Make Servers Always Available by Mapping a Hostname to a Dynamic IP Address

Make sure the web site or other kind of Internet server you run at home is always available to the world. If you run your own web server, mail server, or other kind of server at home and are connected to the Internet via a cable modem or DSL modem, people frequently might not be able to connect to your server. That's because, typically, broadband ISPs assign you a dynamic IP address that changes regularly, even if you don't turn off your PC. Because your IP address constantly changes, there is no way for people to connect to you. One day its IP address might be 66.31.42.96, the next it might be 66.41.42.136, and if people don't know your server's current IP address they won't be able to find it. You won't be able to solve the problem by getting your own domain (such as www.gralla.com) and publishing that because DNS servers won't be able to keep track of your changing IP address either. If people type in your domain name, the servers won't be able to report on your IP addressand again, your server won't be able to be reached. There is a way to solve the problem, however: you can map your server's hostname to a dynamic IP address. When you do this, it doesn't matter that your IP address changes; when people type in your web site's URL, they will be forwarded to your new IP address automatically. You can do this for free by signing up with a service that provides automatic mapping. A number of services will do it for free, such as No-IP.com (http://www.no-ip.com). When you sign up for the service, you choose a hostname for your server and give that hostname out to people who want to connect to the server. Whatever name you choose will end in .no-ip.comfor example, grallasite.no-ip.com. After you get your hostname, you download client software that continually monitors your IP address. It reports on your server's current IP address to the No-IP.com site. Whenever the IP address changes, it reports that new IP address to the site. The client checks your IP address every three seconds. Whenever a PC tries to connect to your server, it first goes to a No-IP.com server, which looks up your server's current address and then redirects the PC to your server, based on your current IP address. The person contacting your site will not have to do anything different from what he normally does; he just types in your URL and is connected to your site. If you own a domain and want to map that hostname to a dynamic IP address instead of using a No-IP.com address, you'll have to sign up for No-IP.com's No-IP Plus service for $24.95 a month. If you're using a router at home to share Internet access among several PCs, you might run into problems using the service. Many routers use NAT, in which all PCs on the network share a single external Internet address but are assigned internal network addresses. The No-IP.com client will track your external address, but because that single address is used by all PCs on the network, not just the server, incoming traffic won't be routed to your server. You can fix the problem by using the port forwarding feature of your router to send the incoming traffic to the server [Hack #50] . You might run into another problem as well: when you try to test your server by connecting to it from a PC inside your network, you might not be able to connect to it. That's because you might not be able to connect to the external IP address from inside the network. If this happens, the only solution is to connect to the site from a PC outside your network or ask a friend to connect to it. One more thing to watch out for: if you're behind a firewall, the No-IP.com client might have trouble connecting back to the No-IP.com site to report on your changing IP address. If you're using a firewall like ZoneAlarm [Hack #78] or a similar one that blocks outbound connections, tell it to allow the client to make outbound connections. Also, depending on the firewall you use, you might need to configure it to open TCP port 8245 because that's the port the client uses to contact No-IP.com with your new IP address.

Control Another PC with Remote Access

You can control a computer virtually moving its mouse and typing on its keyboardover the Internet, using either Windows XP's built-in features or a third-party program. When you are at work, wouldn't it be nice if you could log on to your home computer to check your email or find a file you took home? How about using your home or office desktop computer from your laptop on the road? You can use a remote control program to use another computer over the Internet, viewing its screen on your screen and giving commands via your mouse and keyboard. Windows XP comes with a feature called Remote Desktop, or you can use a third-party program. Windows Messenger [Hack #97] also enables people who are chatting to share control of each other's computers. The computer you will control is called the remote server, and the computer you are actually sitting in front of is the remote client. Windows XP comes with a remote client program (Remote Desktop Connection), and Windows XP Professional comes with a remote server (Remote Desktop) that works with one client at a timethat is, one computer can "take over" your computer remotely (with luck, it'll be you doing the takeover!).

Remote Access Server (RAS) on Windows NT or 2000 servers and the Routing and Remote Access utility on Windows Server 2003 both act as remote servers that allow multiple remote clients to connect.

Windows XP Home Edition can't act as a remote server; if you need to be able to access a Home Edition system remotely, you need to upgrade to Windows XP Professional or use a third-party program. We recommend VNC, the small, free, open source program available at http://www.realvnc.com. 5.7.1. Configuring the Windows XP Remote Server If you want to be able to control your Windows XP Professional system remotely, set it up as a remote server. Using an administrator user account, choose Start Control Panel Performance and Maintenance System (or press the Windows-Break key), click the Remote tab, select the "Allow users to connect remotely to this computer" checkbox in the Remote Desktop section of the tab to enable incoming connections, and click Select Remote Users if you want to control which user accounts can be used by remote clients. (Windows automatically allows connections from the current user, along with all user accounts in the local Administrators and Remote Desktop Users groups.) Normally, remote clients connect to the server via a local area network or a permanent Internet connection. However, you can also configure the remote server to accept incoming phone calls if you have a dial-up modem. Create a dial-up connection that accepts incoming calls by running the New Connection Wizard (click "Create a new connection" from the task pane in the Network Connections window). Choose "Set up an advanced connection" as the Network Connection Type, choose "Accept incoming connections," choose your modem, choose whether to accept VPN connections [Hack #82], and choose which user accounts the incoming connection can connect to. Firewalls usually refuse remote access connections [Hacks #Section 8.4 and Section 8.5], so if you want your remote server to be accessible from the Internet, you need to open a port in your computer's firewall. Remote Desktop uses port 3389. If you use Windows XP's built-in Windows Firewall, display the Network Connections window, right-click the Internet connection, choose Properties from the shortcut menu, click the Advanced tab, and click Settings to display the Advanced Settings dialog box. Click the Remote Desktop checkbox; if the Service Settings dialog box appears, just click OK.

If you want to change the Remote Desktop server port to a number other than 3389 (perhaps to decrease the likelihood of hackers breaking through it), see the Microsoft Knowledge Base Article Q187623 (at http://support.microsoft.com, type the article number in the "Search the Knowledge Base" box).

When you connect from your remote client (described later in this hack), you need to provide a domain name or IP address. If your computer connects via a dial-up, DSL, or cable connection, its IP address changes each time you connect, and the computer doesn't have a domain name. One solution is to have someone at the remote server display the Network Connections window, right-click the Internet connection, choose Status from the shortcut menu, click the Support tab, and call, IM, or email you with the IP address that appears. However, this solution is no good if no one is available to do this. Instead, you can sign up for a dynamic DNS service [Hack #55] at http://www.dyndns.org or http://www.tzo.com. The dynamic DNS service at DynDNS.org gives you a free domain name in the form .dyndns.org (they offer several dozen domain names to which you can add your name). TZO.com provides a subdomain at .tzo.com for $25 per year. You install a small utility on your computer that automatically tells the dynamic DNS whenever your computer's IP address changes. One final configuration note: when a client connects to your server via Remote Desktop, the user logs into one of the Windows XP user accounts. You can't log into accounts that have no password. Choose which account you plan for remote users to log into, and give it a password. 5.7.2. Setting Up the Remote Client To set up the remote client software that comes with Windows XP, connect to the Internet and then choose Start All Programs Accessories Communications Remote Desktop Connection. (If it's not there, you need to install it from your Windows CD.) In the Remote Desktop Connection window, type the domain name or IP address of the server computer and click Connect. Log on with the Windows XP user account and password for the remote server. Your computer screen now shows what's on the screen of the server computer. A connection bar appears as a button on the screen, showing the IP address of the remote server, along with Minimize, Restore, and Maximize buttons you can use to resize the remote client window. Once you're connected, you can cut and paste information from the remote client window to other windows. You can also use local files in your remote session; your local disk drives appear in My Computer (Windows Explorer). When you print from the remote client, the print job goes to your default local printer, not to the printer on the server.

Boot Disks For ALL Windows

01-Bootdisk Essentials
02-Bootdisk for MS-DOS V5.00
03-Bootdisk for MS-DOS V6.00
04-Bootdisk for MS-DOS V6.20
05-Bootdisk for MS-DOS V6.21
06-Bootdisk for MS-DOS V6.22
07-Bootdisk for Win98SE (MS-DOS V7.10)
08-Bootdisk for Windows 95a
09-Bootdisk for Windows 95b
10-Bootdisk for Windows 98 Custom No Ramdrive
11-Bootdisk for Windows 98 Second Edition
12-Bootdisk for Windows 98 Second Edition Custom No Ramdrive
13-Bootdisk for Windows 2000 Advanced Server
14-Bootdisk for Windows 2000 Professional
15-Bootdisk for Windows 2000 Server
16-Bootdisk for Windows Millenium
17-Bootdisk for Windows Millenium Custom No Ramdrive
18-Bootdisk for Windows NT 4.0 Server
19-Bootdisk for Windows NT 4.0 Terminal Server Edition
20-Bootdisk for Windows NT 4.0 Workstation
21-Bootdisk for Windows XP Custom Install Disk
22-Bootdisk for Windows XP System Setup Disk

http://rapidshare.com/files/42604437/AWOBD_ByMechoDownload.rar

Branding Windows with your Name

open notepad dump the following lines into it and save it with the name OEMINFO.INI in the c:\windows\system32 (directory)

• [General]
• Manufacturer=Your Name Here
• Model=Your Model Here
• [Support Information]
• Line1=Your Name Here
• Line2=Your Address Here
• Line3=Your Email Address Here

• Save the file, then make a right click on my computer select properties, in the general tab a button will be highlighted (support information) make a click on it, you will be able to see the changes.
• Now if you want to display some more information then simply increase the line in the file.
• ex: Line4=Your Working Hours Here

Airtel Hack for free internet

These are all the tricks i know so far

~cheers~

You need a PC or a Laptop and the required connectivity tools ,ie.,
Serial/USB cable OR Infrared Device OR Bluetooth dongle

1) Activate Airtel Live! ( It’s FREE so no probs)

2) Create TWO Airtel gprs data accounts (yep TWO) and select the
FIRST as the active profile.

3) Connect your mobile to the PC (or Laptop) and install the driver for
your mobile’s modem.

4) Create a new dial-up connection using the NEW CONNECTION
WIZARD as follows

Connecting Device : Your mobile’s modem
ISP Name : Airtel (or anything you like)
Phone Number : *99***2# / Try 99***1
Username and Password : blank

5) Configure your browser and download manager to use the proxy
100.1.200.99 and port 8080.( My advice is to use Opera since you
can browse both wap and regular websites)

6) Connect to the dial-up account. You will be connected at 115.2
kbps (but remember, that is a bad joke).

7) Pick up your mobile and try to access any site. You will get “Access
Denied…”(except for Airtel Live!). IT DOES NOT MATTER.
Keep the mobile down.

8 ) On the PC ( or Laptop) open your browser, enter any address ,
press ENTER and…….WAIT

9) After a few seconds the page will start to load and you have the
WHOLE internet at your disposal. ***************************************************************************************************************

TWO

Under DATA COMM
~~~~~~~~~~~~

APN : airtelfun.com

USERNAME : blank

PASSWORD : blank

PASS REQ : OFF

ALLOW CALLS : AUTOMATIC

IPADDRESS :

DNSADDRESS :

DATA COMP : OFF

HEADER COMP : OFF


Under INTERNET PROFILES
~~~~~~~~~~~~~~~~

INTERNET MODE : HTTP or WAP (both worked for me)

USE PROXY : YES

IP ADDRESS : 100.1.200.99

PORT : 8080

USERNAME :

PASSWORD :

No Risk Here, Try it and Enjoy

Three

1st go to settings menu then to connectivity tab now choose the option Data comm. then "DATA ACCOUNTS" go to new account now the settings r as follows
ACCOUNT TYPE:GPRS
NEW ACCOUNT NAME:A1
APN:airtelfun.com
usr name: (blank)
password: (blank)

now save it
NOW!
go to Internet Setting in connectivity here choose intrnet profile--go to new profile setting are as below
NAME:A1
CONNECT USING:A1(which was created in data comm.)
save it
now u would be able to see it now selest it and take "more" option then select setting here in use proxy option it will be selected no if it is no then change it into yes
now go to proxy adress and give the adress as
100.1.200.99 and then the port number as 8080
Usr name:
password:
now save all the settings u made . come back 2 connectivity
choose streaming settings now in connect using option choose a1 that we created leave the use proxy option as no itself
THESE R THE SETTINGS
now access airtellive! from ur activated SE phone goto VIDEO GALLERY OR VIDEO UNLIMITED(varies according to states) choose live streaming then choose CNBC OR AAJTAK WHILE CONNECTING TO MEDIA SERVER cancel AFTER 9 or 10 sec then type any web adress if it shows access denied then once again select CNBC and wait for a few more sec than before if its fully connected also no prob its free then cancel it or if ur connected then stop it and the internet is ready to take of .GOOD LUCK SE AIRTEL USERS

alternate

For All Airtel Users

Requirements:
1. Airtel live (available 4 free)
2. Nokia series60 handset eg 6600,6630,n series,7610,6670 etc
3. Opera wap browser 4 mobile
Procedure:-

1. Go to ur connection settings and make a new internet profile using the default settings of airtel live. name that new profile as nething(for eg masala); change the home page of that profile to nething u like for eg www.google.com.

2. Go to ur Opera browser and set the default connection as AIRTEL LIVE. this is the original settings u received thru airtel.

3. Go to the services(in n6600) and Web(N6630) and change the default profile for connection as masala (newer one).

**Note: always make sure that ur access point is airtelfun.com

Apply:-

1. Open Opera and u will see that homepage of Airtel Live is opened. Minimize the application.

2. Now open web using the duplicate Profile and u will see that two gprs connections will work simultaneously and at the web or the services page it will show "Unable to connect" or any error. well thats the signal of ur success.

3. Simply go on the Opera with web on and open any site u want for free. No Charges No nothing.

U can also use it through ur computer..........

someone said dis too

The main principle behind this is we hav 2 fool the bsnl techies 2 activate portal and thus get gprs activated / get "G" signal on ur cell as bsnl portal (wap.cellone.in) needs "gprs signal on ur cel (whether gprs is formaly activated/registerd or not (by my method )i dont know)

NORMALLY THEY DONT DO THAT INSPITE OF THE FACT THAT THEY SHOULD ACTIVATE GPRS SIGNAL SERVICE FOR PORTAL!!!
AND THEY WILL GIVE U NO OF REASONS----
---THAT portal is message based , so go to cellone icon in menu and use that sms based portal (what the f**k)
---THAT portal service will be activated when u will activate gprs by filling up form and registering at nearest CCN!!
---THAT ur handset has some problems (if u say that "G" signal is not present)
----etc,etc!!

U HAVE 2 ACTIVATE PORTAL FIRST WHICH IS FREE AND U CAN EAT UP CC'S FOR THIS REASON!!
SO WHAT U HAV 2 DO IS--
1) SEND PORTAL to 3733 AND CONFIRMATION SHD COME WITH 5 MIN AT-MAXIMM !!
2) SEND FOR ATLEAST 20-30 TIMES (CAN B ANY MORE THAN THAT)
JUST S**K UP THE NETWORK(3733) WITH THESE MESSAGES !!!
THAT'S FREE NO!! BOTH ON POST AND PRE!!
3) NOW ALONG ALSO SEND 20-40 SMS AS GPRS TO 3733
(NO OF SMS DIRECTLY PROPORTIONAL 2 HATE FOR BSNL AND HOW EARLY U WNAN GET UR GPRS ACTIVATED) this is also free both on post and pre!!
4) U WILL GET CONFIRMATION IN BOTH CASES AND MSG TELLS U 2 GET SETTINGS FROM 9400024365, THE NO OF CC!!
HERE AT MY PLACE I CAN DIAL 9419024365 ALSO!
BOTH R TOLL FREE AND BOTH R LOCATED IN CHANDIGARH!!!
(((((((AND SOME OF THE CC'S SAY they cant give such sensitive information that where they r located, as if thay have a 3 rd world of their own! and the other dumbs said that they r in chandigarh!!!!)))))

I WOULD ADVISE ALL FIRST, 2 call them once 2 get the settings!!
(most of the times that is incorect but gives u an idea of settings in ur area))
Try and in ur 1 st call only,
talk roughly and tell them u r calling 10-20th time just for settings and is that their service!!!
5) Now when u get them save them AND plz post them here!!!
6) now GET ATLEAST 2-3 COMPLAINTS REGISTERED( each after 1 day) THAT UR PORTAL HAS NOT ACTIVATED AND GET THEIR SERIAL NO.
and in the end bombard them abt the status of all those complaints !!
b4 registering ur complaint they will hesitate much and always say taht they will b sendin new settings which r accurate! but dont belive them and just register complaints!!
6)AFTER THAT, u have 2 only wait until "G" signal is there on ur screen!!

LOOK, WHAT I HAVE WRIITEN ABV IS METHOD by which i got activated my "G" service !!! without fillin any form or such and without any money drain!!
may be since it bypasses the formal way of registeration, that is why this trick is working !!!!!!!!!!!!

U may also Try this

first open ur msg window and type LIVE and send it to 2567 so that after 5 min u get the setting of Airtel Live or if u have already no need for this procedure.
now then open that setting and copy all the settings from it and create one access point manually which has all the settings like Airtel Live has.
now only one change will be there and it would be in access point name which is "Airtelmms.com" instead of originally "Airtelgprs.com".
ok u've done it just active that setting and access free airtel gprs on ur phone.






a recent comment says dat

Guys i tried and its working, I'm using airtel chennai,..the Method TWO worked, also i request everyone to change the Phone number from *99***2 to *99***1 and its working,.. it'll get connected at 462.8kbps but its the speed between the phone and your computer but actual BAndwidth is 42kbps

How would you like to be able to download software intended to be used on a free trial basis and use it indefinitely without cost never to expire? Well, there is a way you can take any free trial download and use it free for as long as you please. System Mechanic 6 Pro 30 day free trial then 69.95
Get it Free forever Kaspersky Anti-Hacker
Get it Free with System Mechanic Pro
Smart Protector Pro 15 day free trial then 39.90
Get It Free forever All you have to do is set your clock to some date in the distant future using adjust/date/time in Windows, download your free trial software, run the program once and rollback your time setting to the current date. After you’ve run the program for the first time, the Windows registry will be loaded with a Free Trial Key reflecting an expiration date that you’ve predetermined, and your good to go. Another roundabout way to do this after a trial has already expired would be to bring up the Registry Editor in Windows, find the trial key and delete it. Then download the program again and start the free trial period over. This is pretty easy to do, but if you’re using alot of free trials you may find it to be a hassle editing registers and downloading programs over again everytime one expires. Its much easier to simply adjust your date/time to 2009 or something, download your free trials, rollback to the current date and enjoy them for the next 3 years or so hassle free. By the way I’ve found that when doing this I’m still able to get the notifications when updated versions come along, and download them with no problem. The above screenshots are just 3 examples of the many programs that I’ve been doing this with for an extended time. If your the geek type, manipulating the dates in the registers will also work. Do some experimenting and see what you can find, there are tons of possibilities, and this is something you can have alot of fun with.

Password-Cracking Techniques

Understanding Password-Cracking Techniques

We get daily tons of requests regarding password cracking,
hereby we present a well researched comprehensive article adressing the same
It may bounce many of ur heads but we are sure a must mug up for Geeks nour regular visitors!!
so Gear Up! Dont give up before having a look on the entire article!




Many hacking attempts start with attempting to crack passwords. Passwords are the key piece
of information needed to access a system. Users, when creating passwords, often select passwords
that are prone to being cracked. Many reuse passwords or choose one that’s simple—such
as a pet’s name—to help them remember it. Because of this human factor, most password cracking
is successful; it can be the launching point for escalating privileges, executing applications,
hiding files, and covering tracks. Passwords may be cracked manually or with automated tools
such as a dictionary or brute-force method, each of which are covered later in this chapter.
Manual password cracking involves attempting to log on with different passwords. The
hacker follows these steps:
1.
Find a valid user account (such as Administrator or Guest).
2.
Create a list of possible passwords.
3.
Rank the passwords from high to low probability.
4.
Key in each password.
5.
Try again until a successful password is found.
A hacker can also create a script file that tries each password in a list. This is still considered
manual cracking, but it’s time consuming and not usually effective.

Boring!! isnt it!! A more efficient way of cracking a password is to gain access to the password file on a system.
Most systems



hash
(one-way encrypt) a password for storage on a system. During the
logon process, the password entered by the user is hashed using the same algorithm and then
compared to the hashed passwords stored in the file. A hacker can attempt to gain access to
the hashing algorithm stored on the server instead of trying to guess or otherwise identify the
password. If the hacker is successful, they can decrypt the passwords stored on the server.
Passwords are stored in the Security Accounts Manager (SAM) file on a
Windows system and in a password shadow file on a Linux system.



Understanding the LanManager Hash
Windows 2000 uses NT Lan Manager (NTLM) hashing to secure passwords in transit on the
network. Depending on the password, NTLM hashing can be weak and easy to break. For
example, let’s say that the password is
123456abcdef
. When this password is encrypted with
the NTLM algorithm, it’s first converted to all uppercase:
123456ABCDEF
. The password is
padded with null (blank) characters to make it 14 characters long:
123456ABCDEF__
. Before
the password is encrypted, the 14-character string is split in half:
123456A and BCDEF__.
Each string is individually encrypted, and the results are concatenated:
123456A = 6BF11E04AFAB197F
BCDEF__ = F1E9FFDCC75575B15
The hash is
6BF11E04AFAB197FF1E9FFDCC75575B15


Hacking Tools
Legion automates the password guessing in NetBIOS sessions. Legion scans multiple
IP address ranges for Windows shares and also offers a manual dictionary attack tool.
NTInfoScan is a security scanner for NT 4.0. This vulnerability scanner produces an HTMLbased
report of security issues found on the target system and other information.
L0phtCrack is a password auditing and recovery package distributed by @stake software,
which is now owned by Symantec. It performs Server Message Block (SMB) packet captures
on the local network segment and captures individual login sessions. L0phtCrack contains
dictionary, brute-force, and hybrid attack capabilities.
John the Ripper is a command-line tool designed to crack both Unix and NT passwords. The
cracked passwords are case insensitive and may not represent the real mixed-case password.
KerbCrack consists of two programs: kerbsniff and kerbcrack. The sniffer listens on the network
and captures Windows 2000/XP Kerberos logins. The cracker can be used to find the
passwords from the capture file using a brute force attack or a dictionary attack.

Cracking Windows 2000 Passwords
The SAM file in Windows contains the usernames and hashed passwords. It’s located in the
Windows\system32\config
directory. The file is locked when the operating system is running
so a hacker can’t attempt to copy the file while the machine is booted to Windows.
One option for copying the SAM file is to boot to an alternate operating system such as
DOS or Linux with a boot CD. Alternately, the file can be copied from the
repair
directory.
If a systems administrator uses the RDISK feature of Windows to back up the system, then a
compressed copy of the SAM file called
SAM._
is created in
C:\windows\repair
. To expand
this file, use the following command at the command prompt:
C:\>expand sam._ sam
After the file is uncompressed, a dictionary, hybrid, or brute-force attack can be run against
the SAM file using a tool like L0phtCrack.


Redirecting the SMB Logon to the Attacker
Another way to discover passwords on a network is to redirect the Server Message Block
(SMB) logon to an attacker’s computer so that the passwords are sent to the hacker. In order
to do this, the hacker must sniff the NTLM responses from the authentication server and trick
the victim into attempting Windows authentication with the attacker’s computer. A common
technique is to send the victim an e-mail message with an embedded hyperlink to a fraudulent
Hacking Tools
Win32CreateLocalAdminUser is a program that creates a new user with the username and
password
X
and adds the user to the local administrator’s group. This action is part of the
Metasploit Project and can be launched with the Metasploit framework on Windows.
Offline NT Password Resetter is a method of resetting the password to the administrator’s
account when the system isn’t booted to Windows. The most common method is to boot to
a Linux boot CD and then access the NTFS partition, which is no longer protected, and change
the password.
SMB server. When the hyperlink is clicked, the user unwittingly sends their credentials over
the network.


SMB Redirection
Several automated hacking tools can implement SMB redirection:


SMB Relay MITM Attacks and Countermeasures
An SMB relay MITM attack is when the attacker sets up a fraudulent server with a relay
address. When a victim client connects to the fraudulent server, the MITM server intercepts
the call, hashes the password, and passes the connection to the victim server.
Figure 4.1 illustrates an example of such an attack.


Hacking Tools
SMBRelay is an SMB server that captures usernames and password hashes from incoming
SMB traffic. SMBRelay can also perform man-in-the-middle attacks.
SMBRelay2 is similar to SMBRelay but uses NetBIOS names instead of IP addresses to
capture usernames and passwords.
pwdump2 is a program that extracts the password hashes from a SAM file on a Windows system.
The extracted password hashes can then be run through L0phtCrack to break the passwords.
Samdump is another program to extract NTLM hashed passwords from a SAM file.
C2MYAZZ is a spyware program that makes Windows clients send their passwords as clear
text. It displays usernames and their passwords as users attach to server resources.

SMB relay countermeasures include configuring Windows 2000 to use SMB signing, which
causes it to cryptographically sign each block of SMB communications. These settings are
found under Security Policies/Security Options.


NetBIOS DoS Attacks
A NetBIOS Denial of Service (DoS) attack sends a NetBIOS Name Release message to the NetBIOS
Name Service on a target Windows systems and forces the system to place its name in conflict
so that the name can no longer be used. This essentially blocks the client from participating in the
NetBIOS network and creates a network DoS for that system.


Password-Cracking Countermeasures
The strongest passwords possible should be implemented to protect against password cracking.
Systems should enforce 8–12 character alphanumeric passwords. The length of time the same
password should be used is discussed in the next section.
To protect against cracking of the hashing algorithm for passwords stored on the server,
you must take care to physically isolate and protect the server. The systems administrator can
use the SYSKEY utility in Windows to further protect hashes stored on the server hard disk.
The server logs should also be monitored for brute-force attacks on user accounts.
A systems administrator can implement the following security precautions to decrease the
effectiveness of a brute-force password-cracking attempt:
1.
Never leave a default password.
2.
Never use a password that can be found in a dictionary.


Hacking Tools
SMBGrind increases the speed of L0phtCrack sessions on sniffer dumps by removing duplication
and providing a way to target specific users without having to edit the dump files manually.
The SMBDie tool crashes computers running Windows 2000/XP/NT by sending specially
crafted SMB requests.
NBTdeputy can register a NetBIOS computer name on a network and respond to NetBIOS
over TCP/IP (NetBT) name-query requests. It simplifies the use of SMBRelay. The relay can be
referred to by computer name instead of IP address.


Hacking Tools

NBName can disable entire LANs and prevent machines from rejoining them. Nodes on a Net-
BIOS network infected by the tool think that their names are already in use by other machines.
3.
Never use a password related to the host name, domain name, or anything else that can
be found with whois.
4.
Never use a password related to your hobbies, pets, relatives, or date of birth.
5.
Use a word that has more than 21 characters from a dictionary as a password.
This subject is discussed further in the section “Monitoring Event Viewer Logs.”
In the following sections, we’ll look at two measures you can take to strengthen passwords
and prevent password-cracking.



Password Change Interval
Passwords should expire after a certain amount of time so that users are forced to change
their passwords. If the password interval is set too low, then users will forget their current
passwords; as a result, a systems administrator will have to reset users’ passwords frequently.
On the other hand, if passwords are allowed to be used for too long, then security
may be compromised. The recommended password-change interval is every 30 days. In
addition, it’s recommended that users not be allowed to reuse the last three passwords.
You cannot completely block brute-force password attacks if the hacker
switches the proxy server where the source packet is generated. A systems
administrator can only add security features to decrease the likelihood that
brute-force password attacks will be useful.


Monitoring Event Viewer Logs
Administrators should monitor Event Viewer logs to recognize any intrusion attempts either
before they take place or while they’re occurring. Generally, several failed attempts are logged
in the system logs before a successful intrusion or password attack. The security logs are only
as good as the systems administrators who monitor them.
Tools such as VisualLast aid a network administrator in deciphering and analyzing the
security log files. VisualLast provides greater insight into the NT event logs so the administrator
can assess the activity of the network more accurately and efficiently. The program is
designed to allow network administrators to view and report individual users’ logon and
logoff times; these events may be searched according to time frame, which is invaluable to
security analysts who are looking for intrusion details.
The event log located at
c:\\windows\system32\config\Sec.Event.Evt
contains the
trace of an attacker's brute-force attempts