Hit and Hack Techno Gyan: 02/13/14

Thursday, 13 February 2014

Put Meta Tags in Blogger

How to Put Meta Tags in Blogger

We give you tutorial of Meta tags inserting in blogger template. You can put Meta tags in Blogger template for better ranking in search engine with follow easy steps.

Step 1.: Login to Blogger > Go to Dashboard > Template > Edit Html

SEO Meta Description

Step 2.: Go to <head> section in Template. You can search this from Ctrl+F

Step 3.: After <head> section put following code in your template.

Step 4.: Change you original data to demo data as your need.

Step 5.: Save your template and Go to your blog, view page source to see your description and keyword.

Google tricks – Google Hacking

Google Tricks – Google Hacking

1. Google trick to search different file formats (keyword filetype:doc)

2. Google trick to search educational resources (keyword site:.edu) example (computer site:.edu)

3. Finding the time of any location (time romania)

4. Finding the weather of any location (boston weather)

5. Tracking commentary of live events (Olympic games Beijing 2008)

6. Using Google as a calculator (9 * 10)(143+234)(119-8)

7. Converting currencies (1 USD in INR)(10 US Dollars in Indian Rupee)

8. Find how many teaspoons are in a quarter cup (quarter cup in teaspoons)

9. How many seconds there are in a year (seconds in a year)

10. Tracking stocks (stocks:MSFT)

11. Finding faces (add imgtype=face to the URL)

1. define: – This google operator will find definitions for a certain term or word over the Internet. Very useful when you come across a strange word when writing a post. I use this as a google dictionary. example : (define Computer)

2. info: – The google info operator will list the sets of information that Google has from a specific website (i.e. info:http://google.com)

3. site: – This google operator can be used to see the number of indexed pages on your site (i.e.site:www.google.com). Alternative it can also be used to search for information inside a specific site or class of sites.

4. link: – This google link operator allows you to find backlinks pointing to your site. Unfortunately the count is not updated frequently and not all backlinks are shown

5. allinurl: – Using this Google operator will limit the search to results that contain the desired keywords on the URL structure. (i.e. allinurl:dailyblogtips)

6. fileformat: – Useful Google operator for finding specific file formats. Sometimes you know that the information you are looking for is likely to be contained in a PDF document or on a PowerPoint presentation, for instance. (i.e. “fileformat:.pdf market research” will search for PDF documents that contain the terms “market” and “research”)

Wireless Network Hardening

This is the tutorial for securing your AP/Routers.

Threats to Wi-Fi Implementations

Radio waves can penetrate through walls there is a great chance of unauthorized access to the network and data. Because of its broadcasting nature, anybody can sniff the network for valuable credentials. If the network is not properly secured the attacker will get sufficient data to launch an attack.

In brief the following cases may happen.

i) The attacker may search for available wireless networks in the close proximity. If the Access Point( AP) is open the attacker can avail the network without any effort.

ii) The attacker can directly log in to the Access Point using default credentials and configure the device in whatever way he wants.

iii) The attacker can sniff the network for configuration details such as SSID(Service Set Identifier) , BSSID(Basic Service Set Identification ), encryption used, channel used etc. He can capture sufficient packets to launch an attack.

iv) The attacker can install a fake Access Point and lure(like advertising free internet access) users to connect to the rogue AP.

v) The attacker can disrupt the normal functioning of the network.

Securing AP/ Router

As far as a user is concerned, securing Access Point ensures the primary level of security. In this document configuration settings of an AP/Router that is installed in a typical home network is discussed. We have used ‘Linksys’ WAP 54G and ‘beetel’ Router for this purpose. The configuration settings as explained below will secure the AP.

1. Change Administrator Password

An attacker can easily find out the default password. It must be changed. Ensure that the admin password is strong enough.

Password editing interface of Administrator

2. Prefer Wi-Fi Protected Access(WPA2 Preferably) instead of Wired Equivalent Privacy(WEP).

WPA’s salient features are strong encryption algorithm, user authentication and support for IEEE 802.1X . Use Wi-Fi Protected Access (WPA) or WPA2 with Pre-Shared Key (PSK) authentication and AES as the encryption standard. The pass phrase should be strong enough.

Interface for configuring Security Mode.

3. MAC Address Filtering

Access of the clients can be permitted or prevented by providing a list of MAC Addresses in the “MAC Address filter” configuration parameter. This is known as MAC Address filtering. Together with SSID this can also used as a security measure. Select the MAC Address of all the wireless Network interface cards used in the network. The list can be used to permit or prevent the wireless access .

Configuring MAC filter

4. Best Practices

There are certain best practices explained below which should be followed for enhancing security of wireless Access Point / Routers.

i) Restrict the Access

SSID (Service Set Identifier) is used to identify a wireless network which a user wants to attach. All wireless devices that want to communicate on the WLAN need to have their SSID set to the same string as the AP. Even though the attacker can get the SSID simply by sniffing the network it is preferable to change the default SSID. Avoid SSID which shows name or other information. Name the access point such that it can be easily traceable during trouble shooting. Physical security of access point is also important.

ii) Disable Management via Wireless

It is recommended to disable management of the router via wireless devices associated with the access point. If someone manages to associate with the access point and login to the router , they can change the configuration of the router. Prefer wired interface with AP/Router to configure the device.

iii) Disable Remote Management

Remote Router Access permits web-based management of the wireless router from external networks such as the Internet. By default this feature opens port 8080/TCP on the external side of the router. This feature provides significant risk to the device, permitting an attack vector and more importantly significant risk to internal network. It should be disabled unless remote management is absolutely required. Universal Plug and Play may also be disabled.

iv) Turn off the AP when not in use

This is also advisable since it minimizes the risk of unauthorized access.

v) Configure Network Mode

Select the wireless mode which is depending upon the protocols. The possible options are.

_ Disabled – disables AP.

_ Mixed – permits both 802.11 b and 802.11g.

_ B-Only – 8.2.11 b only.

_ G-Only – 8.2.11 g only.

vi) Disable SSID Broadcast.

This can protect the AP from a naive attacker . By disabling SSID broadcast, the easy availability of SSID can be restricted. But the attacker can still sniff the SSID from frames that devices use when associating with an AP. According to some vendors disabling SSID broadcast may restrict or invite the chance of exploitation.

vii) Set Wireless Channel from default

Changing the default wireless channel used by the AP is a good practice.It may avoid automatic association of the wireless interface to the network.

viii ) Maximize the Beacon Interval

Beacon frames are used for connection establishment and management by IEEE 802.11 networks. These frames from AP to wireless clients ,transmitted at regular intervals are used for configuration matching. It is recommended to set the beacon interval to the maximum number. This will reduce the transmission frequency of SSID so that the attacker will get less number of opportunities to sniff the beacons containing SSID. But there is a problem here. The attacker can probe the network using some specific SSID which is known as active scanning.

ix) Prefer Static IP instead of DHCP.

Since DHCP is automatically assigning IP addresses, an attacker can utilize this feature to get an IP. So it is recommended to use static IP on wireless networks.

Configuring Static IP

All Saved Password Location

Google Chrome:

Chrome Passwords are stored in a SQLite file the sites name and sites username is in clear text but the password is seeded in a Triple DES algorithm. The file is called Web Data and is stored in the following location

XP – C:\Documents and Settings\Username\Local Settings\Application Data\Google\Chrome\User Data\Default

Vista – C:\Users\Username\Appdata\Local\Google\Chrome\User Data\Default

Trillian:

Note- I have just realised the new version of trillian the passwords made be stored/encrypted differently

Trillian Passwords are stored in .ini files the first character of the password is encrypted with XOR with the key 243 then the password is converted into hex. The file is based on what the password is for so if it was icq it would be icq.ini (for new versions I think they are all stored in a file called accounts.ini or something similar if you open it up with notepad you will see all the data + the encrypted password). The files are stored in the following location:

XP (old version) – C:\Program Files\Trillian\users\

XP (new version) – C:\Documents and Settings\Username\Local Settings\Application Data\Trillian\user\global – I am not sure on exact but it is somewhere their

Vista (old version)- C:\Program Files\Trillian\users\

Vista (new version)- C:\Users\Username\Appdata\Roaming\Trillian\user\gl obal

MSN /Windows Live Messenger:

MSN Messenger version 7.x: The passwords are stored under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\C reds\[Account Name]

Windows Live Messenger version 8.x/9.x: The passwords are stored in the Credentials file, with entry name begins with “WindowsLive:name=”. They a set of Win API functions (Credential API’s) to store its’ security data (Credentials). These functions store user information, such as names and passwords for the accounts (Windows Live ID credentials). Windows Live ID Credential records are controlled by the operating system for each user and for each session. They are attached to the “target name” and “type”. If you are familiar with SQL you can think of target name and type as the primary key. Table below lists most frequently used fields in Windows Live ID Credential records.

Paltalk:

Paltalk Passwords are using the same password encryption algorithm. Paltalk passwords are stored in the registry. To encrypt the new password Paltalk looks at the serial number of the disk C:\ and performs a mix with the Nickname. The resulting string is then mixed again with the password and some other constants. The final string is then encoded and written to the registry.

AIM, ICQ and Yahoo Messenger passwords that are stored by Paltalk are encoded by BASE64 algorithm.

The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Paltalk\[Account Name]

Google Talk:

Google Talk passwords are encoded/decoded using Crypto API. Encrypted Gmail passwords are stored by Google Talk in the registry under HKEY_CURRENT_USER\Software\Google\Google

Talk\Accounts\[Account Name]

Firefox:

The passwords are stored in one of the following filenames: signons.txt, signons2.txt, and signons3.txt (depends on Firefox version)

These password files are located inside the profile folder of Firefox, in [Windows Profile]\Application Data\Mozilla\Firefox\Profiles\[Profile Name]

Also, key3.db, located in the same folder, is used for encryption/decription of the passwords.

Yahoo Messenger 6.x:

The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager

(”EOptions string” value)

Yahoo Messenger 7.5 or later:

The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager – “ETS” value.

The value stored in “ETS” value cannot be recovered back to the original password.

AIM:

AIM uses Blowfish and base64 algorithms to encrypt the AIM passwords.

448-bit keyword is used to encrypt the password with Blowfish. The encrypted string is then encoded using base64. The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords

Filezilla:

Passwords are stored in a .xml file located in Filezilla on appdata their is sources for this

Internet Explorer 4.00 – 6.00:The passwords are stored in a secret location in the Registry known as the “Protected Storage”.

The base key of the Protected Storage is located under the following key:

“HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider”.

You can browse the above key in the Registry Editor (RegEdit), but you won’t be able to watch the passwords, because they are encrypted.

Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys.

Internet Explorer 7.00 – 8.00:

The new versions of Internet Explorer stores the passwords in 2 different locations.

AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2.

HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords.

Opera:

The passwords are stored in wand.dat filename, located under [Windows Profile]\Application Data\Opera\Opera\profile

Outlook Express (All Versions):

The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.

Outlook 98/2000:

Old versions of Outlook stored the POP3/SMTP/IMAP passwords in the Protected Storage, like the passwords of old versions of Internet Explorer.

Outlook 2002-2008:

All new versions of Outlook store the passwords in the same Registry key of the account settings.

The accounts are stored in the Registry under HKEY_CURRENT_USER\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\[Profile Name]\9375CFF0413111d3B88A00104B2A6676\[Account Index]

If you use Outlook to connect an account on Exchange server, the password is stored in the Credentials file, together with login passwords of LAN computers.

ThunderBird:

The password file is located under [Windows Profile]\Application Data\Thunderbird\Profiles\[Profile Name]

You should search a filename with .s extension.

Digsby:

The main password of Digsby is stored in [Windows Profile]\Application Data\Digsby\digsby.dat

All other passwords are stored in Digsby servers.

Hit and Hack Techno Gyan

MENU

Thursday, 13 February 2014

Put Meta Tags in Blogger

Google tricks – Google Hacking

Google Operators

Wireless Network Hardening

All Saved Password Location

MENU

Thursday, 13 February 2014

Put Meta Tags in Blogger

Google tricks – Google Hacking

Google Operators

Wireless Network Hardening

All Saved Password Location

Get Updates Via Facebook.