[Gyan/ Knowlege] From Con to Consultant

Among my recent promises to myself to write blogs, get certifications, etc. my venture into the hacker world, participating and topping the table of capture the flag, secured me the position of a Penetration Tester in one of the Big Four firms. In the past few months of being a random hackerboy on the internet space who gained pocket money from bug bounties, fame from free goodies there was a sudden drift to convert into a absolute and perfect human. This drift from fame to money, from loose shirts and jeans to walking in suits (Nope, NSA aren't the only one that wear suits), has probably been the most incredible journey of my life.

Even though incredible, the life changing from a hackerboy to a corporate man is terrible. It is like a burden of responsibilities you specifically avoided till today, suddenly seemed to grasp hold of you and pull you down. The expectation of following decorum and maturity in a person is like a sea water fish suddenly finds itself in the depths of pacific ocean. However, having the unusual luck of working under the guidance of the top levels of the organization (Yup! My first project and I get to learn from the best) made me push harder and harder until I realized I could pull myself up and stand up face to face and look into their eyes and say, "Look my good Sir! I exist!". For my utter surprise, the motivation, the energy and the vibe spread by these top level folks are astonishingly awesome and the attention you are given seemed to be particularly amazing (Yes! When people with 15+ years of industry experience looks up at you and says good work - now feel my feeling).

Consultants are often looked up as all knowledgeable folks, who have extreme knowledge in especially what they do. Keeping up with these expectations are particularly hard, but then the challenge involved in it is what keeps you on your toes and learning. With an extremely techie security consulting astronomer (Yes. WTH?!) I was able to increase my Linux skills and with the guidance of an ever hardworking manager I am still shaping up to become a total corporate guy. However this journey of fame to money, deepweb to whiteweb, blackhat to whitehat, hacker to penetration tester, con to consultant is an extremely exciting and learning filled transition, especially for all those Kevin Mitnik(s) who love to social engineer out there. Because remember,

If you can't sell it, don't bother making it.

[Gyan/ Knowledge] A Random Non Governmental Organization

Let us start by the familiar wikipedia definition of what exactly is an Non Governmental Organization

A non-governmental organization or non-governmental organisation in English (NGO) is an organization that is neither a part of a government nor a conventional for-profit business. Usually set up by ordinary citizens, NGOs may be funded by governments, foundations, businesses, or private persons. Some avoid formal funding altogether and are run primarily by volunteers. NGOs are highly diverse groups of organizations engaged in a wide range of activities, and take different forms in different parts of the world. Some may have charitable status, while others may be registered for tax exemption based on recognition of social purposes.

So what is a post about an NGO doing on this blog focused towards the learning of technologies and hacking? Well basically, after finishing my graduation and before applying to universities for further studies or joining any company, as an Engineer I had so much amount of time that I was desperately trying to be busy by picking up internships and hacking websites and participating and getting my name into various Security Hall(s) Of Fame. While all this happened, I got called to come visit this NGO by a genius, geeky and a very old neighbor of mine called Sharath Ram Chandra (My thanks and gratitude to you).

First Visit

Even though I value time a lot, my first visit to this place started off pretty bad with me being about 15-20 minutes late. However, once here, I was received and introduced to this place called the CIS-India by Sharath. Further on, I went on to get introduced to the Executive Director Sunil Abraham, Elonnai Hickok and Beli (Pardon me if I got any names wrong), ending up with a small project and an opportunity to conduct pro bono penetration tests on them.

First Hack

I would term my finding vulnerabilities on various places of CIS as a hack, rather I'd say everything I learn here is a hack. Starting with networking with people who absolutely do not belong to your domain or understand what you do and vice versa. I must say, being a person involved with only technology and nothing more than a bunch of codes with a mind full of ethics and beliefs, working with a bunch of people making policies to help techies like us to convert our beliefs into real life practice is probably the MOST MOTIVATING FACTOR. I am a person who believes in open and free knowledge, probably would mean that I am a hardcore Wikipedia person, and here I was in CIS, an NGO that worked day and night to start and improve various communities in Wikipedia and helping out to provide an Open Media. Anything and everything I saw here would surely keep me motivated for the rest of my life.

Staff Meeting

I had previously experienced staff meeting in various internships that I had done. But none of them has been worthy of talking let alone praising. This staff meeting was held on a conference call between the New Delhi and Bangalore with everyone having a distraction box with internet connected to it in front of them. Here was the first time I felt as if I experienced a motivating leader (Sunil). Starting off the meeting with his speech about punctuality in a very different and unique way that would only make one think how much of a burden he/she was to the team in turn making them guilty conscious without really hurting any feelings. This meeting surely showed an innovative way of keeping all their persons aware even though almost everyone present had a laptop connected to the internet. Sunil surely set up himself as an idol by being I think one of the only persons in the room, listening and grasping almost everything that was being said in the room. This meeting was surely a place you could learn a lot about various fields CIS was working with, technically put I’d call this staff meeting something like the Internet Relay Chat but only with voice. But really, hats off to this charismatic leader - Sunil Abraham.

What I think

CIS is definitely a small office, but the work culture and the community feeling between everyone here surely is a wonderful place to be at (I’d actually call it more like a small home). If you have a mind for Open Internet or Free and Open Knowledge you should probably volunteer up at CIS and work with all these wonderful people. Finally, Even though you might feel a bit out of place as a person working in the core of technologies, I surely think if you are anywhere close to believing in Hacking or Openness and haven’t volunteered at any place that is working hard to bringing the world together, you are missing out on a wonderful experience and probably doing not doing the best thing.

[Gyan/ Knowledge] Indian Hacker Space - Home for fraudsters

In India, it is a sad scenario to see young minds become motivated by what they see in Television. The Social  Media holds the power to brainwash and mobilize anyone, and it is extremely sad to see how the social media takes advantages of its power. A few days back, on the Internet Relay Chat, we were having a conversation about which country had the best hacker. Being a obvious patriot I obviously supported India. But then, suddenly, the entire cyber space go against me calling Indians nothing but a bunch of fraudsters. But why did this happen?
Some time ago, I was having this conversation with this kid. A young mind, extremely enthusiastic about becoming a hacker. Being a hacker enthusiast in your early teens is a incredible thing as long as you are willing to put long hours into it and make it your 1st and foremost commitment. However, this kid was talking something about a certification - A Hacker Certification from a Indian "Premier" Hacker Institute. Ok! Now, this broke all the laws of being a Hacker. Not only does the definition of hacker lose the meaning of "Free Knowledge", but also Institutes terming these certifications as "Ethical Hacking" just abuse the term "HACKING" and are completely ignorant to its ethics.
So how and why did this happen? On talking further to that kid, I realized that he was watching a TV Show called "MTV What the hack" with a person name "Ankit Fadia" often referred as Ankit "Fraud?ya!" on the cyber world. This script kiddie show, encourages young minds to lose the hacker way of gaining knowledge and teaches them to use script kiddie (skiddie) tools leaving them to be ignorant about the "Real Deal" that happens. Yes! Just like the "Anonymous group of Hackers" that are a bunch of script kiddies sitting and using a bunch of tools made by the 1337-Anon hackers, calling themselves "hacktivists" that "take down" websites of the corrupt, ultimately not even knowing what DoS and DDoS are.

The Skiddie Name Ankit "Fraud? Ya!"

In the Hacker world, someone gaining fame as being "one of the best hacker" obviously attracts attention not just from any other single person, but rather a world wide audience and hence people took notice of him and found out this self proclaimed ugly truth. Mr. Fadia, a young hero who "CLAIMS" to have helped a American Intelligence Agency when he was just 14 y/o kid. So believable! Dang! Never knew American Intelligence Agencies took help from 14 y/o who aren't even American Citizen, without any published papers. I guess American standards have too high hopes on Indians that even kids with no proficiency come ahead and get called for classified work. So classified that he can not even name this so called "AGENCY".
This guy published books for hacking with other authors that is dipped in plagiarism from the start to the end. Goes to a extent of having "ethical hacker" certifications under his name. Not sure if his students become elite hackers or just a another bunch of guys who are victimized to social engineering. But full credits to this Fraudster chap for having amazing Social Engineering skills and exploiting media.

This professional hacker that certifies other hacker even holds a record in another field. I guess he is the only hacking certification provider with his own website hacked over and over again.

A full coverage of people of this kind have been done in Errata Charlatan along with all the hacks done to his website.

When you go to Errata, there is one more thing you notice. Among the Authors of hacking books and the number of people who plagiarize materials - India ranks number 1. All of them who are credited in the Indian state and its people thanks to the social media and its coverage, are actually fraudsters and crooks who are disrespected throughout the cyber space.

Stopping these crooks

This is simple! Just start getting more aware and look for fraudsters in and around yourself. And to be a hacker, 1st gain the hacker mindset. Also probably the best tool for starting to learn hacking is "GOOGLE".

UPDATE: DEFCON RECOGNIZE AWARDS on Ankit Fadia

[Gyan/ Knowledge] A Hacker

Often misinterpreted by the public and hyped by the media, a HACKER is generally termed as a person who is a part of a system intrusion of some sort. There is always this division of Hackers that the media can't seem to put onto a hold. Yes, the White Hat, the Grey Hat and the Black Hat. They sound so cool, just imagining the regular villain characters wear a Black Hat. And most of the time you try to imagine a Black Hat, you'd only end up with Slender Man standing at a distance with a computer in his hand. Phew! Super modern Slender Man.

Another definition of this controversial term called "HACKER" would be the one that follows the classic Glider Symbol, termed in the Hacker Jargon Files by Eric S. Raymond. This is a more accepted definition of a Hacker by Hackers as it traces it back to the "Old School" MIT days. But again constraining the meaning of a Hacker to a bunch of Grammar Fanatics and Programmers.

But is this all that is there to become a Hacker? What about the B.C (Before Computers) era? Isn't the founder of the Computer himself a hacker? Hell yeah! He was! :)
So Charles Babbage was a HACKER? Well I never said that! Present day, even students learning about computers or pursuing Computer Science Degree, do not seem to know what was the machine that was built by Charles Babbage. But their ignorance can not be blamed on them! Since this is what they are always taught (Yes! It is all a part of a Plan!).
Ok, before I turn this post into a conspiracy theory post, let us shift back to Alan Turning, whom I consider the real father of Computers.

Alan Turning, in 1945, changed computing entirely. He was the first one to understand the concept of universality inherent in the stored program computer. He was among the few, who knew the power of computing after he designed "The Bombe" to break the then feared "Enigma Cipher", which was probably the hack of the millennium! This concept is what changed computing. And then brought in the machine that was meant to do bills for a department store to a machine that solved complex differential equations.

According to me, A HACKER can be defined by what Pablos said in his TEDx Talk, "Hackers are the ones that have the right mindset to discover what is possible. Hackers have the ability to interact with the world in a different way and find out what can be done."
You can be a hacker if you have enough passion to become one. After all, you can achieve anything if you have passion for that. Hacker is that one who thinks outside the box. Hacker is someone who can analyse without even trying. Hackers are not the guys who are introverts or geeks just sitting behind the computers, they are also the Social Engineers who talk you into doing things that you wouldn't or rather, shouldn't do! Hackers are those who inspect every aspect of existence, test every bit of a protocol, exploiting every inch of work done for flaws and hence becoming hated and rejected "intruders" by the society!
Being a genius is one thing, being a hacker is another. Genius men put in hard work, effort into solving the most complicated problems. A Hacker is a lazy person who provides simple solutions and work around(s) to any problem.
Anyone can become a genius, but you need to live like a HACKER!

[Gyan/ Knowledge] 10 Steps to help write a readable code

10 Steps to help write a readable code

• Commenting and documentation

IDE (integrated development environment) have come a long way and most are comfortable using these IDE’s because they save a lot of our time.

Comments should be simple and basic English understandable to everyone. Comments help us to understand the code even without going through the function. IDE’s help us by showing these comments to know what the function does while calling the function.

• Consistent Indentation

It is very important to indent your code simply because it makes it readable

Ex: in C++

Cout<<”hello world”; if(i==0) cout<<”zero”; else cout<<”not zero”;

(will work perfectly fine)

Cout<<”hello world”;

If(i==0)

{

Cout<<”zero”;

}

Else

{

Cout<<”not zero”;

}

(brackets are not compulsory, code will work if not as well)

There are many styles of indentation, you can choose any style but it is very important to be consistent with your style.

But remember when in group doing a project it is always good when all the team follows the same style.

• Avoid obvious comments

Commenting your code is fantastic however, it can be overdone or just be plain redundant. When the text is that obvious, it’s really not productive to repeat it within comments. If you must comment on that code, you can simply combine it to a single line instead.

Adding a comment at the beginning of each block of code also emphasizes the virtual separation.

• Consistent naming scheme

Function names and variables names should be consistent, readable and understandable.

It is very important to have word boundaries in names, two ways to do:

• camelCase: First letter of each word is capitalized, except the first word.
• Underscore: underscore between words, like: mysql_real_escape_string().

Similar to indent this also has many ways. It is always advisable to follow certain convention in an existing project. There is no “best” style but always remember one thing be consistent.

• DRY (don’t repeat yourself)

The purpose for most application is to automate repetitive tasks. This principle should be maintained in all code, even web applications. The same piece of code should not be repeated over and over again.

• Avoid deep nesting

Too many levels of nesting makes it harder to read and follow and sometimes even harder to remove errors (if any). For the sake of readability it is better to reduce deep nesting.

• Limit line length

As humans we are more comfortable reading small horizontal lines. So it is good practice not to write long lines.

• Use of files and folders

You can always write the entire program in a single file, but that would be a nightmare to read and follow. As the programs become huge it is advisable many files and use “include files” etc. Common files can be combined in a folder for better understanding.

• Capitalize SQL Special words

Creation of database is a important part of any web application. If writing raw SQL queries, it is a good idea to them readable as well.

Even though SQL special words are case insensitive, it is common practice to capitalize them to distinguish them from table and column names.

• Object oriented Vs. procedural

Object oriented programming can help you create well structured code. But that does not mean you need to abandon procedural programming completely. Actually creating a mix of both styles can be good. Objects should be used for representing data, usually residing in a database.

[Gyan/ Knowledge] Structured vs Object Oriented Programming

Arranging your codes

When we talk about the difference between C and C++(in this matter python and JAVA as well), we often come across the term "Structured" and "Object Oriented", w.r.t C and C++ respectively.
So, what are these?
What exactly is the difference between them?
Why is Object Oriented Programs more used and needed in this present world?
Let us understand these concepts and try to implement them in a program.

Data Structure:

It is a method of storing and organizing data. Examples would include an array, a struct, a class, etc.
Take for example, you own a company. Now you want to store some information of your employees, say Employee ID and Employee Name. You could save them just like that in a Alphabetical order. Now this becomes your Data Structure.

Structured Programming:

This is a older style of programming. It is said to have approximately been born in 1960s. It follow top-down logic.
Now what is top-down logic? Well, consider you are given a recipe to prepare a cup of tea. Assuming you accurately attempt each individual step, but you do not follow the order in which the recipe was given, i.e, you do not start from 1st step(top) and then go downwards. Rather you assume your own priorities and do the work. This would lead to a great tea massacre in the kitchen. Following the steps, in a procedural manner is what top down logic is all about!
Structured Programming was aimed at improving the quality, clarity and development time of a program by using subroutines(functions), block structures and loops(for and while loops). This technique emphasizes on the procedure. They are:

1. Sequence: Executing one subprogram and then another subprogram (Ex: Addition of 2 numbers follows a specific procedure). Executing instructions one by one is nothing but the top-down logic.
2. Selection: Executing one of the two subprograms according to the value of a Boolean expression (if loop)
3. Repetition: Executing a subprogram until a Boolean expression is true (for loop)

Even though structured programming improved quality, clarity and development time, it failed to solve one problem, i.e, ABSTRACTION. Structure Programming has a lower level of Abstraction!
Ok, so now what is Abstraction?
As the name suggest, we try to give a abstract picture of the implementation of the code, to the programmer(us)  with the help of a representation relevant to the current perspective. Abstraction tries to reduce and factor out the details, so that the programmer(we) can focus on a few concepts at a time. We shall deal with this further, when we go into OOPS completely.

Object Oriented Programming:

In this style of programming, the programmer can not only define the data type, but also define functions that can be applied to the Data Structure. This is how a Data Structure turns into a Object!

What is an Object?

Just look around, you'll find many examples for an "Object"! Let us take a PEN. A pen is an object? How do we say that? By observing its characters! Any object has 2 qualities: State and Behavior.  For a PEN, the State would be its Shape, Color, Size, etc.  And Behavior?? Behavior is basically the operations it can perform. Like Pen can be used to write, draw, etc. Now look at it this way, the "State" of a object in your program is like your Data Types and the "Behavior" is the Functions defined to perform various activities in capability of that object! You can now use the PEN with the desired size and shape for playing pen fight. In this case you refer only the size and shape of the object,ie, using data types only. And if you are writing a exam paper, you'd probably look in the behavior of the pen (how smooth it writes, comfort it has, etc), ie, using its properties (defined functions).
In the Software world, the State is referred to as fields or variables and Behavior as Methods.
Methods use the objects internal state and help in object to object communication(MESSAGE PASSING).
Hiding the internal state and requiring interactions to be performed through an object's methods is called "DATA ENCAPSULATION". Such a kind of bundling code into objects has various advantages like:

1. Modularity: The source code for an object can be written and maintained independently of the source code for other objects. Once created, an object can be easily passed around inside the system.
2. Information-hiding: By interacting only with an object's methods, the details of its internal implementation remain hidden from the outside world.
3. Code re-use: If an object already exists (perhaps written by another software developer), you can use that object in your program. This allows specialists to implement/test/debug complex, task-specific objects, which you can then trust to run in your own code.
4. Pluggability and debugging ease: If a particular object turns out to be problematic, you can simply remove it from your application and plug in a different object as its replacement. This is analogous to fixing mechanical problems in the real world. If a bolt breaks, you replace it, not the entire machine.

What is a Class?

A set or category of things, having some property or attribute in commin and differentiated from others by kind, type or quality. In the software world, class is a collection of similar type of objects.It is like a blueprint (or prototype) that defines methods and variables common to all objects of that kind. For Example, take your own class. You would be a object(with your state and behavior), so would the other students in your class be as well. Additionally, your school would be the program and your principal would be the main routine. Now if your pricipal calls for Shubham, the class needs to be specified so that the specific Shubham in that class could be summoned in front of the principle(Assuming there is only one Object called Shubham).

Some Very Important terms and definitions in OOPS:

Instance

It is the actual object created at run-time. We can have instance of a object or a class (ie, During run-time the variables may change).

Abstraction

Refers to the act of representing essential features without including the background details or explanations. Classes use the concept of abstraction and are defined as a list of abstract attributes.

Encapsulation

It is the mechanism that binds together code and data in manipulates, and keeps both safe from outside interference and misuse. Like isolating one code from another. Like the medicinal capsule, even though the composition of the medicine is the same, we store them in capsules, so that the dosage is fixed! So classes can be thought of as a container and data present can't be accessed by outside world.

Inheritance

It is the process by which one object acquires the properties of another object. This helps in hierarchical classification, without which, we'd need to explicitly define all the characteristics. Inheritance is a property that generally passes from parent class to sub class. Kind of like the genes that is transferred from our parents to us to our children.

Polymorphism

The ability to take more than one form. An operation may exhibit different behavior in different instances. The behavior depends on data types used in the operation. To be precise, it means, one interface, multiple methods.

Generalization

It describes an is-a relationship which represent a hierarchy between classes of objects. Like PEN is a generalization of "black pen", "blue pen", etc.

Specialization

It means an object can inherit the common state and behavior of a generic object. To be more clear, each object needs to define its own special state and behavior. So specialization means to subclass Generalized class, ie, if Pen is generalization, Red pen is specialization, ie, Red-Pen is a special kind of Pen.

We shall utilize these concepts and build programs around these in the upcoming articles!

[Gyan/ Knowledge] Practicing Pentesting Skills

If you are interested in Info Sec like me, you would be needing a wide play ground to test and improve your skills. So, here is a nice offline hacking game, called Damn Vulnerable Web App.
There are other games like mutillidae, Damn Vulnerable Linux, etc (look for more).
To make the installation process easier on a linux machine, I put up a bash script here.
This script uses "root" as user and "toor" as password.
After downloading and saving a copy(on your desktop) of this script you will have to open your terminal, traverse to the Desktop directory and execute (you might need to change the permissions of the script first) the script (follow the below commands).

root@bt~:# cd /root/Desktop

root@bt~:# chmod +x dvwa.sh

root@bt~/Desktop:# sh dvwa.sh

Now sit back till it is installed, and keep watching.
Once it is done, Open http://localhost/dvwa or http://127.0.0.1/dvwa on your browser.
The login credentials could be found in the script or you could just bruteforce it :)
Happy Hacking :)