Skip to main content

Securing Operating Systems


You can implement various operating system security measures to ensure that passwords are protected.

Regularly perform these low‐tech and high‐tech password‐cracking tests to make sure that your systems are as secure as possible — perhaps as part of a monthly, quarterly, or biannual audit of local and domain passwords.

Windows
The following countermeasures can help prevent password hacks on Windows systems:

✓Some Windows passwords can be gleaned by simply reading the cleartext or crackable ciphertext from the Windows Registry. Secure your registries by doing the following:
  •  Allow only administrator access.
  •  Harden the operating system by using well– known hardening best practices, such as those from SANS (www.sans.org), NIST (http://csrc.nist.gov) and the Center for Internet Security Benchmarks/Scoring Tools (www.cisecurity.org).
 ✓Keep all SAM database backup copies secure. 
 ✓Disable the storage of LM hashes in Windows for passwords that are shorter than 15 characters. For example, you can create and set the NoLMHash registry key to a   value of 1 under  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControl Set\Control\Lsa. 
 ✓Use local or group security policies to help eliminate weak passwords on Windows systems before they’re created. 
✓Disable null sessions in your Windows version or enable the Windows Firewall.
 ✓In Windows XP and later versions, enable the Do Not Allow Anonymous Enumeration of SAM Accounts and Shares option in the local security   policy.

Linux and UNIX
The following countermeasures can help prevent password cracks on Linux and UNIX systems:

✓Ensure that your system is using shadowed MD5 passwords. 
✓Help prevent the creation of weak passwords. You can use either the built‐in operating system password filtering (such as cracklib in Linux) or a password‐auditing program (such as npasswd or passwd+). 
✓Check your  /etc/passwd  file for duplicate root UID entries. Hackers can exploit such entries to gain backdoor access.



NOTE: This is for educational purpose only we are not responsible for any type of inconvenience caused by reader.

Comments

Popular posts from this blog

Social Engineering Toolkit (SET)

Social Engineering Toolkit  (SET) is an advanced,  multifunctional, and easy-to-use computer-assisted social engineering toolset, created by the founders of  TrustedSec (https://www.trustedsec.com/). It helps you prepare the most effective way to exploit client-side application vulnerabilities and makes a fascinating attempt to capture the target's confidential information (for example, e-mail passwords). Some of the most efficient and useful attack methods employed by SET include targeted phishing e-mails with a malicious file attachment, Java applet attacks, browser-based exploitation, gathering website credentials, creating infectious portable media (USB/ DVD/CD), mass-mailer attacks, and other similar multiattack web vectors. This combination of attack methods provides you with a powerful platform to utilize and select the most persuasive technique that could perform an advanced attack against the human element.

 To start SET, navigate to  Applications  |  Kali Linux  |  Expl…

Cracking Wifi Using :Fern(GUI)

Fern(GUI)

As a part of Kali linux , fern can be directly used from kali linux , i would be recommending the use of kali because while using other linux environments it could be a trouble because while using fern it automatically detects the path of aircrack-ng and python installed , while in other environments it is needed to set it manually...so follow the following steps :-->

1.) Download kali linux iso and make a bootable pendrive .....if you dont know how to make bootable pendrive  then follow the steps given in blog of trinity rescue kit

Kali linux iso (amd64) recommended -->here
Link to trinity rescue kit blog --> here


 2.)Open Kali linux Goto Applications-->Wireless Attack--> Fern

3.)Select Interface card wlan0

4.)Double click any where in GUI

5.)Select enable x-terms ...so that you can view that happening ...while through a automated program...

6.)Click on select network

7.)Choose the type of network that is WEP/WPA

8.)I would recommend to add dictonary file .…

Deep Web - Part 1

What is deep web ?

Deep web Aka Invisible web Aka Hidden web are parts of the world wide web whose contents are not indexed by standard search engines.
LEVELS OF WORLD WIDE WEB :
SURFACE WEBBERGIE WEBDEEP WEBCHARTER WEBMARIANAS WEB SURFACE WEB :
The surface web also known as Visible web , Clearnet , Indexed web or Lightnet is that portion of the world wide web that is readily available to the general public and searchable with standard web search engines. Level of web where vast majority of internet users are connected to and which is accessible in any nation that does not block internet access.E.g: Social media sites like Facebook, informational websites like Wikipedia, general websites, etc

BERGIE WEB :

It is the part of world wide web that is not indexed by search-engines,which is directly accessible and no proxy required. E.g: Google locked results, recently web crawled old content, pirated media, pornography etc
DEEP WEB:
Deep web Aka Invisible web Aka Hidden web are parts of the wo…