Keylogger Or Keystroker : Beginners Guide FAQ

In my previous post i written about RAT Beginners guide. Here i am going to post about the Kelogging Or Keyloggers Beginners Guide.So in this post i will cover all the concepts which in the keyloggers After reading this you dont need any guide to start keylogging again.

What is Keylogger?

A keylogger is a program that logs a keyboards keystrokes. It can be used for several purposes, both black hat and white hat. The most common use is black hat. A keylogger functions by grabbing a keystroke, triggered by when the slave presses a key on their keyboard, and saving it to a variable. This process is called "keyboard hooking". It then will take this long variable and send it via a SMTP or FTP server. You can then view these logs and use it for whatever your intention may be. Keyloggers have several different features that I will go into in a later section. The most basic ones only include keyboard hooking and a way to send the logs.

Terms You Should know in Keylogger:

Logger

Slang term for keylogger. See the "What is a keylogger" section.

Hooks

Slang term for keyboard hooks. These are also explained in the "What is a keylogger section"

Keystrokes

Section of code that is triggered when the slave types something on the keyboard.

Logs

Compilation of all the keystrokes over a period of time.

FTP

A web host that stores files that allows the user to connect and retrieve said files. Files in this case are logs.

SMTP

A way that logs are sent via Simple email. Example, MSN, Gmail, Yahoo, etc.

FUD

Fully Un-Detected. This means that antiviruses will not detect your file as a virus. This will be further explained in the "What is crypting section".

UD

Undetected. This means that some antiviruses will not detect your files as a virus, while others will.

Server

A server is the output of your keylogger. I will take this in-depth in the"What is a server?" section.

Crypter
A crypter crypts your file removing detections. I'll take this in-depth in the "What is crypting" section.

Detection
A detection is a term used when an antivirus detects, or thinks your file is a virus. You always want to have the least amount of detections possible to increase your success rate and to reduce errors.

Black hat
A black hat is someone who uses their knowledge of computers and security for malicious reasons.

White hat
A white hat is someone who uses their knowledge of computers and security for helpful reasons. They help disinfect and improve others security to combat black hat hackers.

Grey hat
A grey hat is a mixture between a black and white hat. They will infect innocent people and then help them get rid of it, for free or a price (the latter being more common).

Backdoored
When a file is backdoored it has a virus binded to it. This means that the file will act normally and the user will be infected without their knowledge. This has become extremely common in the keylogger section. Always be wary of new releases.

Keyloggers Common feature:

As I've said before, most keyloggers have two basic settings. Keyboard hooking and log sending (by FTP or SMTP). Most keylogger developers likes to include more settings to help ease the user experience. Below is a list of common settings you may find, and what they do:

Icon Changers

This will change your viruses icon without corrupting it like some third party programs can do.

MuteX

MuteX is a unique string that you generate. It helps prevent multiple logs from being sent.

Add to Startup

This will add a registry (or other ways) that will cause your virus to start when the computer is turned on.

Antis

Antis are a feature that help keep your virus on the slaves computer for as long as possible. They disable or stop certain white hat programs such as antiviruses, sandboxie, and keyscramblers from running or removing your file.

Disable CMD/Taskmanager/Registry

This feature will change the registry value for each of these system tools to disable them.

Logging interval

This allows the user to chose how often logs are sent.

Fake Error Message

This will cause a fake error message to pop up, making it seem less suspicious.

File pumper

This will add to the size of your virus. This helps making it seem less suspicious as a game won't be a few 

kilobytes.

Assembly Editing

This allows you to change things found in the properties menu when right clicking a file. This helps it seem more like a real file rather than a virus.

Encrypted user information

This encrtyps your information so that others cannot steal it by Decompiling your virus.

Test connection

This will test your credentials that you've entered to make sure they are correct.

How do i Use It?

Using a keylogger is a lot easier than it sounds. All you need to do is find one that you want to use, download it, and then choose your settings. Once you have entered all your information and chosen your settings, click the build button. The builder will create your server. This is what you give to people. Give them this file and when they run it they will be infected and you will start receiving logs. Pretty self explanitory. If you ever have a question contact the creator and they should be able to help you.

What is a Stub?

A stub is a separate binary that contains special code that is required for the keylogger to function. There are usually two things in a keylogger. The builder and the stub. Some keyloggers will have a stub built in. A builder takes the information and settings you've chosen and merges it with a stub. The stub contains keyhooks and the workings of each feature. These two merge to create your virus, containing all of the information. I'll cover this file in the next section.

What is Server?

A server is the output of your keylogging builder. It takes your user information (the builder) and the actual malicious code (the stub) and merges the two (via either Code DOM which I'll explain later in this section, or by file splitting, which I will also cover) to make one bad ass file. There are several ways that this is accomplished, and both ways have their ups and downs. The server is also what you distribute to infect people. It is your "virus"

CodeDom is a type of building that generates the code during run time. This allows the user to only have to download one file (just a builder). After inputting your information, the builder will take this and combine it with the malicious code (already inside the builder). This helps lower detection rates, but overall is harder to do, and is harder to reFUD (you have to re distribute the entire builder, instead of just providing another stub).

File splitting is the old school way to do things. It requires taking your information (the builder) and combining it with a separate file that contains the malicious code. While this makes it easier to detect, it's easier to update as you can simply give your users another file (same thing, just with less detections).

What is Crypting?

Crypting can be very complex, though it isn't necessary for you to know all of this information. So for this section I'll keep things to what you need to know. Crypting involves taking a stub (sometimes it's CodeDOM) and using that to FUD (or lower your detection rate) your file. The entire process can get a bit confusing, and I won't bother getting into it. What you do need to know is that crypting can easily corrupt your keylogging sever making it no longer work. A corrupt keylogger may not be detected (the crypter at least did it's job) but it will not send logs making it useless. Because of this you should chose your crypters carefully and it may take a while to find one that works (for free) with your keylogging server. If you are buying a crypter (which I recommend) then be sure to ask the seller to either test or verify your server. In short, crypting is used to lower detection rate, and raise execution rates. That's all you need to know.

Difference Between Keylogger and Stealer?

There is one major defining difference between a stealer and a keylogger. A stealers purposes is to steal passwords that have been saved in the browser/application. Ever logged into something and your browser prompted you to save the password? This is what stealers steal. They are good for massivley grabbing passwords and quickly. Once run they do not continue to steal until run again.

What is .Net Framework?

.Net Framework is a very in-depth concept from Microsoft. While you don't need to know (or should you really care) you should know that most keyloggers are written in Visual Basic .Net, giving it a dependence. Depending on who made it you may have to install a specific version (.Net 4.0). Most computers (99%) come with .Net 2.0 installed. Your output will also require a specific framework (depending on which one you use).

Can Victim detect it's presence once keylogger is installed in his/her computer?

Well it's really difficult for the victim to detect keylogger's presence as it runs in complete stealth mode, It hides it self from task manager, Startup etc

Can victim trace you back?

Once the keylogger is installed, I think it's almost impossible for the victim to trace you back

How can I protect my self from keylogger?

A simple keylogger can be detected by even a lame antivirus, but sometimes the attacker can use methods like Crypting,Binding,Hexing etc, that make it harder for the Antivirus to detect the keylogger. So to counter that you should use a piece of software called sandboxie,Sandboxie runs the choosen computer program in an Isolated space so if the file you receive is a keylogger, You need no to worry because it won't affect your other programs, Firefox users can use the free version of keyscrambler which encrypts each and every keystrokes you type, so even if a keylogger is installed in your computer, You need not to worry as the attacker will receive the encrypted keystroke

How do I find if a file is binded with a keylogger?

Keylogger can be binded with almost any file so how do you know if the file is binded?, You can use Bintext or Hex editor to find out, But Bintext and Hex editing method do not work effectively if the server is crypted so alternatively there is a great piece of software named "Resource hacker" that can tell you if the file is binded or not

i hope i explained the Most of the concepts in keylogger if any thing missing mention in comments i will explain soon.Hope this post helped you.

Happy Hacking.. :)

Read More [...]

Posted in HACKING BASICS, KEYLOGGER

RAT(Remote Administration Tool) Beginners Guide - FAQ

Today i am going to discuss about RATS First Time. Soon I will post some more articles on RATs like ProRat, Turkojan, Spy-Net etc. But before posting such article i want to clear some basic problems of readers. Many peoples were able to get the trick of RATs and how to use RATs to hack email account. But, some readers were just not able to get out their problems.So i plan to do some Beginner guide for Clear View of RAT.

These will Help you to make a good RAT for hack Accounts Online.The Following things containing some discussion about RAT. Go through that part and learn some basic of the RAT and that working process.

What is RAT?

A RAT is also a shortcut called "Remote Administrator Tool". It is mostly used for malicious purposes, such as controlling PC’s, stealing victims data, deleting or editing some files. You can only infect someone by sending him file called Server and they need to click it(Run it).

How they works?

Some RATs can spread over P2P file sharing programs(uTorrent, Pirate Bay etc.), Messangers spams(MSN, Skype, AIM etc.).

Download?

Well you can find some type of RAT here,I will post some article on RATs soon.Also, you can buy FUD private version of RAT: Albertino RAT, Medusa Rat, jRAT etc. Also you will need DNS host for your RAT.

How do I control server?

Once installed, RAT server can be controlled via RAT client. From IP list box you choose PC and connect.

What do I need to setup RAT?

Well, you will need Windows OS,open port & RAT. To forward your port scroll for tutorial visit here.

How do I port forward?

Port forwarding is easy and important for RAT. Well, you need open port because RAT connects through open port and bypass firewall. Open your web browser and write your IP and connect to your rooter(write Username: Admin & Password: Admin), open port forward page and write port you want and your IP. Well that’s all you need to do and now you got open port. For Port forwarding visit here.

How do I make my server FUD?

If you want to make your server FUD(Fully UnDetectable) again, you will need crypter(you can find some free FUD crypters here.). Also, you can hex edit your server, but be careful some servers can crash after hex editing.

How do I remove server if I infect myself?

When you infect yourself, first what you going to do is to connect to your PC. Some RATs have function to uninstall servers, well you click that and you uninstall it. Well there is another way, download MalwareBytes’ Anti-Malware and scan whole computer for Trojan.

Is it Legal or illegal?

Well some RATs are legal, and some are not. Legal are the one without backdoor left, and they have abillity to close connection anytime. Illegal are used for hacking and they can steal data(Credit Cards, Passwords, private data etc.).

Legal:

TeamViewer – Access any remote computer via Internet just like sitting in front of it – even through firewalls.

UltraVNC – Remote support software for on demand remote computer support. VNC.Specializing in Remote Computer Support, goto my pc, goto assist, Remote Maintenance

Ammyy Admin – Ammyy Admin is a highly reliable and very friendly tool for remote computer access. You can provide remote assistance, remote administration or remote

Mikogo – Mikogo is an Online Meeting, Web Conferencing & Remote Support tool where you can share your screen with 10 participants in real-time over the Web.

Illegal :

DarkComet
CyberGate Rat
ProRat
Turkojan
Spy-Net
Beast

Where and how do I spread?

There are few different ways to spread your server. You can spread on various websites, P2P file sharing websites(uTorrent, Pirate bay etc.), YouTube etc. Well some people use custom made Auto-Spreaders programs to spread their server. But best and most effective way to spread is when you FUD your server.

Whats DNS host?

The Domain Name System (DNS) is a hierarchical naming system for computers, services, or any resource connected to the Internet or a private network. It associates various information with domain names assigned to each of the participants. Most importantly, it translates domain names meaningful to humans into the numerical (binary) identifiers associated with networking equipment for the purpose of locating and addressing these devices worldwide.

What can RAT do?

Here is list of basic features:

• Manage files
• Control web browser(Change homepage, open site etc.)
• Get system information(OS Version, AV name, Ram Memory, Computer name etc.)
• Get passwords, credit card numbers or private data etc.
• View and remote control desktop
• Record camera & sound
• Control mouse
• Delete, rename, download, upload or move files

What’s reverse Connection?

A reverse connection is usually used to bypass firewall restrictions on open ports. The most common way a reverse connection is used is to bypass firewall and Router security restrictions.

Whats direct connection?

A direct-connect RAT is a simple setup where the client connects to a single or multiple servers directly. Stable servers are multi-threaded, allowing for multiple clients to be connected, along with increased reliability.

Can I get traced when I rat somebody?

Yes and no. Depends on victim, it is really hard to remove infection or even trace a hacker. There are tools like WireShark, but it’s really hard to trace, because PC usually got over 300 connections. So don’t worry.

So guys i think this beginner guide helps you lot about RAT.

Happy Hacking.. :)

Read More [...]

Posted in HACKING BASICS, RAT, REMOTE HACKING

Hacking Basics

What is hacking?

 

                       Hacking is unauthorized use of computer and network resources. (The term "hacker" originally meant a very gifted programmer. In recent years though, with easier access to multiple systems, it now has negative implications.)
                      Computer Hackers have been around for so many years. Since the Internet became widely used in the World, We have started to hear more and more about hacking.Only a few Hackers, such as Kevin Mitnick, are well known.
                      In a world of Black and White, it’s easy to describe the typical Hacker. A general outline of a typical Hacker is an Antisocial, Pimple-faced Teenage boy. But the Digital world has many types of Hackers.

HACKERS?

                      Hackers are human like the rest of us and are, therefore, unique individuals, so an exact profile is hard to outline. The best broad description of Hackers is that all Hackers aren’t equal. Each Hacker has Motives, Methods and Skills. But some general characteristics can help you understand them. Not all Hackers are Antisocial, Pimple-faced Teenagers. Regardless, Hackers are curious about Knowing new things, Brave to take steps and they are often very Sharp Minded

           Hacker is a word that has two meanings:

                    1. Traditionally, a Hacker is someone who likes to play with Software or Electronic Systems. Hackers enjoy Exploring and Learning how Computer systems operate. They love discovering new ways to work electronically.

                    2. Recently, Hacker has taken on a new meaning — someone who maliciously breaks into systems for personal gain. Technically, these criminals are Crackers as Criminal Hackers. Crackers break into systems with malicious intentions.

Hacker Vs. Cracker:

                     What Is the Difference Between a Hacker and a Cracker?

                     Many articles have been written about the difference between Hackers and crackers, which attempt to correct public misconceptions about hacking. For many years, media has applied the word Hacker when it really means Cracker. So the public now believe that a Hacker is someone who breaks into computer systems and steal confidential data. This is very untrue and is an insult to some of our most talented Hackers.
                 

HACKER:

                 A Hacker is a person who is interested in the working of any computer operating system. Most often, Hackers are programmers. Hackers obtain advanced knowledge of operating systems and programming languages.
                 They may know various security holes within systems and the reasons for such holes. Hackers constantly seek further knowledge, share what they have discovered, and they never have intentions about damaging or stealing data.

CRACKER:

             A Cracker is a person who breaks into other people systems, with malicious intentions. Crackers gain unauthorized access, destroy important data, stop services provided by the server, or basically cause problems for their targets. Crackers can easily be identified because their actions are malicious.
            Whatever the case, most people give Hacker a negative outline. Many malicious Hackers are electronic thieves. Just like anyone can become a thief, or a robber, anyone can become a Hacker, regardless of age, gender, or religion. Technical skills of Hackers varies from one to another. Some Hackers barely know how to surf the Internet, whereas others write software that other Hackers depend upon.

Types of Hacker:

              Let’s see the categories of Hackers on the basis on their knowledge
Coders:
              

               The Real Hackers are the Coders, the ones who revise the methods and create tools that are available in the market. Coders can find security holes and weaknesses in software to create their own exploits. These Hackers can use those exploits to develop fully patched and secure systems.
              Coders are the programmers who have the ability to find the unique vulnerability in existing software and to create working exploit codes.
             These are the individuals with a deep understanding of the OSI Layer Model and TCP/IP Stacks.

Admins:

             Admins are the computer guys who use the tools and exploits prepared by the coders. They do not develop their own techniques, however they uses the tricks which are already prepared by the coders. They are generally System Administration, or Computer Network Controller. Most of the Hackers and security person in this digital world come under this category.
            Admins have experience with several operating systems, and know how to exploit several existing vulnerabilities. A majority of Security Consultants fall in this group and work as a part of Security Team.

Script Kiddies:

              Next and the most dangerous class of Hackers is Script kiddies, They are the new generation of users of computer who take advantage of the Hacker tools and documentation available for free on the Internet but don’t have any knowledge of what’s going on behind the scenes. They know just enough to cause you headaches but typically are very sloppy in their actions, leaving all sorts of digital fingerprints behind. Even though these guys are the teenage
             Hackers that you hear about in the news media, they need minimum skills to carry out their attacks.
            Script Kiddies are the bunnies who use script and programs developed by others to attack computer systems and Networks. They get the least respect but are most annoying and dangerous and can cause big problems without actually knowing what they are doing.

Ethical Hacking:

 

                   Ethical Hacking is testing the resources for a good cause and for the betterment of technology. Technically Ethical Hacking means penetration testing which is focused on Securing and Protecting IT Systems.

Types of Hackers:

                            Types of Hackers on the basis of activities performed by them
White Hat Hacker:

                A White Hat Hacker is computer guy who perform Ethical Hacking. These are usually security professionals with knowledge of hacking and the Hacker toolset and who use this knowledge to locate security weaknesses and implement countermeasures in the resources.
               They are also known as an Ethical Hacker or a Penetration Tester. They focus on Securing and Protecting IT Systems.


Black Hat Hackers:

              A Black Hat Hacker is computer guy who performs Unethical Hacking. These are the Criminal Hackers or Crackers who use their skills and knowledge for illegal or malicious purposes. They break into or otherwise violate the system integrity of remote machines, with malicious intent.
              These are also known as an Unethical Hacker or a Security Cracker. They focus on Security Cracking and Data stealing.

Grey Hat Hackers:

              A Grey Hat Hacker is a Computer guy who sometimes acts legally, sometimes in good will, and sometimes not. They usually do not hack for personal gain or have amalicious intentions, but may or may not occasionally commit crimes during the course of their technological exploits.
            They are hybrid between White Hat and Black Hat Hackers.

Hactivism:
             Another type of Hackers are Hacktivists, who try to broadcast political or social messages through their work. A Hacktivist wants to raise public awareness of an issue. Examples of hacktivism are the Web sites that were defaced with the Jihad messages in the name of Terrorism.

Cyber Terrorist:

              There are Hackers who are called Cyber Terrorists, who attack government computers or public utility infrastructures, such as power stations and air-traffic-control towers. They crash critical systems or steal classified government information. While in a conflict with enemy countries some government start Cyber war via Internet.

                 These are the Hacking Basics and the Hacking Types..!!

Read More [...]

Posted in HACKING, HACKING BASICS, HACKING TYPES