Hacking Gmail account using GX cookie

Disclaimer: This post is only for education purpose. 

Introduction

Hacking web application was always curious for the script kiddies. And hacking free web email account is every geek first attempt. The method which I will describe in this post is not new; the same method can be applied to yahoo and other free web email services too.

The method we will be using is cookie stealing and replaying the same back to the Gmail server. There are many ways you can steal cookie, one of them is XSS (Cross site scripting) discussed by other is earlier post. But we won’t be using any XSS here, in our part of attack we will use some local tool to steal cookie and use that cookie to get an access to Gmail account.

Assumption:

• You are in Local Area Network (LAN) in a switched / wireless environment : example : office , cyber café, Mall etc.
• You know basic networking.

Tool used for this attack:

• Cain & Abel
• Network Miner
• Firefox web browser with Cookie Editor add-ons

Attack in detail:

We assume you are connected to LAN/Wireless network. Our main goal is to capture Gmail GX cookie from the network. We can only capture cookie when someone is actually using his gmail. I’ve noticed normally in lunch time in office, or during shift start people normally check their emails. If you are in cyber café or in Mall then there are more chances of catching people using Gmail.

We will go step by step,
If you are using Wireless network then you can skip this Step A.

A] Using Cain to do ARP poisoning and routing:

Switch allows unicast traffic mainly to pass through its ports. When X and Y are communicating eachother in switch network then Z will not come to know what X & Y are communicating, so inorder to sniff that communication you would have to poison ARP table of switch for X & Y. In Wireless you don’t have to do poisoning because Wireless Access points act like HUB which forwards any communication to all its ports (recipients). 

• Start Cain from Start > Program > Cain > Cain
• Click on Start/Stop Snigger tool icon from the tool bar, we will first scan the network to see what all IPs are used in the network and this list will also help us to launch an attack on the victim.
• Then click on Sniffer Tab then Host Tab below. Right click within that spreadsheet and click on Scan Mac Addresses, from the Target section select

All hosts in my subnet and then press Ok. This will list all host connected in your network. You will notice you won’t see your Physical IP of your machine in that list. 
How to check your physical IP ?
> Click on start > Run type cmd and press enter, in the command prompt type 
Ipconfig and enter. This should show your IP address assign to your PC.
It will have following outputs:


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : xyz.com
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
Main thing to know here is your IP address and your Default Gateway.

Make a note of your IP Address & default gateway. From Cain you will see list of IP addresses, here you have to choose any free IP address which is not used anywhere. We assume IP 192.168.1.10 is not used anywhere in the network.

• Click on Configure > APR > Use Spoof ed IP and MAC Address > IP

Type in 192.168.1.10 and from the poisoning section click on “Use ARP request Packets” and click on OK.

• Within the Sniffer Tab , below click on APR Tab, from the left hand side click on APR and now click on the right hand top spreadsheet then click on plus sign tool from top. The moment you click that it will show you list of IP address on left hand side. Here we will target the victim IP address and the default gateway.

The purpose is to do ARP poisoning between victim and the default gateway and route the victim traffic via your machine. From the left side click on Victim IP address, we assume victim is using 192.168.1.15. The moment you click on victim IP you will see remaining list on the right hand side here you have to select default gateway IP address i.e. 192.168.1.1 then click on OK.

• Finally, Click on Start/Stop Sniffer tool menu once again and next click on Start/Stop APR. This will start poisoning victim and default gateway.

B] Using Network Miner to capture cookie in plain text

We are using Network miner to capture cookie, but Network miner can be used for manythings from capturing text , image, HTTP parameters, files. Network Miner is normally used in Passive reconnaissance to collect IP, domain and OS finger print of the connected device to your machine. If you don’t have Network miner you can use any other sniffer available like Wireshark, Iris network scanner, NetWitness etc.

We are using This tool because of its ease to use.

• Open Network Miner by clicking its exe (pls note it requires .Net framework to work).
• From the “---Select network adaptor in the list---“ click on down arrow and select your adaptor If you are using Ethernet wired network then your adaptor would have Ethernet name and IP address of your machine and if you are using wireless then adaptor name would contain wireless and your IP address. Select the one which you are using and click on start.

Important thing before you start this make sure you are not browsing any websites, or using any Instant Mesaging and you have cleared all cookies from firefox.

• Click on Credential Tab above. This tab will capture all HTTP cookies , pay a close look on “Host” column you should see somewhere mail.google.com. If you could locate mail.google.com entry then in the same entry right click at Username column and click on “copy username” then open notepad and paste the copied content there.
• Remove word wrap from notepad and search for GX in the line. Cookie which you have captured will contain many cookies from gmail each would be separated by semicolon ( GX cookie will start with GX= and will end with semicolon you would have to copy everything between = and semicolon

Example : GX= axcvb1mzdwkfefv ; ßcopy only axcvb1mzdwkfefv

Now we have captured GX cookie its time now to use this cookie and replay the attack and log in to victim email id, for this we will use firefox and cookie editor add-ons.

C] Using Firefox & cookie Editor to replay attack.

• Open Firefox and log in your gmail email account.
• from firefox click on Tools > cookie Editor.
• In the filter box type .google.com and Press Filter and from below list search for cookiename GX. If you locate GX then double click on that GX cookie and then from content box delete everything and paste your captured GX cookie from stepB.4 and click on save and then close.
• From the Address bar of Firefox type mail.google.com and press enter, this should replay victim GX cookie to Gmail server and you would get logged in to victim Gmail email account.
• Sorry! You can’t change password with cookie attack.

How to be saved from this kind of attack?
Google has provided a way out for this attack where you can use secure cookie instead of unsecure cookie. You can enable secure cookie option to always use https from Gmail settings. 
Settings > Browser connection > Always use https



Source(s) - http://www.go4expert.com

How to Copy Text from any Restricted Copying Site?

NOTE - The methods illustrated here are for educational purposes only. It is not advised to copy any copyrighted material in any webpage for commercial purposes. The methods illustrated are STRICTLY for non - commercial, personal use only. 

1. Using Firefox - 

1. Like Opera, Firefox allows you to configure JavaScript on any web. If you want to turn if of, just hit the Tools menu on the top bar and click Option.

2. Accessing Content panel, here you can easily control JavaScript by enable it (check it in the box) or disable it (uncheck the box option). Hit the OK button to finish.

Now, you can easily select and copy text from any web site.

2. Using Chrome - 

1. Open Your Chrome Browser 

2. In the Tools Menu  - 

(Image © Scott Orgera)

Click on the Chrome "wrench" icon, located in the upper right hand corner of your browser window. When the drop-down menu appears, select the choice labeled Settings.

3. Chrome Settings

(Image © Scott Orgera)

Chrome's Settings page should now be displayed in a new browser tab or window, depending on your browser's configuration. Scroll to the bottom of the page and click on the Show advanced settings... link, circled in the example above.

4. Content Settings

(Image © Scott Orgera)

The Settings page should now be expanded to display more options. Locate the Privacy section and click on the Content settings... button, circled in the example above.

5. Disable JavaScript

(Image © Scott Orgera)

Chrome's Content Settings should now be displayed. Locate the JavaScript section, containing two options each accompanied by a radio button. To disable JavaScript, select the option labeled Do not allow any site to run JavaScript. After making this selection, click on the OKbutton to return to the previous screen.

Source(s) - 1. http://www.about.com

                   2. http://starblogger.net

Fixing the IE 8 warning – ‘Do you want to view only the webpage content that was delivered securely?’

In IE 7 and ealier, this dialog would cause annoyance to users but generally didn’t cause any other significant problems. This was because it was worded in such a way that most users would click on the Yes button and allow non-secure content to be downloaded.

However, the wording in the IE 8 version of this dialog has changed:

To download the content a user would now have to click on the No button. As we know, most people using the web onlyscan text and avoid reading it if at all possible! They will usually go for the Yes button if there is not an OK button.

Some sites are going to find that their secure pages in IE 8 have the following problems:

• Any non-secure HTTP image beacons used for analytics data gathering will often be ignored
• The page may not display or even work correctly if it relies on non-secure images, CSS or Javascript

Therefore, avoiding mixed content on HTTPS pages is even more important now that IE 8 has been released. It often becomes an issue when using third party services such as analytics or Content Delivery Networks (CDN). For example, weavoided the use of Google hosted Ajax libraries on our site until Google added HTTPS support.

As mention in the previous blog post, an IE user you can disable this warning by:

1. Going to Tools->Internet Options->Security
2. Select the Security tab
3. Click on the Internet zone icon at the top of the tab page
4. Click the Custom Level button
5. In the Miscellaneous section change Display mixed content to Enable
6. Repeat steps 1 – 5 for the Local intranet and Trusted sites zones

However, if you are developing a web site you can’t expect your visitors to do this. It is better to fix the cause of the problem so that the warning is not displayed by default in IE 8. The only way to do this warning is to ensure that your HTTPS pages only access embedded resources using the HTTPS protocol. You can do this by following these steps:

1. Use a sniffer like HttpWatch that supports HTTPS and shows files being read from the browser cache. The free Basic Edition is sufficient for this because you only need to see the URLs being accessed.
2. Access the page causing the problem and click No when you see the security warning dialog.
3. Any HTTP resources shown in the HttpWatch window are the source of the problem; even if they loaded directly from the browser cache and didn’t cause a network round trip:
4. If you don’t initially see any HTTP based resources, try refreshing the page because a non-secure image may have been retrieved from the IE or Firefox image cache

EDIT #1: If you are a web developer trying to track down why your page causes this warning please also take a look athttp://blog.httpwatch.com/2009/09/17/even-more-problems-with-the-ie-8-mixed-content-warning/ where we cover some javascript snippets that can also trigger this warning. The comments section of both of these posts also contain useful information where people have found and solved related issues.

EDIT #2: Updated instructions to apply the change to all network zones

Why is insert equation editor greyed out in word 2007?

Because we are working the old 1997-2003 .DOC format. The file should be saved as a 2007/2010 .DOCX format and all will be well.

XP Search not working, IE not working properly

If you go to RUN in the start menu, then type in the following commands:

regsvr32 urlmon.dll
regsvr32 jscript.dll
regsvr32 wshom.ocx

Each should prompt a confirmation box saying it has been successful. This should fix your problems!

How to Print First Row or Header Row on Every Page in Excel?

While using Excel, most often the contents overflow to multiple pages and you may have the header row on top on the first page and you would have frozen it on top so that when you scroll down the header is still visible. But when you print any Excel sheet, it would be great to have the header row or the first row printed on top of each and every page for better readability. Also see how to print first column or header column on every page in Excel.

So how to print header row or first row on each and every page in Excel?

This tip applies to Office 2010 and Office 2007.

Go to Page Layout and click on the Print Titles under Page Setup.

In the Page Setup, Under Print titles, click the red arrow icon next to Rows to repeat at top.

use the arrow to select the first row or the row that you want to repeat in each and every page that is printed.

Use the red arrow icon again and you will be taken to Page Setup screen. Click Ok.

Enable Row and Column Headings

Also if you want to row headings which says column A, B, C etc or Row headings or number 1,2,3 then you can enable them under Page Layout –> Sheet Options –> Check Print under Headings.

Here in the Print Preview (Use Keyboard shortcut Ctrl +F2) you can see that the first row and the row and column header is being printed on all pages.

References - http://www.lytebyte.com

ATI Catalyst Tweak Guide

Before we move on to tweaking the Catalysts, let's do some cleaning up and optimization of the system in preparation for more specific tweaking. These steps are important so try to do each and every one of them each time you install a new version of the Catalysts.

Delete Installation Files

When the new Catalysts have installed, and you've rebooted your system, it is now perfectly safe for you to delete the temporary installation files which were created in the directory you specified during installation. These are simply the unzipped contents of the Catalyst installation package which were used to install the drivers elsewhere on your system - they are not the actual driver files being used by Windows. If you didn't specify a new directory for them, these files are usually held under the \ATI directory. Delete them all.

Remember to also delete or backup the latest Catalyst package which you downloaded earlier. You probably won't need to use it again given ATI are releasing new Catalysts regularly, but if you know you may need to do a reformat/reinstall of Windows soon, it may be worth saving them somewhere for future use. Try not to keep lots of older Catalysts however, as these are readily available for download around the net.

Disable Unnecessary Services & Startup Items

When the Catalyst drivers and the Catalyst Control Center install on your system, they install new Services and startup items. Some of these can be removed or disabled, depending on your circumstances. If you're unfamiliar with how to disable a Service, or how to find and temporarily or permanently remove startup items, see the Services and Startup Programs chapters of the TweakGuides Tweaking Companion.

ATI Hotkey Poller (ati2evxx.exe) - Also called the ATI External Event Utility, this service is primarily needed if you use the ATI Hotkey settings available in the ATI Catalyst Control Center. However, before disabling this service note the following: If you use a third party overclocking utility, you must disable this service otherwise the utility may not work; if you have an XT, X1X00 or newer graphics card, disabling this service can also disable the OverDrive section in the Control Center, and can also prevent correct clock speeds being applied in 3D mode; if you run a laptop with an ATI graphics card, you may need to keep this service enabled to allow your LCD screen to switch off properly when the laptop is closed; if you use Fast User Switching then disabling this service may also cause problems with that. If none of the conditions above apply to you, I recommend that you disable this service.

ATI Smart (ati2sgag.exe) - This service is a bit more vague, as it is not needed for the ATI SmartGart settings to work on AGP cards. It seems to continually detect system conditions at boot time and adjust SmartGart settings if needed to maintain stability, but in effect it's just a useless resource hog. I highly recommend disabling this service - I have experienced no negative impacts by doing so. You should still be able to adjust SmartGart settings without any problems, however if you find your SmartGart changes won't "stick", set this service to Automatic, change your SmartGart settings, reboot and then disable this service.

You will also have the following startup item which you can disable depending on your circumstances:

CLIStart/StartCCC (CLIStart.exe) - This item preloads the required processes to make the Catalyst Control Center functional. It is not required for your graphics drivers or settings to function properly. Fortunately, with the latest version of the Catalyst Control Center, even if you remove this startup item (which is recommended) or manually close the CCC.exe, MOM.exe and CLIStart.exe processes in Task Manager, whenever the CCC is launched it will automatically restart the required processes as needed. So you don't need to have it loaded up at Windows startup - you can safely disable this item. Note that the MOM.exe process is a normal ATI CCC process, and is not spyware. It takes the place of previous CLI.exe processes and is harmless.

If you want to remove the ATI Catalyst Control Center System Tray, then you can disable it from loading up each time you restart Windows by opening the ATI Catalyst Control Center, click on the Preferences button and untick the 'Enable System Tray Menu' item. You should also go to Start>All Programs>Startup and delete any ATI entries there. Obviously if you want to use this system tray tool, you can skip this step.

If you want to remove the 'ATI Catalyst Control Center' entry which appears in your context menu (i.e. when you right-click on the Windows Desktop), follow the procedure below. Note that I find this is a handy way to access the CCC, so it's not vital that you remove it. However if you still want to remove it:

1. Start the Windows Registry Editor by going to Start>Run and typing "Regedit" (without quotes).

2. In the Registry Editor, go to the following key:

HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers

3. Delete the 'ACE' entry (and any other ATI-related entries) by right-clicking on its folder and selecting Delete to remove the entire folder and its contents.

You can now check the effects of this immediately by going back to your desktop and right-clicking to check the context menu. The ATI Catalyst Control Center entry will be gone, but note that this cannot be "undone", so either backup using System Restore if you're not sure about this modification, or simply reinstall the ATI Catalysts and the entry will be recreated.

If you have any doubts, or experience any issues, reset all of the above back to their defaults. If you've permanently removed a startup item, you can get it back by reinstalling the graphics driver. It is not critical that you disable or remove these items if you don't feel confident in doing so.

Remove Unused Devices

This is a slightly trickier procedure, but it won't be harmful if you follow the instructions here. If you have had several Catalysts installed on your system in the past, or even an Nvidia card installed previously on the same Windows install, not to mention any other previous items of hardware which you no longer use, then this tip lets you remove them from the registry.

To view unused devices in Device Manager, do the following:

1. Open a Command Prompt by going to Start>Run and typing "cmd" (without quotes). Once the Command Prompt is open, type the following lines, pressing return after each:

Set devmgr_show_nonpresent_devices=1

Devmgmt.msc

2. In the Device Manager window that opens, go to the View menu and select 'Show Hidden Devices' - this is very important if you want to see the unused devices. Now expand each of your devices and look through all the sub-components listed. You will see that some of the devices are shown in a lighter grey color.

3. For the purposes of this guide, what we need to look for are entries under the Monitor and Display Adapter device categories. Under Monitor there should be at least one darker monitor entry for each monitor on your system. If there are any greyed out entries, you can remove them by right-clicking on the entry and selecting 'Uninstall'. Do this for all greyed out entries under the Monitor device.

4. Under the Display Adapter device, if you find two entries - a main one, and another one which has 'Secondary' next to it - these just indicate that your graphics card is capable of two separate outputs to two different display devices. You should keep both of these. Do not attempt to uninstall the dark entries under here. You can however uninstall all other greyed out entries under the Display Adapter device list, especially those which relate to previous graphics cards you had on this system.

5. If you're feeling game, you can go through some of your other device entries and delete greyed out devices which you know for certain are no longer connected to your machine, or are traces of a device which has been moved around a few times. For example, under Human Interface Devices you may find multiple greyed out entries for a mouse which you may have moved from one port to another. As long as there is a solid entry for the device when it is still connected to your system, you can uninstall the greyed out ones. However I do not recommend uninstalling devices which you are not sure about. Most importantly, do not uninstall any greyed out Microsoft (or other Codec) entries under the Sound, Video and Game Controller device, and be extremely careful about entries under the Non Plug and Play Drivers, and Network Adapters device list. If in doubt, do not uninstall a device.

If you do happen to uninstall a device which is still connected to your system, it's not the end of the world. Windows will usually re-detect it upon reboot and look for drivers to reinstall it. If not, then remove and reconnect the device, and/or reinstall its drivers.

Refresh Rate Fix

Windows XP and Windows 2000 have an issue in which the screen Refresh Rate – the number of times per second your monitor redraws the image on the screen - resets to 60Hz (60 times per second) for every resolution by default whenever you install a new graphics driver. This is far too low for CRT monitors, as most of them can easily exceed this refresh rate, especially at lower resolutions. Most people notice a flickering effect with a 60Hz refresh rate, and it is indeed very unhealthy for your eyes (which can detect differences up to 200Hz or more) to view for long periods. Note that this does not apply to LCD monitors which use a different refresh method, and so are fine at 60Hz.

Each time you install a new Catalyst driver, you will have to override this tendency for Windows to default to 60Hz. There are two simple ways you can do this, and the choice is up to you as to which you use:

In the ATI Catalyst Control Center instead, select the 'Displays Manager' item, and then at the bottom of the page you can select a refresh rate higher than 60Hz (if supported) for particular resolutions. Make sure you don't select a refresh rate beyond your monitor's capabilities as this will result in an 'out of frequency' error and can damage your monitor. Alternatively you can use the '3D Refresh Rate Override' option under Display Options - see the Catalyst Control Center section for details.

However the best method is to use a Refresh Rate fix, such as Refresh Force. Download this small utility and run it (launch ReForce.exe). This is the foolproof method. Just click the 'Auto Populate' button and it will detect the correct maximum possible refresh rates for each supported resolution on your monitor. You can also view and manually change the refresh rate for any resolution (be careful to make sure your monitor supports the new refresh rate entered though!), and even specify additional display resolutions. Click the Apply button and the fix is done. It won't run again at startup, or sit in the background, it just changes some registry settings. You will need to use this utility again every time you install a new driver, so keep it handy.

Defragment

This is a simple but important step which should never be skipped. You should defragment your hard drive each time after installing/copying/deleting/patching any application, game, driver or large file. Any time files, particularly game files and system files (like drivers) are added to or deleted from your hard drive they can become 'fragmented' meaning portions of them may be spread over several physical areas of your hard drive. This fragmentation increases loading times and more importantly often results in greater stuttering, especially during games. Details of both the built-in defragmenting utility in Windows XP and Vista, as well as third-party defragmenters, is in the Drive Optimization chapter of the TweakGuides Tweaking Companion. Defragmentation can make a substantial difference to stuttering in games in particular, so it should not be overlooked.

Advanced SmartGart (Control Panel users & AGP Graphics Cards)

For legacy ATI Control Panel users you can check upon - and if necessary change - some of the "Advanced" SmartGart settings for your ATI graphics card by following the steps in this section. Note if you use the ATI Control Center instead, you can access these settings under the SmartGart section of the Control Center. The advice below also applies to the ATI Control Center settings of the same name. PCI-E users don't need to worry about SmartGart settings as they don't apply to such cards, only AGP cards.

To access these advanced settings, go to Start>Run and type "SmartGart" (without quotes). This will bring up the Advanced SmartGart properties box. There are two sets of settings here, PCI Settings and AGP Settings. If you have an AGP graphics card (which almost all recent graphics cards are), then you can ignore the PCI section, and vice versa.

The main purpose of going into the Advanced SmartGart properties is not so much to change anything, but to make sure that under the relevant section the Write and Read settings are set to 'On'. For example, if you have an AGP graphics card, the AGP Write and AGP Read settings should both say On in the 'Current' box next to them. This provides optimal performance, and there should be no reason either or both of them should ever be set to Off.

If you find that one or both are set to Off, set them both to On and click Apply at the bottom of the box. Reboot your system, and go back into Advanced SmartGart and check to see if they are now On. If they are then everything is fine.However, if they won't remain On, then typically you will need to install/re-install the latest Motherboard AGP drivers, and also check and change your BIOS settings as covered in the relevant sections of this guide above. You can also try re-enabling the 'ATI Smart' service if you disabled it previously.