How To Get WiFi Password

This method is only valid for known WiFi network.Sometimes we forgot the WiFi password which is used to access to the network.It works because windows 8 and 10 create a profile of every WiFi network to which you attach.If you tell Windows to forgot the network, then it also forgets the password, so this won't work.but most people never explicitly do that.So we can simply obtain the password like this.

Command Prompt => Run as administrator

Then type this command on command prompt.

c:\windows\system32>netsh wlan show profiles

once you type this command and hit enter, you can see all the networks which are connected to that particular device.

Then you should select the network which you want to get the password.

c:\windows\system32>netsh wlan show profile name="D-Link" key=clear

You should replace the profile name with you have.Once you type this command on terminal and hit enter you can see the WiFi password like this.

SQL Injection

Overview

A SQL injection attack consists of injection or "injection" of a SQL query via the input data from the client to the application.A successful SQL injection exploit can read sensitive data from the database,modify database data (insert/delete/update), execute administration operations on the database,recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.SQL injection attacks are a type of injection attack, in which SQl commands are injected into data-plane input in order to effect the execution of predefined SQL commands.

SQL in Web Pages

SQL injection usually occurs when you ask a user for input, like their username/userid, and instead of a name/id, the user give you an SQL statement that you will unknowingly run on your database.

Example:-

txtUserId = getRequestString("UserId");
txtSQl = "SELECT * FROM Users WHERE UserId = " + txtUserId;

The original purpose of the code was to create an SQL statement to select a user, with a given user id.
If there is nothing to prevent a user from entering "wrong" input, the user can enter some "smart" input.

UserId:- 75 OR 1=1

Then SQL statement will be like this,

SELECT * FROM Users WHERE UserId = 75 OR 1=1;

The SQL above is valid and will return ALL rows from the "Users" table, since OR 1=1 is always TRUE.
A hacker might get access to all the user names and passwords in a database, by simply inserting 75 OR 1=1 into the input field.
SQL Injection Based on ""="" is Always true.

Username: John
Password: abc123

uName = getRequestString("username");
uPass = getRequestString("userpassword");

sql = 'SELECT * FROM Users WHERE Name ="' + uName + '" AND Pass ="' + uPass + '"'

Result 

SELECT * FROM Users WHERE Name =" john " AND Pass = "abc123"

A hacker might get access to user names and passwords in a database by simply inserting "OR""=" into the user name or password text box:

Username : "or ""="
Password : "or ""="

Result

SELECT * FROM Users WHERE Name = "" or  ""="" AND  Pass = "" or ""=""

The SQL above is valid and will return all rows from the "Users" table, since OR ""="" is always TRUE.

SQL Injection Based on Batched SQL Statements

Most databases support batched SQL statement.
A batch of SQL statements is a group of two or more SQL statements, separated by semicolons.
The SQL statement below will return all rows from the "Users" table, then delete the "Suppliers" table.

SELECT * FROM Users; DROP TABLE Suppliers

txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;


Input will be like this:

User id : 75; DROP TABLE Suppliers

Result

SELECT * FROM  Users WHERE UserId = 75; DROP TABLE Suppliers;

Use SQL Parameters for Protection

To protect a web site from SQL injection, you can use SQL parameters.
SQL parameters are values that are added to an SQL query at execution time, in a controlled manner.

txtUserId = getRequestString("UserId");
txtSQL = "SELECT * FROM Users WHERE UserId = @0";
db.Execute(txtSQL,txtUserId);

Note that parameters are represented i the SQL statement by a @ marker.

The SQL engine checks each parameter to ensure that it is correct form its column and are treated literally, and not as part of the SQL to be executed.

Firewalls

What is a Firewall?

Firewall is a network security system to control and monitor the incoming and outgoing traffic based on predefined security rules.A firewall is normally barrier between trusted internal network and outside network.All the traffics which are allows to transmit over the network is predefined inside the firewall policy. All other traffics are denied.

Types of firewalls and history

Ancient history firewall was used to prevent the spread of fire.After that firewall concept is borrowed for computer security.Before firewalls emerged in the late 1980s, the only real form of network security performed by Access Control List(ACL).It has a predefined list of IP addresses were granted or denied access to the network.

The growth of the internet and connectivity  ACL wasn't enough to keep out malicious traffic.

Packet Firewalls

Packet filtering is a firewall technique used in used to control network access by monitoring outgoing and incoming packets and allowing them to pass or halt based on the source and destination Internet  

Protocol (IP) addresses, protocol and ports.

Network layer firewalls define packet filtering rule sets, which provide highly efficient security mechanisms.Packet filtering is also known as static filtering.

Stateful Firewalls

In order to recognize a packet's connection state, a firewall needs to record all connections passing through it to ensure it has enough information to assess whether a packet is the start of a new connection,a part of an existing connection, or not part of any connection.This is what's called "stateful packet inspection."Stateful inspection was first introduced in 1994 by Check Point Software in its Firewall-1 software firewall, and by the late 1990s,it was a common firewall product feature.

This additional information can be used to grant or reject access based on the packet's history in the state table,and to speed up packet processing; that way,packets that are part of an  existing connection based on the firewall's state table can be allowed through without further analysis.If a packet does not match an existing connection,it's evaluated according to the rule set for new connections.

Application Layer Firewalls

As attacks against Web servers become more common, so too did the need for a firewall that could protect servers and the applications running on them, not merely the notwork resources behind them, Application-layer firewall technology first emerged in 1999, enabling firewalls to inspect and filter packets on any OSI layer up to the application layer.

The key benefit of application-layer filtering is the ability to block specific content, such as known malware or certain websites, and recognize when certain applications and protocols such as HTTP,FTP and DNS are being misused.

Proxy Firewalls

Firewall proxy servers also operate at the firewall's application layer,acting as an intermediary for requests from one network to another for a specific network application. A proxy firewall prevents direct connections between either sides of the firewall; both sides are forced to conduct the session through the proxy, which can block or allow traffic based on its rule set.A proxy service must be run for each type of internet application the firewall will support,such as an HTTP proxy for Web services.

Advantages

-Higher security than packet filters

-Only need to scrutinize a few allowable applications

-Easy to log and audit all incoming traffic

Disadvantages

-Additional processing overhead on each connection (gateway as splice point)

GhostHook Attacks For Windows 10

Security experts have discovered a method of bypassing Windows PatchGuard protections and hooking malicious code into the Windows kernel, which allows an attacker to plant rootkits on systems previously thought to be impregnable.

PatchGuard, known under its official name of Kernel Patch Protection (KPP), is a security feature for Windows 64-bit editions that prevents third-party code from patching the Windows kernel with additional routines.

Microsoft introduced PatchGuard in 2005, starting with Windows XP, and the feature has prevented most rootkits from working on 64-bit editions.

GhostHook attack leverages Intel PT feature

Today, security researchers from CyberArk published research on a new technique named GhostHook that successfully bypasses PatchGuard using a feature of Intel CPUs.

According to researchers, GhostHook works only against systems running Intel Processor Trace (PT), a feature of Intel CPUs that uses dedicated hardware to capture information about current software execution to aid with debugging operations and the detection of malicious code.

Normally, tapping into Intel PT operations would require an attacker to patch his malicious functions into kernel-level code, an operation that PatchGuard would immediately detect and block.

CyberArk researchers said they found that by allocating an extremely small buffer for the processing of Intel PT packets would result in the CPU running out of buffer space and opening a PMI handler to manage the overflowing code.

The problem is that PatchGuard doesn't monitor the PMI handler and an attacker could hook his malicious code to patch kernel operations via that PMI handler.

This provides attackers with an undetectable method of patching the Windows kernel and embedding rootkits on Windows 64-bit versions. GhostHook works even on Windows 10, where very few rootkits have proven to be effective since the operating system's launch in the summer of 2015.

Microsoft won't patch GhostHook attack vector

CyberArk says it contacted Microsoft about the GhostHook attack, but the OS maker declined to issue a security update. Microsoft said it might patch the issue during its regular bug fixing cycle, but would not treat GhostHook as a security flaw.

Microsoft justified its decision by saying that an attacker needs to have kernel-level access on an infected machine to perform a GhostHook attack. An attacker with kernel-level rights could perform many other malicious actions, and users should focus on preventing an attacker from gaining this much level of access in the first place.

Responding to Microsoft's refusal to patch this attack vector, CyberArk reiterated that the issue is "the bypassing of PatchGuard" which opens the door for rootkits on 64-bit Windows versions, and not necessarily the attacker's access level.

The real problem is that attackers have a technique at their disposal to implant rootkits on platforms they did not have access in past years.

Currently, 64-bit malware makes up less than 1% of the entire malware landscape, and PatchGuard was one of the reasons that helped keep 64-bit versions secure and harder to infect.

Nuclear Power Plants Was Hacked

The attack was contained to the business associated side of the plant, and evidence indicates that critical infrastructure was not affected.But cyber security experts say that now that the network has been infiltrated, the nuclear systems have become "much more vulnerable."

Hackers have been penetrating the computer networks of companies that operate nuclear power stations and other energy facilities, as well as manufacturing plants in the United States and other countries.

But hackers can’t affect a nuclear power plant operations or safety systems. They can hack some business, personnel and other non-essential files, which may be embarrassing and costly, but not dangerous. These reactors are truly operational islands wholly disconnected from the Internet.

The origins of the hackers are not known, although a joint report from the DHS and the FBI suggests many of the hackers are backed by governments like Russia. In a joint statement, the government agencies said, “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks.”

America’s nuclear plants are one of the best protected of all systems from possible cyber threats. The safety and control systems for our nuclear reactors and other vital plant components are not connected to business networks or the Internet. We learned a lot from Stuxnet, the malicious computer worm that substantially damaged Iran’s nuclear program and that was introduced with a thumb drive.

Unlike other industries, the nuclear power industry conducts regular briefings, and receives quarterly classified briefings on cyber and physical threats, with the FBI and the DHS to discuss threat assessments, to strategize on guarding against them and to maintain situational awareness.

The nuclear industry does not use firewalls to isolate these systems, that’s not good enough. The plants use hardware based data diode technologies developed for high assurance environments, like the DOD. Data diodes allow information to be sent out, like operational and monitoring data, but ensure that information cannot flow back into the plant.

Updating software and equipment using portable devices, have strict restrictions. Outside laptops and thumb drives cannot be used without serious scrubbing, if at all.

The NRC has established regulations that thoroughly monitor and inspect cyber security at all U.S. reactors. But the nuclear energy industry took the initiative to implement a cyber security program for those digital assets needed to maintain nuclear safety and continuity of power well before the NRC mandated such a program. The Nuclear Energy Institute’s cyber security task force, formed in 2002, continuously monitors possible cyber threats and upgraded protective approaches needed to counter them.

Facebook over the OAuth 2.0 Authorization

How to use Facebook apps

Nowadays Facebook apps are very popular on Facebook.There are  millions of Facebook apps available on Facebook.Most of the apps are used to entertainment.Once you clicked on it,you can see the Facebook login page.That's mean you have to provide your Facebook credentials to use the app.How we trust that third party app?.What are the technologies that they used?.

What is OAuth 2.0 protocol?

OAuth is an open standard for access delegation,commonly used as a way for Internet users to grant websites or application access to their information on other websites but without giving them the credentials.This mechanism is used by companies such as Google, Facebook, Instagram, Microsoft and Twitter to permit the users to share information about their accounts with third party applications or websites.

OAuth 2.0 protocol working flow

There are two to types of  tokens that can be used when we developing the app.
1.Access Token :-  Access token can be used several times before it gets expired.
2.Refresh Token :- Once it's expired refresh token is sent to Facebook server in order to receive another access token along with a new refresh token.

Registering the Client App in Facebook Developer Website

Now we are going to create a Facebook app.

Facebook developer site : - https://developers.facebook.com/

First of all you have to login to the developer page using your Facebook credentials.

Then you can see the "Add a New App" under the "My Apps"

In this section you have to provide an App name and Email.

Once your app is created, associate “Facebook Login” with it.

In the Dashboard, you can see the App ID and the App Secret for your app.

Obtaining the Authorization Code

In order to obtain the authorization code from Facebook, we need to send a HTTP GET request to the Authorize endpoint of Facebook, which is https://www.facebook.com/dialog/oauth . Along with the request, you need to send several parameters which are described below.

For the HTTP GET request we have to provide above values along with the link.
https://www.facebook.com/dialog/oauth?response_type=code&client_id=147505339122170&redirect_uri=http%3A%2F%2Flocalhost%3A1234%2Ffb%2F&scope=public_profile%20user_posts%20user_friends%20user_photos

If your not logged into the Facebook it'll ask you to login.

After you login,you can see the below page.it's called as "User Consent Page".When you click on the "Edit this" link you will able to change the resources that external app can access.

Since you are the owner of this App you don't have to worry about privacy. Click on continue.

Once you Continue, Facebook will redirect the browser to the Redirection Endpoint URL which you defined in the app settings and along with the URL, it will send the query parameter code, which is the authorization code. 

http://localhost/team/?code=AQDRsjK348Gmy1upjm7vXVWPA5_n3A64gRs43npMFInR7b3H2-ibuf7s9vMaPnx3uqQt_oT2wx7XeICuIUlR2J-xICsHREiV5RmZ_-tqEPxKZYWfbI9qCtUopJBtLPkvC7KkPlWsshukf2siNYG1oAJTI87cYmNPC5_vhFdJeVAG7jqPu-Wbc1ACrLHMkCvMXXiWryWz0hMOGWMiZfgA8kteKuj0Y18fzL8vI156P1UiOiOr9pAz11OXrEPtga
7bZt4UJzzFJ0V8QJ0rof8Kc2HmKvGoaKpOC6oJBpR09fPo2fRs8umhQ5JMa4pHZwpm7j4nI-t4goKumDxpMMnlHG7R#_=_ 



Obtaining the Access Token

Now we have the authorization code,So have to obtain the access token.For that, the client web application has to send a HTTP POST request to the Token Endpoint of Facebook sending the authorization code received in previous step. The Token Endpoint of Facebook is https://graph.facebook.com/oauth/access_token

1.Grant Type:- Authorization code  AQDRsjK348Gmy1upjm7vXVWPA5_n3A64gRs43npMFInR7b3H2-ibuf7s9vMaPnx3uqQt_oT2wx7XeICuIUlR2J-xICsHREiV5RmZ_-tqEPxKZYWfbI9qCtUopJBtLPkvC7KkPlWsshukf2siNYG1oAJTI87cYmNPC5_vhFdJeVAG7jqPu-Wbc1ACrLHMkCvMXXiWryWz0hMOGWMiZfgA8kteKuj0Y18fzL8vI156P1UiOiOr9pAz11OXrEPtga
7bZt4UJzzFJ0V8QJ0rof8Kc2HmKvGoaKpOC6oJBpR09fPo2fRs8umhQ5JMa4pHZwpm7j4nI-t4goKumDxpMMnlHG7R#_=_ 

2.Client ID :-147505339122170

3.Redirect URL:-  http://localhost/team/

 In the HTTP Headers, we need to add the Authorization header with the App credentials. 

App ID = 147505339122170

App Secret = 04b38deb331c6d34f35263a4556a66bd

AppID:AppSecret = 147505339122170:04b38deb331c6d34f35263a4556a66bd

Base64(AppID:AppSecret) MTQ3NTA1MzM5MTIyMTcwOjA0YjM4ZGViMzMxYzZkMzRmMzUyNjNhNDU1NmE2NmJk

So, I can add the header as following.

Authorization: Basic MTQ3NTA1MzM5MTIyMTcwOjA0YjM4ZGViMzMxYzZkMzRmMzUyNjNhNDU1NmE2NmJk

When sending the request, I can use a HTTP Client browser plugin like RESTClient.

Once you send this request, As a result of this task you can  get the access token.

Retrieve resources using access token

Method - GET
URL :-  https://graph.facebook.com/v2.8/me?fields=id

This will give user's ID 
  {

  "id": "1021167613XXXXXXX"

}

Using this ID, we can post anything on Facebook on behalf of the user.

You can download my source code using below GitHub link  

https://github.com/thusith94/FacebookApp

Protect Your Essential Files

What Is Cryptography?

Cryptography involves creating written or generated codes that allows information to be kept secret. Cryptography converts data into a format that is unreadable for an unauthorized user, allowing it to be transmitted without anyone decoding it back into a readable format, thus compromising the data.
Information security uses cryptography on several levels. The information cannot be read without a key to decrypt it. The information maintains its integrity during transit and while being stored. Cryptography also aids in non-repudiation. This means that neither the creator nor the receiver of the information may claim they did not create or receive it.
Cryptography is also known as cryptology.

What Is Encryption?

Encryption is the conversion of electronic data into another form, called cipher-text, which cannot be easily understood by anyone except authorized parties.

The primary purpose of encryption is to protect the confidentiality of digital data stored on computer systems or transmitted via the Internet or other computer networks. Modern encryption algorithms play a vital role in the security assurance of IT systems and communications as they can provide not only confidentiality, but also the following key elements of security:

Authentication: the origin of a message can be verified.
Integrity: proof that the contents of a message have not been changed since it was sent.
Non-repudiation: the sender of a message cannot deny sending the message.

There are two types of encryption

1)Symmetric Cryptography

2)Asymmetric Cryptography

1)Symmetric Cryptography

Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both encryption of plain-text and decryption of cipher-text.

2)Asymmetric Cryptography

Asymmetric cryptography, also known as public key cryptography, uses public and private keys to encrypt and decrypt data. The keys are simply large numbers that have been paired together but are not identical (asymmetric). One key in the pair can be shared with everyone; it is called the public key. The other key in the pair is kept secret; it is called the private key. Either of the keys can be used to encrypt a message; the opposite key from the one used to encrypt the message is used for decryption.

Here I used symmetric encryption.

Using the "Browse" button , we can add a file which we want to encrypt.

Once we click the "Encrypt" button ,the file will encrypt.

Then the whole data of the file will encrypted.

Using "Decrypt" button we can derypt the file. 

You can download my source files from this link :-https://github.com/thusith94/Encryption