Control User Logins by Hacking the Registry

Make better use of the XP login screen.

If your system contains more than one user account, or if you've set up XP to require logins, you'll have to log in to XP before you can begin to use it. But you needn't stay with the default XP login rules; you can use a single Registry key to customize how you log in. For example, you can display custom text before login, and you can remind anyone with an account on the PC to change their password a certain number of days prior to the password's expiration.

To control logon options, run the Registry Editor [Hack #83] and go to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Winlogon subkey, which contains a variety of logon settings (as well as some settings not having to do directly with logons). Following are the most important values you can edit to customize logons.

Don't Display Last UserName

This setting lets you control how the system logon dialog box is used. If this String value is present and set to 1, all users will have to enter both their username and password to log on. If the value is 0, the name of the last user to log on will be displayed in the system logon dialog box.

Default User Name

This String value contains the name of the last user who logged on. It will be displayed only if the DontDisplayLastUserName value is not present or is set to 0.

Legal Notice Caption

This String value, used in concert with the LegalNoticeText value, displays a dialog box prior to logon that contains any text you want to display. (The text doesn't have to be a legal notice, but this value is often used for that purpose.) The box has a title and text. The LegalNoticeCaption value will be the dialog box's title.

LegalNoticeText

This String value, used in concert with LegalNoticeCaption, contains the text that you want to be displayed inside a dialog box displayed prior to logon.

Password Expiry Warning

This DWORD value lets you display a warning message to users a certain number of days before their passwords are set to expire. It lets you determine how many days ahead of time the warning should be issued. To edit the value, click the decimal button and enter the number of days.

Shutdown Without Logon

This String value enables or disables a button on the XP logon dialog box that lets the system shut down. A value of 1 enables the button (so that it is shown); a value of 0 disables the button (so that it is not shown).

Shell

This String value really doesn't have to do with logons, but it's one you should know about. It determines the shellthe user interfacethat will be used by XP. The default is Explorer.exe, but it can be another shell as wellfor example, the Program Manager from older Windows versions. Type in the name of the program; for example, Progman.exe for the Program Manager, or Taskman.exe for the Task Manager.

Auto Restart Shell

This DWORD value doesn't have to do with logons either, but it's another good one to know. It sets whether to automatically restart the Windows shell if the shell crashes. A value of 1 automatically restarts the shell. A value of 0 tells XP not to restart the shell, forcing you to log off and then back on again to restart it.

Now that your system's startup and shutdown are under control, let's move on to the user interface.

How To Catch A Hacker

Some one wrote this great Post at orkut about Catching Hackers

I don't know who exactly the writer of this great post is...

Here is what he had to write :

"just wrote this guide to give you some tips of which you may not have heard yet. Hopefully, it won't come to a hacker getting in, but if it does...

Tip 1: Hackers cover their tracks. Experienced hackers cover them more thorougly, but amateur hackers sometimes leave things behind. Don't expect them to leave any really big evidence behind; expect more of little things here and there you might find surprising. For example, if you're writing a term paper and a black hat hacker accidently saved it when he took a paragraph out- that's suspicious. Where did that paragraph go? Well, for one thing, now you know he was in that area. Check the folders surrounding the file- you might find something.

Tip 2: Decipher between the type of hackers that are attacking you. Experienced hackers will have a more in depth look around when they penetrate your system. They won't touch much because they know that that won't add too much to their knowledge. But if you know a hacker's been in, and some files are messed with, and you have a log of someone guessing passwords to a file or something of that sort, its probably some newbie who's just starting out. These are the easiest hackers to catch. They usually get so caught up in thoughts like "I'm in!" that they forget the basics, such as work behind a proxy.

Tip to protect yourself

My friend was setting up a webserver once. His first time too, and he wasn't to anxious to set up some good software to protect against hackers and viruses. He didn't put up one IDS, and before you know it, the obvious happened. But this time, a newbie had struck. The nice log files showed, bluntly across the screen, multiple instances of a foreign IP address that stood out. Some stupid newbie had tried to login as "uucp" on my friend's XP computer, with a password of "uucp." Well, that's great, but he also had tried the same user/pass combination three times, enough to get himself logged nicely. Even a semi-brainless user with some form of neurological system knows that uucp isn't a default XP account. Again, excitement toiled this hacker's brain, and maybe if he hadn't done that, along with a few other stupid things, he wouldn't have gotten caught. What other things did he do? Well, lets see. He openned 35 instances of MS-DOS. He tried to clean the printer's heads, and he edited a .gif in notepad. Then he uninstalled a few programs and installed some html editor, and replaced four files with the words "14P." he might as well have posted his phone number. In a few days, we had tracked him down to a

suburban town in Ohio. We let him go, not pressing any charges, because he had done nothing really damaging and had provided me with an example of a moron for this guide.

Tip 3: Don't go crazy if you lose data. Chances are, if it was that important, you would have backed it up anyway. Most hackers nowadays wish they were back in 1989 when they could use a Black Box and having a Rainbow Book actually meant something. Most hackers aren't blackhat, they are whitehat, and some even greyhat. But in the end, most hackers that are in systems aren't satisfied by looking around. From past experiences, I have concluded that many hackers like to remember where've they been. So, what do they do? They either press delete here and there, or copy some files onto their systems. Stupid hackers (yes, there are plenty of stupid hackers) send files to e-mail addresses. Some free email companies will give you the IP of a certain e-mail address's user if you can prove that user has been notoriously hacking you. But most of the time, by the time you get the e-mail addy it's been unused for weeks if not months or years, and services like hotmail have already deleted it.

Tip 4: Save information! Any information that you get from a log file (proxy server IP, things like "14P", e-mail addresses that things were sent to, etc.) should be saved to a floppy disk (they're not floppy anymore, I wish I could get out of the habit of calling them that) incase there's a next time. If you get another attack, from the same proxy, or with similar e-mail addresses (e.g: one says Blackjack 123@something.whatever and the other says Black_jack_45@something.znn.com) you can make an assumption that these hackers are the same people. In that case, it would probably be worth the effort to resolve the IP using the proxy and do a traceroute. Pressing charges is recommended if this is a repeat offender.

Tip 5: Don't be stupid. If you've been hacked, take security to the next level. Hackers do talk about people they've hacked and they do post IPs and e-mail addresses. Proof? Take a look at Defcon Conventions. I've never gone to one, but I've seen the photos. The "Wall of Shame"-type of boards I've seen have IPs and e-mail addresses written all over them in fat red, dry-erase ink. Don't be the one to go searching the Defcon website and find your e-mail address posted on the Wall of Shame board!

Tip 6: Don't rely on luck. Chances are, sometime or another, you're going to be targeted for an attack. Here you can rely on luck. Maybe they'll forget? Maybe they don't know how to do it? If you think this way, a surprise is going to hit your face very hard. Another way you could stupidly rely on luck is by saying this: It's probably just a whitehat. On the contrary, my friend, it's probably just a blackhat. A blackhat with knowledge stored in his head, ready to be used as an ax. It's your data. You take the chance.

How to Hack an Email Account

The most frequent question asked by many people especially in a chat room is How to Hack an Email Account? So you as the reader are most likely reading this because you want to hack into some one’s email account. Most of the sites on the internet teach you some nonsense and outdated tricks to hack an email. But here are some of the real and working ways that can be used to hack an email account.

THINGS YOU SHOULD KNOW BEFORE PROCEEDING

Before you learn the real ways to hack an email, the following are the things you should be aware of.

1. There is no ready made software that can hack emails just with a click of a button. Please don’t waste your money on such scam softwares.

2. Never trust any hacking services that claims to hack email passwords just for $100 or $200. Often people get fooled by these services and eventually loose their money with no gain.

3. With my experience of over 6 years in the field of Hacking and Security, I can tell you that there exists only 2 foolproof methods to hack an email. All the other methods are simply scam or don’t work. The following are the only 2 foolproof methods that work.

1. EASIEST WAY TO HACK AN EMAIL ACCOUNT

Today, with the advent of a program called Keylogger it’s just a cakewalk to hack an email account. It doesn’t matter whether or not you have physical access to the victim’s computer. Using a keylogger is the easiest way to hack an email account. Any one with a basic knowledge of computer can use the keylogger and within few hours you can hack any email account.

1. What is a keylogger?

A keylogger, sometimes called a keystroke logger, key logger, or system monitor, is a small program that monitors each keystroke a user types on a specific computer’s keyboard. Using a keylogger is the easiest way to hack an email account. A keylogger program can be installed just in a few seconds and once installed you are only a step away from getting the victim’s password.

2. Where is the keylogger program available?

A keylogger program is widely available on the internet. Some of the best ones are listed below

SniperSpy

Win-Spy

3. How to install it?

You can install these keyloggers just as any other program but these things you must keep in mind. While installing, it asks you to set a secret password and a hot key combination. This is because, after installation the keylogger program is completely hidden and the victim can no way identify it. So, you need the Hot Key combination and secret password to later unhide the keylogger.

4. Once installed how to get password from it?

The hacker can open the keylogger program by just pressing the hot keys (which is set during installation) and enter the password. Now it shows the logs containing every keystroke of the user,where it was pressed, at what time, including screenshots of the activities. These logs contain the password of the victim’s email account.

5. I don’t have physical access to the victim’s target computer, what can I do?

It doesn’t matter whether or not you have physical access to the victim’s computer. Because keyloggers like SniperSpy and Win-Spy offers Remote Installation Feature. With this feature it is possible to remotely install the keylogger on the victim’s PC.

You can attach the keylogger with any file such as image, MS excel file or other programs and send it to the victim via email. When the victim runs the file, it will automatically get installed without his knowledge and start recording every activity on his computer. These activities are sent to you by the keylogger software via email or FTP.

6. What if the target user (victim) refuses to run the attached file?

Sometimes the victim may refuse to run the attachment that you send via email because of suspicion. To solve this problem plz refer the following link

A fool proof method to remote install the spy software

7. How can a keylogger hack the Email password?

Hacking an email password using keylogger is as simple as this: You install the keylogger on a Remote PC (or on your local PC). The victim is unaware of the presence of the keylogger on his computer. As usual, he logs into his Email account by typing the username and password. This username and password is recorded and sent to you via Email. Now you have the password of your target email account.

In case if you install the keylogger on your local PC, you can obtain the recorded email password just by unhiding the keylogger program (use your hot key and password to unhide).

8. Which Keylogger is the best?

Both the keyloggers mentioned above are the best for email hacking. However I recommend SniperSpy as the best for the following reasons.

1. Sniper Spy is more reliable than Win-Spy since the logs sent will be received and hosted by SniperSpy servers. You need not rely on your email account to receive the logs.

2. Unlike Winspy, Sniperspy doesn’t require anything to be installed on your computer. To monitor the remote PC all you have to do is just login to your SniperSpy account from your browser.

3. SniperSpy is more easy to use and faster than Winspy.

4. SniperSpy offers better support than WinSpy.

5. SniperSpy has got recognition from media such as CNN, BBC, CBS, Digit etc. Hence it is more reputed and trustworthy.

To get a complete review of SniperSpy please see my new post Which Spy Software to Choose

Apart from the above mentioned reasons, both SniperSpy and WinSpy stands head-to-head. However in my opinion it’s better to go for SniperSpy since it is the best one. I have tested tons of keyloggers and the only two that stood up were SniperSpy and Winspy.

So what are you waiting for? If you’re serious to hack an email account then go grab either of the two keyloggers now!

For more information on these two softwares visit the following links

1. SniperSpy 2. WinSpy

2. OTHER WAYS TO HACK AN EMAIL ACCOUNT

The other most commonly used trick to sniff password is using Fake Login Pages. Today, Fake login pages are the most widely used techniques to hack an email account. A Fake Login page is a page that appears exactly as a Login page but once we enter our password there, we end up loosing it.

Fake login pages are created by many hackers on their sites which appear exactly as Gmail or Yahoo login pages but the entered details(username & pw) are redirected to remote server and we get redirected to some other page. Many times we ignore this but finally we loose our valuable data.

However creating a fake login page and taking it online to successfully hack an email account is not an easy job. It demands an in depth technical knowledge of HTML and scripting languages like PHP, JSP etc.

I hope this info has helped you. Happy Email Hacking!

Warning : All the information given in this post is just for sake of fun. Any illegal use of this information will clear your way to jail and can also charge you a lot.

Hack Protect your Orkut Account.

Most of the people ask me “How to hack an Orkut account” which I have already discussed in my previous post Hacking Orkut. But here I am giving you a detailed information about how to protect your Orkut accounts. As we all know most of the Google services are still in BETA. So,websites like Orkut, powered by Google is not totally secure!Several people feel proud in hacking other user’s account. You do a foolish thing, and next day your account is hacked. This is very sad indeed, but hackers are adding names to their victims list till now.

How can a hacker hack my Orkut account?
The answer to this question is already discussed in my previous post How to Hack Orkut.

But this post is meant for providing some safety measures to prevent your Orkut account from being hacked. There is not much you have to take care of. Just follow the simple steps and never get your orkut account hacked in your life.

1. Never try to login/access your Orkut account from sites other than Orkut.com.

2. Never click on any links from the sources you don’t trust while accessing your Orkut account. (or while accessing any other Google services like Gmail,Blogger etc.)

3. Delete any links on your scrapbook, no matter if a known or unknown person have sent it.

4. Never disclose your orkut login details with anyone.

5. Never ever use Javascripts on Orkut, no matter whatever it claims to do. Get satisfied with the services provided by default! Avoid using third party Scripts which might be malicious.

6. Never get excited to see a site claiming to have 1000 cool orkut tricks for which you have to just log in to your orkut account. Don’t trust that site. That’s a Phishing site.

7. Never tick the box “REMEMBER ME” on the orkut homepage if you are surfing from a cafe or a public area.

8. Always remember to hit Sign out button, when you are done.

How to prevent your email account to be hacked?

Today in this post I’ll teach you how to protect your email account from being hacked. Nowadays I get a lot of emails where most of the people say “My Email account is hacked please help…”. Now one question which arises in our mind is:”Is it so easy to hack an email account? OR Is it so difficult to protect an email account from being hacked?”. The single answer to these two questions is “Absolutely NOT!”. It is neither easy to hack an email nor difficult to protect an email account from bieng hacked.

If this is the case, then what is the reason for many people to loose their accounts?
The answer is very simple. They don’t know how to protect themselves from being hacked! In fact most of the people who loose their email accounts are not the victims of hacking but the victims of Trapping. They loose their passwords not because they are hacked by some expert hackers but they are fooled to such an extent that they themselves give away their password.

Are you confused? If so continue reading and you’ll come to know…

Now I’ll mention some of the most commonly used online scams which fool people and make them loose their passwords. I’ll also mention how to protect your email account from these scams.

1. WEBSITE SPOOFING

Website spoofing is the act of creating a website, with the intention of misleading the readers. The website will be created by a different person or organisation (Other than the original)especially for the purposes of cheating. Normally, the website will adopt the design of the target website and sometimes has a similar URL.

For example a Spoofed Website of Yahoo.com appears exactly same as Yahoo Website. So most of the people believe that it is the original site and loose their passwords. The main intention of spoofed websites is to fool users and take away their passwords. For this,the spoofed sites offer fake login pages. These fake login pagesresemble the original login pages of sites like Yahoo,Gmail,Orkut etc. Since it resemble’s the original login page people beleive that it is true and give away theirusername and passwords by trying to login to their accounts.

Solution:

• Never try to login/access your email account from the sites other than the original site.
• Always type the URL of the site in the address bar to get into the site.Never click on the hyperlink to enter the site.

2. BY USING KEYLOGGERS

The other commonly used method to steal password is by using a Keylogger. A Keylogger is nothing but a spyware. The detailed description of keylogger and it’s usage is discussed in the post Hacking an email account. If you read this post you’ll come to know that it is too easy to steal the password using a keylogger program. If you just access your email account from a computer installed with keylogger, you definitely loose your password. This is because the keylogger records each and every keystroke that you type.

Solution:

Protecting yourselves from a keylogger scam is very easy.Just install a good anti-spyware program and update it regularly. This keeps your PC secure from a keylogger. Also there is a program called Anti-keylogger which is specially designed to detect and remove keyloggers. You can use this program to detect some stealth keyloggers which remain undetected by many anti-spyware programs.
3. ACCESSING YOUR EMAIL ACCOUNT FROM CYBER CAFES

Do you access your email from cyber cafes? Then definitely you are under the risk of loosing your password.In fact many people loose their email account in cyber cafes. For the owner of the cyber cafe it’s just a cakewalk to steal your password. For this he just need’s to install a keylogger on his computers. So when you login to your email account from this PC, you give away your password to the cafe owner. Also there are many Remote Administration Tools (RATs) which can be used to monitor your browsing activities in real time.

This doesn’t mean that you should never use cyber cafes for browsing the internet. I know, not all the cyber cafe owners will be so wicked but it is recommended not to use cafes for accessing confidential information. If it comes to the matter of security never trust anyone, not even your friend. I always use my own PC to login to my accounts to ensure safety.

So with this I conclude my post and assume that I have helped my readers to protect their email accounts from being hacked. Please pass your comments…

How to hack a orkut account?

Google uses a 4 Level Orkut login which makes it difficult to hack Orkut using brute force attack.

First Level - Security-SSL or 128 bit secured connection

Second Level – Google account checks for cookie in the sytem of user

Third Level – Google provides a redirection to the entered User information

Fourth Level – Google doesn’t use conventional php/aspx/asp coding. So it is impossible to hack Orkut using input validation attack!!!

It is not an easy task to hack Orkut by breaking this security! But still some people manages to get access to other’s Orkut accounts. The question concerned is How they do it? Many of them just use simple tricks that fool users and then they themself leak out their password. Here are some points you need to take care of, to protect your Orkut account being hacked.

Common Ways to Hack Orkut

1. Using Keyloggers is one of the Easiest Way to Hack an Orkut (or any other email) password. Keylogger programs can spy on what the user types from the keyboard. If you think that you can just uninstall such programs, you are wrong as they are completely hidden.

A keylogger, sometimes called a keystroke logger, key logger, or system monitor, is a hardware device or small program that monitors each keystroke a user types on a specific computer’s keyboard. Keylogger is the easiest way to hack an Orkut account.

A keylogger program is widely available on the internet. Some of the best ones are listed below

Win-Spy Monitor

Realtime Spy

A detailed information on Keylogger Hack can be found in my post Hacking an Email Account.

2. Phishing Attack is the most popular way of hacking/stealing other’s password. By using fake login pages it is possible to hack Orkut. Here the users land on a page where they are asked for their login information and they enter their Orkut username and password thinking it to be a real page but actually it is other way round. It submits all the entered details to the creator of the fake login page.

3. Orkut New Features: I have come across a page(fake page) that looks like they are giving the user a choice of selecting new features for orkut with your ID and password, of course!! When the user submit’s his/her Orkut login information through this page, there goes his ID and password mailed to the coder.

4. Community Links: Many times you are provided with a link to a community in a scrap. Read the link carefully, It may be something like http://www.okrut.com/Community.aspx?cmm=22910233 OKRUT not ORKUT. This is definitely a trap created by the hacker to hack your Orkut password. Clicking on this link will take you to a fake login page and there you loose up your password.

5. Java script: You must have seen the circulating scraps that asks you to paste this code in your address bar and see what happens! Well sometimes they also leak out your information. Check the code and if you are unsure of what to do, then I recommend not to use it. So be careful, javascripts can even be used to hack Orkut!

6. Primary mail address: If by some means a hacker came to know the password of your Yahoo mail or Gmail, which users normally keeps as their primary mail address in their Orkut account, then hacker can hack Orkut account by simply using USER ID and clicking on ‘forget password’. This way Google will send link to the already hacked primary email ID to change the password of the Orkut account. Hence the email hacker will change your Orkut account’s password. Hence your, Orkut account is hacked too.

So a better thing would be to keep a very unknown or useless email ID of yours as primary email id so that if the hacker clicks on ‘Forgot password’ the password changing link goes to an unknown email id i.e. not known to the hacker. Hence your Orkut account saved.

So, I hope that this post not only teaches you to hack Orkut but also to hack protect your Orkut account.

If you would like to share something, comment here and I will add up here with a credit to your name.