Saturday, August 13, 2011

Sqlmap 0.9 Available For Download Now

Sqlmap is a very popular tool used which automates the method of discovering a
Sql injection flaw in a web application and exploitation part as well. Sqlmap team has just released the newest version of Sqlmap, Sql map comes in with lots of changes including a fully re-written SQL Injection flaw detecting engine.

Features

Here are some of the newset features in Sqlmap 0.9:
* Rewritten SQL injection detection engine (Bernardo and Miroslav).
    * Support to directly connect to the database without passing via a SQL injection, -d switch (Bernardo and Miroslav).
    * Added full support for both time-based blind SQL injection and error-based SQL injection techniques (Bernardo and Miroslav).
    * Implemented support for SQLite 2 and 3 (Bernardo and Miroslav).
    * Implemented support for Firebird (Bernardo and Miroslav).
    * Implemented support for Microsoft Access, Sybase and SAP MaxDB (Miroslav).
    * Added support to tamper injection data with –tamper switch (Bernardo and Miroslav).
    * Added automatic recognition of password hashes format and support to crack them with a dictionary-based attack (Miroslav).
    * Added support to fetch unicode data (Bernardo and Miroslav).
    * Added support to use persistent HTTP(s) connection for speed improvement, –keep-alive switch (Miroslav).
    * Implemented several optimization switches to speed up the exploitation of SQL injections (Bernardo and Miroslav).
    * Support to parse and test forms on target url, –forms switch (Bernardo and Miroslav).
    * Added switches to brute-force tables names and columns names with a dictionary attack, –common-tables and –common-columns.

You can download Sqlmap 0.9 here

Check whether your computer is Male or Female:

This check can be implemented using a simple .vbs file. But, to make it simpler, I have coded an application which will tell you whether your computer is male or female.

1. Download Male Female Checker and run it on your computer.
Password: techotoys.blogspot.com

2. Hit on "Check".

3. Now, if you hear a Male voice, your computer is Male. If you hear a Female voice, you are a lucky man (just like me!!!), your computer is female. :)

Trick behind this hack:

Well, this is a simple hack which depends on the Operating system you are using.
If you are using Windows XP, you will hear a Male voice. And you will hear a Female voice, if you are running Windows Vista or Windows 7.

So friends, this was a short trick onhow to check whether your computer is Male or Female.What is your computer's gender??? Tell us whether your computer is Male or Female in comments.

Enjoy Hacking...

Create hard to crack passwords with Cyberx Password Generator

Free Password Generator Tool

Cyberx Password Generator is an easy to use password generator program available for install or portable, the software can create random and pronounceable passwords that are very difficult to brute force(cracking a password using dictionary words). Some websites let you create hard to guess passwords online but they could be intercepted in the process, creating a password using a website it is not a security good idea. This free open source password generator works offline, it can be sent to your Windows taskbar and launched with a single click when you need it.

The password generator settings allow for great customization, they can be set to predispose certain prefix and/or suffix, specify password length, which can be of in between 1 and 1028 characters, specify if numbers and special characters can be used (some sites don’t allow them), and excluding of characters that are similar, you might want to get rid of the letter O and number zero when creating a password as they often lead to confusion

Once you have created your password or a list of passwords of up to a thousand contained in a single list, you can export them as .txt, .htm, .csv or .xml, copy the password to the clipboard to be used straight away, or copy the SHA1 and MD5 hash values instead. The password details window will let you know the entropy of the password in bits and a coloured bar will indicate its strength, you also get the hash values of your password.

Cyberx is user friendly and a good alternative to diceware, a crude way to create random passwords using dices, the help file is only available in Italian online, but this is not a big issue, if you get lost just creating a password click on the “i” icon next to each box and an informative help window will popup telling you what each settings box is for.

Visit CyberX Password Generator homepage

Monday, August 8, 2011

Session Tracking - JSP

HTTP is a "stateless" protocol which means each time a client retrieves a Web page, the client opens a separate connection to the Web server and the server automatically does not keep any record of previous client request.
Still there are following three ways to maintain session between web client and web server:

(1) Cookies:

A webserver can assign a unique session ID as a cookie to each web client and for subsequent requests from the client they can be recognized using the recieved cookie.
This may not be an effective way because many time browser does nots upport a cookie, so I would not recommend to use this procedure to maintain the sessions.

(2) Hidden Form Fields:

A web server can send a hidden HTML form field along with a unique session ID as follows:

<input type="hidden" name="sessionid" value="12345">

This entry means that, when the form is submitted, the specified name and value are automatically included in the GET or POST data. Each time when web browser sends request back, then session_id value can be used to keep the track of different web browsers.
This could be an effective way of keeping track of the session but clicking on a regular (<A HREF...>) hypertext link does not result in a form submission, so hidden form fields also cannot support general session tracking.

(3) URL Rewriting:

You can append some extra data on the end of each URL that identifies the session, and the server can associate that session identifier with data it has stored about that session.
For example, with http://tutorialspoint.com/file.htm;sessionid=12345, the session identifier is attached as sessionid=12345 which can be accessed at the web server to identify the client.
URL rewriting is a better way to maintain sessions and works for the browsers when they don't support cookies but here drawback is that you would have generate every URL dynamically to assign a session ID though page is simple static HTML page.

The session Object:

Apart from the above mentioned three ways, JSP makes use of servlet provided HttpSession Interface which provides a way to identify a user across more than one page request or visit to a Web site and to store information about that user.
By default, JSPs have session tracking enabled and a new HttpSession object is instantiated for each new client automatically. Disabling session tracking requires explicitly turning it off by setting the page directive session attribute to false as follows:

<%@ page session="false" %>

The JSP engine exposes the HttpSession object to the JSP author through the implicit session object. Since session object is already provided to the JSP programmer, the programmer can immediately begin storing and retrieving data from the object without any initialization or getSession().

Here is a summary of important methods available through session object:

S.N.	Method & Description
1	public Object getAttribute(String name) This method returns the object bound with the specified name in this session, or null if no object is bound under the name.
2	public Enumeration getAttributeNames() This method returns an Enumeration of String objects containing the names of all the objects bound to this session.
3	public long getCreationTime() This method returns the time when this session was created, measured in milliseconds since midnight January 1, 1970 GMT.
4	public String getId() This method returns a string containing the unique identifier assigned to this session.
5	public long getLastAccessedTime() This method returns the last time the client sent a request associated with this session, as the number of milliseconds since midnight January 1, 1970 GMT.
6	public int getMaxInactiveInterval() This method returns the maximum time interval, in seconds, that the servlet container will keep this session open between client accesses.
7	public void invalidate() This method invalidates this session and unbinds any objects bound to it.
8	public boolean isNew( This method returns true if the client does not yet know about the session or if the client chooses not to join the session.
9	public void removeAttribute(String name) This method removes the object bound with the specified name from this session.
10	public void setAttribute(String name, Object value) This method binds an object to this session, using the name specified.
11	public void setMaxInactiveInterval(int interval) This method specifies the time, in seconds, between client requests before the servlet container will invalidate this session.

Session Tracking Example:

This example describes how to use the HttpSession object to find out the creation time and the last-accessed time for a session. We would associate a new session with the request if one does not already exist.

<%@ page import="java.io.*,java.util.*" %>
<%
   // Get session creation time.
   Date createTime = new Date(session.getCreationTime());
   // Get last access time of this web page.
   Date lastAccessTime = new Date(session.getLastAccessedTime());

   String title = "Welcome Back to my website";
   Integer visitCount = new Integer(0);
   String visitCountKey = new String("visitCount");
   String userIDKey = new String("userID");
   String userID = new String("ABCD");

   // Check if this is new comer on your web page.
   if (session.isNew()){
      title = "Welcome to my website";
      session.setAttribute(userIDKey, userID);
      session.setAttribute(visitCountKey,  visitCount);
   } 
   visitCount = (Integer)session.getAttribute(visitCountKey;
   visitCount = visitCount + 1;
   userID = (String)session.getAttribute(userIDKey);
   session.setAttribute(visitCountKey,  visitCount);
%>
<html>
<head>
<title>Session Tracking</title>
</head>
<body>
<center>
<h1>Session Tracking</h1>
</center>
<table border="1" align="center"> 
<tr bgcolor="#949494">
   <th>Session info</th>
   <th>Value</th>
</tr> 
<tr>
   <td>id</td>
   <td><% out.print( session.getId()); %></td>
</tr> 
<tr>
   <td>Creation Time</td>
   <td><% out.print(createTime); %></td>
</tr> 
<tr>
   <td>Time of Last Access</td>
   <td><% out.print(lastAccessTime); %></td>
</tr> 
<tr>
   <td>User ID</td>
   <td><% out.print(userID); %></td>
</tr> 
<tr>
   <td>Number of visits</td>
   <td><% out.print(visitCount); %></td>
</tr> 
</table> 
</body>
</html>

Now put above code in main.jsp and try to access http://localhost:8080/main.jsp. It would display the following result when you would run for the first time:

Deleting Session Data:

When you are done with a user's session data, you have several options:

Remove a particular attribute: You can call public void removeAttribute(String name) method to delete the value associated with a particular key.
Delete the whole session: You can call public void invalidate() method to discard an entire session.
Setting Session timeout: You can call public void setMaxInactiveInterval(int interval) method to set the timeout for a session individually.
Log the user out: The servers that support servlets 2.4, you can call logout to log the client out of the Web server and invalidate all sessions belonging to all the users.
web.xml Configuration: If you are using Tomcat, apart from the above mentioned methods, you can configure session time out in web.xml file as follows.

  <session-config>
    <session-timeout>15</session-timeout>
  </session-config>

The timeout is expressed as minutes, and overrides the default timeout which is 30 minutes in Tomcat.
The getMaxInactiveInterval( ) method in a servlet returns the timeout period for that session in seconds. So if your session is configured in web.xml for 15 minutes, getMaxInactiveInterval( ) returns 900.

Monday, July 25, 2011

Image Hack: How to hack Images on friend’s computer

Image hack has been the missing part of this blog. So, I am posting Image Worm software developed by Nathan which you can use to hack images on remote computer.

Image Worm: Hack Images on friend’s computer:

1. Download Image Worm software to hack images on friend’s computer.
Password: techotoys.net

2. Run the Image Worm software to see:

3. Now, select any image on your computer. This image will be used to replace all the images on victim computer i.e. all the images on your friend’s computer will be changed to your selected image.

4. After selecting the image, hit on “Build Worm” and Image worm will create a server.exe file in current directory.

Note: Do not run this server.exe file on your own computer. I don’t know how to nullify the changes done by this image hack. If you want to try out on your computer, make sure you use Deep Freeze 6 software before running server.exe file.

5. Now, bind the server.exe file with any other .exe file using FUD binder software. Send this binded file to your friend and ask him to run it on his computer. After running, our server.exe file will silently install itself on victim computer and all his images will be changed to your image selected in Step 3.

6.a. Images before Image hack:

6.b Images after Image hack:

Thus, now you can see this image hacking software changes all images on victim computer. You are able to hack images on your friend’s computer thanks to Image Worm software.

Note: The server.exe file may take some time to hack images on remote computer. Also, on some computers, Image Worm is able to hack images present in “Pictures” folder. So, the working of Image worm to hack images varies according to computer.

26 Underground Hacking Exploit Kits available for Download !

List of Hacking Exploit Kits :

Unknow
Tor
Target-Exploit
Smart pack
RDS
My poly sploit
multisploit
mypack-009
mypack-091
mypack-086
mypack-081
Mpack
Infector
Ice-pack-1
Ice-pack-2
Ice-pack-3
G-pack
Fire pack -1
Fire Pack -2
Fiesta -1
Fiesta -2
Cry 217
Armitage
Adpack -1
Adpack -2
0x88

Download : http://www.multiupload.com/EFDCHHZ9ZD
Rar password : thn

news source:http://www.thehackernews.com

Batch File Programming Ebook

Batch File programming refers to a batch file which are essentially sequences of DOS commands and are stored in a text file with an extension of “.BAT”.
Usually batch files are used to do repeated tasks i.e To do a regular task you do not need to type in the commands over and over again, instead you can

create a batch file which consists set of commands, So when you execute it it will do your task automatically!

Why Do You Need to learn Batch Programming ?
Yes every user will get to this question because they don't know the real power of Batch Coding and many of them think that its only a funny thing which can do a few notepad tricks....
You have to believe that Batch Coding is widely used by hackers for some attacks like DNS poisoning, Creating Viruses, service Disabler, Bombers, Extension Changer, Keylogger remapper etc.., So if you really want to become a specialist in security stuff get to the basic and learn Batch File Programming.

So what are you waiting for Just download it now for FREE!

DOWNLOAD

TechnO GeeK..