A Report On Ethical Hacking & Network Defense

Submitted in partial fulfillment for the B. Tech. Degree

Submitted To:- Submitted By:-

Mr. Jitendra Purohit Karan Singh Sisodia
Asst.Professor B. Tech. IV year
CSE & IT Dept.
Information Technology
Vyas Institute of Engineering & Technology
Vyas Institute of Engineering & Technology

VYAS INSTITUTE OF ENGINEERING AND TECHNOLOGY

JODHPUR
 COURSE TITLE

Ethical Hacking & Network Defense:

Why Information Security?
After the boom in Networking and Software jobs, the past two years have seen a
sharp rise in the field of Information Security. Information Security and Ethical
hacking is the latest buzzword in the industry. In the past five years, the
percentage of hacking crimes, data thefts, data losses, viruses and other cyber
crimes have increased exponentially. “NASSCOM predicts requirement of 1,
88,000 professionals by the year 2008. Currently the number of security
professionals in India is around 22,000.” The current demand for Information
Security jobs continue to grow. With information security increasingly
becoming a boardroom level concern, training and certification are becoming
increasingly important for candidates and companies like. Need for Information
Security in the Indian Market Security Compliance is must for all companies
with IT backbone. The requirement is high with organizations in IT / ITES
segment. Information workers lack of basic security knowledge. Information
Security Industry is going through an exponential growth rate, current
worldwide growth rate is billed at 21 %.
 INDEX
1. Cover Page

2. Certificate

3. Institute Name

4. Course title

5. Index

6. Introduction to Ethical Hacking & Network Defense.

7. What is a Hacker

8. What are virus, worms, Backdoor Trojans.

9. What is Spyware

10. What is Firewall and Ports.

11. What is Registry

12. What is Group Policy Editor.

13. Proxy Servers

14. Hacking Attacks (Types)

15. Phishing

16. Email-Tracker

17. Password Cracking

18. Footprinting

19. SQL Injection

20. DoS Attack

21. Net Tools

22. Cryptography

23. Art of Googling

24. Data Recovery

25. Honeypot or Trapdoor

 Introduction to Ethical Hacking & Network Defense

 Ethical hackers
 Employed by companies to perform penetration tests

 Penetration test
 Legal attempt to break into a company’s network to find its weakest link

 Tester only reports findings, does not harm the company

 Ethical hackers
 Employed by companies to perform penetration tests

 Penetration test

 Legal attempt to break into a company’s network to find its weakest link

 Tester only reports findings, does not harm the company

What is a Hacker?
Eric Raymond, compiler of The New Hacker's Dictionary, defines a hacker as a clever
programmer. A "good hack" is a clever solution to a programming problem and "hacking" is
the act of doing it. Raymond lists five possible characteristics that qualify one as a hacker,
which we paraphrase here:

 A person who enjoys learning details of a programming language or system

 A person who enjoys actually doing the programming rather than just theorizing about
it

 A person capable of appreciating someone else's hacking

 A person who picks up programming quickly

 A person who is an expert at a particular programming language or system, as in

"Unix hacker"
 

 Hacker classes

 Black hats – highly skilled, malicious, destructive “crackers”

 White hats – skills used for defensive security analysts

 Gray hats – offensively and defensively; will hack for different

reasons, depends on situation.

 Hactivism – hacking for social and political cause.

 Ethical hackers – determine what attackers can gain access to, what they will
do with the information, and can they be detected.

Anatomy of an attack:

 Gathering Data – attacker gathers information; can include social

engineering.

 Scanning – searches for open ports (port scan) probes target for vulnerabilities.

 Gaining access – attacker exploits vulnerabilities to get inside system; used for
spoofing IP.

 Maintaining access – creates backdoor through use of Trojans; once attacker gains
access makes sure he/she can get back in.

 Covering tracks – deletes files, hides files, and erases log files. So that attacker
 cannot be detected or penalized

Raymond deprecates the use of this term for someone who attempts to crack someone else's
system or otherwise uses programming or expert knowledge to act maliciously. He prefers
the term cracker for this meaning.

The term hacker is used in popular media to describe someone who attempts to break into
computer systems. Typically, this kind of hacker would be a proficient programmer or
engineer with sufficient technical knowledge to understand the weak points in a security
system

A cracker is someone who breaks into someone else's computer system, often on a network;
bypasses passwords or licenses in computer programs; or in other ways intentionally breaches
computer security. A cracker can be doing this for profit, maliciously, for some altruistic
purpose or cause, or because the challenge is there. Some breaking-and-entering has been
done ostensibly to point out weaknesses in a site's security system.

A program or piece of code that is loaded onto your computer without your knowledge and
runs against your wishes. Viruses can also replicate themselves. All computer viruses are
manmade. A simple virus that can make a copy of itself over and over again is relatively easy
to produce. Even such a simple virus is dangerous because it will quickly use all available
memory and bring the system to a halt. An even more dangerous type of virus is one capable
of transmitting itself across networks and bypassing security systems.

Since 1987, when a virus infected ARPANET, a large network used by the Defense
Department and many universities, many antivirus programs have become available. These
programs periodically check your computer system for the best-known types of viruses.

Some people distinguish between general viruses and worms. A worm is a special type of
virus that can replicate itself and use memory, but cannot attach itself to other programs.
What Is a Virus?

A computer virus attaches itself to a program or file enabling it to spread from one computer
to another, leaving infections as it travels. Like a human virus, a computer virus can range in
severity: some may cause only mildly annoying effects while others can damage your
hardware, software or files.

Almost all viruses are attached to an executable file, which means the virus may exist on your
computer but it actually cannot infect your computer unless you run or open the malicious
program. It is important to note that a virus cannot be spread without a human action, (such
as running an infected program) to keep it going.

People continue the spread of a computer virus, mostly unknowingly, by sharing infecting
files or sending e-mails with viruses as attachments in the e-mail.

What Is a Worm?

A worm is similar to a virus by design and is considered to be a sub-class of a virus. Worms

spread from computer to computer, but unlike a virus, it has the capability to travel without
any human action. A worm takes advantage of file or information transport features on your
system, which is what allows it to travel unaided

The biggest danger with a worm is its capability to replicate itself on your system, so rather
than your computer sending out a single worm, it could send out hundreds or thousands of
copies of itself, creating a huge devastating effect. One example would be for a worm to send
a copy of itself to everyone listed in your e-mail address book. Then, the worm replicates and
sends itself out to everyone listed in each of the receiver's address book, and the manifest
continues on down the line.
Due to the copying nature of a worm and its capability to travel across networks the end
result in most cases is that the worm consumes too much system memory

(or network bandwidth), causing Web servers, network servers and individual computers to
stop responding. In recent worm attacks such as the much-talked-about Blaster Worm, the
worm has been designed to tunnel into your system and allow malicious users to control your
computer remotely

What Is a Trojan horse?

A Trojan Horse is full of as much trickery as the mythological Trojan Horse it was named
after. The Trojan Horse, at first glance will appear to be useful software but will actually do
damage once installed or run on your computer. Those on the receiving end of a Trojan Horse
are usually tricked into opening them because they appear to be receiving legitimate software
or files from a legitimate source. When a Trojan is activated on your computer, the results
can vary. Some Trojans are designed to be more annoying than malicious (like changing your
desktop, adding silly active desktop icons) or they can cause serious damage by deleting files
and destroying information on your system. Trojans are also known to create a backdoor on
your computer that gives malicious users access to your system, possibly allowing
confidential or personal information to be compromised. Unlike viruses and worms, Trojans
do not reproduce by infecting other files nor do they self-replicate.

What Are Blended Threats?

Added into the mix, we also have what is called a blended threat. A blended threat is a more
sophisticated attack that bundles some of the worst aspects of viruses, worms, Trojan horses
and malicious code into one single threat. Blended threats can use server and Internet
vulnerabilities to initiate, then transmit and also spread an attack. Characteristics of blended
threats are that they cause harm to the infected system or network, they propagates using
multiple methods, the attack can come from multiple points, and blended threats also exploit
Vulnerabilities:

To be considered a blended thread, the attack would normally serve to transport multiple
attacks in one payload. For example it wouldn't just launch a DoS attack — it would also, for
example, install a backdoor and maybe even damage a local system in one shot. Additionally,
blended threats are designed to use multiple modes of transport. So, while a worm may travel
and spread through e-mail, a single blended threat could use multiple routes including e-mail,
IRC and file-sharing sharing networks.

Lastly, rather than a specific attack on predetermined .exe files, a blended thread could do
multiple malicious acts, like modify your exe files, HTML files and registry keys at the same
time — basically it can cause damage within several areas of your network at one time.

Blended threats are considered to be the worst risk to security since the inception of viruses,
as most blended threats also require no human intervention to propagate.

Combating Viruses, Worms and Trojan Horses:

The first step in protecting your computer from any malicious there is to ensure that your
operating system (OS) is up-to-date. This is essential if you are running a Microsoft Windows
OS. Secondly, you need to have anti-virus software installed on your system and ensure you
download updates frequently to ensure your software has the latest fixes for new viruses,
worms, and Trojan horses. Additionally, you want to make sure your anti-virus program has
the capability to scan e-mail and files as they are downloaded from the Internet, and you also
need to run full disk scans periodically. This will help prevent malicious programs from even
reaching your computer. You should also install a firewall as well.

A firewall is a system that prevents unauthorized use and access to your computer. A firewall
can be either hardware or software. Hardware firewalls

provide a strong degree of protection from most forms of attack coming from the outside
world and can be purchased as a stand-alone product or in broadband routers. Unfortunately,
when battling viruses, worms and Trojans, a hardware firewall may be less effective than a
software firewall, as it could possibly ignore embedded worms in out going e-mails and see
this as regular network traffic.
For individual home users, the most popular firewall choice is a software firewall. A good
software firewall will protect your computer from outside attempts to control or gain access
your computer, and usually provides additional protection against the most common Trojan
programs or e-mail worms. The downside to software firewalls is that they will only protect
the computer they are installed on, not a network.

It is important to remember that on its own a firewall is not going to rid you of your computer
virus problems, but when used in conjunction with regular operating system updates and a
good anti-virus scanning software, it will add some extra security and protection for your
computer or network.

Backdoor Trojans

Background Information:

Examples of backdoor trojans are Netbus or Back Orifice. They allow other people to control
your computer over the Internet. When you run a program that contains the Backdoor trojan,
it will copy itself to the Windows or Windows\System directory and add itself to the system's
registry. Trojans are usually claimed to be some sort of desirable program. For example, one
popular trojan wrapper is a game called "Whack a Mole". Another is a game call "Pie Bill
Gates". Once the program is in memory, it tries to hide itself on the task list. It doesn't show
any icon or indication that it is running. It listens on a port until someone connects. The
person who is controlling your computer uses a program that lets them record keystrokes,
view files, move the mouse, open and close the CD-ROM, etc. Sometimes, the trojan is
customized so that the person who planted it gets an e-mail when you run it.

Removal:

The trojan tries to make itself hard to remove. For Back Orifice, it uses a file with a name that
shows usually shows up as " .EXE" Sometimes it uses a name like "MSGSRV32.DRV".
Windows prevents deleting the trojan file while it is active. Some of the regular antivirus
software can find these trojans and delete them while Windows is not running. The antivirus
program should find at least one EXE or DRV file containing the trojan. If it finds a .DLL
file, then it is just an add-on to the trojan that provides extra features. If you decide to use a
single purpose trojan remover, then be cautious. Sometimes trojans are disguised as trojan
removers. For example, SynTax Back Orifice Remover and BOSniffer are all Back Orifice. A
program imitating Antigen named Trojan.Win32.Antigen claims to remove Back Orifice but
is actually a program that steals passwords. There are legitimate Anti-Trojan programs, but
make sure you get recommendations from people who have tried them and download them
directly from the author's site. You can also remove it from the registry manually. Click Start,
then Run, then type regedit in the text box, then click OK. Click
HKEY_LOCAL_MACHINE, then Software, then Microsoft, then Windows, then
CurrentVersion. Check under Run and RunServices for any suspicious-looking files. Some
files are Normally under this part of the registry. They are Rundll32.exe, systray.exe,
scanregw.exe, taskmon.exe, mstask.exe. There are also some other files that are legitimate
parts of the registry.

Why is it called "Spyware" ?

While this may be a great concept, the downside is that the advertising companies also install
additional tracking software on your system, which is continuously "calling home", using
your Internet connection and reports statistical data to the "mothership". While according to
the privacy policies of the companies, there will be no sensitive or identifying data collected
from your system and you shall remain anonymous, it still remains the fact, that you have a
"live" server sitting on your PC that is sending information about you and your surfing habits
to a remote location.....
Are all Adware products "Spyware"?

No, but the majority are. There are also products that do display advertising but do not install
any tracking mechanism on your system. These products are not indexed in our database.

Is Spyware illegal?

Even though the name may indicate so, Spyware is not an illegal type of software in any way.
However there are certain issues that a privacy oriented user may object to and therefore
prefer not to use the product. This usually involves the tracking and sending of data and
statistics via a server installed on the user's PC and the use of your Internet connection in the
background.

What's the hype about?

While legitimate adware companies will disclose the nature of data that is collected and
transmitted in their privacy statement (linked from our database), there is almost no way for
the user to actually control what data is being sent. The fact is that the technology is in theory
capable of sending much more than just banner statistics - and this is why many people feel
uncomfortable with the idea. On the other hand millions of people are using advertising
supported "spyware" products and could not care less about the privacy hype..., in fact some
"Spyware" programs are among the most popular downloads on the Internet.

Real spyware:

There are also many PC surveillance tools that allow a user to monitor all kinds of activity on
a computer, ranging from keystroke capture, snapshots, email logging, chat logging and just
about everything else. These tools are perfectly legal in mostplaces,but, just like an ordinary
tape recorder, if they are abused, they can seriously violate your privacy.
 FIREWALL
A firewall is a secure and trusted machine that sits between a private network and a public
network. The firewall machine is configured with a set of rules that determine which network
traffic will be allowed to pass and which will be blocked or refused. In some large
organizations, you may even find a firewall located inside their corporate network to
segregate sensitive areas of the organization from other employees. Many cases of computer
crime occur from within an organization, not just from outside.

Firewalls can be constructed in quite a variety of ways. The most sophisticated arrangement
involves a number of separate machines and is known as a perimeter network. Two machines
act as "filters" called chokes to allow only certain types of network traffic to pass, and
between these chokes reside network servers such as a mail gateway or a World Wide Web
proxy server. This configuration can be very safe and easily allows quite a great range of
control over who can connect both from the inside to the outside, and from the outside to the
inside. This sort of configuration might be used by large organizations.

Typically though, firewalls are single machines that serve all of these functions. These are a
little less secure, because if there is some weakness in the firewall machine itself that allows
people to gain access to it, the whole network security
has been breached. Nevertheless, these types of firewalls are cheaper and easier to manage
than the more sophisticated arrangement just described.
The Linux kernel provides a range of built-in features that allow it to function quite nicely as
an IP firewall. The network implementation includes code to do IP filtering in a number of
different ways, and provides a mechanism to quite accurately configure what sort of rules
you'd like to put in place. The Linux firewall is flexible enough to make it very useful in
either of the configurations

PORT:

(1) An interface on a computer to which you can connect a device. Personal computers have
various types of ports. Internally, there are several ports for connecting disk drives, display
screens, and keyboards. Externally, personal computers have ports for connecting modems,
printers, mice, and other peripheral devices.

Almost all personal computers come with a serial RS-232C port or RS-422 port for
connecting a modem or mouse and a parallel port for connecting a printer. On PCs, the
parallel port is a Centronics interface that uses a 25-pin connector. SCSI (Small Computer
System Interface) ports support higher transmission speeds than do conventional ports and
enable you to attach up to seven devices to the same port.

(2) In TCP/IP and UDP networks, an endpoint to a logical connection. The port number
identifies what type of port it is. For example, port 80 is used for HTTP traffic. Also see
Well-Known TCP Port Numbers in the Quick Reference section of Webopedia.

(3) To move a program from one type of computer to another. To port an application, you
need to rewrite sections that are machine dependent, and then recompile the program on the
new computer. Programs that can be ported easily are said to be portable.

REGISTARY
This is a database used by Microsoft Windows to store configuration information about the
software installed on a computer. This information includes things like the desktop
background, program settings, and file extension.

The windows registry consist of six part:

HKEY_User - contains the user information for each user of the system.
HKEY_Current_User - has all the preferences for the current user.

HKEY_Current_Configuration - stores settings for the display and printers.

HKEY_Classes_Root - includes file associations and OLE information.

HKEY_Local_Machine - has the settings for the hardware, operating system, and
Installed applications.

How to Hide Run (all users):

1) open regedit (start menu > run, and type in regedit)

2) go to:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies/Expl
orer
3) Right Click on the Right Pane Select New-> DWORD -> change the String to "NoRun"
4) Select Properties and Change the Value to 1

5) Logoff the Windows, Login again, Run is Hidden.

How to Hide Search (all users):

1) open regedit (start menu > run, and type in regedit)

2) go to:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies/Expl
orer
3) Right Click on the Right Pane Select New-> DWORD -> change the String to "NoFind"
4) Select Properties and Change the Value to 1
5) Logoff the Windows, Login again, Run is Hidden.

How to Hide Desktop (all users):

1) open regedit (start menu > run, and type in regedit)

2) go to:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies/Expl
orer
3) Right Click on the Right Pane Select New-> DWORD -> change the String to
"NoDesktop"
4) Select Properties and Change the Value to 1

5) Logoff the Windows, Login again, Run is Hidden.

About the Group Policy Editor-

How it works?

Although the Group Policy Editor console (gpedit.msc) is mostly used by administrators of
networks and domains, it also has uses for a stand-alone home computer. One application is
to allow convenient and easy editing of the Registry so that a variety of tweaks or changes to
the system can be made. These settings are known as policies and are stored in a special
hidden folder %SystemRoot%\System32\GroupPolicy\ (For most home systems the
environment variable %SystemRoot% is C:\Windows.) Policies that apply to the machine are
stored in a sub-folder "Machine" and policies that apply to a user are stored in a sub-folder
"User". In each case the settings are in a file named "Registry.pol". Thus the settings for the
machine are in %SystemRoot%\System32\GroupPolicy\Machine\Registry.pol and in similar
fashion user settings are in User\Registry.pol. Policies are used to write to a special key of the
Registry and override any settings elsewhere in the Registry. Since only the administrator
account can access the policy settings, limited account users can be prevented from making
unwanted system changes.

Another useful application of the Group Policy Editor (GPE) is to provide for the automatic
running of scripts or programs whenever the computer is started up or shut down or when a
user logs on or off. This may be the application of most practical use to a typical home PC
user.
Using the Group Policy Editor:

Like many other management consoles, the GPE is not listed in Start-All Programs. To
open it, go to Start-Run and enter "gpedit.msc" (without quotes). Figure 1 shows one view
of the console. Note that there are entries for the

computer configuration and for the user configuration. Selecting either one then gives the
entries shown in the right panel of the figure. Clicking plus signs in the left panel will expand
the selections

Proxy Servers
A proxy server is a kind of buffer between your computer and the Internet resources you are
accessing. They accumulate and save files that are most often requested by thousands of
Internet users in a special database, called “cache”. Therefore, proxy servers are able to
increase the speed of your connection to the Internet. The cache of a proxy server may
already contain information you need by the time of your request, making it possible for the
proxy to deliver it immediately. The overall increase in performance may be very high. Also,
proxy servers can help in cases when some owners of the Internet resources impose some
restrictions on users from certain countries or geographical regions. In addition to that,
among proxy servers there are so called anonymous proxy servers that hide your IP address
thereby saving you from vulnerabilities concerned with it.
Anonymous Proxy Server:

Anonymous proxy servers hide your IP address and thereby prevent unauthorized access to
your computer through the Internet. They do not provide anyone with your IP address and
effectively hide any information about you and your reading interests. Besides that, they
don’t even let anyone know that you are surfing through a proxy server. Anonymous proxy
servers can be used for all kinds of Web-services, such as Web-Mail (MSN Hot Mail, Yahoo
mail), web-chat rooms, FTP archives, etc.
Why Should You Use Anonymous Proxy Servers?
Any web resource you access can gather personal information about you through your unique
IP address – your ID in the Internet. They can monitor your reading interests, spy upon you
and, according to some policies of the Internet resources, deny accessing any information you
might need. You might become a target for many marketers and advertising agencies who,
having information about your interests and knowing your IP address as well as your e-mail,
will be able to send you regularly their spam and junk e-mails.A web site can automatically
exploit security holes in your system using not-very-complex, ready-made, free hacking
programs. Some of such programs may just hang your machine, making you reboot it, but
other, more powerful ones, can get access to the content of your hard drive or RAM.
Everything a web site may need for that is only your IP address and some information about
your operating system. Using an anonymous proxy server you don't give anybody any chance
to find out your IP address and any information about you and use them in their own
interests.

The Solution:

Using an anonymous proxy server you don’t give anybody chance to find out your IP address
to use it in their own interests. We can offer you three ways to solve your IP problem:

1. Secure Tunnel - pay proxy server with plenty of features. Effective for personal use,
when your Internet activities are not involved in web site development, mass form
submitting, etc. The best solution for most of Internet users. Ultimate protection of privacy -
nobody can find out where you are engaged in surfing. Blocks all methods of tracking.
Provides an encrypted connection for all forms of web browsing, including http, news, mail,
and the especially vulnerable IRC and ICQ. Comes with special totally preconfigured
software.

2. ProxyWay Pro - multifunctional anonymous proxy surfing software which you can use
together with a wide variety of web applications (web browsers, Instant Messengers, Internet
Relay Chat (IRC), etc.) to ensure your anonymity. ProxyWay Pro provides an extended proxy
management system that enables you to search for, check proxy (multithreaded proxies checking),
analyze, validate proxy servers for speed, anonymity, type (HTTP/HTTPS/SOCKS), geographical location,
create proxy chains. Allows update proxy list automatically using scheduler. ProxyWay Pro lets you clear
history, block ads and popups, change User-Agent and Referrer fields, block harm code and much more. Also it
can be used as a simple local proxy server.

3. Our own small proxy list is also a good place to start with if you are a novice There are MANY
methods to change your IP address. Some methods will work for you but may not work for
someone else and vice versa. If your IP is static, then you CAN’T change your IP address
without contacting your ISP. If you have a long lease time on your IP then you won’t be able
to change your IP without cloning your MAC address, which I’ll explain later in this article.
 Hacking Attack Types

1) Inside Jobs - Most security breeches originate inside the network that is under attack.
Inside jobs include stealing passwords (which hackers then use or sell), performing industrial
espionage, causing harm (as disgruntled employees), or committing simple misuse. Sound
policy enforcement and observant employees who guard their passwords and PCs can thwart
many of these security breeches.

2) Rogue Access Points - Rogue access points (APs) are unsecured wireless access points
that outsiders can easily breech. (Local hackers often advertise rogue APs to each other.)
Rogue APs are most often connected by well-meaning but ignorant employees.

3) Back Doors - Hackers can gain access to a network by exploiting back doors
administrative shortcuts, configuration errors, easily deciphered passwords, and unsecured
dial-ups. With the aid of computerized searchers (bots), hackers can probably find any
weakness in your network.

4) Viruses and Worms - Viruses and worms are self-replicating programs or code fragments
that attach themselves to other programs (viruses) or machines (worms). Both viruses and
worms attempt to shut down networks by flooding them with massive amounts of bogus
traffic, usually through e-mail.

5) Trojan Horses - Trojan horses, which are attached to other programs, are the leading
cause of all break-ins. When a user downloads and activates a Trojan horse, the hacked
software (SW) kicks off a virus, password gobbler, or remote-control SW that gives the
hacker control of the PC.

6) Denial of Service - DoS attacks give hackers a way to bring down a network without
gaining internal access. DoS attacks work by flooding the access routers with bogus traffic
(which can be e-mail or Transmission Control Protocol, TCP, packets).

Distributed DoSs (DDoS5) are coordinated DoS attacks from multiple sources. A DDoS is
more difficult to block because it uses multiple, changing, source IP addresses.

7) Anarchists, Crackers, and Kiddies - Who are these people, and why are they attacking I
your network?
Anarchists are people who just like to break stuff. They usually exploit any target of
opportunity.

Crackers are hobbyists or professionals who break passwords and develop Trojan horses or
other SW (called warez). They either use the SW themselves (for bragging rights) or sell it
for profit.

Script kiddies are hacker wannabes. They have no real hacker skills, so they buy or download
warez, which they launch.

Other attackers include disgruntled employees, terrorists, political operatives, or anyone else
who feels slighted, exploited, ripped off, or unloved.

8) Sniffing and Spoofing - Sniffing refers to the act of intercepting TCP packets. This
interception can happen through simple eavesdropping or something more sinister.

Spoofing is the act of sending an illegitimate packet with an expected acknowledgment

(ACK), which a hacker can guess, predict, or obtain by snooping.

As the cost of hacking attacks continues to rise, businesses have been forced to increase
spending on network security. However, hackers have also developed new skills that allow
them to break into more complex systems. Hacking typically involves compromising the
security of networks, breaking the security of application software, or creating malicious
programs such as viruses.

The most popular forms of network hacking are denial of service (DoS) attacks and mail
bombs. DoS attacks are designed to swamp a computer network, causing it to crash. Mail
bombs act in a similar fashion, but attack the network's mail servers. When eBay was
attacked in February 2000, its Web server was bombarded with fake requests for Web pages,
which overloaded the site and caused it to crash. Network hackers also try to break into
secure areas to find sensitive data. Once a network is hacked, files can be removed, stolen, or
erased. A group of teens in Wichita, Kansas, for example, hacked into AOL and stole credit
card numbers that they then used to buy video games.

Application hackers break security on application software-software including word

processing and graphics programs-in order to get it for free. One way they gain access to
software that requires a serial number for installation is by setting up a serial number
generator that will try millions of different combinations until a match is found. Application
hackers also sometimes attack the program itself in an attempt to remove certain security
features.

Hackers that create viruses, logic bombs, worms, and Trojan horses are involved in perhaps
the most malicious hacking activities. A virus is a program that has the potential to attack and
corrupt computer files by attaching itself to a file to replicate itself. It can also cause a
computer to crash by utilizing all of the computer's resources. For example, e-mail systems
were inundated with the "ILOVEYOU" and the "Love Bug" viruses in May of 2000, and the
damage to individuals, businesses, and institutions was estimated at roughly $10 billion.
Similar to viruses, logic bombs are designed to attack when triggered by a certain event like a
change in date. Worms attack networks in order to replicate and spread. In July of 2001, a
worm entitled "Code Red" began attacking Microsoft Internet Information Server (IIS)
systems. The worm infected servers running Windows NT 4, Windows 2000, Windows XP,
and IIS 4.0 and defaced Web sites, leaving the phrase "Welcome to www.worm.com Hacked
by Chinese!" Finally, a Trojan horse is a program that appears to do one thing, but really does
something else. While a computer system might recognize a Trojan horse as a safe program,
upon execution, it can release a virus, worm, or logic bomb. 
 PHISHING

Just like a lure might be dangled in front of a fish to trick it into thinking there’s a real worm
at the end of the hook, phishing is e-mail or instant messages that look like they’re from a
reputable company to get you to click a link. These messages can look like the real thing,

right down to a spoofed e-mail address (faking someone else’s e-mail address is known as
“spoofing”). When unsuspecting users click the link, they’re taken to an equally convincing
(and equally fake) Web page or pop-up window that’s been set up to imitate a legitimate
business. The phishing site will ask for the user’s personal information, which the phisher
then uses to buy things, apply for a new credit card, or otherwise steal a person’s identity.

What are the signs of phishing?

Spotting the imposters can be tricky since phishers go to great lengths to look like the real
thing:
Unsolicited requests for personal information. Most businesses aren’t going to ask you for
your personal information out of the blue—especially not an organization such as your bank
or credit card company, which should already have this information on file. If you do get a
request for personal information, call the company first and make sure the request is
legitimate.

Alarmist warnings. Phishers often attempt to get people to respond without thinking, and a
message that conveys a sense of urgency, perhaps by saying that an account will be closed in
48 hours if you don’t take immediate action, may cause you to do just that.

Mistakes. The little things can often reveal the biggest clues. Phishers often slip up on the
finer details and overlook typos, mistakes in grammar, and so on.
Addressed as “Customer.” If your bank, for example, regularly addresses you by name in
its correspondence and you get an e-mail addressed to “Dear Customer,” this may be a
phishing attempt.

The words “verify your account.” A legitimate business will not ask you to send
passwords, logon names, Social Security numbers, or other personally identifiable
information through e-mail. Be suspicious of a message that asks for personal information no
matter how authentic it looks.

The phrase “Click the link below to gain access to your account.” HTML-formatted
messages can contain links or forms that you can fill out just as you’d fill out a form on a
Web site. The links that you are urged to click may contain all or part of a real company's
name, but the link you see is actually taking you to a phony Web site.Trust your instincts. If
an e-mail message looks suspicious, it probably is.Another common technique that phishers
use is a Uniform Resource Locator (URL) that at first glance appears to be the name of a
well-known company but is slightly altered by intentionally adding, omitting, or transposing
letters. For example, the URL "www.microsoft.com" could appear instead as:

www.micosoft.com

www.verify-microsoft.com

MAIL TRACKER
Each email you receive comes with headers. The headers contain information about the
routing of the email and the originating IP of the email. Not all emails you receive can be
traced back to the originating point and depending on how you send emails etermines
whether or not they can trace the email back to you. The headers don't contain any personal
information. At most, you can get the originating IP and the computer name that sent the
email. The originating IP can be looked up to determine from where the email was sent. .

eMailTrackerPro can trace email back to it's true geographical location. You can also
use the spam filter in eMailTrackerPro to wipe out 90% of your daily spam in one go!

eMailTrackerPro is the only tool you will need to fight off SPAM. Not only can you track
email you have received to find the location, and more importantly, the relevant ISP in order
to report the SPAM but you can set up your eMail account with eMailTrackerPro to filter out
the SPAM before it even gets to your machine.
How does eMailTrackerPro trace email?

Using advanced header analysis and a world renown IP database eMailTrackerPro can pin
point the real IP address of the sender and track it down to the town/city the email came from.

How can eMailTrackerPro filter my SPAM?

eMailTrackerPro Advanced has a mail filtering feature. This is available to any user with a
POP account (SSL is supported). Once set up eMailTrackerPro will trace your emails whilst
they are still on your POP server, this alone can spot emails that have been misdirected and
then mark them as SPAM. Pre defined filters are already set up to check your email against
DNS Blacklists and foreign language filters to further wipe out SPAM.

You can cut your SPAM load by 90%

without having to do anything! (for this feature the advanced edition is needed)

Can I take further action against spammers?

eMailTrackerPro has an abuse reporting feature which automatically generates a report to be
sent to the ISP responsible for a particular SPAM email. We also provide the abuse address
for it to be sent to. All of this in just a couple of clicks.

Step A: Sender creates and sends an email

The originating sender creates an email in their Mail User Agent (MUA) and clicks 'Send'.
The MUA is the application the originating sender uses to compose and read email, such as
Eudora, Outlook, etc.

Step B: Sender's MDA/MTA routes the email

The sender's MUA transfers the email to a Mail Delivery Agent (MDA). Frequently, the
sender's MTA also handles the responsibilities of an MDA. Several of the most common
MTAs do this, including sendmail and qmail (which Kavi uses).

The MDA/MTA accepts the email, then routes it to local mailboxes or forwards it if it isn't
locally addressed.

In our diagram, an MDA forwards the email to an MTA and it enters the first of a series of
"network clouds," labeled as a "Company Network" cloud.

Step C: Network Cloud

An email can encounter a network cloud within a large company or ISP, or the largest
network cloud in existence: the Internet. The network cloud may encompass a multitude of
mail servers, DNS servers, routers, lions, tigers, bears (wolves!) and other devices and
services too numerous to mention. These are prone to be slow when processing an unusually
heavy load, temporarily unable to receive an email when taken down for maintenance, and
sometimes may not have identified themselves properly to the Internet through the Domain
Name System (DNS) so that other MTAs in the network cloud are unable to deliver mail as
addressed. These devices may be protected by firewalls, spam filters and malware detection
software that may bounce or even delete an email. When an email is deleted by this kind of
software, it tends to fail silently, so the sender is given no information about where or when
the delivery failure occurred.

Email service providers and other companies that process a large volume of email often have
their own, private network clouds. These organizations commonly have multiple mail servers,
and route all email through a central gateway server (i.e., mail hub) that redistributes mail to
whichever MTA is available. Email on these secondary MTAs must usually wait for the
primary MTA (i.e., the designated host for that domain) to become available, at which time
the secondary mail server will transfer its messages to the primary MTA.

Step D: Email Queue

The email in the diagram is addressed to someone at another company, so it enters an email
queue with other outgoing email messages. If there is a high volume of mail in the queue—
either because there are many messages or the messages are unusually large, or both—the
message will be delayed in the queue until the MTA processes the messages ahead of it.

Step E: MTA to MTA Transfer

When transferring an email, the sending MTA handles all aspects of mail delivery until the
message has been either accepted or rejected by the receiving MTA.

As the email clears the queue, it enters the Internet network cloud, where it is routed along a
host-to-host chain of servers. Each MTA in the Internet network cloud needs to "stop and ask
directions" from the Domain Name System (DNS) in order to identify the next MTA in the
delivery chain. The exact route depends

partly on server availability and mostly on which MTA can be found to accept email for the
domain specified in the address. Most email takes a path that is dependent on server
availability, so a pair of messages originating from the same host and addressed to the same
receiving host could take different paths. These days, it's mostly spammers that specify any
part of the path, deliberately routing their message through a series of relay servers in an
attempt to obscure the true origin of the message.

To find the recipient's IP address and mailbox, the MTA must drill down through the Domain
Name System (DNS), which consists of a set of servers distributed across the Internet.
Beginning with the root nameservers at the top-level domain (.tld), then domain nameservers
that handle requests for domains within that .tld, and eventually to nameservers that know
about the local domain.
DNS resolution and transfer process:

There are 13 root servers serving the top-level domains (e.g., .org, .com, .edu, .gov, .net, etc.).
These root servers refer requests for a given domain to the root name servers that handle
requests for that tld. In practice, this step is seldom necessary.

The MTA can bypass this step because it has already knows which domain name servers
handle requests for these .tlds. It asks the appropriate DNS server which Mail Exchange
(MX) servers have knowledge of the subdomain or local host in the email address. The DNS
server responds with an MX record: a prioritized list of MX servers for this domain.

An MX server is really an MTA wearing a different hat, just like a person who holds two jobs
with different job titles (or three, if the MTA also handles the responsibilities of an MDA).
To the DNS server, the server that accepts messages is an MX server. When is transferring
messages, it is called an MTA.

The MTA contacts the MX servers on the MX record in order of priority until it finds the
designated host for that address domain.

The sending MTA asks if the host accepts messages for the recipient's username at that
domain (i.e., username@domain.tld) and transfers the message.

Step F: Firewalls, Spam and Virus Filters

The transfer process described in the last step is somewhat simplified. An email may be
transferred to more than one MTA within a network cloud and is likely to be passed to at
least one firewall before it reaches it's destination.

An email encountering a firewall may be tested by spam and virus filters before it is allowed
to pass inside the firewall. These filters test to see if the message qualifies as spam or
malware. If the message contains malware, the file is usually quarantined and the sender is
notified. If the message is identified as spam, it will probably be deleted without notifying the
sender.

Spam is difficult to detect because it can assume so many different forms, so spam filters test
on a broad set of criteria and tend to misclassify a significant number of messages as spam,
particularly messages from mailing lists. When an email from a list or other automated source
seems to have vanished somewhere in the network cloud, the culprit is usually a spam filter at
the receiver's ISP or company.
 Password Cracking
Password cracking is the process of recovering passwords from data that has been stored in
or transmitted by a computer system. A common approach is to repeatedly try guesses for the
password. The purpose of password cracking might be to help a user recover a forgotten
password (though installing an entirely new password is less of a security risk, but involves
system administration privileges), to gain unauthorized access to a system, or as a preventive
measure by system administrators to check for easily crackable passwords. On a file-by file
basis, password cracking is utilized to gain access to digital evidence for which a judge has
allowed access but the particular file's access is restricted.

Principal attack methods

Weak encryption

If a system uses a poorly designed password hashing scheme to protect stored passwords, an
attacker can exploit any weaknesses to recover even 'well-chosen' passwords. One example is
the LM hash that Microsoft Windows XP and previous versions use by default to store user
passwords of less than 15 characters in length. LM hash converts the password into all
uppercase letters then breaks the password into two 7-character fields which are hashed
separately—which allows each half to be attacked individually.

Password encryption schemes that use stronger hash functions like MD5, SHA-512, SHA-1,

and RIPEMD-160 can still be vulnerable to brute-force and precomputation attacks. Such
attacks do not depend on reversing the hash function. Instead, they work by hashing a large
number of words or random permutations and comparing the result of each guess to a user's
stored password hash. Modern schemes such as MD5-crypt and bcrypt use purposefully slow
algorithms so that the number of guesses that an attacker can make in a given period of time
is relatively low. Salting, described below, greatly increases the difficulty of such
precomputation attacks, perhaps sufficiently to resist all attacks; every instance of its use
must be evaluated independently, however.

Because progress in analyzing existing cryptographic hash algorithms is always possible, a

hash which is effectively invulnerable today may become vulnerable tomorrow. Both MD5
and SHA-1, long thought secure, have been shown vulnerable to less than brute force
efficiency attacks. For encryption algorithms (rather different than cryptographic hashes) the
same has been true. DES has been broken (in the sense of more efficient than brute force
attacks being discovered), and computers have become fast enough that its short key (56 bits)
is clearly and publicly insecure against even brute force attacks. Passwords protected by these
measures against attack will become vulnerable, and passwords still in use thereby exposed.
Historical records are not always and forever irrelevant to today's security problems.

Guessing, dictionary and brute force attacks

The distinction between guessing, dictionary and brute force attacks is not strict. They are
similar in that an attacker goes through a list of candidate passwords one by one; the list may
be explicitly enumerated or implicitly defined, can incorporate knowledge about the victim,
and can be linguistically derived. Each of the three approaches, particularly 'dictionary
attack', is frequently used as an umbrella term to denote all the three attacks and the spectrum
of attacks encompassed by them.

Guessing

Passwords can sometimes be guessed by humans with knowledge of the user's personal
information. Examples of guessable passwords include:

 blank (none)
 the words "password", "passcode", "admin" and their derivatives
 a row of letters from the qwerty keyboard -- qwerty itself, asdf, or qwertyuiop)
 the user's name or login name
 the name of a significant other, a friend, relative or pet
 their birthplace or date of birth, or a friend's, or a relative's
 their automobile license plate number, or a friend's, or a relative's
 their office number, residence number or most commonly, their mobile number.
 a name of a celebrity they like
 a simple modification of one of the preceding, such as suffixing a digit, particularly 1,
or reversing the order of the letters.
 a swear word

Personal data about individuals are now available from various sources, many on-line, and
can often be obtained by someone using social engineering techniques, such as posing as an
opinion surveyor or a security control checker. Attackers who know the user may have
information as well. For example, if a user chooses the password "YaleLaw78" because he
graduated from Yale Law School in 1978, a disgruntled business partner might be able to
guess the password.

Guessing is particularly effective with systems that employ self-service password reset. For
example, in September 2008, the Yahoo e-mail account of Governor of Alaska and Vice
President of the United States nominee Sarah Palin was accessed without authorization by
someone who was able to research answers to two of her security questions, her zip code and
date of birth and was able to guess the third, where she met her husband.

Dictionary attacks

Users often choose weak passwords. Examples of insecure choices include the above list,
plus single words found in dictionaries, given and family names, any too short password
(usually thought to be 6 or 7 characters or less), or any password meeting a too restrictive and
so predictable, pattern (eg, alternating vowels and consonants). Repeated research over some
40 years has demonstrated that around 40% of user-chosen passwords are readily guessable
by sophisticated cracking programs armed with dictionaries and, perhaps, the user's personal
information.

In one survey of MySpace passwords obtained by phishing, 3.8 percent of those passwords

were a single word findable in a dictionary, and another 12 percent were a word plus a final
digit; two-thirds of the time that digit was 1.

Some users neglect to change the default password that came with their computer system
account. And some administrators neglect to change default account passwords provided by
the operating system vendor or hardware supplier. An infamous example is the use
of FieldService as a user name with Guest as the password. If not changed at system
configuration time, anyone familiar with such systems will have 'cracked' an important
password; such service accounts often have higher access privileges than do a normal user
accounts. Lists of default passwords are available on the Internet. Gary McKinnon, accused
by the United States of perpetrating the "biggest military computer hack of all time", has
claimed that he was able to get into the military's networks simply by using aPerl script that
searched for blank passwords; in other words his report suggests that there were computers
on these networks with no passwords at all. 
Cracking programs exist which accept personal information about the user being attacked and
generate common variations for passwords suggested by that information.

Brute force attack

A last resort is to try every possible password, known as a brute force attack. In theory, if

there is no limit to the number of attempts, a brute force attack will always be successful
since the rules for acceptable passwords must be publicly known; but as the length of the
password increases, so does the number of possible passwords. This method is unlikely to be
practical unless the password is relatively short, however techniques using parallel processing
can reduce the time to find the password in inverse proportion to the number of computer
devices (CPUs) in use. This depends heavily on whether the prospective attacker has access
to the hash of the password as well as the hashing algorithm, in which case the attack is
called an offline attack (it can be done without connection to the protected resource) or not, in
which case it is called an online attack. Offline attack is generally much easier, because
testing a password is reduced to a mathematical computation of the hash of the password to
be tried and comparison with the hash of the real password. In an online attack the attacker
has to try to authenticate himself with all the possible passwords, and rules and delays can be
imposed by the system and the attempts can be logged.

A common password length recommendation is eight or more randomly chosen characters

combining letters, numbers, and special characters (punctuation, etc). This recommendation
makes sense for systems using stronger password hashing mechanisms such as md5-crypt and
the Blowfish-based bcrypt, but is inappropriate for many Microsoft Windows systems
because they store a legacy LAN Manager hash which splits the password into two seven
character halves. On these systems, an eight character password is converted into a seven
character password and a one character password. For better security, LAN Manager
password storage should be disabled if it will not break supported legacy systems. Systems
which limit passwords to numeric characters only, or upper case only, or generally those
which limit the range of possible password character choices, also make brute force attacks
easier. Using longer passwords in these cases (if possible) can compensate for the limited
allowable character set. Of course, even with an adequate range of character choice, users
who limit themselves to an obvious subset of the available characters (e.g., use only upper
case alphabetic characters, or only digits) make brute force attacks against their accounts
much easier.
Generic brute-force search techniques are often successful, but smart brute-force techniques,
which exploit knowledge about how people tend to choose passwords, pose an even greater
threat. NISTSP 800-63 (2) provides further discussion of password quality, and suggests, for
example, that an 8 character user-chosen password may provide somewhere between 18 and
30 bits of entropy (randomness), depending on how it is chosen. For example 24 binary digits
of randomness is equivalent to 3 randomly chosen bytes, or approximately 5 random
characters if they are restricted to upper case alphabetic characters, or 2 words selected from
a 4000 word vocabulary. This amount of entropy is far less than what is generally considered
safe for an encryption key.

How small is too small for offline attacks thus depends partly on an attacker's ingenuity and
resources (e.g. available time and computing power). The second of these will increase as
computers get faster. Most commonly used hashes can be implemented using specialized
hardware, allowing faster attacks. Large numbers of computers can be harnessed in parallel,
each trying a separate portion of the search space. Unused overnight and weekend time on
office computers can also be used for this purpose.

Precomputation

In its most basic form, precomputation involves hashing each word in the dictionary (or any
search space of candidate passwords) and storing the word and its computed hash in a way
that enables lookup on the list of computed hashes. This way, when a new encrypted
password is obtained, password recovery is instantaneous. Precomputation can be very useful
for a dictionary attack if salt is not used properly (see below), and the dramatic decrease in
the cost of mass storage has made it practical for fairly large dictionaries.

Advanced precomputation methods exist that are even more effective. By applying a time-
memory tradeoff, a middle ground can be reached - a search space of size N can be turned
into an encrypted database of size O(N2/3) in which searching for an encrypted password takes
time O(N2/3). The theory has recently been refined into a practical technique. Another
example cracks alphanumericWindows LAN Manager passwords in a few seconds. This is
much faster than brute force attacks on the obsolete LAN Manager, which uses a particularly
weak method of hashing the password. Windows systems prior to Windows Vista/Server
2008 compute and store a LAN Manager hash by default for backwards compatibility.
A technique similar to precomputation, known generically as memoization, can be used to
crack multiple passwords at the cost of cracking just one. Since encrypting a word takes
much longer than comparing it with a stored word, a lot of effort is saved by encrypting each
word only once and comparing it with each of the encrypted passwords using an efficient list
search algorithm. The two approaches may of course be combined: the time-space tradeoff
attack can be modified to crack multiple passwords simultaneously in a shorter time than
cracking them one after the other.

Salting

The benefits of precomputation and memoization can be nullified by randomizing the hashing

process. This is known as salting. When the user sets a password, a short, random string
called the salt is suffixed to the password before encrypting it; the salt is stored along with
the encrypted password so that it can be used during verification. Since the salt is usually
different for each user, the attacker can no longer construct tables with a single encrypted
version of each candidate password. Early Unix systems used a 12-bit salt. Attackers could
still build tables with common passwords encrypted with all 4096 possible 12-bit salts.
However, if the salt is long enough, there are too many possibilities and the attacker must
repeat the encryption of every guess for each user. Modern methods such as md5-crypt and
bcrypt use salts of 48 and 128 bits respectively.

Early Unix password vulnerability

Early Unix implementations limited passwords to 8 characters and used a 12-bit salt, which
allowed for 4096 possible salt values. While 12 bits was conventionally considered good
enough for most purposes in the 1970s, by 2005 disk storage had become cheap enough that
an attacker can precompute the hashes of millions of common passwords, including all 4096
possible salt variations for each password, and store the precomputed values on a single
portable hard drive. An attacker with a larger budget can build a disk farm with all 6
character passwords and the most common 7 and 8 character passwords stored in encrypted
form, for all 4096 possible salts. And when ] still offers some benefit. Since there is little
downside to using a longer salt, and because they render any precomputation or memoization
hopeless, modern implementations choose to do so.
Prevention

The best method of preventing password cracking is to ensure that attackers cannot get access
even to the encrypted password. For example, on the Unix operating system, encrypted
passwords were originally stored in a publicly accessible file /etc/passwd. On modern Unix
(and similar) systems, on the other hand, they are stored in the file /etc/shadow, which is
accessible only to programs running with enhanced privileges (ie, 'system' privileges). This
makes it harder for a malicious user to obtain the encrypted passwords in the first instance.
Unfortunately, many common network protocols transmit passwords in cleartext or use weak
challenge/response schemes.

Modern Unix systems have replaced traditional DES-based password hashing with stronger
methods based on MD5 and Blowfish. Other systems have also begun to adopt these
methods. For instance, the Cisco IOS originally used a reversible Vigenere cipher to encrypt
passwords, but now uses md5-crypt with a 24-bit salt when the "enable secret" command is
used. These newer methods use large salt values which prevent attackers from efficiently
mounting offline attacks against multiple user accounts simultaneously. The algorithms are
also much slower to execute which drastically increases the time required to mount a
successful offline attack.

Solutions like a security token give a formal proof answer by constantly shifting password.

Those solutions abruptly reduce the timeframe for brute forcing (attacker needs to break and
use the password within a single shift) and they reduce the value of the stolen passwords
because of its short time validity.

Software

There are many password cracking software tools, but the most popular are Cain and
Abel, John the Ripper, Hydra, ElcomSoft and Lastbit. Many litigation support
software packages also include password cracking functionality. Most of these packages
employ a mixture of cracking strategies, with brute force and dictionary attacks proving to be
the most productive.

Footprinting
Is the technique of gathering information about computer systems and the entities
they belong to. This is done by employing various computer security techniques, as:

 DNS queries
 Network enumeration
 Network queries
 Operating system identification
 Organizational queries
 Ping sweeps
 Point of contact queries
 Port Scanning
 Registrar queries (WHOIS queries)

When used in the computer security lexicon, "footprinting" generally refers to one of
the pre-attack phases; tasks performed prior to doing the actual attack. Some of the
tools used for footprinting areSam Spade, nslookup, traceroute, Nmap and neotrace.

SQL injection
SQL injection is a code injection technique that exploits a security
vulnerability occurring in the database layer of an application. The vulnerability is
present when user input is either incorrectly filtered for string literal escape
characters embedded in SQL statements or user input is not strongly typed and
thereby unexpectedly executed. It is an instance of a more general class of
vulnerabilities that can occur whenever one programming or scripting language is
embedded inside another. SQL injection attacks are also known as SQL insertion
attacks. Forms of vulnerability

Incorrectly filtered escape characters

This form of SQL injection occurs when user input is not filtered for escape
characters and is then passed into a SQL statement. This results in the potential
manipulation of the statements performed on the database by the end user of the
application.
The following line of code illustrates this vulnerability:

statement = "SELECT * FROM users WHERE name = '" + userName + "';"

This SQL code is designed to pull up the records of the specified username from its
table of users. However, if the "userName" variable is crafted in a specific way by a
malicious user, the SQL statement may do more than the code author intended. For
example, setting the "userName" variable as

' or '1'='1

Or using comments to even block the rest of the query:

' or '1'='1';/*'

renders this SQL statement by the parent language:

SELECT * FROM users WHERE name = '' OR '1'='1';

If this code were to be used in an authentication procedure then this example could
be used to force the selection of a valid username because the evaluation of '1'='1' is
always true.

The following value of "userName" in the statement below would cause the deletion
of the "users" table as well as the selection of all data from the "userinfo" table (in
essence revealing the information of every user), using an API that allows multiple
statements:

a';DROP TABLE users; SELECT * FROM userinfo WHERE 't' = 't

This input renders the final SQL statement as follows:

SELECT * FROM users WHERE name = 'a';DROP TABLE users; SELECT * FROM
userinfo WHERE 't' = 't';

While most SQL server implementations allow multiple statements to be executed

with one call in this way, some SQL APIs such as PHP's mysql_query() do not allow
this for security reasons. This prevents attackers from injecting entirely separate
queries, but doesn't stop them from modifying queries.

Incorrect type handling

This form of SQL injection occurs when a user supplied field is not strongly typed or
is not checked for type constraints. This could take place when a numeric field is to
be used in a SQL statement, but the programmer makes no checks to validate that
the user supplied input is numeric. For example:

statement := "SELECT * FROM userinfo WHERE id = " + a_variable + ";"

It is clear from this statement that the author intended a_variable to be a number
correlating to the "id" field. However, if it is in fact a string then the end user may
manipulate the statement as they choose, thereby bypassing the need for escape
characters. For example, setting a_variable to

1;DROP TABLE users

will drop (delete) the "users" table from the database, since the SQL would be
rendered as follows:

SELECT * FROM userinfo WHERE id=1;DROP TABLE users;

Vulnerabilities inside the database server

Sometimes vulnerabilities can exist within the database server software itself, as was
the case with the MySQL server's mysql_real_escape_string() function. This would
allow an attacker to perform a successful SQL injection attack based on bad Unicode
characters even if the user's input is being escaped. This bug was patched with the
release of version 5.0.22 (released on 24th May 06).

Blind SQL injection

Blind SQL Injection is used when a web application is vulnerable to an SQL injection
but the results of the injection are not visible to the attacker. The page with the
vulnerability may not be one that displays data but will display differently depending
on the results of a logical statement injected into the legitimate SQL statement called
for that page. This type of attack can become time-intensive because a new
statement must be crafted for each bit recovered. There are several tools that can
automate these attacks once the location of the vulnerability and the target
information has been established.

Conditional responses

One type of blind SQL injection forces the database to evaluate a logical statement
on an ordinary application screen.

SELECT booktitle FROM booklist WHERE bookId = 'OOk14cd' AND 1=1;

will result in a normal page while

SELECT booktitle FROM booklist WHERE bookId = 'OOk14cd' AND 1=2;

will likely give a different result if the page is vulnerable to a SQL injection. An
injection like this may suggest to the attacker that a blind SQL injection is possible,
leaving the attacker to devise statements that evaluate to true or false depending on
the contents of another column or table outside of the SELECT statement's column
list.

Conditional errors

This type of blind SQL injection causes an SQL error by forcing the database to
evaluate a statement that causes an error if the WHERE statement is true. For
example,

SELECT 1/0 FROM users WHERE username='Ralph';

the division by zero will only be evaluated and result in an error if user Ralph exists.

Time delays

Time Delays are a type of blind SQL injection that cause the SQL engine to execute
a long running query or a time delay statement depending on the logic injected. The
attacker can then measure the time the page takes to load to determine if the
injected statement is true.

Preventing SQL injection

To protect against SQL injection, user input must not directly be embedded in SQL
statements. Instead, parameterized statements must be used (preferred), or user
input must be carefully escaped or filtered.

Parameterized statements

With most development platforms, parameterized statements can be used that work
with parameters (sometimes called placeholders or bind variables) instead of
embedding user input in the statement. In many cases, the SQL statement is fixed,
and each parameter is a scalar, not a table. The user input is then assigned (bound)
to a parameter. This is an example using Java and the JDBC API:
PreparedStatement prep = conn.prepareStatement("SELECT * FROM USERS
WHERE USERNAME=? AND PASSWORD=?");

prep.setString(1, username);

prep.setString(2, password);

prep.executeQuery();

Enforcement at the database level

Currently only the H2 Database Engine supports the ability to enforce query
parameterization. However, one drawback is that query by example may not be
possible or practical because it's difficult to implement query by example using
parametrized queries.

Enforcement at the coding level

Using object-relational mapping libraries avoids the need to write SQL code. The
ORM library in effect will generate parameterized SQL statements from object-
oriented code.

Escaping

A straight-forward, though error-prone, way to prevent injections is to escape

characters that have a special meaning in SQL. The manual for an SQL DBMS
explains which characters have a special meaning, which allows creating a
comprehensive blacklist of characters that need translation. For instance, every
occurrence of a single quote (') in a parameter must be replaced by two single
quotes ('') to form a valid SQL string literal. In PHP, for example, it is usual to escape
parameters using the function mysql_real_escape_string before sending the SQL
query:

$query = sprintf("SELECT * FROM Users where UserName='%s' and

Password='%s'",

mysql_real_escape_string($Username),

mysql_real_escape_string($Password));

mysql_query($query);

This is error prone because it is easy to forget to escape a given string.

Real-world examples
On November 1, 2005, a high school student used SQL injection to break into the
site of a Taiwanese information security magazine from the Tech Target group and
steal customers' information.

On January 13, 2006, Russian computer criminals broke into a Rhode Island
government web site and allegedly stole credit card data from individuals who have
done business online with state agencies.

On March 29, 2006, Susam Pal discovered an SQL injection flaw in an official Indian
government tourism site.

On March 2, 2007, Sebastian Bauer discovered an SQL injection flaw in the knorr.de
login page.

On June 29, 2007, a computer criminal defaced the Microsoft U.K. website using
SQL injection. . U.K. website The Register quoted a Microsoft spokesperson
acknowledging the problem.

In January 2008, tens of thousands of PCs were infected by an automated SQL

injection attack that exploited a vulnerability in application code that uses Microsoft
SQL Server as the database store.

On April 13, 2008, the Sexual and Violent Offender Registry of Oklahoma shut down
its website for 'routine maintenance' after being informed that 10,597 Social Security
numbers from sex offenders had been downloaded via an SQL injection attack

In May 2008, a server farm inside China used automated queries to Google's search
engine to identify SQL server websites which were vulnerable to the attack of an
automated SQL injection tool.

In 2008, at least April through August, a sweep of attacks began exploiting the SQL
injection vulnerabilities of Microsoft's IIS web server and SQL Server database
server. The attack doesn't require guessing the name of a table or column, and
corrupts all text columns in all tables in a single request. A HTML string that
references a malware JavaScript file is appended to each value. When that database
value is later displayed to a website visitor, the script attempts several approaches at
gaining control over a visitor's system. The number of exploited web pages is
estimated at 500,000
On August 17, 2009, the United States Justice Department charged an American
citizen Albert Gonzalez and two unnamed Russians with the theft of 130 million
credit card numbers using an SQL injection attack. In reportedly "the biggest case of
identity theft in American history", the man stole cards from a number of corporate
victims after researching their payment processing systems. Among the companies
hit were credit card processor Heartland Payment Systems, convenience store chain
7-Eleven, and supermarket chain Hannaford Brothers.

In December 2009, an attacker breached a RockYou! plaintext database containing

the unencrypted usernames and passwords of about 32 million users using an SQL
injection attack

Forms of vulnerability

Incorrectly filtered escape characters

This form of SQL injection occurs when user input is not filtered for escape characters and is
then passed into a SQL statement. This results in the potential manipulation of the statements
performed on the database by the end user of the application.

The following line of code illustrates this vulnerability:

statement = "SELECT * FROM users WHERE name = '" + userName + "';"
This SQL code is designed to pull up the records of the specified username from its table of
users. However, if the "userName" variable is crafted in a specific way by a malicious user,
the SQL statement may do more than the code author intended. For example, setting the
"userName" variable as

' or '1'='1

Or using comments to even block the rest of the query:

' or '1'='1';/*'

renders this SQL statement by the parent language:

SELECT * FROM users WHERE name = '' OR '1'='1';
If this code were to be used in an authentication procedure then this example could be used to
force the selection of a valid username because the evaluation of '1'='1' is always true.
The following value of "userName" in the statement below would cause the deletion of the
"users" table as well as the selection of all data from the "userinfo" table (in essence revealing
the information of every user), using an API that allows multiple statements:

a';DROP TABLE users; SELECT * FROM userinfo WHERE 't' = 't

This input renders the final SQL statement as follows:

SELECT * FROM users WHERE name = 'a';DROP TABLE users; SELECT * FROM
userinfo WHERE 't' = 't';
While most SQL server implementations allow multiple statements to be executed with one
call in this way, some SQL APIs such as PHP's mysql_query() do not allow this for security
reasons. This prevents attackers from injecting entirely separate queries, but doesn't stop
them from modifying queries.
Incorrect type handling
This form of SQL injection occurs when a user supplied field is not strongly typed or is not
checked for type constraints. This could take place when a numeric field is to be used in a
SQL statement, but the programmer makes no checks to validate that the user supplied input
is numeric. For example:
statement := "SELECT * FROM userinfo WHERE id = " + a_variable + ";"
It is clear from this statement that the author intended a_variable to be a number correlating
to the "id" field. However, if it is in fact a string then the end user may manipulate the
statement as they choose, thereby bypassing the need for escape characters. For example,
setting a_variable to

1;DROP TABLE users

will drop (delete) the "users" table from the database, since the SQL would be rendered as
follows:
SELECT * FROM userinfo WHERE id=1;DROP TABLE users;

Vulnerabilities inside the database server

Sometimes vulnerabilities can exist within the database server software itself, as was the case
with the MySQL server's mysql_real_escape_string() function. This would allow an attacker
to perform a successful SQL injection attack based on bad Unicode characters even if the
user's input is being escaped. This bug was patched with the release of version 5.0.22
(released on 24th May 06).
Blind SQL injection
Blind SQL Injection is used when a web application is vulnerable to an SQL injection but the
results of the injection are not visible to the attacker. The page with the vulnerability may not
be one that displays data but will display differently depending on the results of a logical
statement injected into the legitimate SQL statement called for that page. This type of attack
can become time-intensive because a new statement must be crafted for each bit recovered.
There are several tools that can automate these attacks once the location of the vulnerability
and the target information has been established.

Conditional responses
One type of blind SQL injection forces the database to evaluate a logical statement on an
ordinary application screen.
SELECT booktitle FROM booklist WHERE bookId = 'OOk14cd' AND 1=1;
will result in a normal page while
SELECT booktitle FROM booklist WHERE bookId = 'OOk14cd' AND 1=2;
will likely give a different result if the page is vulnerable to a SQL injection. An injection like
this may suggest to the attacker that a blind SQL injection is possible, leaving the attacker to
devise statements that evaluate to true or false depending on the contents of another column
or table outside of the SELECT statement's column list.

Conditional errors
This type of blind SQL injection causes an SQL error by forcing the database to evaluate a
statement that causes an error if the WHERE statement is true. For example,
SELECT 1/0 FROM users WHERE username='Ralph';
the division by zero will only be evaluated and result in an error if user Ralph exists.

Time delays
Time Delays are a type of blind SQL injection that cause the SQL engine to execute a long
running query or a time delay statement depending on the logic injected. The attacker can
then measure the time the page takes to load to determine if the injected statement is true.

Preventing SQL injection

To protect against SQL injection, user input must not directly be embedded in SQL
statements. Instead, parameterized statements must be used (preferred), or user input must be
carefully escaped or filtered.

Parameterized statements
With most development platforms, parameterized statements can be used that work with
parameters (sometimes called placeholders or bind variables) instead of embedding user input
in the statement. In many cases, the SQL statement is fixed, and each parameter is a scalar,
not a table. The user input is then assigned (bound) to a parameter. This is an example using
Java and theJDBC API:
PreparedStatement prep = conn.prepareStatement("SELECT * FROM USERS WHERE
USERNAME=? AND PASSWORD=?");
prep.setString(1, username);
prep.setString(2, password);
prep.executeQuery();
Enforcement at the database level
Currently only the H2 Database Engine supports the ability to enforce query
parameterization. However, one drawback is that query by example may not be possible or
practical because it's difficult to implement query by example using parametrized queries.

Enforcement at the coding level

Using object-relational mapping libraries avoids the need to write SQL code. The ORM
library in effect will generate parameterized SQL statements from object-oriented code.

Escaping
A straight-forward, though error-prone, way to prevent injections is to escape characters that
have a special meaning in SQL. The manual for an SQL DBMS explains which characters
have a special meaning, which allows creating a comprehensive blacklist of characters that
need translation. For instance, every occurrence of a single quote (') in a parameter must be
replaced by two single quotes ('') to form a valid SQL string literal. In PHP, for example, it is
usual to escape parameters using the function mysql_real_escape_string before sending the
SQL query:
$query = sprintf("SELECT * FROM Users where UserName='%s' and Password='%s'",
mysql_real_escape_string($Username),
mysql_real_escape_string($Password));
mysql_query($query);
This is error prone because it is easy to forget to escape a given string.
Real-world examples

 On November 1, 2005, a high school student used SQL injection to break into the site
of a Taiwanese information security magazine from the Tech Target group and steal
customers' information.

 On January 13, 2006, Russian computer criminals broke into a Rhode Island
government web site and allegedly stole credit card data from individuals who have done
business online with state agencies.

 On March 29, 2006, Susam Pal discovered an SQL injection flaw in an official Indian
government tourism site.

 On March 2, 2007, Sebastian Bauer discovered an SQL injection flaw in

the knorr.de login page.

 On June 29, 2007, a computer criminal defaced the Microsoft U.K. website using
SQL injection. . U.K. website The Register quoted a Microsoft spokesperson
acknowledging the problem.

 In January 2008, tens of thousands of PCs were infected by an automated SQL

injection attack that exploited a vulnerability in application code that uses Microsoft SQL
Server as the database store. 

 On April 13, 2008, the Sexual and Violent Offender Registry of Oklahoma shut down

its website for 'routine maintenance' after being informed that 10,597 Social Security
numbers from sex offendershad been downloaded via an SQL injection attack

 In May 2008, a server farm inside China used automated queries to Google's search
engine to identify SQL server websites which were vulnerable to the attack of an
automated SQL injection tool.

 In 2008, at least April through August, a sweep of attacks began exploiting the SQL
injection vulnerabilities of Microsoft's IIS web server and SQL Server database server.
The attack doesn't require guessing the name of a table or column, and corrupts all text
columns in all tables in a single request.  A HTML string that references a malware
JavaScript file is appended to each value. When that database value is later displayed to a
website visitor, the script attempts several approaches at gaining control over a visitor's
system. The number of exploited web pages is estimated at 500,000
 On August 17, 2009, the United States Justice Department charged an American
citizen Albert Gonzalez and two unnamed Russians with the theft of 130 million credit
card numbers using an SQL injection attack. In reportedly "the biggest case of identity
theft in American history", the man stole cards from a number of corporate victims after
researching their payment processing systems. Among the companies hit were credit card
processor Heartland Payment Systems, convenience store chain 7-Eleven, and
supermarket chain Hannaford Brothers.

 In December 2009, an attacker breached a RockYou! plaintext database containing

the unencrypted usernames and passwords of about 32 million users using an SQL
injection attack.

Denial-of-Service attack (DoS attack)

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack)

is an attempt to make a computer resource unavailable to its intended users. Although the
means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of
the concerted efforts of a person or people to prevent an Internet site or service from
functioning efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks
typically target sites or services hosted on high-profile web servers such as banks, credit card
payment gateways, and even root nameservers. The term is generally used with regards to
computer networks, but is not limited to this field, for example, it is also used in reference to
CPU resource management.

One common method of attack involves saturating the target (victim) machine with external
communications requests, such that it cannot respond to legitimate traffic, or responds so
slowly as to be rendered effectively unavailable. In general terms, DoS attacks are
implemented by either forcing the targeted computer(s) to reset, or consuming its resources
so that it can no longer provide its intended service or obstructing the communication media
between the intended users and the victim so that they can no longer communicate
adequately.

Denial-of-service attacks are considered violations of the IAB's Internet proper use policy,
and also violate the acceptable use policies of virtually all Internet service providers. They
also commonly constitute violations of the laws of individual nations.
 NET TOOLS
Net Tools is cutting-edge security and network monitoring software for the Internet and
Local Area Networks, providing clients with the ability and confidence to meet the
challenges of tomorrow's technology. Keeping pace with the industry trends, we offer
professional tools that support the latest standards, protocols, software, and hardware for both
wired and wireless networks. The main goal is the creation of high quality software. Net
Tools is a very strong combination of network scanning, security, file, system, and
administrator tools useful in diagnosing networks and monitoring your PC and

computer's network connections for system administrators. Next to the essential core tools it
includes a lot of extra valuable features. It’s a Swiss Army knife for everyone interested in a
set of powerful network tools for everyday use. This all-in-one toolkit includes also a lot of
handy file and system utilities next to the huge amount of network tools. The menus are fully
configurable, so in this way you won’t get lost in the extremely large amount of essential
tools. All the additional features will make this application a must have for all system
administrators. There are numerous constructive and valuable applications included in Net
Tools that can be used for a great amount of purposes. The latest version of Net Tools is
hybrid; it means that it’s capable of working together with applications that are made and
designed for Net Tools, so in this way more flexibility and user-friendliness is obtained. This
software is designed for the Microsoft Windows OS (Windows 98, NT, 2000, 2003, XP,
Vista). It’s entirely compatible and has thoroughly been tested on Windows XP. With the
175+ tools it is a great collection of useful tools for network users. The size of Net Tools
5.0.70 is approximately 25 Mb.

CRYPTOGRAPHY

Public-key cryptography is a cryptographic approach, employed by many cryptographic

algorithms and cryptosystems, whose distinguishing characteristic is the use of asymmetric
key algorithms instead of or in addition to symmetric key algorithms. Using the techniques of
public key-private key cryptography, many methods of protecting communications or
authenticating messages formerly unknown have become practical. They do not require a
secure initial exchange of one or more secret keys as is required when using symmetric key
algorithms. It can also be used to create digital signatures.

Public key cryptography is a fundamental and widely used technology around the world, and
is the approach which underlies such Internet standards as Transport Layer Security (TLS)
(successor to SSL), PGP and GPG.

The distinguishing technique used in public key-private key cryptography is use of

asymmetric key algorithms because the key used to encrypt a message is not the same as
the key used to decrypt it. Each user has a pair of cryptographic keys — a public key and a
private key. The private key is kept secret, whilst the public key may be widely distributed.
Messages are encrypted with the recipient's public key and can only be decrypted with the
corresponding private key. The keys are related mathematically, but the private key cannot be
feasibly (ie, in actual or projected practice) derived from the public key. It was the discovery
of such algorithms which revolutionized the practice of cryptography beginning in the middle
1970s.

In contrast, Symmetric-key algorithms, variations of which have been used for some
thousands of years, use a single secret key shared by sender and receiver (which must also be
kept private, thus accounting for the ambiguity of the common terminology) for both
encryption and decryption. To use a symmetric encryption scheme, the sender and receiver
must securely share a key in advance.

Because symmetric key algorithms are nearly always much less computationally intensive, it
is common to exchange a key using a key-exchange algorithm and transmit data using that
key and a symmetric key algorithm. PGP, and the SSL/TLS family of schemes do this, for
instance, and are called hybrid cryptosystems in consequence
 ART OF GOOGLING

Here's a quick list of some of our most popular tools to help refine and improve your search. For additional help with
Google Web Search or any other Google product.

OPERATOR EXAMPLE   FINDS PAGES CONTAINING...

Vacation hawaii   the words vacation and Hawaii .
Maui OR Hawaii   either the word Maui or the word Hawaii
"To each his own"   the exact phrase to each his own
virus –computer   the word virus but NOT the word computer
+sock   Only the word sock, and not the plural or any tenses or synonyms
~auto loan   loan info for both the word auto and its synonyms: truck, car, etc.
define:computer   definitions of the word computer from around the Web.
red * blue   the words red and blue separated by one or more words.
I'm Feeling Lucky   Takes you directly to first web page returned for your query.

CALCULATOR OPERATORS   MEANING   TYPE INTO SEARCH BOX

+   Addition   45 + 39
-   Subtraction   45 – 39
*   multiplication   45 * 39
/   Division   45 / 39
% of   percentage of   45% of 39
^ raise to a power 2^5
   
(2 to the 5th power)

ADVANCED OPERATORS   MEANING   WHAT TO TYPE INTO SEARCH BOX (& DESCRIPTION OF RESULTS)
Search only one admission site:www.stanford.edu
site:    
website (Search Stanford Univ. site for admissions info.)
Search within a DVD player $100..150
[#]…[#]    
range of numbers (Search for DVD players between $100 and $150)
link:www.stanford.edu
link:   linked pages  
(Find pages that link to the Stanford University website.)
info:   Info about a page   info:www.stanford.edu
 (Find information about the Stanford University website.)
related:www.stanford.edu
related:   Related pages  
(Find websites related to the Stanford University website.)

DATA RECOVERY

Data recovery is the retrieval of inaccessible or contaminated data from media that has been
damaged in some way. Data recovery is being increasingly used and is an important process
nowadays.

There has been a lot of progress in increasing the memory capacity of data storage devices.
Therefore data loss from any one incident also tends to be very high. The relevance of lost
data can vary greatly. Maybe you have had the experience of storing a homework assignment
on a floppy disk only to have it missing on the day the assignment in due.

Consider the fact that a large amount of businesses nowadays have vital organizational
related data stored on machines. Also hospitals store data on patients on computers. Large
amounts of websites nowadays use databases technology to enhance their websites and make
them more dynamic. Php and MySql use has been on the rise on the Internet. Database failure
is not uncommon and so it is not a fail proof method of storing information.

Companies have high reliance on computer technology to write and store data relevant to
their business operations. Thus the data being stored can have a great deal of impact on
personal lives and operations of companies.

There can be several causes of data loss.

Data loss can occur from unexpected incidences including national tragedies such as floods
and earthquakes.

Often power failure can cause loss of data from hard drives. Sudden power surges can also
cause a lot of damage to a computer’s hard drive.
Accidentally deleting a file or formatting a hard drive or floppy disk is a common reason for
data loss.

If you have accidentally lost any important documents there are several steps you can take.
Remember that if you have accidentally erased a file, it may not have vanished from your
computer. It may have left an imprint in a different format on the computer’s hard drive or
other storage devices. Recovering the data involves locating it and transforming it into human
readable form.

Not all data may be recoverable.

You can either hire professional service to help you solve your problem or attempt a recovery
on your own.

You can carry out data recovery operations on your own computer if you know what you are
doing. There is data recovery software widely available that can assist you in the process.

Data recovery can become complicated if you overwrite on the storage device that has the
lost data. Therefore if you do not know what you are doing, it is advisable to contact a
professional service firm.

Data recovery professionals are experts in recovering data from all sorts of media and from a
variety of damages done. There are many specialists out there who have years of experience
in the IT field. The kind of data recovery operation to use will depend a great deal on the
storage device and other variables such as the amount of damage done or the operation
system used such as Macintosh, Windows or Linux.

There are some cases where it may be impossible to recover any data. However do not fret as
the odds lie in your favor since a high percentage of data recovery operations are successful.

Preventing data loss

Of course the best way is to prevent data loss in the first place.

Data backup allows for restoring data if data loss occurs. Even ordinary pc users can set up
their computer to carry out regularly scheduled backup operations. In the event of a hard
drive crash or an unwise change in settings by an uninformed user, the restore tool can be
used to retrieve deleted data or to restore the computer’s settings from an earlier time.

For the back up process to be useful it should involve several reliable backup systems and
performing drills to make sure the data is being stored correctly. Additional protection
methods from data loss include making sure that the hard drive is protected from damages
from the external environment. This includes protection from sunlight and temperature
extremes.

Also plugging in your pc into a surge protector rather than an ordinary outlet can give your
computer a protection layer from electricity fluctuations. Keep your virus protection up to
date. Also remember to keep your backup data separate from your computer.

Nevertheless a lot of companies will go through a disaster and experience data loss. The best
thing to do is not to panic and also not to ignore the situation. The quicker you rectify the
situation the better. Counting on data loss will help you be prepared for any such event

.
 Honeypot or Trap Door
In computer terminology, a honeypot is a trap set to detect, deflect, or in some manner
counteract attempts at unauthorized use of information systems. Generally it consists of a
computer, data, or a network site that appears to be part of a network, but is actually isolated,
(un)protected, and monitored, and which seems to contain information or a resource of value
to attackers.

Function:
A honeypot is valuable as a surveillance and early-warning tool. While it is often a computer,
a honeypot can take other forms, such as files or data records, or even unused IP address
space. A honeypot that masquerades as an open proxy to monitor and record those using the
system is a sugarcane. Honeypots should have no production value, and hence should not see
any legitimate traffic or activity. Whatever they capture is therefore malicious or
unauthorized. One practical implication of this is honeypots that thwart spam by
masquerading as the type of systems abused by spammers. They categorize trapped material
100% accurately: it is all illicit.
Honeypots can carry risks to a network, and must be handled with care. If they are not
properly walled off, an attacker can use them to break into a system.
Victim hosts are an active network counter-intrusion tool. These computers run special
software, designed to appear to an intruder as being important and worth looking into. In
reality, these programs are dummies, and their patterns are constructed specifically to foster
interest in attackers. The software installed on, and run by, victim hosts is dual purpose. First,
these dummy programs keep a network intruder occupied looking for valuable information
where none exists, effectively convincing him or her to isolate themselves in what is truly an
unimportant part of the network. This decoy strategy is designed to keep an intruder from
getting bored and heading into truly security-critical systems. The second part of the victim
host strategy is intelligence gathering. Once an intruder has broken into the victim host, the
machine or a network administrator can examine the intrusion methods used by the intruder.
This intelligence can be used to build specific countermeasures to intrusion techniques,
making truly important systems on the network less vulnerable to intrusion.

Types:
Honeypots can be classified based on their deployment and based on their level of
involvement. Based on the deployment, honeypots may be classified as
1. Production Honeypots
2. Research Honeypots
1. Production honeypots are easy to use, capture only limited information, and are used
primarily by companies or corporations; Production honeypots are placed inside the
production network with other production servers by organization to improve their
overall state of security. Normally, production honeypots are low-interaction
honeypots, which are easier to deploy. They give less information about the attacks or
attackers than research honeypots do. The purpose of a production honeypot is to help
mitigate risk in an organization. The honeypot adds value to the security measures of
an organization.

2. Research honeypots are run by a volunteer, non-profit research organization or an

educational institution to gather information about the motives and tactics of the
Blackhat community targeting different networks. These honeypots do not add direct
value to a specific organization. Instead they are used to research the threats
organizations face, and to learn how to better protect against those threats. This
information is then used to protect against those threats. Research honeypots are
complex to deploy and maintain, capture extensive information, and are used
primarily by research, military, or government organizations.

Spam versions
Spammers abuse vulnerable resources such as open mail relays and open proxies. Some
system administrators have created honeypot programs that masquerade as these abusable
resources to discover spammer activity. There are several capabilities such honeypots provide
to these administrators and the existence of such fake abusable systems makes abuse more
difficult or risky. Honeypots can be a powerful countermeasure to abuse from those who rely
on very high volume abuse (e.g., spammers).
These honeypots can reveal the apparent IP address of the abuse and provide bulk spam
capture (which enables operators to determine spammers' URLs and response mechanisms).
For open relay honeypots, it is possible to determine the e-mail addresses ("dropboxes")
spammers use as targets for their test messages, which are the tool they use to detect open
relays. It is then simple to deceive the spammer: transmit any illicit relay e-mail received
addressed to that dropbox e-mail address. That tells the spammer the honeypot is a genuine
abusable open relay, and they often respond by sending large quantities of relay spam to that
honeypot, which stops it. The apparent source may be another abused system—spammers and
other abusers may use a chain of abused systems to make detection of the original starting
point of the abuse traffic difficult.
This in itself is indicative of the power of honeypots as anti-spam tools. In the early days of
anti-spam honeypots, spammers, with little concern for hiding their location, felt safe testing
for vulnerabilities and sending spam directly from their own systems. Honeypots made the
abuse less easy and safe.
Spam still flows through open relays, but the volume is much smaller than in 2001 to 2002.
While most spam originates in the U.S., spammers hop through open relays across political
boundaries to mask their origin. Honeypot operators may use intercepted relay tests to
recognize and thwart attempts to relay spam through their honeypots. "Thwart" may mean
"accept the relay spam but decline to deliver it." Honeypot operators may discover other
details concerning the spam and the spammer by examining the captured spam messages.
(However, open relay spam has declined significantly.[citation needed])
Open relay honeypots include Jackpot, written in Java, smtpot.py, written in Python, and
spamhole, written in C. The Bubblegum Proxypot is an open proxy honeypot (or proxypot).

E-mail trap
An e-mail address that is not used for any other purpose than to receive spam can also be
considered a spam honeypot. Compared with the term spamtrap, the term "honeypot" might
better be reserved for systems and techniques used to detect or counter attacks and probes.
Spam arrives at its destination "legitimately"—exactly as non-spam e-mail would arrive.
An amalgam of these techniques is Project Honey Pot. The distributed, open-source Project
uses honeypot pages installed on websites around the world. These honeypot pages hand out
uniquely tagged spamtrap e-mail addresses. E-mail address harvesting and Spammers can
then be tracked as they gather and subsequently send to these spamtrap e-mail addresses.
Database Honeypot
Databases often get attacked by intruders using so called SQL Injection. Because such
activities are not recognized by basic firewalls, companies often use so called database
firewalls. Some of the available SQL database firewalls provide/support honeypot
architectures to let the intruder run against a trap database while the web application still runs
as usual.

Detection
Just as honeypots are a weapon against spammers, honeypot detection systems are a
spammer-employed counter-weapon. As detection systems would likely use unique
characteristics of specific honeypots to identify them, a plethora of honeypots in use makes
the set of unique characteristics larger and more daunting to those seeking to detect and
thereby identify them. This is an unusual circumstance in software: a situation in which
"versionitis" (a large number of versions of the same software, all differing slightly from each
other) can be beneficial. There's also an advantage in having some easy-to-detect honeypots
deployed. Fred Cohen, the inventor of the Deception Toolkit, even argues that every system
running his honeypot should have a deception port that adversaries can use to detect the
honeypot. Cohen believes that this might deter adversaries.

Honeynets
Two or more honeypots on a network form a honeynet. Typically, a honeynet is used for
monitoring a larger and/or more diverse network in which one honeypot may not be
sufficient. Honeynets and honeypots are usually implemented as parts of larger network
intrusion-detection systems. A honeyfarm is a centralized collection of honeypots and
analysis tools.
The concept of the honeynet first began in 1999 when Lance Spitzner, founder of the
Honeynet Project, published the paper "To Build a Honeypot":
"A honeynet is a network of high interaction honeypots that simulates a production network
and configured such that all activity is monitored, recorded and in a degree, discretely
regulated."
 Bibliography
Stuart McClure; Hacking Exposed: Network Security Secrets and Solutions, McGraw-Hill, 2009