CYBER-RESISTANCE : COMMENT SURFER ANONYME EN DEUX MINUTES Une petite piqure de rappel grand public, ça ne fait pas de mal… Merci à l’équipe de Linux Manua pour ce travail de vulgarisation indispensable ! [Linux Manua - 17/03/2009] En ces temps obscurs de surveillance généralisée et de répression, être anonyme sur le Net devient essentiel – Alors voilà la méthode pour avoir temporairement une adresse IP du Canada, de Russie, des Seychelles et même de Chine (un comble) puis, par exemple : dénoncer les lois liberticides visant à surveiller le Web et réprimer les internautes,critiquer les puissants sans retenue et sans risquer la répression,riposter aux satrapes qui traitent les internautes de terroristes ou de criminelstélécharger des fichiers interdits par des législations locales dictées par des lobbys mercantiles, Bien entendu, ces fictions invraisemblables ne concernent pas la France, pays de la Liberté. 1) Se connecter à un serveur proxy anonyme étranger gratuit : hostip.fr ip-adress.com utrace.de 4) TOR : L’artillerie lourde Like this:
The Freenet Project - /faq Additional information sources General / Philosophical questions Technical questions Publisher questions Contribution questions Security questions Philosophical answers What is Freenet? How is Freenet different to Tor? Freenet is a self-contained network, while Tor allows accessing the web anonymously, as well as using "hidden services" (anonymous web servers). Freenet is a distributed datastore, so once content is uploaded to Freenet, it will remain on Freenet forever, as long as it remains popular, without fear of censorship or denial of service attacks, and without needing to run your own web server and keep it online constantly. The other big difference is that Freenet has the "darknet" or Friend to Friend mode, where your Freenet node (software on your computer) only connects to the Freenet nodes run by your friends, i.e. people you know (and maybe to their friends, to speed things up). Freenet has many unsolved problems, and is still experimental. Summary: Tor (or I2P): Freenet in general:
How to Crack WPA2 WPS WiFi password Wifi Protected Setup or WPS is a 802.11 certified standard for delivering security over your Wireless network. Wi-Fi Protected Setup enables typical users who possess little understanding of traditional Wi-Fi configuration and security settings to automatically configure new wireless networks, add new devices and enable security. WPS has been accompanying WPA2 since 2007, with over 200 wireless routers that support WPS with WPA2. Warning: This guide is to showcase weaknesses in Wifi security standards & is purely for educational purposes only. All vendors (including Cisco/Linksys, Netgear, D-Link, Belkin, Buffalo, ZyXEL, TP-Link and Technicolor) have WPS-enabled devices. Although WPS is marketed as being a secure way of configuring a wireless device, there are design and implementation flaws which enable an attacker to gain access to an otherwise sufficiently secured wireless network. How the WPA2 WPS Crack works Further details are available at Google code page and PDF whitepaper. Step 1.
The Freenet Project - /index Penetration Testing Explained, Part III: Playing with RATs and Reverse Shells | Varonis Blog Last week I broke into a Windows 2008 server and inserted a remote access trojan or RAT. Don’t call security, I did this in a contained environment within virtual machines. To continue on with my pen testing experiment, in this post I’ll explore a few basic steps and techniques used by hackers after they’ve entered a system. Where Am I? One of the first tasks for a hacker is to map out the surrounding terrain in the victim’s environment. As a practical matter, you’d want to know what other computers are connected to the target. One quick baby step is simply to look at the ARP tables. The address resolution protocol or ARP is used to map IP addresses to MAC addresses. Exploring the local network with arp -a. Anyone can view the tables by entering arp -a from a command line in Windows (and Linux). And that’s just what I did. The larger point is that with ARP I could see other computers on the network. If I wanted a more complete picture, I could upload and use nmap. Reverse Shell Game
Freenet Da Wikipedia, l'enciclopedia libera. Freenet è una rete decentralizzata, creata per resistere alla censura, che sfrutta le risorse (banda passante, spazio su disco) dei suoi utenti per permettere la pubblicazione e la fruizione di qualsiasi tipo di informazione. Freenet è stata costruita pensando ad anonimato e sicurezza, non alla velocità di trasmissione. Questa caratteristica la rende poco indicata per lo scambio di file di grosse dimensioni (come filmati e file audio). Freenet è software libero distribuito con GNU General Public License; essendo scritto in Java può funzionare su Microsoft Windows, GNU/Linux, Mac OS X e su tutti i sistemi operativi dotati di Java Virtual Machine. Sebbene molte nazioni censurino le comunicazioni per motivi diversi, hanno tutte una caratteristica comune: qualcuno deve decidere cosa tagliare e cosa mantenere, cosa considerare offensivo e cosa no. All'interno di Freenet è possibile utilizzare servizi simili al Web e alle BBS. Ian Clarke et al.
Penetration Testing Explained, Part II: RATs! | Varonis Blog - The Metadata Era Remote Access Trojans or RATs are vintage backdoor malware. Even though they’ve been superseded by more advanced command-and-control (C2) techniques, this old, reliable malware is still in use. If you want to get a handle on what hackers are doing after they’ve gained access, you’ll need to understand more about RATs. A RAT’s Tale RATs came on the scene in the late 1990s or early aughts, and may have been first used as administrative tools—hence its other name, Remote Administrative Tool. BO2K, SubSeven, and Netbus are just a few of the more common critters in the RAT world — see this Microsoft TechNet article for a complete rundown. So why look at them? RATs let you upload or download files, run commands, capture keystrokes, take screen images, and examine file hierarchies. It’s also a good introduction for those who want to understand what hackers are up to. The RAT Laboratory Real pen testers set up their own separate laboratories to isolate toxic malware. The RAT Maze And Please Note
Hyperlink Penetration Testing Explained, Part IV: Making the Lateral Move | Varonis Blog You can think about the post-exploitation part of penetration testing as an army or rebel force living off the land. You’re scrounging around the victim’s website using what’s available — shells, networking utilities, berries, poorly protected password files, etc. Kidding about the berries, but the idea is to import as little malware as possible and leverage what you find for more exploration and new attacks. This whole topic goes under the name of “malware-less” hacking, which is much harder to detect than old-school techniques. This next post in the series will focus on moving off the original hacked site — lateral movement in pen testing speak. Acme Company Domain If you can find the goodies on the original target’s site, then you make a quick getaway. To make my penetration testing a little more realistic, I decided to set up a small domain, courtesy of Amazon Web Services. I now will disclose that I made the server firewall less restrictive than was called for in the Amazon specs.
Penetration Testing Explained, Part VI: Passing the Hash | Varonis Blog We’re now at a point in this series where we’ve exhausted all our standard tricks to steal credentials — guessing passwords, or brute force attacks on the hash itself. What’s left is a clever idea called passing the hash or PtH that simply reuses a password credential without having to access the plaintext. Mimikatz Remember the simple test environment I had set up? I have a Windows domain with two servers for the mythical Acme company with its beer-based server naming scheme. In our last post, I showed you how to dump the local user hashes with fgdump. Let’s now meet mimikatz, developed by Benjamin Delpy. Mimikatz is an amazingly powerful tool that probes the lsass process for hashes, and has the ability to run programs under these hash credentials. You can download the mimikatz binary from github. The software has its own mini command language. To use mimikatz you’ll need admin privileges, the same as you did with fgdump. Plaintext Passwords?! Technically, they don’t. Pass the Hash Slick!