Apr 4, 2014

Howto: Delete iCloud Account wihtout password (Works on iOS7.0 and iOS7.1)

1.  Touch Find my iphone and Delete my account in the same time

2. Your screen will hang and doesn't response anything.

3.  Try to delete iCloud Account again, it will not ask any password.

Have a nice day. :)

Source: http://bgr.com/2014/04/03/ios-7-security-flaw-find-my-iphone-disable-restore/

If you like my blog, Please Donate Me
Or Click The Banner For Support Me.

Apr 2, 2014

CheatSheet: SIFT 3.0

Download Link: https://dl.dropboxusercontent.com/u/2330423/sift_cheat_sheet.pdf

Source: http://digital-forensics.sans.org/media/sift_cheat_sheet.pdf

If you like my blog, Please Donate Me
Or Click The Banner For Support Me.

Tools: HonSSH – A high interaction honeypot solution for Linux based systems

The honeypot is connected to the same virtual network as the internal NIC of HonSSH.
The iptables on the machine running HonSSH will forward any outbound connections from the virtual network and allow incoming connections on tcp/22, but it’s NOT configured to forward this connection to the honeypot as this will be handled by HonSSH itself.
The second NIC on the HonSSH machine is connected to the same network as the gateway. The gateway will handle any incoming requests to tcp/22 as it normally would do and forward them to tcp/22 on the HonSSH machine.
When the attacker finds the correct username/password combination and is able to access the honeypot, HonSSH takes over the show.
HonSSH is configured to intercept incoming connections on tcp/22 (or the port of your choosing), and once the connection is intercepted it will establish a new connection of its own from the NAT device to the honeypot and preform a sort Man-In-The-Middle attack if you like. This will be completely transparent to the attacker.
The attacker will not find any suspicious processes or installed software on the machine he just connected that will tip him off about this being a honeypot. All passwords the attacker enters are logged to the HonSSH logs, and if the attacker uses the honeypot as a pivot device and connects to another machine using SSH that too, including all passwords, will be logged.
If we built an entire network infrastructure as one giant honeypot we would only need to use HonSSH to monitor the first device the attacker connected to, as all other connections from that device would be captured as well.

Source: http://bruteforce.gr/honssh-high-interaction-honeypot-solution-linux-based-systems.html

If you like my blog, Please Donate Me
Or Click The Banner For Support Me.

Howto: Execute External Programs, the Python Ways.

In Python, there are many ways to execute external programs. The easiest one is to import the os package. It provides the popen(), system(), startfile() methods.
import os
print os.popen("echo Hello, World!").read()
The os.popen() will treat the output (stdout, stderr) as file object, so you can capture the output of the external programs. It is one of the synchronous methods.
The os.system() is also synchronous, which is fairly easy to use, and it returns the exit-status.

import os
print os.system('notepad.exe')
By acting like double-click in the file explorer, you can use os.startfile() to launch external program that is associated with this file. This is an asynchronous method.
import os
It will throw out an exception if file is not found.
WindowsError: [Error 2] The system cannot find the file specified:

If you install the win32api package (which is not shipped by the python installation by default), you can use the following asynchronous method.
import win32api
Of course, this is only available on windows platforms. The subprocess package provides a syncrhonous and an asynchronous methods: namely, call and Popen. Both methods take the first parameter as a list. For example,
import subprocess
subprocess.call(['notepad.exe', 'abc.txt'])
# thread continues ...
You can use wait() to synchronous the processes.
import subprocess
p = subprocess.Popen('ls', shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
for line in p.stdout.readlines():
    print line
retval = p.wait()
Another asynchronous method would be to use asynproc package. The example is given below.
import os
from asynproc import Process
myProc = Process("notepad.exe")
while 1:
    # check to see if process has ended
    poll = myProc.wait(os.WNOHANG)
    if poll != None:
    # print any new output
    out = myProc.read()
    if out != "":
        print out
The following is a popular script taken from stackoverflow which shows the usage of subprocess package.
from subprocess import Popen, PIPE
import time
running_procs = [
    Popen(['/usr/bin/my_cmd', '-i %s' % path], stdout=PIPE, stderr=PIPE)
    for path in '/tmp/file0 /tmp/file1 /tmp/file2'.split()]
while running_procs:
    for proc in running_procs:
        retcode = proc.poll()
        if retcode is not None: # Process finished.
    else: # No process is done, wait a bit and check again.
    # Here, `proc` has finished with return code `retcode`
    if retcode != 0:
        """Error handling."""

Source: http://helloacm.com/execute-external-programs-the-python-ways/

If you like my blog, Please Donate Me
Or Click The Banner For Support Me.

Tools: Ninja-PingU - High performance network scanner tool for large scale analyses

NINJA-PingU Is Not Just a Ping Utility is a free open-source high performance network scanner tool for large scale analyses. It has been designed with performance as its primary goal and developed as a framework to allow easy plugin integration.

Source: http://owasp.github.io/NINJA-PingU/index.html 

If you like my blog, Please Donate Me
Or Click The Banner For Support Me.

Mar 31, 2014

Tools: SysAnalyzer - automated malcode run time analysis application


SysAnalyzer is an automated malcode run time analysis application that monitors various aspects of system and process states. SysAnalyzer was designed to enable analysts to quickly build a comprehensive report as to the actions a binary takes on a system. SysAnalyzer can automatically monitor and compare:
  • Running Processes
  • Open Ports
  • Loaded Drivers
  • Injected Libraries
  • Key Registry Changes
  • APIs called by a target process
  • File Modifications
  • HTTP, IRC, and DNS traffic
SysAnalyzer also comes with a ProcessAnalyzer tool which can perform the following tasks:
  • Create a memory dump of target process
  • parse memory dump for strings
  • parse strings output for exe, reg, and url references
  • scan memory dump for known exploit signatures
Full GPL source for SysAnalyzer is included in the installation package. 

Source: http://www.aldeid.com/wiki/SysAnalyzer

If you like my blog, Please Donate Me
Or Click The Banner For Support Me.

Tools: Smbexec rapid post exploitation tool

Smbexec is a tool that you can use for penetration testing domain controllers, the program allows to run post exploitation for domain accounts and expand the access to targeted network. this makes pentester have a full access without any privilege requirement.
Latest release include improvements so it runs faster and there are more options in configuration and a module that support file search. using smbexec allows to easily go through all machines on the network and collect the necessary information such as the UAC configuration or other system settings beside where the domain administrators credentials are in use.

Source: http://www.sectechno.com/2014/03/30/smbexec-rapid-post-exploitation-tool/

If you like my blog, Please Donate Me
Or Click The Banner For Support Me.