WELCOME GUEST ENJOY YOUR STAY HERE...

TELL A FRIEND ABOUT US.. Share/Save/Bookmark
Showing posts with label tutorial. Show all posts
Showing posts with label tutorial. Show all posts

Tuesday, August 25, 2009

Reduce Windows Animation Speed in Windows Vista

Windows Vista comes with several new enhancements, however for these added features you have to pay the price of slow processing speed for even the fastest of computers. The main reason is the visual upgrades, which though looks good can drastically reduce the performance of your system. If your system can not take the load of Window Vista and you still want to use it for considerable performance, you may tweak Windows Vista for certain optimizations. For example; when you minimize, maximize or close any windows/applications, the animation speed to perform these tasks is a default setting which is not under the control of the user. Never the less, you can make this transition run slower while holding the SHIFT key button; after performing the following registry hack as shown below: 1. Click on the Start button and type regedit in the Start Search field, then press enter. 2. If User Account Control prompts you for consent, click on Continue. 3. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM 4. In the right hand pane, right click on an empty space and from the context menu that appears choose “New > DWORD (32-bit) Value”. 5. Give the new DWORD (32-bit) Value a name of AnimationsShiftKey. 6. Double click on the “AnimationsShiftKey” value and give it a value of 1. 7. Close the Registry Editor and log off of Windows and log back in for this to take effect. If you have successfully edited the registry, you will notice that the animation speed has become slower when compared to previous without holding the SHIFT key. Enjoy!

Automated scp on Linux

Scenario You would like to automate the export of SQL dump files from one Linux server to another using scp. These dump files are to be generated and exported once every two weeks. You also wish to archive these dump files on the source server. So let’s say the servers and directories are as follows: Source Hostname: perak
Username: nazham
Dump file directory: /home/nazham/data_export/current
Archive directory: /home/nazham/data_export/archive/yyyymmdd Target Hostname: selangor
Username: romantika
Target directory: /home/romantika/data_import Passwordless scp First you need to set it up so that you don’t need to enter a password for scp. The overall picture is as follows:
At the source server, generate a pair of public and private keys [1] using RSA.
Store the private key in a specific place in the source server.
Store the public key in a specific place in the destination server.
And that’s it! Now you’ll no longer be prompted for a password when using scp.
One-off steps # login to perak with username nazham
ssh-keygen -t rsa
# choose default location, no passphrase - just press enter at all prompts
scp ~/.ssh/id_rsa.pub romantika@selangor:/home/romantika/.ssh/authorized_keys
# I'm assuming the file authorized_keys does not exist!
# otherwise, you need to append the contents of id_rsa.pub to it.
crontab -e
# add the following:
# 1 0 1,15 * * nazham /home/nazham/run_data_export >> /dev/null 2>&1
# which means, run at 12:01 am every 1st and 15th of the month
mkdir ~/data_export
mkdir ~/data_export/current
mkdir ~/data_export/archive The run_data_export script todaysDate=`date +%Y%m%d`
oldDate=`date -d '1 year ago' +%Y%m%d`
exportDir=data_export
mysqldump -u username -ppassword -r ~/$exportDir/current/filename dbname tablenames
echo $todaysDate > ~/$exportDir/current/importdate.txt
scp ~/$exportDir/current/* romantika@selangor:/home/romantika/data_import
mkdir ~/$exportDir/archive/$todaysDate
rm ~/$exportDir/current/importdate.txt
mv ~/$exportDir/current/* ~/$exportDir/archive/$todaysDate
if [ -d ~/$exportDir/archive/$oldDate ]; then rm -r ~/$exportDir/archive/$oldDate; fi The Linux date command I’m very impressed by the Linux date command. This might be old news to some, but the fact that I’m able to say date -d '1 year ago' or date -d '30 days ago' completely blows the mind. Notes [1] From Pass on Passwords with scp: “If you’re not familiar with public key cryptography, here’s the 15-second explanation. In public key cryptography, you generate a pair of mathematically related keys, one public and one private. You then give your public key to anyone and everyone in the world, but you never ever give out your private key. The magic is in the mathematical makeup of the keys; anyone with your public key can use it to encrypt a message, but only you can decrypt it with your private key.”

Friday, August 14, 2009

MySQL Injection Tutorial Described

TABLE OF CONTENT:
#INTRO
#WHAT IS DATABASE?
#WHAT IS SQL INJECTION?
#BYPASSING LOGINS
#ACCESSING SECRET DATA
#Checking for vulnerability
#Find the number of columns
#Addressing vulnerable part
#Finding MySQL version
#MySQL 5 or above injection
#MySQL 4 injection
#MODIFYING SITE CONTENT
#SHUTTING DOWN THE MySQL SERVER
#LOADFILE
#MySQL ROOT
#MAJOR MySQL COMMANDS
#FINALIZING THE INJECTION TUTORIAL
#REFERENCES
#SECURITY SITES
#WARGAMEZ SITES
#GREETZ AND SHOUTZ
#THE END
INTRO!!
In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various php & mysql functions in various sites which will help you a lot... lets begin our walkthrough of SQL injection.
WHAT IS DATABASE?
Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either bcoz of their vulnerability or bcoz of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc.
WHAT IS SQL INJECTION?
SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location.
In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough..
CTD...
BYPASSING LOGINS
Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scriptblock is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection??
Let's see an example, where the username admin with the password pass123 can login to the site. Suppose, the SQL query for this is carried out as below:
SELECT USER from database WHERE username='admin' AND password='pass123'
And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scriptblock is not sanitized. This opens a door for the hackers to gain illegal access to the site.
In this example, the attacker can enter the following user data in the login form:
username: a or 1 =1--
password:blank
So, this would make our query as:
SELECT USER from database WHERE username='a' or 1 =1-- AND password=''
Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.
So our above query becomes:
SELECT USER from database WHERE username='a' or 1 =1
Now this query evaluates true even if there is no user called 'a' bcoz 1 =1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.
There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.
Few such combinations are:
username:' or 1 ='1 password:' or 1 ='1
username:' or '1 '='1 ' password:' or '1 '='1'
username:or 1 =1 password:or 1 =1
and there are many more cheat sheets. Just google. In fact, you can create your own such combination to bypass logins..
That's all about bypassing logins.
CTD...

ACCESSING SECRET DATA
SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections.
Sub-section 1 :
Checking for vulnerability
Suppose, u got a site:
http://www.site.com/article.ph p?id=5
Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned.
So, it is:
www.site.com/article.php?id=5'
Now if the site is not vulnerable, it filters and the page loads normally.
But, if it doesn't filter the query string, it would give the error something like below:
"MySQL Syntax Error By '5 '' In Article.php on line 15."
or
error that says us to check the correct MySQL version or MySQL Fetch error or sometimes just blank page. The error may be in any form. So it makes us sure that the site is vulnerable.
Also just using ' may not be the sure test; so you may try different things like:
www.site.com/article.php?id=5 union select 1--
If you get error with this, you again come to know that its vulnerable... Just try different things..
Read part 2 to continue...

Sunday, August 2, 2009

15 Top Secrets of Windows XP (Tutorial)

1. Useful key shortcuts available:
- Windows key + D - shows the desktop
- Windows key + M - minimizes all open windows
- Windows key + Shift + M - maximizes all open windows
- Windows key + E - Runs Windows Explorer
- Windows key + R - shows the RUN dialog
- Windows key + F - shows Search window
- Windows key + Break - shows System Properties box
- Windows key + TAB - Go through taskbar applications
- Windows key + PAUSE Display the System Properties dialog box
- Windows key + U Open Utility Manager
- ALT + TAB - Cycle through opened applications
- Hold down CTRL while dragging an item to Copy it
- CTRL + ESC Display the Start menu
- ALT + ENTER View the properties for the selected item
- F4 key Display the Address bar list in My Computer or
- NUM LOCK + Asterisk (*) Display all of the subfolders that are under the selected folder
2. Lock Windows to protect computer
You can lock Windows to protect the computer when leaving the station easily by creating a shortcut with the path rundll32 .exeuser32 .dll, LockWorkStation. The Windows key + L is also a shortcut to this feature.
3. Edit sysoc.inf to list all software
To show all software that can be removed from your computer (including protected Windows services), you can manually edit (using notepad for example) the sysoc.inf file located in Windows\inf\. Just remove the word hide next to the software pack.
*Note* - use this at your own risk. Removing critical components of the system will make Windows instable.
4 . Windows XP comes with IPv4 and IPv6
Windows XP comes both IPv4 and IPv6 support. To enable IPv6 , you can install the protocols needed with the command "ipv6 install" in the command-prompt. Then type ipv6 /? to see the options. The installation will not remove the IPv4 protocols so your current configuration will still work.
5. Access Task Manager with shortcut
To access the Task Manager easier, you can make a shortcut that points to %windir%\system32\taskmgr.e xe.
6. Stop treating ZIP files like Folders
If you don't want your Windows XP to treat ZIP files like folders, you can disable this component by running regsvr32 /u zipfldr.dll at the command prompt or Run dialog. If you start missing it, you can enable it by typing regsvr32 zipfldr.dll.
7. Run program as diffrent user
You can run a program as a different user. Right click an application and select Run As command.
8. Switch users leaving applications opened
You can switch users leaving the applications opened too (*NOTE* use this only when needed since it could lead to system instability).
Go to Task Manager - processes and end the process explorer.exe. This will end only your session and not all applications. Then go to Applications tab, click New task and type runas /user:domainname\username explorer.exe. A password prompt will appear to login to the desired username. The user's session will start, with all your previously applications running.
I recommend to open first a command-line prompt and type runas /? to see all the options available.
9. Rename multiple files in Windows at once
Rename multiple files in Windows at once. Select them all, right click and select Rename. Enter the desired name. They will be renamed using what you specified, with a number in brackets to distinguish them.
10. Task kill feature in Windows
Windows has a task kill feature similar to Linux. Go to a command prompt and run the command tasklist to see running processes with PID numbers. Then type tskill to end the specific task. This forces an instant closing of the task.
11. Edit features with GPEDIT.MSC
You can edit many features by running gpedit.msc. You can add log on/log off scripts here and many features.
12. Edit accounts in the command prompt
You can edit accounts by running "control userpasswords2" at the command prompt.
13. Use systeminfo.exe to see System Information
You can use the systeminfo.exe command in the command prompt to see System Information, including all Windows updates and hotfixes.
14. Disable system services for maximum performance
There are system services that you can disable to free up the system's load. To access the interface that permits you to make changes to system's services, type services.msc and the command prompt.
This is a list of services that are *usually* useless and can be safely disabled.
Alerter
Application Layer Gateway Service,
Application Management
Automatic Updates
Background Intelligent Transfer
Clipbook
Distributed Link Tracking Client
Distributed Transaction Coordinater
Error Reporting Service
Fast User Switching Compatibility
IMAPI CD-Burning
Indexing Service
IPSEC Services
Messenger
Net Logon
Net Meeting
Remote Desktop Sharing
Network DDE
Network DDE DSDM
Portable Media Serial Number
Remote Desktop Help Session Manager
Remote Registry
Secondary Logon
Smartcard
SSDP Discovery Service
Uninterruptible Power Supply
Universal Plug and Play Device Host
Upload Manager
Webclient
Wireless Zero Configuration
WMI Performance Adaptor
*NOTE*: Make sure you don't need them since some applications you're using could depend on them. If you make any application to fail by disabling any of the services, go back and enable it again.
15. Repair Windows XP by using the XP installation CD
If your system failes to start due to an error related to missing HAL.DLL, invalid Boot.ini or any other critical system boot files you can repair this by using the XP installation CD. ...

Follow Me... Stay Connected

MY STATS

Top Blogs

Learn hacking tips tricks earn online hints cheats

Blog Directory & Search engine

blogarama - the blog directory

BlogsByCategory.com

Technology Blogs - Blog Rankings

Visit blogadda.com to discover Indian blogs

Computers

Computers Blogs