Madhans Tutorial : Firewall (What is RootKit)

Madhans Firewall(What is RootKit)

What is Root Kit (or Rootkit)? Kit means set of programs or set of tools. Rootkit is a MALICIOUSLY MODIFIED set of tools to get the ROOT access for the Unix Operating System (and other operating systems) When the hacker replaced the original administrative tools on a computer with a rootkit, he is able to access the root prompt and able to conceal his activities from the legitimate administrator. How the hacker installs the rootkit? He may have physical access to the computer. He may exploit a security vulnerability in the system. Rootkits exist for a variety of operating systems, such as Microsoft Windows, Linux, Mac OS, and Solaris. Rootkits often modify parts of the operating system or install themselves as drivers or kernel modules, depending on the internal details of an operating system's mechanisms. What information hackers can steal using this rootkit? Hackers can conceal certain processes from monitoring programs. They can hide files or system data. They can install a back door in your system by replacing the login mechanisam with an executable that accepts a secret login combination which, in turn, allows an attacker to access the system, regardless of the changes to the actual accounts on the system. (coutesy:wiki)

Disclaimer and Copyright

What is root kit, what is rootkit

Madhans Tutorial : Firewall (What is FIN attack)

Madhans Firewall (What is FIN Attack)

What is fin attack? The article explains how the attackers are doing port scan.Suppose the attacker wants to know whether port no.8080 is open or not. Step 1 : he sends a tcp packet like this: Source IP:his ip address:80 Destination IP: 24.34.45.78:8080 Flag:FIN is set. It means " I want to close(finish) our talk" Step 2 : By analysing the REPLYreceived back for this FIN packet, the attacker will know certain information about the victim computer: 1. whether firewall is there or not. If it is there,wheter it is strong or not. 2. whether the port is open or closed. You can imagine the concept like this: You dial a pbx operator and tells " I have completed my talk with your boss mr.8080. Now you can disconnect thecall. The operator reply can be either of these: "But today my boss not at all turned up to office . You could not have spoken to my boss at all. Wrong number please." This much of reply is sent in one single word "RST" . RST stands for resetting the connection. If the boss is there, but at the same time, if the operator has not put through the call, then she will simply close the phone. This is equal to : the attack will NOTget any reply from the victim computer. From these two replies, the attacker will know whether the boss is sitting in the office or not (whether the port is open or not).

Posted By : Madhan

Disclaimer and Copyright

Madhans Tutorial : Firewall (Opened Ports in XP)

Madhans Firewall : Ports Opened

How lto find out which ports are open in a windows XP Computer? In the dos prompt, type "netstat -a". you will get the output as shown in this screenshot. To get the process id each application which is running on each port, give the command like this : "netstat -NO". But from the process id , how i can know the NAME of the application? You can open the task manager and see the application name and process id. But in my computer, when i open the task manager, it is showing the application names, but not the process id. what i should do? Certain fields are not displayed by default. The process id is one of the hidden field. You click the checkbox as shown in this screenshot.

Disclaimer and Copyright