IP F***:The firefox addon proxy

IPFuck is a firefox addon created to simulate the use of a proxy. With this addon installed and enabled, and if a lot of us use it, there will no longer be any mean to know who is using a real IP, who isn't and who was charged doing something he didn't... Basicaly : we all become anonymous !

This addon is a "proof of concept" to show anyone who isn't already aware that IP address has become obsolete and that no one should use an IP address as an evidence anymore. This plugin is just one of many ways to spoof an IP address and these spoofing could lead to outrageous accusation of innocents.

How does it work ?

You can imagine that if I could just overwrite any existing information about your IP address I would have done so (or somebody else would have a while back ago)...

But it's actually a little more tricky : when sending a request to a server you will provide several information about your IP address : three of them come from the Application Layer and the last one comes from the Transport Layer. This last one I can't modify : you wouldn't get the answer to your request if that was done. But the three others can be overwritten without any consequence to your browsing...

These three headers were created to provide information on the real IP of a person surfing through a proxy server. So when you enable IPFuck, the websites you are visiting will believe that your real IP is a proxy server and (if the website was done correctly) focus on the false IP you are sending...

A lot of websites try and figure out who is hidding behind a proxy server. And if you don't believe me (I won't mind), just check out this google search request : get real ip address php. Most of the snipplets given here will check HTTP headers (the one we overwrite) before the Transport Layer information ('REMOTE_ADDR').

Source : http://ipfuck.paulds.fr/

Read more →

Owned And Exposed : When the hackers become hacked!

The group of hackers known as the publishers of the "Owned And Exposed" Magazine had released the second version of their "newsletter" in which they describ and details how they compomised the security of six sites... you'll be really shocked when you'll know the names :

Ccarders.cc
Exploit-db.com
Backtrack-Linux.org
Ettercap
Inj3ctor.com
free-hack.com

All the details can be found in the paper here!


Just remember that a series of small mistakes can mean big, when your adversaries put the pieces together.

Read more →

Pentbox:The Security Command Line Suite

Pentbox is a Linux lightweight suite of command line tools to test the safety and stability of your system / network, written in ruby and also compatible windows Windows / Mac and any system that handles & supports ruby (even iOS & Android).

The tools are divided into different categories& you will get :

Base64 Encoder & Decoder
Multi-Digest (MD5, SHA1, SHA256, SHA384, SHA512, RIPEMD-160)
Password Cracker Hash (MD5, SHA1, SHA256, SHA384, SHA512, RIPEMD-160)
Secure Password Generator
Net DoS Testing
TCP port scanner
Honeypot
Fuzzer
DNS and host gathering
L33t Sp3@k Converter


The Suite is avaible here & easy to install :
1- Get the last release from the link bellow & Install Ruby : 
sudo apt-get install  ruby

2- Extract the archive:
tar -xvf pentbox_1.4.tar
cd pentbox_1.4


3-Start the suite :
./pentbox.rb


Have Fun!

Read more →

Le Site du ministère du tourisme marocain piraté !

L'année 2010 commence mal à ce qu'il parait pour le ministère du tourisme marocain, qui s'est retrouvé avec un site officiel piraté!
La vitrine promotionnel du Maroc dans le monde a été piratée le Dimanche 03-01-2010 Par Mr.BenLadeN & Federal,c'est ce qu'on apprend sur le site www.hamza.ma qui traite des sujets de sécurité informatique.

On apprend aussi en faisant des recherches sur internet sur le groupe de pirates,que même le site du tourisme rural marocain et le site bleach-insainity ont été défaçés.
A l'heure qu'il est, aucune information n'a été confirmée par les autorités marocaines.

Read more →