Recover FireFox Passwords using FireFox Password Viewer

FirePasswordViewer is the GUI version of popular FirePassword tool to recover login passwords stored by Firefox. Like other browsers, Firefox also stores the login details such as username, password for every website visited by the user at the user consent. All these secret details are stored in Firefox sign-on database securely in an encrypted format. FirePasswordViewer can instantly decrypt and recover these secrets even if they are protected with master password.
Also FirePasswordViewer can be used to recover sign-on passwords from different profile (for other users on the same system) as well as from the different operating system (such as Linux, Mac etc). This greatly helps forensic investigators who can copy the Firefox profile data from the target system to different machine and recover the passwords offline without affecting the target environment.

Using FirePasswordViewer

FirePasswordViewer is the standalone application and it does not require any installation. You can just run it by double clicking on the executable file.

Here are the brief usage details.

• On running, FirePasswordViewer automatically populates the Firefox profile location if it is already installed. Otherwise you can enter the profile location manually.
• If you have set the master password for your Firefox, then you need to specify the same in the master password box.
• Once the profile location is specified, you can click on "Start Recovery" button and FirePasswordViewer will instantly recover all passwords from Firefox sign-on store.
• By default passwords are not shown for security reasons as it is sensitive data. However you can click on "Show Password" button to view these passwords.
• Finally you can save all recovered password list to HTML file by clicking on "Save as HTML" button.

You can also use FirePasswordViewer to recover passwords from different system either Windows or Linux. In that case you can copy Firefox profile data from remote system to local machine and then specify that path in the profile location field for recovering the passwords.

Screenshots of FirePasswordViewer



Screenshot 2: Showing the hidden passwords recovered by FirePasswordViewer on clicking "Show Password" button.






Download FireFox Password Viewer Here

Free Full Version Software to Recover Deleted Files

Free Full Version Software to recover deleted files. Using this software you not only can recover deleted files but also formatted drives can be easily recovered. So Enjoy..

Hetman Uneraser recovers deleted files and folders in a few easy steps! The file recovery software is simple to use yet yields impressive results in recovering most of the lost data from all kinds of media. Supporting hard disks, USB drives, memory cards, and many other types of storage media, Hetman Uneraser can recover data from all types of FAT and NTFS disks.

The file recovery software makes it easy to get back deleted files and folders as well as data lost after virus attacks, system failures, hard disk damage and memory card corruption.

Using the data recovery program could not be easier. Just select the disk that used to contain your files, and Hetman Uneraser will perform the complete scan automatically. You can select, filter, sort, and preview the files it discovers before performing the data recovery step.

Key features

• Recovers Word and Excel documents, digital pictures and RAW files, audio and video files, compressed archives, email, and many other types of data;
• Supports all versions and revisions of NTFS and FAT file systems;
• Unerases deleted files, recovers files and folders from formatted and repartitioned disks, recovers lost pictures from all types of memory cards such as SD, SDHC, Compact Flash, Memory Stick, and so on;
• Recovers data from corrupted and inaccessible hard drives and disks after a computer failure;
• Recovers files removed from Windows Recycle Bin
• By Lokish

                                                          HOTFILE DOWNLOAD

Phone Creeper v0.98 latest version download ! :

“Phone Creeper is a phone espionage suite It can be silently installed by just inserting an sd card with the files below on it. The program does not show up under installed programs or running programs and allows for a useful array or features. Phones running this software can be remotely controled by sms text messages. All commands will be silently received and deleted immediately and results will be issued back to sender. Pre-configured settings can be added to the installer to have your own default password and phone number to receive live updates. By default, this program will silently reinstall itself even after a hard reset, if the memory card with these files is still in the device.”

This is the change log:

GETPOS command for GPS location now just grab and sends on demand to minimize battery & CPU usage
Block list will now also block SMS messages from users in list also, not just calls.
Emergency contact and SIM detection features fixed up.
GPS google maps link and coordinates 0,0 issues resolved.
FTP Setup command now only responds true if FTP is actually working (it runs a test first)
LIVE FTP command has been added as is working, however if you use this avoid SMS commands as much as possible since SMS commands might slip through during FTP uploads (Maybe a fix for next time.)
Log files have been trimmed to basic info only so as to not waste so much space.
Ignore features have been added to ignore logging number in the list.
ZAP feature has been added for silent uninstall, however it’s not fully working yet (next update).
Since we last blogged about Phone Creeper, the following new commands have been added:

password ftplive - To receive live updates of SMS and Call activity to your FTP server (setupftp must be set first)
password addign xxxxxxxxxxx - To add phone number to your ignore log list (it won't create logs of these numbers)
password delign - To remove phone number from your ignore log list (it will log this number again)

Download Phone Creeper v0.98 here.

TOP HACKING TOOLS

1. Nmap

I think everyone has heard of this one, recently evolved into the 4.x series.

Nmap (“Network Mapper”) is a free open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers and both console and graphical versions are available. Nmap is free and open source.

Can be used by beginners (-sT) or by pros alike (–packet_trace). A very versatile tool, once you fully understand the results.

Get Nmap Here

 

2. Nessus Remote Security Scanner

Recently went closed source, but is still essentially free. Works with a client-server framework.

Nessus is the world’s most popular vulnerability scanner used in over 75,000 organizations world-wide. Many of the world’s largest organizations are realizing significant cost savings by using Nessus to audit business-critical enterprise devices and applications.

Get Nessus Here

 

3. John the Ripper

John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix flavors, supported out of the box are Kerberos AFS and Windows NT/2000/XP/2003 LM hashes, plus several more with contributed patches.

You can get JTR Here

 

4. Nikto

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

Nikto is a good CGI scanner, there are some other tools that go well with Nikto (focus on http fingerprinting or Google hacking/info gathering etc, another article for just those).

Get Nikto Here

 

5. SuperScan

Powerful TCP port scanner, pinger, resolver. SuperScan 4 is an update of the highly popular Windows port scanning tool, SuperScan.

If you need an alternative for nmap on Windows with a decent interface, I suggest you check this out, it’s pretty nice.

Get SuperScan Here

 

6. p0f

P0f v2 is a versatile passive OS fingerprinting tool. P0f can identify the operating system on:

– machines that connect to your box (SYN mode),
– machines you connect to (SYN+ACK mode),
– machine you cannot connect to (RST+ mode),
– machines whose communications you can observe.

Basically it can fingerprint anything, just by listening, it doesn’t make ANY active connections to the target machine.

Get p0f Here

 

7. Wireshark (Formely Ethereal)

Wireshark is a GTK+-based network protocol analyzer, or sniffer, that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and to give Wireshark features that are missing from closed-source sniffers.

Works great on both Linux and Windows (with a GUI), easy to use and can reconstruct TCP/IP Streams! Will do a tutorial on Wireshark later.

Get Wireshark Here

 

8. Yersinia

Yersinia is a network tool designed to take advantage of some weakeness in different Layer 2 protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems. Currently, the following network protocols are implemented: Spanning Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), Dynamic Host Configuration Protocol (DHCP), Hot Standby Router Protocol (HSRP), IEEE 802.1q, Inter-Switch Link Protocol (ISL), VLAN Trunking Protocol (VTP).

The best Layer 2 kit there is.

Get Yersinia Here

 

9. Eraser

Eraser is an advanced security tool (for Windows), which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns. Works with Windows 95, 98, ME, NT, 2000, XP and DOS. Eraser is Free software and its source code is released under GNU General Public License.

An excellent tool for keeping your data really safe, if you’ve deleted it..make sure it’s really gone, you don’t want it hanging around to bite you in the ass.

Get Eraser Here.

 

10. PuTTY

PuTTY is a free implementation of Telnet and SSH for Win32 and Unix platforms, along with an xterm terminal emulator. A must have for any h4x0r wanting to telnet or SSH from Windows without having to use the crappy default MS command line clients.

Get PuTTY Here.

11. LCP

Main purpose of LCP program is user account passwords auditing and recovery in Windows NT/2000/XP/2003. Accounts information import, Passwords recovery, Brute force session distribution, Hashes computing.

A good free alternative to L0phtcrack.

LCP was briefly mentioned in our well read Rainbow Tables and RainbowCrack article.

Get LCP Here

 

12. Cain and Abel

My personal favourite for password cracking of any kind.

Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort.

Get Cain and Abel Here

 

13. Kismet

Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic.

A good wireless tool as long as your card supports rfmon (look for an orinocco gold).

Get Kismet Here

 

14. NetStumbler

Yes a decent wireless tool for Windows! Sadly not as powerful as it’s Linux counterparts, but it’s easy to use and has a nice interface, good for the basics of war-driving.

NetStumbler is a tool for Windows that allows you to detect Wireless Local Area Networks (WLANs) using 802.11b, 802.11a and 802.11g. It has many uses:

• Verify that your network is set up the way you intended.
• Find locations with poor coverage in your WLAN.
• Detect other networks that may be causing interference on your network.
• Detect unauthorized “rogue” access points in your workplace.
• Help aim directional antennas for long-haul WLAN links.
• Use it recreationally for WarDriving.

Get NetStumbler Here

 

15. hping

To finish off, something a little more advanced if you want to test your TCP/IP packet monkey skills.

hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping unix command, but hping isn’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

IP Spoofing

Learn how to create custom IP packets Using tool RafaleX and Engage Packet Builder

 

The RafaleX application allows for the creation of custom IP packets. The packet is very customizable and allows for the spoofing of the IP, setting the flags, number of packets, and so forth. RafaleX is becoming hard to locate on the Internet as it appears it is now called Engage Packet Builder.

The RafaleX application is an excellent way to “spoof” custom packets. Attackers can place a valid IP address as the source of the packet and the target will have to attempt to respond to the spoofed address. By sending hundreds of thousands of packets in this manner, an attacker can create a Denial of Service attack against a target.

In this example, the Source IP of the packets to be sent is set to 10.10.10.10 with the source address of port 123. According to Internet etiquette, this should never be able to route on the Internet as the 10.x.x.x range is reserved for Private addressing. Set the destination IP to the target address. In this example it is 172.16.1.40. Set the Destination
port to port 21. The SYN and ACK flags were set for each packet.

*Note: The Ethernet communications process requires a three-way handshake:

SYN: Synchronize
SYN-ACK: Synchronize-Acknowledge
ACK: Acknowledge

When a computer receives an uninitiated SYN-ACK packet its response is to send a RST (Reset) packet.


The number of packets was set to 100. Click the Send button to send the packets to the target. The Status area at the bottom left of the application will tell you that the packets were sent.



The proof is below screen shot captured from packet capturing tool:

(frm hackguide4u.tk)

Download Deep Freeze 6 Full version: Protect computers from Viruses

Sometimes, we download and install a software on computer and on installation, we find our computer losing its sound state. Even, sometimes, we want to safely test a Keylogger or any suspicious file on our computer. So, at such situations, it is better to use Deep Freeze 6 software which really helps you to protect your computer from such Viruses and keyloggers. Deep Freeze 6 is one of the best security softwares ever made. So, download deep freeze 6 full version to protect your computer from viruses and hacking tools. I have provided link for Deep Freeze 6 full version software download... just read on.

Deep Freeze 6 to protect from viruses:

Deep Freeze 6 comes with unique "Boot Frozen" feature which makes it really very special. When you start your computer in "Boot Frozen" mode, all the changes made to your computer in current session will be erased when you restart your computer. So, whenever you have to test any keylogger or RAT server on yourself, enable "Boot Frozen" mode and test your server. After you have finished your work, simply restart your system and it will be restored to the previous state... the changes made by server or virus in this session will be erased, thus keeping your computer safe and sound.

Download Deep Freeze 6 Full version:

1. Free Download Deep Freeze 6 Full version to protect your computer from viruses.
Password: techotoys.blogspot.com

2. Unzip the file and run Deep Freeze.exe file on your computer. Your computer will be restarted.

3. On restart, you will see icon in your taskbar. Keeping shift pressed, double click on this icon to access the Deep Freeze 6 control panel. You can even assign password to Deep Freeze 6.

4. Deep Freeze can be operated in two modes:

Boot Frozen: When selected, Deep Freeze will nullify all the changes made to your computer on restart.

Boot Thawed: When selected, Deep Freeze will not nullify any changes on restart.

Remember to use "Boot Frozen" mode while testing any RAT or suspicious file on your computer.

So friends, this was a little tutorial on how to download Deep Freeze 6 full version and the way to use it. I have provided many hacking softwares on Techotoys. Always use Deep Freeze in "Frozen" mode while testing these hacking softwares, to prevent any harm to your computer. If you have any problem to download Deep Freeze 6 full version to protect your computer from viruses, please mention it in comments.

Enjoy n download Deep Freeze 6 Full version...

Website Hacking Methods

Remote File Inclusion (RFI):
A method of uploading a shell by an off-site Icon_charly_link_green.

Local File Inclusion (LFI) AKA Directory traversal attack:
A method of pulling usernames and passwords off a website vulnerable to the exploit of
insufficient security validation / sanitization of user-supplied input file names.

Blind Structured Query Language Injection (blind SQLI):
Method of once again insufficiant security validation and sanitization of user-input.

Basic SQLi
This is the easiest method of SQLi. This method allows you to enter codes such as ' or '1'='1
into the username and password fields to gain access. E.g. you find the admin login on a site
and you may enter the correct username admin and the password as: ' or '1'='1.

Cross Site Scripting (XSS):
A method of injection html/javascript into a website. The can be both persistent attacks, and
non-persistant.


Cross site request forgery (CSRF):
An attack that is commonly sent by e-mail or other means and often tricks a user. Icon_charly_link_greens given to a target may include HTML, something like this:
Code:
<img src="http://bank.example/withdraw?account=bob&amount=100&for=mallory" height="1" width="1" border="0">
And this will be activated through the victims browser and the site will think it was a valid and intentional move.

Public Exploits:
Public exploits are just scripts that people have released for others to use. Such as
this exploit which exploits a webserver
running this program on one of its open ports. I suggest you have a quick look through the
script to see how/why it works. The way of finding which software you target is using is by using Namp or the GUI Zenmap

DNS hijacking:
This is the method or redirecting the domain name to a rouge domain name. This method is used
particually in phishing attacks.

Bruteforcing:
This method is the practise of running a program to keep guessing the password and username of
a site. This method is fastly going out of fashion as the max login attempts are added and even
without this obstical, it can take weeks to gain the correct password. Programs commonly used
for this are hydra and Brutus.

Password Guessing:
Yes, just as it sounds. This is the method of just guessing common passwords such as:

Code:
admin
admin123
321admin123
password
toor
thesitesname

Packet Sniffing:
If you find a site with FTP access, there may be a chance you can use a tool such as
cain and abel to sniff their password and username when
the login. Not a very easy task as the trafic is sometimes encrypted.

RCE (Remote Command Execution):
This is the method of making the server read command that you have entered for it to.
E.g.
Code:
index.php?cmd=whoami
index.php?cmd=net user


Social Enginering:
A common method used to gain information. This can be a long process, but an effective one.
They can patch software, but it will always be people's ignorance that will let you/your target
down.

Cookie poisoning:
This is a method of editing cookies you have already gained, to gain extra privileges. Not a very common method now as of cookies being encrypted, and having to be signed. This exploit can work on some surprising sites, take a look, you may be surprised.

Parameter tampering:
An attack usual done by moderfying values in the url. E.g. changing a value to decrease the amount you have to pay on something.
Code:
<input type=”hidden” id=”1008” name=”cost” value=”70.00”>

In this example, an attacker can modify the “value” information of a specific item, thus lowering its cost.
source: http://www.owasp.org/index.php/Web_Parameter_Tampering

Tamper Data:
A very nifty Firefox addon which is used to modify http/https headers and post parameters.

Admin Auth bypass:
This exploit can be as simple as adding:
Code:
?action=edit
To a URL. This exploit when a server/application allows you to edit by having the valid URL, instead of by cookies. Another method of admin auth bypass is editting the html to proceed even if the password is wrong.