Pugna

Run as Administrator

Pentru cei care nu stiu cu ce se mananca, noobs indeed

Raspund din respect fata de cei care vand SMTP-uri, pentru ca toti cauta SMTP-uri care trimit in inbox, dar putini stiu sa le foloseasca si clientii pleaca fara sa stie ca e vina lor. AMS ( Advanced Mail Sender ) seteaza un header de MS Outlook 6.0, iar filtrele Gmail / Yahoo te arunca imediat in spam. X-Mailer te mai arunca uneori in spam, in functie de ce urmeaza dupa el. Foloseste un sender care iti ofera posibilitatea sa modifici tu headerele. Daca hederele sunt in regula, ca sa nu intre in spam trebuie ca IP-ul SMTP-ului sa nu fie blacklisted. Aici il verifici pe vanzator daca sunt fresh sau nu. Nu in ultimul rand, dar rar intalnit, e ca SMTP-ul sa seteze el headere aiurea care sa te bage la spam. Aplicatie n-am care sa te ajute, dar sigur gasesti pe forum. Sper ca ti-a fost de folos informatia.

Pe *NIX da, dar pe Windows trebuie sa schimbi din registry, ori sa te duci la Adaptor Settings, iar ca sa salvez timp ma folosesc de aplicatia pe care am postat-o; are si un frontend dragut cu feature-uri pe care le mai folosesc de la caz la caz ... simplific lucrurile.

Technitium MAC Address Changer allows you to change Media Access Control (MAC) Address of your Network Interface Card (NIC) irrespective to your NIC manufacturer or its driver. It has a very simple user interface and provides ample information regarding each NIC in the machine. Every NIC has a MAC address hard coded in its circuit by the manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Network (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address. Technitium MAC Address Changer is a must tool in every security professionals tool box. Technitium MAC Address Changer is coded in Visual Basic 6.0. Technitium MAC Address Changer v5 Release 3 (FREEWARE) Nu exista retea la care sa ma conectez si sa nu imi schimb MAC-ul. Pe *NIX e mult mai simplu : ifconfig ethX hw ether 01:22:33:AA:c4:30

Am o placa Intel Centrino Wireless pe care n-am putut sa o adaptez la Backtrack. Am cautat indelung resurse pe net, dar fara rezultat. Sigur spui ca da roade ? Merci.

Daca tot e un hoax, publicati ce v-a oferit HellScream, sigur a avut ceva de castigat din manevra asta .

... apreciem totusi ca stii sa te identifici

Daca mai ai si propriul ircd hidden setat sa nu salveze log-uri care sa accepte SSL, folosindu-te sa te conectezi la el prin ce ai scris mai sus, esti no problem .

O mica adaugare: daca folosesti AMS te bagi singur in bulk.

Da, ai nevoie de unul extern.

Daca nu e opensource si P2P nu putem sa vorbim de "secure instant messenger".

steal.cpp compilat, sa-l numim steal.o, trebuie sa aiba si el drepturi +x ca sa poata executa la randul lui : system("chmod +x FQPV");

Nu sunt adept Travian, ori altor jocuri browser based care iti mananca fara rost timpul, dar de ce jucatorul ar alege unul privat in schimbul oficialului ?

Headerele si host-ul conteaza, nu cat de bine arata.

Posteaza sursa daca o ai. Nu o sa stea nimeni sa-ti auditeze binarul, sa vada daca mai trimite date si in alta parte.

somafm.com

Raporteaza-l la operatorul de telefonie ca sa-i tai avantul, dovezi ai. Inconstientii astia pot fi usor legati, n-au idee in ce se baga.

Societatile care presteaza audit de securitate nici nu se uita la pret. Noi putem sa ne multumim si cu Wireshark.

Google a pus la dispozitia utilizatorilor o solutie menita sa le permita blocarea procesului de colectare a datelor vizand propriile retele WiFi, avansand formula „_nomap” pentru atasare la numele retelei. Este vorba mai exact despre mentinerea statului de „incognito” in ceea ce priveste sistemele de geolocalizare, pastrand discretia asupra propriei retele WiFi chiar daca se afla in raza de actiune a acestora. Persoanele care nu doresc sa dezvaluie informatii privitoare la reteaua lor WiFi, impiedicand colectarea de catre Google a datelor menite sa imbunatateasca serviciile de geolocatie ale companiei, pot opta pentru modificarea denumirii propriei retele, adaugandu-i termenul „_nomap” dupa nume. Initiativa pare sa fie rezultatul unei presiuni tot mai mari exercitate de politica adoptata de UE in ceea ce priveste prelucrarea datelor sensibile ale utilizatorilor si colectarea de informatii fara acordul acestora. Solutia „_nomap” constituie in acest context, un semnal de colaborare din partea grupului Google cu autoritatile europene, in spiritul normativelor in vigoare, pentru respectarea dreptului la intimitate al utilizatorilor. Sursa: hit.ro

NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows. NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files. NetworkMiner collects data (such as forensic evidence) about hosts on the network rather than to collect data regarding the traffic on the network. The main user interface view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames). NetworkMiner has, since the first release in 2007, become popular tool among incident response teams as well as law enforcement. NetworkMiner is today used by companies and organizations all over the world. NETRESEC NetworkMiner - The Network Forensics Analysis Tool This video was made to show some of the extra features of NetworkMiner Professional, like Pcap-over-IP, running on OS X under Mono, Export results to CSV / Excel, Geo IP localization, Host coloring support, and Command line scripting support. http://www.irongeek.com/i.php?page=videos/networkminer-professional

HM Government's finest thwarted by web spider A simple Google search unlocks the supposedly secret completion page to GCHQ's code-cracking competition. The signals snooping agency launched a codebreaking competition this week, promoted via social networks, that aimed to find would be code breakers that conventional recruitment efforts might miss. The canyoucrackit.co.uk challenge involved making sense of a 16x10 grid of 8-bit hexadecimal numbers to figure out a password, and then developing a virtual machine to execute code that would lead to the final page. Puzzle-solvers had 10 days to crack the codes. However instead of solving this puzzle, which was not trivial to conquer, at least if some of the emails we've received are any guide, the completion page could be reached via a simple Google search. Oops. "All it takes to find the page is to use the site: command in Google, as the 'Can You Crack It?' webmaster seemingly didn't hide the success page from search engines," Graham Cluley of net security firm Sophos explains. Given the interest in the competition perhaps it was inevitable that someone would find some sort of side-channel to cheat the challenge, which doesn't mean that the exercise is now not worth participating in especially for those keen on puzzle-solving and base-16 crosswords. The canyoucrackit.co.uk website was set up in partnership with a recruitment agency and at arm's length from GCHQ itself. El Reg doubts anyone from the intelligence agency was involved in setting up the website, but we are unable to immediately confirm this on Friday afternoon. ® source: theregister.co.uk

Salut Aron, limba romana cum ti se pare ? Bun venit.

=========================== Indexed blind SQL injection =========================== :Author: gamma95 <gamma95 [at] gmail> and his minions Date: December 03, 2011 Time based blind SQL attack suffers from low bit/request ratio. Each request produces only one valuable bit of information. This paper describes a tweak that produces higher yield at the expense of longer runtime. Along the way, some issues and notes of applicability are also discussed. Background ++++++++++ Time based blind SQL injection attack is probably the most well-known technique in the planet. The method works by analyzing the time difference in various queries. Because query execution time is a side effect of a query, no visible output is required for this method to succeed. For example, a query could request that the DBMS to sleep for 10 seconds if the first character of the username is ``A``. Usually, time based technique go hand in hand with binary search. Instead of asking if the first character is ``1``, then ``2``, then ``3``, it could partition the possible values into two ranges (say from ``0`` to ``4`` and ``5`` to ``9``) and ask if the first character is less than ``5``. Depending on the result, it picks out the more likely range and repeats the process until there is only one possible value. This effectively puts a logarithmic bound on number of requests to the DBMS. In other words, each request gives us one bit of information. Increasing the usable bit/request ratio +++++++++++++++++++++++++++++++++++++++ Due to low bit/request ratio, an attack attempt usually leaves behind too many requests in access log. This is undesirable. A better approach could be to encode the correct value into query execution time itself. For example, if we know the value is a number from 0 to 9, we could ask DBMS to sleep for that many seconds straight. In this case, one request carries more than 3 bits of usable information. This is the principal idea behind our tweak. Indexed time based attack +++++++++++++++++++++++++ To encode more bits into the execution time, we must work with variable numeric delay values. Therefore, we need two things: + A measurable delay interval. Too short the interval and network latency could negatively affect our measurement. Too long the delay will also waste our time. + And its mapping to target values. A delay of one second could mean character ``A`` or it could also mean some other value, depending on the possible domain. These necessitate an array-like index search. Say, if our domain is ten (character) values from ``0`` to ``9``, then we can easily combine them into an array like shown below. :: 1 2 3 4 5 6 7 8 9 10 (index) | | | | | | | | | | v v v v v v v v v v +---+---+---+---+---+---+---+---+---+---+ | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | (value) +---+---+---+---+---+---+---+---+---+---+ Given a random character, we can tell in one request if it is in this set, and if it is, what specific character it actually is. The way to do that is by delaying query time by the index of the character. If the input character is not in the set, there will be no delay. If it is, its index is determinable from the sleep time. An example ++++++++++ Suppose we are trying to grab version information from a **MySQL** server. Possible characters include 0-9 and period. Observe the execution time. :: select sleep(find_in_set(mid(@@version, 1, 1), '0,1,2,3,4,5,6,7,8,9,.')); 1 row in set (6.04 sec) # index 6, value '5' select sleep(find_in_set(mid(@@version, 2, 1), '0,1,2,3,4,5,6,7,8,9,.')); 1 row in set (11.00 sec) # index 11, value '.' select sleep(find_in_set(mid(@@version, 3, 1), '0,1,2,3,4,5,6,7,8,9,.')); 1 row in set (2.00 sec) # index 2, value '1' ... Each request gives us exactly one character (not bit). Notes of applicability ++++++++++++++++++++++ Adjusting sleep time ==================== Faster sleep time is easily achievable by multiplying the index with some factor smaller than 1. For example, we can sleep half the time as before:: select sleep(0.5 * find_in_set(mid(@@version, 1, 1), '0,1,2,3,4,5,6,7,8,9,.')); 1 row in set (3.00 sec) # index 6, value '5' Similarly, longer sleep time can use factors greater than 1. Guarding against network latency ================================ Time based attack generally works best in a fast and reliable networked environment. Small jitters in latency could skew the measurements and affect end result. However, this technique we are describing here could be modified to support network latency. The idea is that since sleeping time is a calculated number, we could add to it a fixed amount of time for latency, or prepend some invalid characters (such as ``a`` when the domain is 0-9) in the domain set. :: select sleep(find_in_set(mid(@@version, 1, 1), 'a,a,a,a,0,1,2,3,4,5,6,7,8,9,.')); 1 row in set (10.00 sec) # index 10, value '5' We can also sprinkle invalid characters in between valid characters to manually adjust amount of sleeping time. Picking an acceptable domain ============================ The set of possible values should be carefully picked to match the value that one expects. Wide domain (more values) has a better chance of catching the input, but it requires a longer sleep time on average. Narrow domain (less values) has slimmer chance to catch the input, but it generally finishes faster on average. Some web frameworks enforce a maximum execution time. A query that takes more than, say, 30 seconds will be prime target for an early termination (and possibly logging). Therefore, picking out an acceptable domain is not only an optimization but sometimes a necessity. Using other functions ===================== ``find_in_set`` is only one of the string search functions that MySQL supports. One can also use other functions such as ``instr``, ``locate``, and ``position``. Sleeping in ``WHERE`` clause ============================ Most of the time, the injection point is in a ``WHERE`` clause. Because the ``WHERE`` clause is tested against all candidate rows, we better make sure that there is only **one** candidate. We can do that by making sure the table scan produces one row. Otherwise, our sleep measure will be multiplied up by the number of candidates. :: create table test (a int primary key, b char(16)); insert into test values(1, 'abcd'); insert into test values(2, 'zyxw'); select count( * ) from test; +----------+ | count( * ) | +----------+ | 2 | +----------+ # we have 2 rows in table test select * from test where sleep(locate(mid(@@version, 1, 1), '0123456789.')); Empty set (12.00 sec) # here we sleep for 12 seconds because all (2) rows are tested select * from test where a=1 and sleep(locate(mid(@@version, 1, 1), '0123456789.')); Empty set (6.00 sec) # here we sleep for 6 seconds because only one row is tested Conclusion ++++++++++ This paper described a small tweak to the well-known time based SQL injection technique. The principle behind the increase in bit/request ratio is encoding more information in the query execution time. This is done with index based array search functions such as ``find_in_set``. The desirably smaller number of requests comes at the expense of generally longer execution time. This paper also discussed about some technical concerns that one must pay close attention to when employing the technique. Minute aspects such as table scan, applicable value domain, network latency, and amount of sleep time are at the top list to watch out for. Acknowledgement +++++++++++++++ Thanks go to Nam Nguyen for his early review and support.

ThePirateBay Wants to Buy Its Own Country - Softpedia