Privacy Violations-Exposing personal information such as email addresses,phone numbers,account details etc, on social media,websites,etc.

3-Identity theft-Stealing personal information from somebody and impersonating that person.

4-Sharing copyright files/information-This involves distributing copyright protected files such as eBooks and computer program etc.

5-Electronic funds transfer-This involves gaining an unauthorized access to bank computer networks and making illegal funds transferring.

6-Electronic money laundering-This involves the use of the computer to launder money.

7-Atm fraud-This involves intercepting ATM card details such as account numbers and PIN numbers.These details are then used to withdraw funds from the intercepted accounts.

8-Denial of service attack-This involves the use of computers in multiple locations to attack servers with a view of shutting them down.

9-Spam:sending unauthorized emails.
These emails usually contain advertisements.


CYBER LAW

Under The Information Technology Act,2000 
CHAPTER XI-OFFENCES-66. Hacking with computer system.

1-whoever with the Intent to cause or knowing that he is likely to cause Wrongfull Loss or Damage to the public or any person Destroys or Deletes or Alter any Information Residing in computer Resource or diminishes its value or utility or affects it injuriously by any means, commits hack.

2-whoever commits hacking shell be punished with imprisonment up to three years, or  with fine which may extend up to two lakh rupees,or with both.
Related articles

  1. Hacking Ético
  2. Hacking Cracking
  3. Growth Hacking Pdf
  4. 101 Hacking
  5. Manual Del Hacker
  6. Start Hacking
  7. Udemy Hacking
  8. Hacking Health
  9. Aprender Seguridad Informatica
  10. Que Hace Un Hacker
  11. Growth Hacking Examples
  12. Hacking Music
  13. Python Desde 0 Hasta Hacking - Máster En Hacking Con Python
  14. Hacker Significado
  15. Aprender Hacking Desde Cero

Tuesday, May 19, 2020

Cómo Te Pueden Hackear Cuentas De Whatsapp Usando El Buzón De Voz

Algo que sabes, algo que tienes y algo que eres. Estas son las tres categorías de las que se sirven los sistemas para autenticar a un usuario, es decir, el proceso por el cual la identidad que está queriendo acceder puede responder a la pregunta de quién. Gran parte de los servicios de Internet, en sus inicios, solicitaban únicamente en el registro la necesidad de tener asociado un correo electrónico para cambiar la contraseña.

Figura 1: Cómo te pueden hackear cuentas de Whatsapp usando el buzón de voz

Para un atacante que quisiera conseguir el acceso a un servicio de una persona, primero debía conocer cuál era el correo electrónico de su objetivo, y luego centrarse en conseguir acceso al e-mail, robando la contraseña con un ataque de Spear Phishing, consiguiendo un token OAuth que permitiera leer todos los mensajes como se explica en Sappo, o aprovechándose de que la cuenta de e-mail de recuperación de contraseña sea olvidada y caduquePero el primer paso, siempre es el mismo. Conocer la dirección de e-mail que utiliza un objetivo para identificarse en los servicios de Internet cuando en inicio era solo para recibir mensajes.

El correo electrónico como elemento esencial para la autenticación

En muchas ocasiones, haciendo una simple búsqueda en Google usando técnicas de Hacking con Buscadores podríamos dar con el correo electrónico de una persona. Sin embargo, podría ser que esa persona no hubiera publicado nunca, por lo que podemos recurrir a las siguientes técnicas:

- Leak del login: Chema Alonso ya hablaba sobre ello en el artículo Redes sociales de contactos íntimos que filtran cuentas de sus clientes en donde, introduciendo el correo electrónico, el propio servicio te dice si hay una cuenta creada o no con esa dirección de correo. En servicios como Gmail, además de validar que ese correo existe puedes saber hasta la marca del móvil de la persona ya que se le requiere al usuario acceder a la pestaña de "Seguridad" para obtener el código de seguridad y así poder autenticarse.

Figura 2: Artículo "¿Está seguro tu presidente en Twitter?"
de Yaiza Rubio y Felix Brezo publicado en el blog de ElevenPaths

En cambio, en Outlook, si el correo existe directamente te solicita la contraseña. O, por ejemplo, en 2017, mi compañero Félix Brezo y yo identificamos las cuentas de Twitter de todos los Presidentes de Gobierno y vimos que al menos el 85% de ellos exponía un indicio de la cuenta utilizada en esta red social o que un 30% utilizaron una cuenta de Gmail para su registro.

- Combinaciones de nombre de usuario y servicio de correo: cuando nos encontramos en una situación en la que desconocemos cuál es la cuenta utilizada, en OSRFramework disponemos de una herramienta que se llama mailfy que, pasándoles como parámetro de entrada un nombre de usuario o una dirección de e-mail, te valida si hay una cuenta registrada en servicios como Facebook, Gmail y otros.

Figura 3: Manual de Ciberinvestigación en Fuentes Abiertas: OSINT para Analistas
 
Esta es una herramienta que utilizamos mucho en nuestros ejemplos de búsqueda de información de fuentes OSINT para el mundo de la ciberinvestigación. 

Una vez que hemos conseguido saber la dirección de correo electrónico, al final, todo concluye en poder recuperar el acceso perdido. Un sistema ampliamente aceptado por la mayoría de los servicios como método de recuperación de cuentas cuando te has olvidado de la contraseña, pero que a más de una "celebritry" le ha traído algún que otro disgusto.

El número de teléfono como elemento esencial para la autenticación

Viendo que las direcciones de correo electrónico y el uso de las contraseñas no era lo más recomendable, nació la autenticación basada en el número de teléfono. Con este objetivo, se han creado, entre otros, servicios como el de Mobile Connect, en donde se eliminan por completo las contraseñas. El usuario final introduce su número de teléfono y la operadora automáticamente te envía un desafío de cara a comprobar la posesión del número de teléfono y así finalizar la autenticación. Sin embargo, existen otros servicios de internet como WhatsApp y Telegram que basan la creación de sus cuentas en el número de teléfono.

Empecemos por Whatsapp

Imaginemos la situación en la que un atacante quiere hacerse con una cuenta de un usuario de Whatsapp. Después de instalar la app, tendrá que indicar cuál es el número de teléfono de la cuenta que quiere recuperar en ese terminal y, posteriormente, seleccionar uno de los dos métodos de los que dispone la plataforma para hacer llegar al usuario el código de verificación.

Vamos a plantear tres escenarios que pueden darse. En el Escenario 1, nos encontramos en la situación en la que usuario legítimo dispone de su móvil y recibe un SMS debido a que el atacante ha solicitado el código para verificar el número. 

Figura 4: Verificación de registro de WhatsApp por SMS

A pesar de que este escenario es menos probable de que pueda tener éxito, en el pasado, se ha dado la situación en la que a la víctima se le solicitaba el código de verificación en nombre de Whatsapp. Mira que en el mensaje del SMS lo pone bien claro:  "¡No compartas este código con nadie!" Pero hay más métodos.

1.- Ingeniería social: Como hemos dicho, preguntándole a la víctima por medio de un e-mail, otro SMS, una cuenta maliciosa de WhatsApp o llamándole por teléfono directamente. Cuando se trata de engañar a un usuario, cualquier camino es válido.

2.- App maliciosa o vulnerable con permiso para acceder a los SMS: Si el atacante tiene controlada una app maliciosa con permisos para leer los SMS en el terminal podría recuperarlo siempre. Por ello, hay que tener mucho cuidado qué apps nos instalamos - no tengamos un troyano o una Gremlin App - y tener el sistema operativo y las apps actualizadas. Si tu terminal no soporta las últimas versiones del sistema operativo de Android, deberías pensar en cambiarlo.

3,. SIM Duplicada: Si alguien te puede duplicar tus documentos de identidad, con una fotocopia, o consigue convencer a un empleado en una tienda de tu operadora para conseguir un duplicado de tu SIM, podría recibir los SMS al mismo tiempo, por eso hay que tener mucho cuidado con tu información personal y documentos de identidad.

4.- SIM Swapping: En algunos países, los ataques se hacen abusando de las políticas de portabilidad de números, por lo que es importante conocer cómo de protegido está tu número frente a un intento de portabilidad.

5.- Ataques RTL: Se trata de abusar de la seguridad del canal SMS. Para ello, si el atacante está cerca y conoce bien las herramientas y ataques del Hacking de Comunicaciones Móviles, podría capturar el SMS cuando la antena más cercana los reenvíe hacia tu terminal.

6.- Previsualización de SMS: Si tienes la previsualización de mensajes SMS en la pantalla bloqueada de tu terminal, alguien podría acceder a ellos en un descuido. Sería un ataque local, pero igualmente peligroso. Igual que el truco con Siri para robar cuentas de e-mail.

Como veis, la verificación de dueño de WhatsApp por SMS tiene sus "corner cases" y hay que tener ciertas medidas de precaución, para evitar que uno de estos casos nos afecte. Aún así, quedan dos posibilidades más que pueden ser fácilmente aprovechables por un atacante cercano o remoto.

Escenario 2: Llamada de teléfono

En el Escenario 2, se envía el código de verificación por SMS y, si al cabo de un minuto, no se ha introducido, la víctima podría recibir una llamada a su número de teléfono donde se le indica cuál es su código de verificación. 

Figura 5: Verificación por llamada al número de teléfono

En estos entornos, si el atacante dispusiera del teléfono de la víctima, directamente podría coger la llamada, escuchar el código de verificación y hacerse con la cuenta ya que para descolgar una llamada de teléfono no hay que desbloquear el terminal.

El buzón de voz

Pero imaginemos que la víctima no coge la llamada. Entonces se da el Escenario 3. Automáticamente, WhatsApp te deja un mensaje en el buzón de voz. Y entonces te lo pueden robar del buzón de voz. Para acceder al buzón de voz, suelen existir dos maneras:

1.- Desde tu teléfono: Haciendo la llamada desde el número de teléfono para el que vas a acceder al buzón de voz, por lo que no necesitas dar la contraseña.

Figura 6: WhatsApp deja el código de verificación en el buzon

2) Desde otro teléfono: haciendo una llamada a un número de teléfono si la llamada que se está realizando no es desde el número de teléfono del buzón de voz. En esta situación, te solicitará el PIN en donde dispones de tres intentos. Si esos tres intentos son erróneos se cuelga la llamada. En esta situación, el atacante podría recurrir a estadísticas sobre la frecuencia de uso de los número PIN, en donde el 1234 es el más frecuente, seguido del 1111 y del 0000.

Telegram: El SMS, la llamada y el buzón de Voz

La popular competencia de WhatsApp, el popular Telegram dispone de un sistema parecido. Ofrece a los usuarios los mismos dos métodos: envío del código de verificación mediante SMS y, al cabo de dos minutos, llama al número de teléfono cuya cuenta se quiere recuperar para decirle cuál es el código de verificación, con la salvedad de que no deja el código en el buzón de voz. Esto hace que el problema del ataque al buzón de voz de WhatsApp no le afecte.

Figura 7: Telegram también dispone de código y
llamada telefónica como métodos de validación.

Si bien es cierto que cualquier servicio en Internet debe crear procesos sencillos de cara a captar más usuarios y entendibles a nivel de seguridad para el usuario, esta última opción que ofrece WhatsApp de dejar el código de verificación en el buzón de voz no es ni sencilla, ya que es probable que nadie conozca cuál es su PIN para acceder al buzón de voz y, ni es segura, ya que un atacante con un poco de maña podría sin tener acceso físico al teléfono acceder a la información antes de que el usuario se dé cuenta. 

Recomendaciones de seguridad

Como punto final, os recomiendo el artículo de  Cómo espiar WhatsApp que, aunque tiene ya bastante tiempo, muchos de los ataques sigue funcionando de una forma similar. Respecto a tener protegido tu cuenta de WhatsApp, te dejo esta serie de Proteger tu cuenta de WhatsApp a prueba de balas.

Y para el caso concreto del buzón de voz, asegúrate de que nadie remotamente pueda acceder, ya sea porque tienes desactivado el buzón de voz o porque has cambiado el PIN por defecto. Asegúrate de eso. Por otra parte, tal vez WhatsApp deba replantearse dejar el PIN en un buzón de voz, ya que abre un vector de ataque que tal vez el usuario no sea consciente.

Saludos,


Contactar con Yaiza Rubio

Read more


  1. Herramientas Hacking Android
  2. Hacking Quotes
  3. Google Hacking Search