Machines don't fight wars. Terrain doesn't fight wars. Humans fight wars. You must get into the mind of humans. That's where the battles are won. - COL John R. Boyd
Assessment of men; selection of personnel for the Office of Strategic Services [by] the OSS Assessment Staff
Turning Firefox to an Ethical Hacking Platform
- Information gathering
Whois and geo-location
ShowIP : Show the IP address of the current page in the status bar. It also allows querying custom services by IP (right mouse button) and Hostname (left mouse button), like whois, netcraft.
Shazou : The product called Shazou (pronounced Shazoo it is Japanese for mapping) enables the user with one-click to map and geo-locate any website they are currently viewing.
HostIP.info Geolocation : Displays Geolocation information for a website using hostip.info data. Works with all versions of Firefox.
Active Whois : Starting Active Whois to get details about any Web site owner and its host server.
Bibirmer Toolbar : An all-in-one extension. But auditors need to play with the toolbox. It includes ( WhoIs, DNS Report, Geolocation , Traceroute , Ping ). Very useful for information gathering phase
Enumeration / fingerprinting
Header Spy: Shows HTTP headers on statusbar
Header Monitor : This is Firefox extension for display on statusbar panel any HTTP response header of top level document returned by a web server. Example: Server (by default), Content-Encoding, Content-Type, X-Powered-By and others.
Social engineering
People Search and Public Record: This Firefox extension is a handy menu tool for investigators, reporters, legal professionals, real estate agents, online researchers and anyone interested in doing their own basic people searches and public record lookups as well as background research.
Googling and spidering
Advanced dork : Gives quick access to Google’s Advanced Operators directly from the context menu. This could be used to scan for hidden files or narrow in a target anonymously (via the scroogle.org option) [Updated Definition. Thanks to CP author of Advanced Dork]
SpiderZilla : Spiderzilla is an easy-to-use website mirror utility, based on Httrack from www.httrack.com.
View Dependencies : View Dependencies adds a tab to the "page info" window, in which it lists all the files which were loaded to show the current page. (useful for a spidering technique)
- Security Assessment / Code auditing
Editors
JSView : The ’view page source’ menu item now opens files based on the behavior you choose in the jsview options. This allows you to open the source code of any web page in a new tab or in an external editor.
Cert Viewer Plus : Adds two options to the certificate viewer in Firefox or Thunderbird: an X.509 certificate can either be displayed in PEM format (Base64/RFC 1421, opens in a new window) or saved to a file (in PEM or DER format - and PKCS#7 provided that the respective patch has been applied - cf.
Firebug : Firebug integrates with Firefox to put a wealth of development tools at your fingertips while you browse. You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page
XML Developer Toolbar:allows XML Developer’s use of standard tools all from your browser.
Headers manipulation
HeaderMonitor : This is Firefox extension for display on statusbar panel any HTTP response header of top level document returned by a web server. Example: Server (by default), Content-Encoding, Content-Type, X-Powered-By and others.
RefControl : Control what gets sent as the HTTP Referer on a per-site basis.
User Agent Switcher :Adds a menu and a toolbar button to switch the user agent of the browser
Cookies manipulation
Add N Edit Cookies : Cookie Editor that allows you add and edit "session" and saved cookies.
CookieSwap : CookieSwap is an extension that enables you to maintain numerous sets or "profiles" of cookies that you can quickly swap between while browsing
httpOnly : Adds httpOnly cookie support to Firefox by encrypting cookies marked as httpOnly on the browser side
Allcookies : Dumps ALL cookies (including session cookies) to Firefox standard cookies.txt file
Security auditing
HackBar : This toolbar will help you in testing sql injections, XSS holes and site security. It is NOT a tool for executing standard exploits and it will NOT learn you how to hack a site. Its main purpose is to help a developer do security audits on his code.
Tamper Data : Use tamperdata to view and modify HTTP/HTTPS headers and post parameters.
Chickenfoot : Chickenfoot is a Firefox extension that puts a programming environment in the browser’s sidebar so you can write scripts to manipulate web pages and automate web browsing. In Chickenfoot, scripts are written in a superset of Javascript that includes special functions specific to web tasks.
- Proxy/web utilities
FoxyProxy : FoxyProxy is an advanced proxy management tool that completely replaces Firefox’s proxy configuration. It offers more features than SwitchProxy, ProxyButton, QuickProxy, xyzproxy, ProxyTex, etc
SwitchProxy: SwitchProxy lets you manage and switch between multiple proxy configurations quickly and easily. You can also use it as an anonymizer to protect your computer from prying eyes
POW (Plain Old WebServer) : The Plain Old Webserver uses Server-side Javascript (SJS) to run a server inside your browser. Use it to distribute files from your browser. It supports Server-side JS, GET, POST, uploads, Cookies, SQLite and AJAX. It has security features to password-protect your site. Users have created a wiki, chat room and search engine using SJS.
- Misc
Hacks for fun
Greasemonkey : Allows you to customize the way a webpage displays using small bits of JavaScript (scripts could be download here)
Encryption
Fire Encrypter : FireEncrypter is an Firefox extension which gives you encryption/decryption and hashing functionalities right from your Firefox browser, mostly useful for developers or for education & fun.
Malware scanner
QArchive.org web files checker : allowing people to check web files for any malware (viruses, trojans, worms, adware, spyware and other unwanted things) inclusions.
Dr.Web anti-virus link checker : This plugin allows you to check any file you are about to download, any page you are about to visit
ClamWin Antivirus Glue for Firefox : This extension scans every downloaded file automatically with ClamWin.
Anti Spoof
refspoof : Easy to pretend to origin from a site by overriding the url referrer (in a http request). — it incorporates this feature by using the pseudo-protocol spoof:// .. thus it’s possible to store the information in a "hyperlink" - that can be used in any context .. like html pages or bookmarks
Additional Links:
Blackbuntu is Ubuntu base distro for Penetration Testing with GNOME Desktop Environment. It's currently being built using the Ubuntu 10.10.
The Metasploit® Framework is a free, open source penetration testing solution developed by the open source community & Rapid7.
The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element.
The intelligence community gets social by Brian Fung, WSJ
Intelligence Advanced Research Projects Activity (IARPA), the intelligence community’s research arm, says it hopes to use data gathered from social media to predict political unrest and natural disasters. While the proposal may rankle privacy critics, it’s just the latest example of the way intelligence officials are turning to the social Web to collect policy-relevant information.
The CIA already monitors social networks manually. In 2010, agency analysts became aware of a YouTube account allegedly belonging to the propaganda service of North Korea. Pyongyang soon had other identities set up on Twitter and Facebook (the latter of which was abandoned). The CIA issued several reports later that year on the regime’s entry into social media, concluding that the new Web offensive was primarily aimed at influencing the population of South Korea, one of the world’s most digitally enabled societies. Both countries are engaged in a tenuous military truce and longstanding public relations war.
Even as it was watching North Korea’s evolving positions on social media, the CIA was conducting a study of the social media landscape in India (pdf). Beyond uncovering some fascinating details about the country’s Internet usage patterns, analysts discovered that many of India’s controversial separatist groups were taking advantage of social media tools to advocate their agendas.
Spy agencies’ growing interest in digital media is perhaps unsurprising given that it is an industry that trades in information.. But it also reflects broader, underlying trends in intelligence-gathering. Since the end of the Cold War, U.S. officials have embraced what are called “open sources” — non-classified information drawn from newspapers, radio broadcasts and other publicly accessible outlets. Open sources accounted for some 80 percent (pdf)of what the CIA knew about the Soviet Union’s downfall in the early 1990s, according to then-deputy director William Studeman. Sherman Kent, one of the agency’s first analysts, once estimated (pdf) that 80 percent of all U.S. intelligence needs could be met with open sources in peacetime.
The biggest victory for open-source proponents came in 2005, when the CIA launched a new center dedicated to gleaning intelligence from public information. The announcement signaled more of a rebranding than anything else — open source intelligence has always been a part of the mix to some degree — but the event finally lent recognition and credibility to a historically obscure tradition.
The open-source revolution has only accelerated with social media. Now, analysts can tap directly into millions of individual sources at the micro level, examining tweets, blog posts and videos for new information. They can also step back and survey entire social ecosystems, using vast amounts of metadata to identify significant patterns of behavior in the abstract. Or at the mid-range level, digital media can reveal important connections among small groups of users.
Whether government scrutiny of social media is problematic for civil society depends on your conception of public and private. But it raises other questions, too. What is the intelligence value of an individual tweet? How does the study of social media affect signal-to-noise ratios and, more importantly, how does it affect ways in which the intelligence community allocates its resources to adapt? Does social media change the meaning of open-source intelligence?
Harris DirectionFinding and Geo-Location Systems
Archangel: CIA's Supersonic A-12 Reconnaissance Aircraft By David Robarge
This history of the A-12 reconnaissance aircraft is occasioned by CIA’s acquisition on loan from the Air Force of the eighth A-12 in the production series of 15. Known as Article 128, the aircraft will be on display at the Agency’s Headquarters compound in Langley, Virginia. This history is intended to provide an accessible overview of the A‑12’s development and use as an intelligence collector.
Writing this story was a fascinating challenge because I am not an aviation historian and have never flown any kind of aircraft. Accordingly, I have tried to make the narrative informative to lay readers like myself, while retaining enough technical detail to satisfy those more knowledgeable about aeronautics and engineering. I have drawn on the sources listed in the bibliography and the extensive files on the A-12 program in CIA Archives. Hundreds of those documents will be declassified and released to the public in conjunction with the dedication of Article 128 in September 2007 as part of the Agency’s 60th anniversary commemoration. I have limited citations to specific documentary references and direct quotes from published works. When discrepancies arose among the sources regarding dates and other details, I have relied on the official records.
For their contributions to the substance and production of this work and to the documentary release, I would like to thank my colleagues on the CIA History Staff and at the Center for the Study of Intelligence, the information review officers in the Directorate of Science and Technology, designers and cartographers in the Directorate of Intelligence, and publication personnel at Imaging and Publishing Support. I also am grateful for historical material provided by the Lockheed Martin Corporation and the A-12 program veterans, the Roadrunners.
David Robarge
CIA Chief Historian
September 2007
First Earth Battalion Manual
In 1979, the Peoples’ Republic of China publicly reported that several thousand of its children aged 8-14 were capable of telepathy, clairvoyance, X-ray vision, or psychokinesis. Having already heard about this program, the Central Intelligence Agency (CIA), National Security Agency (NSA), Defense Intelligence Agency (DIA), Lawrence Livermore Laboratories, and the US Army were simultaneously pouring billions of dollars into their own similar research.
The Army program was headquartered at Fort Meade, Maryland, and was part of the Intelligence and Security Command (INSCOM). Leaders included Generals Edmund Thompson and Albert Stubblebine, and Colonel John Alexander.
Officers assigned to the US Army War College at Carlisle Barracks, Pennsylvania contributed research to the project, and "The First Earth Battalion" is essentially a textual copy of one group's unclassified briefing slides.
Although decidedly New Age, the War College project was not entirely theoretical. Colonel Alexander, for example, went on to become a leader in the Los Alamos National Lab's non-lethal weapons program. Likewise, during the early 1980s Special Forces hired Richard Strozzi Heckler and other outside contractors to provide two A-teams, a total of 25 men, with training in biofeedback, aikido, and "mind-body psychology." In the latter program, a typical training day included running, swimming, "industrial-strength" calisthenics, and 1-1/2 hours of aikido practice. After six months, the soldiers were not aikido masters but they were quantifiably 75% more physically fit than when they started.
During correspondence with the editor in January 2000, author Channon had this to say:
And if nothing else, the following paper does suggest why drug testing became common for all ranks during the mid-1980s.
Declassified MKULTRA Project Documents
One 1955 MKULTRA document gives an indication of the size and range of the effort; this document refers to the study of an assortment of mind-altering substances described as follows:
- Substances which will promote illogical thinking and impulsiveness to the point where the recipient would be discredited in public.
- Substances which increase the efficiency of mentation and perception.
- Materials which will prevent or counteract the intoxicating effect of alcohol.
- Materials which will promote the intoxicating effect of alcohol.
- Materials which will produce the signs and symptoms of recognized diseases in a reversible way so that they may be used for malingering, etc.
- Materials which will render the induction of hypnosis easier or otherwise enhance its usefulness.
- Substances which will enhance the ability of individuals to withstand privation, torture and coercion during interrogation and so-called "brain-washing".
- Materials and physical methods which will produce amnesia for events preceding and during their use.
- Physical methods of producing shock and confusion over extended periods of time and capable of surreptitious use.
- Substances which produce physical disablement such as paralysis of the legs, acute anemia, etc.
- Substances which will produce "pure" euphoria with no subsequent let-down.
- Substances which alter personality structure in such a way that the tendency of the recipient to become dependent upon another person is enhanced.
- A material which will cause mental confusion of such a type that the individual under its influence will find it difficult to maintain a fabrication under questioning.
- Substances which will lower the ambition and general working efficiency of men when administered in undetectable amounts.
- Substances which promote weakness or distortion of the eyesight or hearing faculties, preferably without permanent effects.
- A knockout pill which can surreptitiously be administered in drinks, food, cigarettes, as an aerosol, etc., which will be safe to use, provide a maximum of amnesia, and be suitable for use by agent types on an ad hoc basis.
- A material which can be surreptitiously administered by the above routes and which in very small amounts will make it impossible for a person to perform physical activity.
Area 51: An Uncensored History of America's Top Secret Military Base

Myths and hypotheses about Area 51 have long abounded, thanks to the intense secrecy enveloping it. Some claim it is home to aliens, underground tunnel systems, and nuclear facilities. Others believe that the lunar landing was filmed there. The prevalence of these rumors stems from the fact that no credible insider has ever divulged the truth about his time inside the base. Until now...
KIll/Capture
Watch the full episode. See more FRONTLINE.