Indian National Informatics Site(NIC) Hacked !!!

Indian hackers Code injector and Yash have breached the Indian National Informatics centre website(NIC.in) , the exclusive registrar for government domains (.gov.in).

According to Cyber News report, the hackers claimed to have uploaded a PHP based shell over the site and gained complete control over the Indian domains managed by NIC.

Image uploaded in  NIC

However, since hackers are from India and since they are patriotic hackers , they have sent notification about the vulnerability to NIC Department.

To demonstrate the fact that they have gained access , the hackers just uploaded an image file and a text file in the files directory.

The hack was done with a upload Misconfigured section. Hackers claimed to have Modified the Section with a Complete patch to prevent other hackers to exploit the Indian NIC.

Two XSS Vulnerabilities found in Mediafire Site by THER00tC0de

Vulnerability in Mediafire :

An Security Researches with handle name " TheR00tC0de" has found two Cross Scripting (XSS) Vulnerabilities in the most famous file hosting website "Mediafire"

In an email Sent to some sites, the researcher provided the two vulnerable links that executes the code injected by hacker. 

XSS Vulnerability in Mediafire

The researcher claimed that he sent notification about the vulnerability to Mediafire Team and waiting for their response.  The researcher asked the site owners not to publish the vulnerable link.  

And many have confirmed those vulnerabilities . But this type of vulnerability can be used only in social engineering attacks ,So it cannot be mostly used to deface large sites like Mediafire,So we hope our files are safe ;)

Recently, a security researcher - Mahadev Subedi identified a XSS vulnerability in the File Uploading service of Mediafire .

Emails of Israel News site Haaretz hacked by Syrian Electronic Army

The hacker group Syrian Electronic Army hacked into mail system of Israel News Paper Haaretz.

The hackers claimed that they gained access to more than 80 email accounts and passwords of Haaretz employees and leaked the data in their official website.(syrian-es.org/leaks/Haaretz/Haaretz-EmailsAndPasswords) 

According to Haaretz report, the hackers sent a spoofed emails to Haaretz employees and asked them to click a link that leads to an article on website of The Guardian, about talks between the United States and the Syrian opposition.

Once the employee click the link, it redirect the victim to a page requesting them to enter their login credentials that allowed hackers to breach their work email accounts.

(Which is basically called phishing) 

A small list of breached accounts

Haaretz take down the email server after the security breach. The Haaretz Group responded by saying that all employees' email passwords will be changed.  Readers' data from Haaretz Group websites  are not affected by this breach.

The employees used very simple passwords.Some of them are "lol" and "abc123"


"It's just the beginning ... Next hacks will include Israeli government targets  "              Hackers said in their post.

OWASP Zed Attack Proxy (ZAP)

The OWASP Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen tester's toolbox.



Team is now releasing weekly updates on every Monday. These are not the full releases , like stable one, but to give more enhancements as soon as possible, ZAP team decide to release weekly updates also.

The following new features are included in weekly releases:

• Completely rewritten 'traditional' Spider (c/o Cosmin Stefan and the GSoC)
• New Ajax Spider (using Crawljax, c/o Guifre Ruiz and the GSoC)
• Web sockets support (c/o Robert Koch and the GSoC)
• Performance improvements (both speed and memory)
• Session awareness
• Authentication handling
• Contexts
• Modes (Safe, Protected and Standard)
• Online links in menu

Download ZAP week update

Social-Engineer Toolkit (SET) 4.1.3 Released

TrustedSec Release the latest version of Social-Engineer Toolkit (SET) as 4.1.3. As most of us know that, It is an open source, python-driven, social-engineering penetration testing framework of custom tools which solely focuses on attacking the human element of penetration testing.

It was designed in order to arm penetration testers and security researchers with the ability to effectively test heavily advanced social-engineering attacks armed with logical methods. The Social Engineer Toolkit leverages multiple attack vectors that take advantage of the human element of security in an effort to target attackers.

Change version 4.1.3:
* Added multiple checks when importing file, no longer exits the entire application

Download Social Engineer Toolkit 4.1.3:
http://svn.trustedsec.com/social_engineering_toolkit set/

Remote Root access vulnerability in Routers with Broadcom chipsets

DefenseCode researchers have discovered a critical security vulnerability that allows remote unauthenticated attacker to remotely execute arbitrary code under root privileges in the UPnP (Universal Plug and Play) implementation developed by Broadcom and used by many routers with Broadcom chipsets.

Routers with vulnerable Broadcom UPnP stack are mostly based on Broadcom chipset. "We have found that, in fact, same vulnerable firmware component is also used in at least two other Cisco Linksys models - WRT54G3G and probably WRT310N. Could be others." researchers said.

The vulnerability is located within the wanipc and wanppp modules of the Broadcom UPnP stack, which is used by manufacturers that deliver routers based on the Broadcom chipset. The UPnP service is intended to be used on local networks, but Rapid7 found that there are over 80 million devices on the Internet that respond to UPnP discovery requests, making them vulnerable to remote attacks.

The vulnerability can be exploited to read the memory of a device that uses the vulnerable Broadcom UPnP stack or to write arbitrary values at arbitrary addresses in its memory.

Full exploit was previously demonstrated in a video on Cisco Linksys WRT54GL, that is also based on Broadcom UPnP stack. DefenseCode hasn't compiled a complete list with affected router models, but believes that some devices from Broadcom, Asus, Cisco, TP-Link, Zyxel, D-Link, Netgear, USRobotics and other vendors probably use the vulnerable Broadcom UPnP stack.

Russian Hackers Behind Gozi Malware charged for Infecting Millions users

The mastermind Russian Hackers who coded and distributed the Gozi malware, Nikita Vladimirovich Kuzmin, 25 was charged along with Deniss Calovskis, 27, and Mihai Ionut Paunescu, 28 for infecting more than a million computers worldwide in order to steal banking and other credentials from tens of thousands of victims.

They may face a maximum penalty of 95, 60 and 67 years in prison, respectively. Kuzmin allegedly created the Gozi program in 2005, hiring a programmer to write the source code and then leasing it to other criminal customers.

According to latest reports, Nikita has agreed to cooperate with the United States. As potential evidence, the feds have been able to retrieve 51 servers in Romania as well as laptops, desktops and external hard drives. The data seized amounts to 250 terabytes.

Paunescu, a Romanian national who went by the name “Virus” operated a bulletproof hosting service that provided criminal customers with servers and IP addresses from which to send out phishing emails containing the Gozi virus as well as the Zeus and SpyEye banking trojans.

Calovskis, who went by the name "Miam," was purportedly hired by Kuzmin to develop "web injects."

Authorities say the virus infected at least 40,000 computers in the U.S., including more than 160 computers belonging to NASA, and cost victims tens of millions of dollars in losses. The malicious code allowed Kuzmin to remotely control the compromised systems as a botnet, installing additional code to steal information and access banks accounts.

Disclosure of vulnerabilities in many of Pentagon Sites by a Hacked

 A hacker named (~!White!~) released a list of many sites of the American Military and pentagon domains which were vulnerable to Sql Injections.He posted it in Pastebin - http://pastebin.com/Cpgp9jHE .

It includes many top domains which needed to be very secure including Pentagon Defense Post Office Website, Office of the Deputy Director for Science Programs, Wiesbaden Military Community, NMCI Legacy Applications, Darby Military Community, Department of Economic and Social Affairs at United Nation and many more......

SQL injection is a technique by which hackers can easily get databases of the site.It allows them to find all members ,admin ,passwords,emails,etc.

Hence if the sites are not gonna be secured soon ,Hackers may get the secret details of Pentagon and many other sites 

Dump of the list of sites

Buffer Overflow Vulnerability in VLC Player

VideoLAN recently published a security advisory warning of a buffer overflow vulnerability in versions 2.0.5 and earlier of VLC Media Player, which might be exploited to execute arbitrary code. This vulnerability was reported by Debasish Mandal , a vulnerabilty researcher

   The vulnerability is caused due to an error in the “DemuxPacket()” function (modules/demux/asf/asf.c) when processing ASF files and can be exploited to cause a buffer overflow via a specially crafted ASF file. To exploit the vulnerability, a user must explicitly open a specially crafted ASF movie. 

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into opening a malicious file. 

VideoLAN advises users to refrain from opening files from untrusted locations and to disable the VLC browser plug-ins until the issue is patched. A patch will be included in VLC 2.0.6, the next version of the media player, which is only available for testing purposes at the moment.

United Nations High Comissioner for Refugees in Sri Lanka (UNHCR.lk) website defaced

The  hacker named Davy Jones who has been hacking many important Sri Lankan Websites has come up with a new deface , He hacked UNHCR’s website. UNHCR is a refugee agency of United States which has been helping and protecting the Tamil people who had been termed as Internally Displaced People(IDP’s) and helping people returning from India after the war .

 He hacked the website and leaked the whole database  in Pastebin http://pastebin.com/5UaZ6XgB .

 The dump contains all info including the admin password which has been MD5 hashed ,Even though it is MD5 hashed ,the password is ‘ admin ‘  which is easy to be guessed by a normal user too.

 And he has recently announced that he ddosed the Columbo Stock Exchange(cse.lk) for a few hours as a protest against the corruption of Sri Lankan Government.

One of his defacement pages:

[HOT] How to use proxies to your browser (Stay anonymous)

Note: 

1. Get a good proxy from http://hidemyass.com/proxy-list/ 
2. Make sure it’s anonymity is high
3.  And if you are a beginner ,better use a HTTPS proxy 

Instructions to apply proxy to your browser:

1. Mozilla Firefox:Tools > Options > Advanced > Settings > Manual proxy configuration. 
2. Google Chrome:Options > Under the hood > Network > Change proxy settings > LAN settings > Use a proxy server > Advanced > HTTP. 
3. Internet Explorer:Tools > Internet options > Connections > LAN settings > Use a proxy server > Advanced > HTTP. 
4. Opera:Tools > Preferences > Advanced > Network 

Note:

1. It will lower your speed to a greater extent 
2. We cannot assure full anonymity 
3. To assure full anonymity ,use a paid VPN which is the best 
4. You can also use free vpn’s like proxpn,openvpn,etc….. 
5. Use it at your own risk 

Enjoy Safe Hacking………