Hack Like a Pro: Cryptography Basics for the Aspiring Hacker

As hackers, we are often faced with the hurdle of cryptography and encryption. In some cases, we use it to hide our actions and messages. Many applications and protocols use encryption to maintain confidentiality and integrity of data. To be able to crack passwords and encrypted protocols such as SSL and wireless, you need to at least be familiar with the concepts and terminology of cryptography and encryption.

To many new hackers, all the concepts and terminology of cryptography can be a bit overwhelming and opaque. Cryptography is the science and art of hiding messages so that they are confidential, then "unhiding" them so that only the intended recipient can read them. Basically, we can say that cryptography is the science of secret messaging.

With this brief overview for the newcomer, I hope to lift the fog that shrouds this subject and shed a tiny bit of light on cryptography. I intend this simply to be a quick and cursory overview of cryptography for the novice hacker, not a treatise on the algorithms and mathematics of encryption. I'll try to familiarize you with the basic terminology and concepts so that when you read about hashing, wireless cracking, or password cracking and the encryption technologies are mentioned, you have some grasp of what is being addressed.

Don't get me wrong, I don't intend to make you a cryptographer here (that would take years), but simply to help familiarize the beginner with the terms and concepts of cryptography so as to help you become a credible hacker.

I will attempt to use as much plain English to describe these technologies as possible, but like everything in IT, there is a very specialized language for cryptography and encryption. Terms like cipher, plaintext, ciphertext, keyspace, block size, and collisions can make studying cryptography a bit confusing and overwhelming to the beginner. I will use the term "collision," as there really is no other word in plain English that can replace it.

Let's get started by breaking encryption into several categories.

Types of Cryptography

There are several ways to categorize encryption, but for our purposes here, I have broken them down into four main areas.

• Symmetric Encryption
• Asymmetric Encryption
• Hashes
• Wireless

A Word About Key Size

In the world of cryptography, size does matter! In general, the larger the key, the more secure the encryption. This means that AES with a 256-bit key is stronger than AES with an 128-bit key and likely will be more difficult to break. Within the same encryption algorithm, the larger the key, the stronger the encryption.

It does not necessarily mean that larger keys mean stronger encryptionbetween encryption algorithms. Between algorithms, the strength of the encryption is dependent on both the particulars of the algorithm and the key size.

Symmetric Cryptography

Symmetric cryptography is where we have the same key at the sender and receiver. It is probably the most common form of cryptography. You have a password or key that encrypts a message and I have the same password to decrypt the message. Anyone else can't read our message or data.

Symmetric cryptography is very fast, so it is well-suited for bulk storage or streaming applications. The drawback to symmetric cryptography is what is called the key exchange. If both ends need the same key, they need to use a third channel to exchange the key and therein lies the weakness. If there are two people who want to encrypt their communication and they are 12,000 miles apart, how do they exchange the key? This key exchange then is fraught with the all the problems of the confidentiality of the medium they choose, whether it be telephone, mail, email, face-to-face, etc. The key exchange can be intercepted and render the confidentiality of the encryption moot.

Some of the common symmetric algorithms that you should be familiar with are:

• DES - This was one of the original and oldest encryption schemes developed by IBM. It was found to be flawed and breakable and was used in the original hashing system of LANMAN hashes in early (pre-2000) Windows systems.
• 3DES - This encryption algorithm was developed in response to the flaws in DES. 3DES applies the DES algorithm three times (hence the name "triple DES") making it slightly more secure than DES.
• AES - Advanced Encryption Standard is not a encryption algorithm but rather a standard developed by NIST. Presently, it is considered the strongest encryption, uses a 128-, 196-, or 256-bit key and is occupied by the Rijndael algorithm since 2001. Used in WPA2, SSL/TLS, and many other protocols where confidentiality and speed is important.
• RC4 - This is a streaming (it encrypts each bit or byte rather than a block of information) cipher and developed by Ronald Rivest of RSA fame. Used in VoIP and WEP.
• Blowfish - The first of Bruce Schneier's encryption algorithms. It uses a variable key length and is very secure. It is not patented, so anyone can use it without license.
• Twofish - A stronger version of Blowfish using a 128- or 256-bit key and was strong contender for AES. Used in Cryptcat and OpenPGP, among other places. It also is in the public domain without a patent.

Asymmetric Cryptography

Asymmetric cryptography uses different keys on both end of the communication channel. Asymmetric cryptography is very slow, about 1,000 times slower than symmetric cryptography, so we don't want to use it for bulk encryption or streaming communication. It does, however, solve the key exchange problem. Since we don't need to have the same key on both ends of a communication, we don't have the issue of key exchange.

Asymmetric cryptography is used primarily when we have two entities unknown to each other that want to exchange a small bit of information, such as a key or other identifying information, such as a certificate. It is notused for bulk or streaming encryption due to its speed limitations.

Some of common asymmetric encryption schemes you should be familiar with are:

• Diffie-Hellman - Many people in the field of cryptography regard the Diffie-Hellman key exchange to be the greatest development in cryptography (I would have to agree). Without going deep into the mathematics, Diffie and Hellman developed a way to generate keys without having to exchange the keys, thereby solving the key exchange problem that plagues symmetric key encryption.

• RSA - Rivest, Shamir, and Adleman is a scheme of asymmetric encryption that uses factorization of very large prime numbers as the relationship between the two keys.
• PKI - Public key infrastructure is the widely used asymmetric system for exchanging confidential information using a private key and a public key.

• ECC - Elliptical curve cryptography is becoming increasing popular in mobile computing as it efficient, requiring less computing power and energy consumption for the same level of security. ECC relies upon the shared relationship of two functions being on the same elliptical curve.
• PGP - Pretty Good Privacy uses asymmetric encryption to assure the privacy and integrity of email messages.

Hashes

Hashes are one-way encryption. A message or password is encrypted in a way that it cannot be reversed or unencrypted. You might wonder, "What good would it do us to have a something encrypted and then not be able to decrypt it?" Good question!

When the message is encrypted is creates a "hash" that becomes a unique, but indecipherable signature for the underlying message. Each and every message is encrypted in a way that it creates a unique hash. Usually, these hashes are a fixed length (an MD5 hash is always 32 characters). In that way, the attacker can not decipher any information about the underlying message from the length of the hash. Due to this, we don't need to know the original message, we simply need to see whether some text creates the same hash to check its integrity.

This is why hashes can be used to store passwords. The passwords are stored as hashes and then when someone tries to log in, the system hashes the password and checks to see whether the hash generated matches the hash that has been stored. In addition, hashes are useful for integrity checking, for instance with file downloads or system files.

In the world of encryption and hashing, a "collision" is where two different input texts produce the same hash. In other words, the hash is not unique. This can be an issue when we assume that all the hashes are unique such as in certificate exchanges in SSL. NSA used this property of collisions in the Stuxnet malware to provide it with what appeared to be a legitimate Microsoft certificate. Hash algorithms that produce collisions, as you might guess, are flawed and insecure.

These are the hashes you should be familiar with.

• MD4 - This was an early hash by Ron Rivest and has largely been discontinued in use due to collisions.
• MD5 - The most widely used hashing system. It's 128-bit and produces a 32-character message digest.
• SHA1- Developed by the NSA, it is more secure than MD5, but not as widely used. It has 160-bit digest which is usually rendered in 40-character hexadecimal. Often used for certificate exchanges in SSL, but because of recently discovered flaws, is being deprecated for that purpose.

Wireless Cryptography

Wireless cryptography has been a favorite of Null Byte readers as so many here are trying to crack wireless access points. As you might guess, wireless cryptography is symmetric (for speed), and as with all symmetric cryptography, key exchange is critical.

• WEP - This was the original encryption scheme for wireless and was quickly discovered to be flawed. It used RC4, but because of the small key size (24-bit), it repeated the IV about every 5,000 packets enabling easy cracking on a busy network.
• WPA - This was a quick fix for the flaws of WEP, adding a larger key and TKIP to make it slightly more difficult to crack.
• WPA2-PSK - This was the first of the more secure wireless encryption schemes. It uses a pre-shared key and AES. It then salts the hashes with the AP name or SSID. The hash is exchanged at authentication in a four-way handshake between the client and AP.
• WPA2-Enterprise - This wireless encryption is the most secure. It uses a 128-bit key, AES, and a remote authentication server (RADIUS).

I hope you keep coming back, my rookie hackers, as we continue to explore the wonderful world of information security and hacking! For a more in depth reading on cryptography, I suggest you check out Adam Billman's cryptography guide here on Null Byte.

Read more »

HACK a Wpa2-Psk Password with Windows

How to HACK a Wpa2-Psk Password with Windows :-

It,s very common question on the internet how to hack a WiFi password. Even if you search on YouTube you will find a lots of tutorial to How to hack a WiFi password using backtrack. However, backtrack OS is not most handy OS for normal users. 

Today i am going to show you how to a crack a Wp2-psk password with windows machine.

Software Requirement for this :-

1. CommView for Wifi ( Download)

2. Elcomsoft Wireless Security Auditor (Download)

3.patience 

here we will use 5 attacks

1.DICTIONARY

2.WORD

3.MASK

4.HYBRID

5.COMBINATION 

Presently i am connected with my own wifi network Virusfound and i want to hack the password of Ultimate that is secured with Wpa2-psk encryption.

First you need to be capture the Wpa2, four-way handsake with CommView.

Open commView and click on the Start option

then click on the capture option to start the capture

now it will show you all available AP, Now click on the Tools > Select the Node Reassoication option ( if Node Rassociation is not working , then use WiFi Alfa card )

now select your target AP in the Send a deauthentication request from this AP option. it will show you all available client option.

now click on the Send Now option to send the packet for 4-way authentication. wait for some time so it will capture the packet.

now click on the Save option and choose your file format Commview Capture Files (*.ncf)

you capture work is done.

Now open Elcomsoft Wireless Security Auditor to crack your wifi password.

Click on the Import Data tab > select the Import CommViewLog option.

now it will show you information about AP and Multiple Handshake selection information. Click on Ok.

now click on the Start attack option and select the Dictionary Attack option. However you have other attack options are also available.

now within minutes it will found your password and it will show you the password.

Enjoy Wifi Hacking with Windows machine.

This video will help you in packet capture.

How to HACK a Wpa2-Psk Password with Windows 

Read more »

Footprinting -The Ultimate Guide

=> What Is Footprinting?

Footprinting is the first and most convenient way that hackers use to gather information
about computer systems and the companies they belong to.  The purpose of footprinting to
learn as much as you can about a system, it's remote access capabilities, its ports and
services, and the aspects of its security.

In order to perform a successful hack on a system, it is best to know as much as you can,
if not everything, about that system.  While there is nary a company in the world that
isn't aware of hackers, most companies are now hiring hackers to protect their systems.
And since footprinting can be used to attack a system, it can also be used to protect it.
If you can find anything out about a system, the company that owns that system, with the
right personell, can find out anything they want about you.

In this talk, I will explain what the many functions of footprinting are and what they do.
I'll also footprint everyone's favorite website, just to see how much info we can get on
Grifter.

=> Open Source Footprinting

Open Source Footprinting is the easiest and safest way to go about finding information
about a company.  Information that is available to the public, such as phone numbers,
addresses, etc.  Performing whois requests, searching through DNS tables, and scanning
certain IP addresses for open ports, are other forms of open source footprinting.  Most
of this information is fairly easy to get, and getting it is legal, legal is always good.

Most companies post a shit load of information about themselves on their website.  A lot
of this information can be very useful to hackers and the companies don't even realize it.
It may also be helpful to skim through the webpage's HTML source  to look for comments.
Comments in HTML code are the equivalent to the small captions under the pictures in high
school science books.  Some comments found in the HTML can hold small tid-bits of info
about the company, otherwise not found anywhere else.

=> Network Enumeration

Network Enumeration is the process of identifying domain names and associated networks.
The process is performing various queries on the many whois databases found on the
internet.  The result is the hacker now having the information needed to attack the system
they are learning about.  Companie's domain names are listed with registrars, and the
hacker would simply query the registrar to obtain the information they are looking for.
The hacker simply needs to know which registrar the company is listed with.  There are
five types of queries which are as follows:

Registrar Query:  This query gives information on potential domains matching the
target.

Organizational Query:  This is searching a specific registrar to obtain all
instances of the target's name.  The results show many different domains associated
with the company.

Domain Query:  A domain query is based off of results found in an organizational
query.  Using a domain query, you could find the company's address, domain name,
administrator and his/her phone number, and the system's domain servers.  The
administrative contact could be very useful to a hacker as it provides a purpose
for a wardialer.  This is also where social engineering comes into play.  But
that's a talk for another time.  Many administrators now post false phone numbers
to protect themselves from this.

Network Query:  The fourth method one could use the American Registry for Internet
Numbers is to discover certain blocks owned by a company.  It's good to use a
broad search here, as well as in the registrar query.

POC Query:  This query finds the many IP adresses a machine may have.

=> DNS Interrogation

After gathering the information needed using the above techniques, a hacker would begin to
query the DNS.  A common problem with system adminstrators is allowing untrusted, or worse,
unknown users, to perform a DNS Zone Transfer.  Many freeware tools can be found on the
internet and can be used to perform DNS interrogation.  Tools such as nslookup, for PC, and
AGnet Tools, for Mac, are some common programs used for this.

=> Other Helpful Techniques Used In Footprinting

Ping Sweep:  Ping a range of IP addresses to find out which machines are awake.

TCP Scans:  Scan ports on machines to see which services are offered.  TCP scans
can be performed by scanning a single port on a range of IPs, or by scanning a
range of ports on a single IP.  Both techniques yeild helpful information.

UDP Scans:  Send garbage UDP packets to a desired port.  I normally don't perform
UDP scans a whole lot because most machines respond with an ICMP 'port unreachable'
message.  Meaning that no service is available.

OS Indentification:  This involves sending illegal ICMP or TCP packets to a machine.

The machine responds with unique invalid inputs and allows the hacker to find out what the
target machine is running.

=> Let's Try It!

Ok, I've explained as best I can what the functions of footprinting are.  Now we're going
to actually use them.  Let's footprint 2600slc.org to find out as much as we can about
Grifter.  Keep in mind that I am using a mac and I don't know the necessary tools to use
on a PC when footprinting.  For all the procedures listed below, I will be using a utility
known as AGnet Tools version 2.5.1.  This application allows you to use all of the basic
funtions of footprinting in one easy to use program.  I know there are other security
auditing tools for the mac out there which offer more functions, but AGnet is the most
user friendly program I can find.

Now, just by looking at the website, we know where the 2600 meetings are held and at what
time.  This information really isn't useful right now because you obviously managed to find
your way here.  Good for you.  We find that Grifter also runs staticdischarge.org, and by
going further into the website, we find that Grifter has three main email contacts which
are:

grifter@staticdischarge.com
grifter@linuxninjas.org
and grifter@hackinthebox.org

Ok, we have Grifter's three emails which we will use later.  But for now, let's get some
information on 2600slc.org.  We type in 2600slc.org into the prompt of the Name Lookup
window in AGnet tools, and our result is this IP address:

207.173.28.130

But wait, just out of curiosity, what is the IP of staticdischarge.org?  We type the domain
into the Name Lookup prompt and we are given the same IP.  We can safely say that
2600slc.org and staticdischarge.org are hosted on the same box.  But if I were to do a
reverse name lookup on the IP, which domain will come up?  2600slc.org or
taticdischarge.org?  Neither, the result is linuxninjas.org.  Ah ha!  So linuxninjas.org
is the name of the box hosting 2600slc.org and staticdischarge.org.  Neat!

So now that we have the IP, let's check to see if linuxninjas is awake.  We type the IP
into the prompt in the Ping window.  We'll set the interval between packets to 1
millisecond.  We'll set the number of seconds to wait until a ping times out to 5.  We'll
set the ping size to 500 bytes and we'll send ten pings.

Ten packets sent and ten packets received.  Linuxninjas.org returned a message to my
computer within an average of 0.35 seconds for every packet sent.  Linuxninjas is alive
and kicking.

Moving on.  Remember Grifter's three email addresses?  What can we do with those?  This is
where Finger comes in.  A lot of businesses nowadays don't run finger, because it reveals
too much information about any one user on a system.  But of course, it never hurts to try.
Let's enter Grifter's emails into the prompt in the Finger window.

grifter@staticdischarge.com = Finger failed.
grifter@linuxninjas.org = Finger failed.
grifter@hackinthebox.org = Finger failed.

Like I said, a lot of systems no longer use finger.

Ok, since Finger gave us bupkuss, let's move on to Whois.  We open the Whois window and
type linuxninjas.org into the Query prompt, and whois.networksolutions.com into the Server
prompt.  This means we'll be asking Network Solutions to tell us everything they know about
linuxninjas.org.

The result is this laundry list of info:

Registrant:
Static Discharge (LINUXNINJAS-DOM)
p.o.box 511493
SLC, UT 84151
US

Domain Name: LINUXNINJAS.ORG

Administrative Contact, Billing Contact:
Wyler, Neil  (NWB43)  grifter212@uswest.net
Static Discharge
p.o.box 511493
SLC, UT 84151
801-773-6103

Technical Contact:
sutton, kenny  (KS16306)  root@HEKTIK.COM
hektik
p.o.box 511493
SLC, UT 84151
877-828-3849

Record last updated on 17-Aug-2001.
Record expires on 11-Aug-2002.
Record created on 11-Aug-2000.
Database last updated on 12-Dec-2001 04:06:00 EST.

Domain servers in listed order:

NS1.HEKTIK.ORG    207.173.28.130
NS2.HEKTIK.ORG    64.81.168.80

Wow.  Check this out.  But remember that a lot of sysadmins post false info into their
registrars database.  So these phone numbers could be payphones, and these addresses could
be whore houses.  But as far as we know, we now have Grifter's real name, his address and
his phone number.  We also have the same for Kenny.  We can see when Grifter registered
linuxninjas.org, when it expires, and when it was last updated.  And look!  We have
another one of Grifter's email addresses.  Lets run it through Finger just for kicks.

grifter212@uswest.net = Finger failed.  Oh well.

Well, now that we have a bit of personal info on Grifter, let's check back with
linuxninjas.org.

A corner stone of footprinting is Port Scanning.  Let's port scan linuxninjas.org and see
what kind of services are running on that box.  We type in the linuxninjas IP into the Host
prompt of the Port Scan window.  We'll start searching from port number 1, and we'll stop
at the default Sub7 port, 27374.  Our results are:

21    TCP    ftp
22    TCP    ssh    SSH-1.99-OpenSSH_2.30
25    TCP    smtp
53    TCP    domain
80    TCP    www
110    TCP    pop3
111    TCP    sunrpc
113    TCP    ident

Just by this we know that Grifter is running a website and email, (duh), using POP3,
(Post Office Protocal version 3), SUNRPC (SUN Remote Procedure Call), and ident.  This
could lead to some fun trying to access his FTP, or telnetting to his SMTP and sending
your mom midget porn through his email address.

=> Conclusion

All of these functions are very basic.  They are simpe and easy to use.  And above all,
they are legal.  As I said in the introduction, legal is always good.  Whenever
footprinting a system, keep in mind that you could find something that you aren't supposed
to see.  If this happens, contact the sysadmin and let them know of it.  You could get into
serious trouble if you misuse the information you find.  Also let them know of any bugs or
exploits you may find.  Who knows?  If you help them out enough, you could land a job with
them protecting their system.  Nothing could be greater than getting paid to do what you do
best.  But try not to let money be your motivation.  Hacking is all about learning.

There is definetely more to learn about Grifter and his little websites.  Like why I found
him sneaking around my backyard last night.  But I guess we'll have to delve into that
later.

Especially be careful when trying to access any open ports you may find.  Brute forcing an
ftp or a web server can also land you in a pile.  If anything you try to access requires a
password, you probably shouldn't be there.  But like I said, if you access something
important and it didn't ask you for a password, let the sysadmin know of it.

Note: This tutorial is only for Educational Purposes

Read more »