Fi8sVrs

Part 1: Code your own Server/Client and start analyzing with Scapy Part1 (INTRO): In the Python part of video, we jump right into the code and cover your first Python TCP client and server and walk you through each of them, line by line. The Scapy part of the video will show you basic packet analysis in Scapy with a few helpful "making yourself feel at home in Scapy" tips. You will also walk out of this part with a better understanding of SYN/ACK/FIN packets, and what TCP connections and disconnects look like "on the wire". We also have a little surprise at the end The Source files (python 2.6) can be downloaded at: github.com/piman/PyPrimer-for-Hackers ------------ Some key points we want to cover in the whole video series: toolz often lie! code your own networking tools and get the correct feedback! code your own networking environments some network attacks run your toolz on several machines and communicate with them ...and other funny stuff Part 2 scr: python tutorial for hackers pentesters ? th3mast3r

dork: inurl:.php?id= site:sitexxxxxxxx.com sau "Import sites"

Download: Downloads - maxisploit-scanner - Scanner for SQL injection(error/blind) and XSS. Analysis Report for MaXIsploit.exe https://www.virustotal.com/file/f740429ae15d1ed571f4c23a7442c7f0e3f88678834c33a24d bd5d2bc91fbfa5/analysis/1335614595/ source: Maxisploit Scanner Demo

Welcome to RATS - Rough Auditing Tool for Security RATS - Rough Auditing Tool for Security - is an open source tool developed and maintained by Secure Software security engineers. Secure Software was acquired by Fortify Software, Inc. RATS is a tool for scanning C, C++, Perl, PHP and Python source code and flagging common security related programming errors such as buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions. RATS scanning tool provides a security analyst with a list of potential trouble spots on which to focus, along with describing the problem, and potentially suggest remedies. It also provides a relative assessment of the potential severity of each problem, to better help an auditor prioritize. This tool also performs some basic analysis to try to rule out conditions that are obviously not problems. As its name implies, the tool performs only a rough analysis of source code. It will not find every error and will also find things that are not errors. Manual inspection of your code is still necessary, but greatly aided with this tool. Download RATS RATS is free software. You may copy, distribute, and modify it under the terms of the GNU Public License. Latest Release: 2.3 Source tarball: rats-2.3.tar.gz [382K] [MD5] Win32 binary: rats-2.3-win32.zip [220K] [MD5] Requirements RATS requires expat to be installed in order to build and run. Expat is often installed in /usr/local/lib and /usr/local/include. On some systems, you will need to specify --with-expat-lib and --with-expat-include options to configure so that it can find your installation of the library and header. Expat can be found at: The Expat XML Parser Installation Building and installation of RATS is simple. To build, you simply need to run the configuration shell script in the distribution's top-level directory: ./configure The configuration script is a standard autoconf generation configuration script and accepts many options. Run configure with the --help option to see what options are available. Once the configuration script has completed successfully, simply run make in the distribution's top-level directory to build the program make By default, RATS will be installed to /usr/local/bin and its vulnerability database will be installed to /usr/local/lib. You may change the installation directories of both with the --prefix option to configure. You may optionally use the --bindir and --datadir to specify more precise locations for the files that are installed. To install after building, simply run make with the install target: make install This will copy the built binary, rats, to the binary installation directory and the vulnerability database, rats.xml, to the data installation directory. Running RATS Once you have built and installed RATS, it's time to start auditing your software! RATS accepts a few command line options that will be described here and accepts a list of files to audit on the command line. If no files to audit are specified, stdin will be used. Usage: rats [-d ] [-h] [-r] [-w ] ] [file1 file2 ... filen] Options explained: -d Specifies a vulnerability database to be loaded. You may have multiple -d options and each database specified will be loaded. -h Displays a brief usage summary -i Causes a list of function calls that were used which accept external input to be produced at the end of the vulnerability report. -l Force the specified language to be used regardless of filename extension. Currently valid language names are "c", "perl", "php" and "python". -r Causes references to vulnerable function calls that are not being used as calls themselves to be reported. -w Sets the warning level. Valid levels are 1, 2 or 3. Warning level 1 includes only default and high severity Level 2 includes medium severity. Level 2 is the default warning level 3 includes low severity vulnerabilities. -x Causes the default vulnerability databases (which are in the installation data directory, /usr/local/lib by default) to not be loaded. When started, RATS will scan each file specified on the command line and produce a report when scanning is complete. What vulnerabilities are reported in the final report depend on the data contained in the vulnerability database or databases that are used and the warning level in use. For each vulnerability, the list of files and line numbers where it occurred is given, followed by a brief description of the vulnerability and suggested action. https://www.fortify.com/ssa-elements/threat-intelligence/rats.html

Most people know that simply deleting a file won't stop someone from downloading important data from your hard drive. Sure you could do a 35-pass Gutmann wipe or run a program such as Darik's Boot and Nuke, but if you really want to feel secure, you need to bring in the heavy artillery. Maker Wiebetech claims that its Drive eRazer Ultra will make your data disappear in a fashion that's good enough even for the Department of Defense (whatever that means), or you can use any of ten other modes if you think the DoD specs aren't good enough. Unlike the software-based solutions mentioned earlier, the Drive eRazer Ultra is a physical box that you connect directly to your SATA or IDE drive. Wiping runs at around seven gigabytes-per-minute, so it should make pretty quick work of your drive. Best of all, after it is completely erased, the drive can be reused just as if it were new. The cost of all this security? Just $274, or a lot more than the hard drive probably cost new. What the heck were you hiding on there anyway? Wiebetech, via dvice

http://skype-ip-finder.tk/ source code: server.py print('****************************************************************************'); print('Skype IP lookup deamon'); print('****************************************************************************'); # This deamon listen unix socket for username string and then make RefreshProfile() for username. # If username online in Skypekit debug log will be string with IP adress. # # Put this script in skypekit-sdk_runtime-3.7.0/examples/python/tutorial and run there. # # You will need to launch the SkypeKit runtime before running this deamon. #---------------------------------------------------------------------------------- # Importing necessary libraries. Note that you will need to set the keyFileName value # in the keypair.py file. import sys; import socket import os, os.path import time import keypair; from time import sleep; sys.path.append(keypair.distroRoot + '/ipc/python'); sys.path.append(keypair.distroRoot + '/interfaces/skype/python'); try: import Skype; except ImportError: raise SystemExit('Program requires Skype and skypekit modules'); #---------------------------------------------------------------------------------- # Taking skypename and password arguments from command-line. if len(sys.argv) != 3: print('Usage: python vcard_socket.py <skypename> <password>'); sys.exit(); accountName = sys.argv[1]; accountPsw = sys.argv[2]; loggedIn = False; #---------------------------------------------------------------------------------- # Creating our main Skype object try: MySkype = Skype.GetSkype(keypair.keyFileName); MySkype.Start(); except Exception: raise SystemExit('Unable to create Skype instance'); #---------------------------------------------------------------------------------- # Defining our own Account property change callback and assigning it to the # Skype.Account class. def AccountOnChange (self, property_name): global loggedIn; if property_name == 'status': if self.status == 'LOGGED_IN': loggedIn = True; print('Login complete.'); Skype.Account.OnPropertyChange = AccountOnChange; #---------------------------------------------------------------------------------- # Defining our own Contact property change callback and assigning it to the # SkyLib.Contact class. def ContactOnPropertyChange(self, property_name): if property_name == 'availability': print('Online status event: ' + self.displayname + ' is now ' + self.availability); Skype.Contact.OnPropertyChange = ContactOnPropertyChange; #---------------------------------------------------------------------------------- # Retrieving account and logging in with it. account = MySkype.GetAccount(accountName); print('Logging in with ' + accountName); account.LoginWithPassword(accountPsw, False, False); while loggedIn == False: sleep(1); #---------------------------------------------------------------------------------- # Unix socket start if os.path.exists( "/tmp/skype_iplookup" ): os.remove( "/tmp/skype_iplookup" ) print "Opening socket..." MySocket = socket.socket( socket.AF_UNIX, socket.SOCK_DGRAM ) MySocket.bind("/tmp/skype_iplookup") os.chmod("/tmp/skype_iplookup", stat.S_IRWXU | stat.S_IRGRP | stat.S_IRWXO) print "OK. Now listening..." #---------------------------------------------------------------------------------- # Main cycle. # while True: MyUsername = MySocket.recv( 1024 ) if not MyUsername: break else: print ('Looking for ' + MyUsername + '...') # Be aware, string will put in MySkype.GetContact(MyUsername).RefreshProfile() without any verification of input data # string with illegal characters and "echo123" can broke whole programm. MySkype.GetContact(MyUsername).RefreshProfile() print ('Maybe done.') client.py # -*- coding: utf-8 -*- import socket import os, os.path import sys import re import time #------------------------------------------------------------------------ # Put here path to debug log that is currently written by skypekit runtime # you need run "skypekit -d logname" before edit this # also you can parse log by youself like "tail -F /some/folder/logname | grep -a noticing" and use client.py only for send username into socket PathToLog = "/some/folder/logname" if len(sys.argv) == 1: print('Usage: python skyip.py <skypename>') sys.exit(); Username = sys.argv[1] if os.path.exists( "/tmp/skype_iplookup" ): client = socket.socket( socket.AF_UNIX, socket.SOCK_DGRAM ) client.connect( "/tmp/skype_iplookup" ) client.send(Username) client.close() time.sleep(3) File = open(PathToLog,'rb').readlines() finds = [] for matches in File: finded = re.findall('.*noticing.{0}.0.*-r(.*?)-l(.*?:[0-9]*?)[^0-9].*'.format(Username), matches) if len(finded)>0: finds.append('%s - %s'%(finded[0][0],finded[0][1])) finds = list(set(finds)) for f in finds: print f else: print "Can't connect to unix socket /tmp/skype_iplookup" README.md Skype-iplookup Perform obscure ip lookup for online skype account. Can find local and remote ip address. Based on deobfuscated Skypekit runtime that write clear debug log. How to use? First of all you need cracked Skypekit. magnet:?xt=urn:btih:3da068082f6ec70be379d4046e4c77bc4578f751&dn=SkypeKit_sdk%2Bruntimes_370_412.zip&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftracker.ccc.de%3A80 This runtime also don't need certificate from Skype LTD to use it. You can made your own skype client/plugin and share sources without proprietary Skypekit. Run Skypekit ./skypekit-sdk_runtime-3.7.0/bin/linux-x86/RUNTIME_linux-x86-skypekit-voicertp-videortp_3.7.0 -x -m -d logname Put server.py in ./skypekit-sdk_runtime-3.7.0/examples/python/tutorial/ and run it python2.6.5 ./server.py username password Be aware to login with your main account! Edit path to log file in client.py and try it. https://github.com/zhovner/Skype-iplookup/ via: http://board.protecus.de/t42182.htm

super cool design-ul, Like

ctrl a/ctrl c/ ctrl v

Agentia Spatiala Americana, NASA, a anuntat recent deschiderea centrului sau de sustenabilitate. Numite Ames Research Center, cladirile sunt de fapt primele avanposturi lunare construite vreodata. Constructiile sunt in Moffett Field, Canada, SUA si au castigat de curand certificarea Platinum LEED - cea mai inalta in materie de constructii prietenoase cu mediul, functionale si locuibile. Directorul Centrului de Cercetare Ames, Pete Worden, a descris acest centru ca "prima cladire de pe Luna, construita pe Pamant". Asadar asa vor arata bazele lunare, daca vor fi construite vreodata pe suprafata satelitului nostru natural. Tehnologia din aceste cladiri este una care apartine maidegraba viitorului, fiind similara cu cea de pe Statia Orbitala Internationala. Inclusiv sistemele de reciclare a apei sunt prezente, asta ducand la economii de 90% in privinta consumului de apa. Peretii cladirii sunt incalziti prin conducte speciale cu apa termala, iar energia consumata provine de la panourile solare in care este "invelit" centrul. Practic, aceasta constructie genereaza mai multa energie decat consuma, iar excesul este stocat. Image: Aerial of Sustainability Base Image credit: NASA/Eric James http://www.nasa.gov/centers/ames/images/content/637289main_ACD10-0037-293.jpg http://www.nasa.gov/centers/ames/images/content/637291main_ACD10-0037-191.jpg In Sustainability Base, computational fluid dynamics (CFD) is used to simulate environmental flows in- and outside the building. Above figure shows a CFD simulation of NASA Ames, where surfaces are colored by Mach number. The new building is in the foreground Image credit: NASA Ames NAS The new facility has embedded repurposed NASA technologies, including NASA’s advanced computational fluid dynamic (CFD) tools. Above image shows CFD flows of NASA Ames, where surfaces are colored by pressure. The new building is in the background. Image credit: NASA Ames NAS scr Asa arata primele baze lunare construite de NASA. "Suntem gata sa ne mutam". FOTO - Yahoo! ?tiri România scr NASA - Digital Press Kit - NASA Ames Sustainability Base

Mul?umesc

Error 404 - page not found

Description This is a very simple way to build yourself a small scale SMTP to SMS gateway, to allow you to send emails to your mobile phone. Requirements Old mobile phone with a pre-paid phone card, so you won't end up with a nasty bill. http://www.e-things.org/smtp2sms/images/mobile_phone.png Data cable http://www.e-things.org/smtp2sms/images/phone_cable.png Phone charger http://www.e-things.org/smtp2sms/images/phone_charger.png Linux PC (Pentium 120Mhz with 32MB RAM) http://www.e-things.org/smtp2sms/images/pc_486.png Gnokii gnokii.org - Home Installation Connect your phone to COM1 (/dev/ttyS0) using your data cable. Download and install Gnokii. su - rpm -ivh ftp://ftp.gnokii.org/pub/gnokii/binaries/RedHat/gnokii-0.4.3-1.i386.rpm rpm -ql gnokii # List files more /usr/share/doc/gnokii-0.4.3/COPYING more /usr/share/doc/gnokii-0.4.3/CREDITS more /usr/share/doc/gnokii-0.4.3/README cp /usr/share/doc/gnokii-0.4.3/gnokiirc ~/.gnokiirc vi ~/.gnokiirc # set "model = " to suite your phone # set "connection = " to suite your cable # in my case I set # "model = 7110" # "connection = dau9p" # and had to comment out "require_dcd = 1" # Now test that gnokii can find your phone gnokii --monitor # send yourself an SMS echo "Test SMS message" | gnokii --sendsms [your mobile number] Example POP3 to SMS Perl script #!/usr/bin/perl use Net::POP3; my $mail_server="mailserver"; my $username="username"; my $password="password"; my $phoneNumber="phonenumber"; my $gnokii = "|/usr/bin/gnokii --sendsms $phoneNumber"; my $pop = Net::POP3->new($mail_server) or die "Can't open connection to $mail_server : $!\n"; defined ($pop->login($username, $password)) or die "Can't authenticate: $!\n"; $messages = $pop->list or die "Can't get list of undeleted messages: $!\n"; foreach my $msgid (keys %$messages) { my $email = $pop->get($msgid); unless (defined $email) { warn "Couldn't fetch $msgid from server: $!\n"; next; } my $header=1; my $message = ""; # $message is a reference to an array of lines foreach (@$email) { if ($_ =~ /^\n/ && $header == 1) { $header = 0; } if ($header == 1 &&; /^From:\s/) { my ($from) = ($_ =~ /([\w\d\.-_]+@[\w\d\.-]+)/); $from =~ s/[\<\>]//g; $message .= "Frm $from\n"; } if ($header == 1 && /^Subject:\s/) { my ($subject) = ($_ =~ s/^Subject:/Sbj/g); $message .= "$_"; } if ($header == 0) { s/are/R/gi; s/you/U/gi; s/before/B4/gi; s/see\syou/CU/gi; # etc, etc. $message .= "$_"; } } # limit to SMS 160 char limit. $message = substr($message, 0, 160); # send this message open(GNOKII, $gnokii) or die "$0: Could not open $gnokii\n"; print GNOKII $message; close GNOKII; # mark message to be deleted at quit below $pop->delete($msgid); } $pop->quit($mail_server); exit 0; scr

ai pm

Japan's Ogaki Kyoritsu bank is preparing to roll out biometric ATMs that will allow users to access their accounts by scanning their hand, and entering their birthdate and PIN number. They will be the first machines that do not require cards. Customers at select locations of the bank will register their biometric data with their branch where it will be stored in conjunction with their numerical data. These will then authenticate a person's account. There are ATMs that make use of some level of biometrics — whether it is a scanning the unique patterns of a finger, palm or iris. The difference is these scans are used in conjunction with cards — you can't use one without the other. The addition of this combination of scans and cards were originally used to combat card skimming — where all the data is copied off a user's card. The scan was an extra safety measure. The move to the completely card-less system being trialed in Japan has a surprising origin. A large number of customers lost their cards and other forms of ID after the 2011 Tohoku earthquake — this new system would allow clients access to their accounts in emergency situations. It is just one of the many innovations the Japanese have created to ride out a catastrophe. Of course, it goes without saying that not having another card to fiddle around with would also be pretty convenient. Source

ai pm

Forum: Linkuri Postati aici doar linkurile despre securitate!

Passwords - SkullSecurity http://leetupload.com/dbindex2/index.php?dir=Word%20Lists/ http://rapidshare.com/files/305013757/dictionaries-vince213333.part01.rar http://rapidshare.com/files/305013804/dictionaries-vince213333.part02.rar http://rapidshare.com/files/305028222/dictionaries-vince213333.part03.rar http://rapidshare.com/files/90611743/purehates_word_list.part1.rar http://rapidshare.com/files/90620632/purehates_word_list.part2.rar http://rapidshare.com/files/90628318/purehates_word_list.part3.rar http://rapidshare.com/files/90636711/purehates_word_list.part4.rar http://rapidshare.com/files/90639703/purehates_word_list.part5.rar https://rstcenter.com/forum/50984-python-dictionary-file-maker-v0-2-a.rst

exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, reverse engineering. Nebula Nebula covers a variety of simple and intermediate challenges that cover Linux privilege escalation, common scripting language issues, and file system race conditions. Nebula is an ideal place to get started for people new to Linux exploitation. Protostar Protostar introduces basic memory corruption issues such as buffer overflows, format strings and heap exploitation under "old-style" Linux system that does not have any form of modern exploit mitigiation systems enabled. Protostar is the next progression from Nebula. Fusion Fusion continues the memory corruption, format strings and heap exploitation but this time focusing on more advanced scenarios and modern protection systems. Fusion is the place to start if you are familiar with Linux exploitation and wish to learn more about exploitation prevention systems. scr

a mai fost https://rstcenter.com/forum/50575-os.rst

fc.tape — rotate css-sprites like cinema tape! Download v0.1 10 kb fc.tape — jQuery widget for sprite animations. For the widget to work you need: jQuery (1.6+), jQuery UI (1.8+) Core and Widget, and certainly a sprite with animation frames. fc.tape — rotate css-sprites like cinema tape! scr

daca apeleaza 333 va observa ca nu a primit

Comenzi USA sunt de incredere, trimite-le linkul si codul produsului, folosind pagina CONTACT, pentru a afla comisionul.

Today, we introduce a new unit to Code Year: HTML and CSS. You'll learn how to build and customize webpages, and eventually combine this with your JavaScript knowledge to add interactivity and animation to websites. Code Year » Week 13: Build a Webpage Code Year: Week 13: Build a Webpage | Codecademy via mail

“GooDork is for the few people who enjoy being creative about hacking/information gathering!” Some of you may have heard about Google Dorking/Hacking and even fewer have heard about GooDork.py a new designed to super charge you’re google dorking, and can even be used as front end for sqlmap (mass pwnage!) if you’re bash scripting is good enough! GooDork? Very simply put GooDork is a python script that allows you to perform Google Search queries from the comfort of your command line (Bleach fans, you can think of this as a Shikai). The real power of GooDork lies in its ability to let you run regular expressions on the attributes of the results of a Google Search (BANKAI!). Let me rephrase that, you run a query, this query will return a couple of results (URLs), these results will be web pages (or rather URLs to web pages), you then have the ability to run regular expressions on these web pages and be returned a list of results containing links to only those pages that satisfied your regular expression(s). So whats these regular expression stuff? Before you can come to truly appreciate the power of GooDork, you need to master regular expressions! Regular expressions can be thought of as little programs that help you specify how a string should be matched. They are expressions that detail the structure of a string. For instance, we can write a regex that will match all strings with a given range of characters in them, or one that matches strings with only a specific repetition of chars. These little buggers are incredibly powerful! If you wanna read more about them check out the links at the end of the post Vulnerability Scanning: Okay so how do use GooDork to find vulnerabilities? Actually quite easily! It just takes a bit of practice. I’m actually gonna show you what I personally use GooDork for. If we are to do vulnerability scanning with GooDork, we need to make sure we know what to look for, in this example I’ll show you how do find a specific SQL injection vulnerability in a CMS. Basically what ill be showing you is how I fingerprint CMSs (learn to recognize them) and then we will write a regex for GooDork that will make sure to find links to only the vulnerable web applications. So we gonna look for web pages with the MediaSolusi SQLi (MediaSolusi - SQL Injection Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode) i know its quite random, but I need to show you guys how to use GooDork properly, as an information gathering tool! So lets get started, our aim is to find out the few details that “tag” or mark all these vulnerable web pages, over here half the job is done by knowing that if they are running the mentioned CMS then theres a good chance that the web page is vulnerable at least in the way described. The report will have you believe that the best way to find these vulnerable servers is by Dorking: inurl:"/products/category/?id=" nm=" intext:"All rights reserved. - By Media Kreasi" But I never settle for just a google dork, there are details that a Google dork cannot specify, this is why I make use of regex to hunt vulnerabilities in GooDork so lets see what we can find out, I start with this command GooDork starting up ./GooDork.py intext:%22All%20rights%20reserved.%20-%20By%20Media%20Kreasi%22 -a[\\w]* I’ve urlencoded the ” and space chars, to make it appear as a single argument to python. the first argument to the script is the dork I want to run, the one quoted above using the “intext:” directive, I choose not to use the inurl, because Google blows a gasket, if you use it in general Im not interested in the known vulnerabilities, I’m interested in fingerprinting the CMS The second argument is a lil hack I came up with, -a is the argument to specify regex to search for in the anchor tag of the pages, the regex I give it matches any alphanumeric character, which will cause GooDork to print out all the anchors on all the pages / you should spend some time checking out the anchors, you might find some interesting stuff, for instance what i found is in the screen shot: GooDork loot The vulnerability report above details that we find it based on URL value, and that the script in the category sub directory is the vulnerable, I bet the script in the product subdirectory is as well. So what we established here as well is that the anchors of vulnerable CMS contain hrefs like the ones in the screen shot. So our next task will be to find all the pages with anchor tags like the ones above. Oh wait heres something interesting i found when i ran this dork as well authd?IDKEY= lols you’ve gotta be insane to put that in an anchor! Anyway back to the hunt! We wanna find specific URLs in a pages anchor tags , one of the example URLS looks as follows: PT. Duta Plastik Industri - Plastic Forming - Plastik Kemasan - Kemasan Plastik We need to write a regex that matches every part of the string. Basically the string consits of a protocol spec,domain and a query-string. I skipped the “http://” part of the regex purely because I was lazy lols! But the regex I came up with was: “([\w]+)\.([\w]+)\.([\w]+)/([\w_-]|/)*\?([\w_-].*?)(=|%3D)([\d].*?)” I know it looks ascii art that grew up next to a nuclear power plant, but if you start trying to build your won regexes you’ll see how easy they are to use! I’ll break down that regex, this what everything is there for: ([\w]+) — matches the first part of the domain \. — matches a dot ([\w]+) — matches the second part of the domain \. — another dot ([\w]+) — the final part of the domain / — the slash demarcating the path ([\w_-]|/)* — matches the first work after the path \? — the query delimiter ([\w_-].*?) — the keyword (=|%3D) — an = sign or its urlencoding ([\d].*?) — an argument for the keyword, im betting on only decimal data here! Oh I should have used number instead of bullets here, but just do you know (if you don’t), order does matter!! This regex is pretty generic, but i did build it straight from one of the sample URLs to make sure it works, at returns exactly what i want, here’s me building the regex Building a regex There is something you need to remember when running a regex, and thats escaping properly, remeber that you will be supplying your regex via the command line. you will need to escape somethings for bash and somethings for regex, the things you escape for regexes sake! for instance notice in the following screen shot how i escape the parenthesis and | chars so bash doesn’t interpret them but them! You also need to wary of the \w special chars because of the \ in them, bash will assume you are escaping the “w” with the “\” so to make sure it doesn’t escape the w we need to escape the escape character its self like this: “\\w”, the first \ protects the second \ Running the dork And the results? We actually get only sites vulnerable to the SQL injection Proofs in the pudding GooDork: https://github.com/k3170makan/GooDork <— Download Keith (k3170) Makan: GooDork : Super Charging your Google Hacking Regular expressions: 7.2. re — Regular expression operations — Python v2.7.2 documentation Regular expression - Wikipedia, the free encyclopedia 8 Regular Expressions You Should Know | Nettuts+ Scr: GooDork.py as a Vulnerability Scanner | The ProjectX Blog – Information Security Redefined

CaptchaTrader - The most affordable CAPTCHA bypass service you'll find This method is: 95.9% accurate(last time I checked). This program uses the site captchatrader.com and you'll need an account there. import urllib, urllib2, sys if len(sys.argv )<2: sys.exit("the first argument should be the captcha file") url = "http://api.captchatrader.com/submit" api_key = "API_KEY" passwd = "PASSWORD" user = "USERNAME" img = base64.b64encode(open(sys.argv[1]).read()) values = {'api_key' : api_key,'password' : passwd,'username' : user, 'value':img} data = urllib.urlencode(values) req = urllib2.Request(url, data) response = urllib2.urlopen(req) the_page = response.read().split(",") the_page = the_page.replace("\"", "") the_page = the_page.replace("]", "") print the_page[1] Just change the variables the top to your credentials then run it using these arguments: python captcha.py '/image/location/image.jpg' Solve any Captcha