Monday, 23 November 2015

ANONYMOUS ISIS HUNT- #OPPARIS...!!!!!


WE ARE ANONYMOUS....!!!!

          WE ARE LEGION...!!!

                  WE DO NOT FORGIVE...!!!

                            WE DO NOT FORGET...!!!

                                  IT IS TOO LATE FOR ISIS TO EXPECT US...!!!!!


Anonymous declares war against ISIS.
As a cyber guy we all know that anonymous is the one which can do anything they want to do on cyberspace.
After claiming responsibility for the Paris terrorist attacks last week, ISIS has a new foe.
Hacker collective Anonymous posted a video Saturday on YouTube in which it declared a cyber war on ISIS. In the nearly two-and-a-half-minute video, a person wearing the group’s signature Guy Fawkes mask read a statement in French promising that the hacktivist organization would attack ISIS in cyberspace with the ultimate goal of weakening the terrorist organization.
Expect massive cyber attacks,” the person said. “War is declared. Get prepared. Anonymous from all over the world will hunt you down. You should know that we will find you and we will not let you go.”
After the attack on Charlie Hebdo in January, Anonymous posted a video that said it would attack terrorists in connection with the killings. Soon after, it brought down sites allegedly connected with terrorism (including a dating site for ISIS members) and claims to have taken down tens of thousands of Twitter accounts of people suspected of having ISIS connections.
This, though, is different, Anonymous says. It warned ISIS after the latest attacks to “get ready,” adding that it doesn’t “forgive and we don’t forget.” While Anonymous did not reveal any details about planned attacks, the threat could be serious. Given its history.
They also took down another 20,000 twitter accounts in war against ISIS. now according to their plan they are planning to attack ISIS on a large scale.

For that they have published a guide for newbies to join them in the war           against ISIS

They are teaching newbies, script kiddies and crackers to attack with                 stronger effort on
ISIS.

The guide they have published is what is called as THE NOOB GUIDE.


Encouraging the people to join the cyber-war against ISIS, hacktivist group Anonymous has published three hacking guides. These guides have instructions regarding recognizing ISIS-affiliated websites, using a Twitter bot to uncover social media accounts of ISIS, and learning how to hack using a “NoobGuide

The war between the hackers and terrorists is escalating quickly in the wake of the recent Paris attacks. In the short time frame of past two days, Anonymous hacktivist group has declared an open war on ISIS. In response, ISIS was quick to retaliate and called Anonymous ‘idiots’ who just know how to ‘hack email and Twitter accounts’.

In another development, Anonymous has released a series of guides urging the people to take part in their biggest ever operation called #OpParis. The guides include how-to instructions that tell the ways to hack the ISIS-affiliated websites and social media accounts.

The rivalry of ISIS and Anonymous dates back to the Charlie Hebdo massacre in January.Anonymous has continued its attacks on ISIS and already exposed more than a thousand Twitter accounts. To train and bring the newer generation of hacktivists, Anonymous has released three how-to guides.



 

 These guides were posted on an IRC channel and Anonymousencouraged everyone to join this war against ISIS regardless of their computer skills.

The three hacking guides include, a “NoobGuide” for the people willing to learn how to hack and a “Reporter” guide explaining how to deploy and set up a Twitter bot for unmasking Islamic State accounts. The third guide is basically a “Searcher” guide for finding ISIS-affiliated websites.

An anonymous member, posting the guides to IRC, states: “There should be plenty of work to keep you occupied so get going. If you wish to submit anything of value, place your findings on ghostbin.com and share to the link to one of the channel operators and we can talk about what to do next.”

These guides have detailed instructions on how to carry out a cyber attack against ISIS websites using DDoS attacks and MITM (Man in the Middle) attacks.


Here are the instructions mentioned by Anonymous for finding ISIS-related website (thanks to IBTimes):
  • Get Python at https://www.python.org/downloads/ unless you already have it (Mac does)
  • Open Terminal (or Command Prompt for Windows) and type (without quotes) “python”
  • Now, this step requires a little explanation. Let’s set this out neatly, shall we…
  • Copy the contents of the following link to your clipboardhttps://ghostbin.com/paste/oo4tb
  • The contents of that link are some search terms that relate to ISIS and their content, allowing you to narrow down the results to specific ones
  • Paste the strings into the Terminal and press Enter
  • Choose a couple of strings (3 recommended) from the list of strings. For this example, we will use strings 3+38+46
  • Once chosen, continue in terminal (without quotes) “print(str3+str38+str42)” and copy the results
  • Paste the results in https://www.google.iq and analyze the new results To translate pages, it is recommended to use Google Chrome, which has integrated translation
  • Submit any valid ones to one of the channel operators and we will deal with the info accordingly



References :

Twitter Reporter  >>>   https://ghostbin.com/paste/pjuox
Primary Targets   >>>   https://ghostbin.com/paste/fgrfx
Python Language   >>>   https://www.python.org/downloads
Splinter Module   >>>   http://num.to/guide/718262837890

DIGITAL FORENSICS AND PARIS ATTACKS...!!!!!

When one of the terrorists involved in the Paris shootings dropped his smartphone in a trashcan outside the Bataclan concert venue on Friday night, he didn't see it coming that it can be bring their whole team down. He didn't know the power of Digital Forensics. that led to main suspect.

Lets see hoe Digital forensics led local police authorities and SWAT team to suspect.!!!


But that telephone, and wiretaps on another, led police to announce Thursday that the suspected organizer of the shootings and a string of other attacks, Abdel Hamid Abaaoud, was dead

The phone discarded by one of the terrorists contained an SMS sent to an unidentified local recipient at 9.42 p.m. local time, moments before the shooting there began: "On est parti on commence" ("We're going in"), public prosecutor François Molins told a news conference Wednesday evening.

The phone also contained a detailed map of the interior of the concert hall, according to local media reports citing police sources.

The attacker's lapse in information security came too late for French security services to prevent the shootings, but it did contribute to the swift identification of three hideouts used in the days leading up to the attack. Two were already abandoned. but more than 100 heavily armed police raided the third on Wednesday morning.

Investigators used CCTV recordings, wiretaps, cellphone location information, search warrants, eyewitness accounts and data mined from existing intelligence reports to identify and locate the cars, phones, weapons and hideouts used by the terrorists to plan and execute the attacks, local news said

Cellphones can't work unless they regularly report their location to the network, so it knows where to direct their incoming calls and SMSs. Networks typically store that data for a few weeks or months for fault analysis or, as in this case, as a result of a legal obligation to retain the data for use in police investigations.

Tracking the location reports received from the telephone used to send the SMS led police to a hotel in Alfortville, on the outskirts of Paris, where they found two rooms had been rented Nov. 11-17 in the name of Salah Abdeslam, Molins said. Abdeslam is suspected of involvement in the attacks.

While technology didn't lead police to the other hideouts, it did allow them to confirm two tip-offs they had received from other sources.

One of those tip-offs prompted a search of an empty house in Bobigny, northeast of Paris.

The second suggested that Abaaoud, the suspected organizer of the attacks, was hiding on the top floor of an apartment building in Saint Denis, to the north of Paris, and not in Syria as previously thought.

Investigators analyzed telephone and banking data to confirm the information about Abaaoud, Molins said, before ordering an explosive and bloody assault on the building Wednesday morning by France's top SWAT team, RAID.

Over 100 police officers surrounded the building in Saint Denis before the assault began on Wednesday. At 4:20 a.m. local time, they attempted to blow the apartment door open, but it wouldn't move, losing them the advantage of surprise. In the shootout that followed, one of the apartment's occupants set off an explosive charge, killing herself. Another was later found dead on the floor below, pinned beneath a fallen beam.

saint denis police map

French police released this map of the center of Saint Denis on Nov. 18, 2015, showing the area cordoned off following a raid on a terrorist hideout.


Police worked through the night to identify the bodies, confirming Thursday morning that the dead woman was Hasna Ait Boulahcen, local media reported. Wiretaps of her conversations with Abaaoud led police to the apartment, the reports said, citing police sources.

Shortly after midday Thursday, the news arrived: Abaaoud was dead too, killed in the police raid.  His body was identified by its fingerprints, a statement from Molins' office said.

Refernce : http://www.networkworld.com/article/3006824/telecommunication/how-tech-led-to-the-death-of-frances-public-enemy-number-1.html



Saturday, 31 October 2015

Tuesday, 4 August 2015

Forensic investigation of windows REGISTRY PART-1

By opening the Registry Editor (by typing 'regedit' in the run window), the Registry can be seen as one unified 'file system'. 

The left-hand pane, also known as the key pane contains an organized listing of what appear to be 
folders. 

The five most hierarchal folders are called 'hives' and begin with 'HKEY' (an abbreviation for Handle to a Key). Although five hives can be seen, only two of these are actually 'real', HKEY_USERS (HKU) and HKEY_LOCAL_MACHINE (HKLM). 

The other three are shortcuts or aliases to branches within one of the two hives. Each of these five hives is composed of keys, which contain values and subkeys.

 Values are the names of certain items within a key, which uniquely identify specific values pertaining to the operating system, or to applications that depend upon that value.

A common analogy that is often used to help understand the structure of the Windows Registry is a comparison between it and the Windows Explorer file system, both are very similar in their structures. 
  
Fig :- Registry Values

The key pane of the Registry is much like the hierarchical structure of the left-hand pane in the Windows Explorer file system. The keys and sub keys located within the five main hives are similar to folders and sub folders of Windows Explorer, and a key's value is similar to a file within a folder. 

In the right-hand pane of the Windows Registry - a value's name is similar to a file's name, its type is similar to a file's extension, and its data is similar to the actual contents of a file.


Root Key Functions:-
Below are listed the five hierarchical hives seen in Figure 1, with a very basic description of each. Beside the root key is their commonly referred to abbreviation in parenthesis, which will frequently be referred to as throughout the paper.

1.HKEY_CLASSES_ROOT (HKCR)
Information stored here ensures that the correct program opens when it is executed in Windows Explorer. It also contains further details on drag-and-drop rules, shortcuts, and information on the user interface. Alias for: HKLM\Software\Classes

2.HKEY_CURRENT_USER (HKCU)
Contains configuration information for the user who is currently logged into the system, including user's folders, screen colors, and Control Panel settings. Alias for a user specific branch in HKEY_USERS. The generic information usually applies to all users and is HKU\.DEFAULT.

3.HKEY_LOCAL_MACHINE (HKLM)
Contains machine hardware-specific information that the operating system runs on. It includes a list of drives mounted on the system and generic configurations of installed hardware and applications.

4.HKEY_USERS (HKU)
Contains configuration information of all user profiles on the system, which concerns application configurations, and visual settings.

5.HKEY_CURRENT_CONFIG (HCU)
Stores information about the systems current configuration. Alias for: HKLM\Config\profile