Autostarting programs on login in Ubuntu [How To]

If you want to start any program in your ubuntu installation whenever you login then you can just create a symbolic link in a special folder located at ~/.config/autostart/(that is somewhere inside of your home folder). The process is pretty easy and most of the guys out there might have already understood what you have to do but still I am writing the process for those who might get stuck on the way.

I'll demonstrate, as an example, how to autostart skype at the login time. As stated earlier, all you have to do is create a symbolic link to skype executable file as below. The command is typed in terminal(gnome-terminal).

ln -s /usr/bin/skype ~/.config/autostart

Btw, to find the location of any executable in linux, you can use the which command like below:

which skype

I hope this helps. Thanks. :)

Read more...

How to get things for free in internet [Google dorks]

Well its been a few days I haven't posted. Today I have come with an interesting post that will help you get things for free in internet. Of course, it is not legal but it works in many cases but not always. And many of the results might be some craps.

Following are the list of the google dorks that will help you get some of the commercial softwares for free. Google dorks are the keyword phrases that can be searched with the google search engine.

intitle:"Thank You For Your Order" intext:Click Here to Download
intitle:"Thank You For Your Purchase" intext:Click Here to Download
inurl:/thankyou*.html intitle:Thank you for your order! intext:Click Here to Download
intitle:"Thank You For Your Order!" intext:download
inurl:thanks intext:"Thank You For Your Order!" "Click Here" filetype:html

The above dorks are just the examples. You can modify them and do some experiments on your own to search for specific domains, etc. I hope this is useful. Thanks :)

Read more...

How to fix the USB support in virtualbox

I installed virtualbox 4 after removing the OSE version and I tried to test the USB support. But I didn't find it working so I tried few things. And on diving to the internet, I figured out that I must be the member of the group "vboxusers" to be able to have USB support in my virtualbox.

Follow the steps as stated below:

1) Go to System->Administration->Users and groups. You'll see the screen like below:

2) From there, click on Manage groups and then select the vboxusers group and edit its property. Now in the properties window, check your username as marked for the group. The screenshot below would clarify you.

Alternatively this all could be achieved by a simple command as below(Here, we are adding the user "samar" to the group vboxusers):

samar@Techgaun:~$ sudo useradd -G vboxusers samar

In order to verify that everything went well, you could type in terminal:

samar@Techgaun:~$ grep vboxusers /etc/group

3) Now you will have to restart(or just logout from your account) and then re-login to your account. Now virtualbox will allow you to use USB devices. When your virtual machine is on, just go to Devices->USB devices and select the one that needs to be active.

I hope this helps you. :)


Read more...

Art of hacking 2 - spyd3rm4n's guide to hacking

Earlier I posted the spyd3rm4n's guide to hacking part 1 over HERE. This is the 2nd part of the guide. Enjoy the guide.

Part II

[0x01] Common_Knowledge
[0x02] How


Sub Common_Knowledge{
It is customary that a hacker know how to hack, but it is mandatory that a hacker know how to hide his/her ass.

You DO NOT want to get caught because:
A) I'm sure you don't want to pay that hefty fine.
B) I'm positive you don't want a criminal record.
C) You probably don't want to be put on probation.
D) You put everybody you have contacted on the internet within your past at risk of being caught.
E) You WILL be frowned upon as a terrible hacker. Everyone knows, you're dumb as shit if you get caught.
F) If you find any reasons why getting caught would be a good idea, please consider the following:
Go to the local gunshop.
Purchase a powerful weapon (remember, you don't want to screw this up.)
Purchase a small magazine.
Go home, place the clip into the weapon, take off the saftey and look into the barrel of the gun and email me back
the color that flashes inside the barrel when the trigger is pulled.
}

Sub How{
What are some ways you can hide your ass? Well, good question, but there are many answers.

I have to say, that the most common way for a person to hide their e-dentity is via a proxy.
Now, one problem with the proxies, is that anyone with common sense can find out your real IP. This is the start of Forensics.
The easiest way for a person to find your IP is the find the provider of the proxy, most like CDN (CoDeeN), seeing that they are
the largest proxy releasing company on the inet. Once they contact CoDeeN (who keep records of all IP's logged into their proxy
at all times), they can find your IP and with a simple whois, can come up with the location of you or your ISP. After that, it's just
a long talk between you and your ISP to find out your information. That's if there has been illegal activity and/or you caused some 
pretty hefty damage. ISP's can't release a persons information without a court order as that is an invasion of privacy. But there are
some loop holes in this system. I'm sure you have all read your ISP's fine print and Terms of Service correct? Well, it will most likely
contain something stating that hacking is illegal and that if caught, they can and will report you to the authorities etc.
Another reason is because of the easy PHP function, $_SERVER['HTTP_X_FORWARDED_FOR'] which can be used to grab your real
IP and/or block your attempt at viewing the site.

Another way of hiding your ass, which I suggest as a first part, because it is the easiest, is find a VPN. VPN stands for Virtual Private
Network. Large companies/businesses have these VPN's for their employees to operate on a local network (LAN) over WAN (Wide
Area Network). They will mask your IP with the IP that the VPN is setup on. I.E. My IP is 66.77.88.102 and the VPN IP is 24.12.21.64,
when I log into the VPN, my IP will become 24.12.21.64. This covers your IP over every protocol, it whoops Socks 4 and Socks 5 proxies
rearends. The one thing you have to worry about with a VPN, is that they too, if setup correctly, can log every IP that has used the VPN
at anytime of the day.

Now that the 2 most common ways of hiding your ip have been discussed. Let's not rule out some of the other ways. One being VNC tunneling.
This is the process of logging in to a remote administrative tool repeatedly on other servers.
Example:
Server 1 IP: 1.2.3.4
Server 2 IP: 1.2.3.5
Server 3 IP: 1.2.3.6

All servers have VNC running. I will then log into the VNC for Server 1, then I will use Server 1's VNC to log into Server 2, and repeat the process until
I am logged in on Server 3. This will hide my IP 3 times and make tracing it back even harder. But, once again, you've guessed it. It records everything.

Well, Since I'm getting pretty desperate here, why don't I go balls out?

I will hop on a VPN, then I will VNC tunnel into about 2 or 3 Servers, while logging into a VPN on each of those, then, finally, when I'm tunneled into
Server 3, I will put a VPN on, log into a Socks 4 proxy, put on a anonymous proxy, if I have to, even goto a well known web proxifying site that runs
a CGI or PHP built proxy to view the content needed. Now, picture yourself as that person who has to find your real IP. Yeah, it's gonna be a blast.
The only bad part about this is the fact that the more you log into, the slower and slower it will get. Best done on a high-speed line.

Finally, since this is a mini-book on hiding your ass, I might as well tell you that everything of anything on the internet is logged. Don't forget to clear them.
Example: SSH-
don't forget to rm -rf /var/logs*
}

- Credits : Kr3w of TheDefaced.

Read more...

Delete empty folders with Vanity Remover

So have you ever come to the situation when you have to delete several empty folders in your hard disks? If yes, it must have been some boring shit. But now, Vanity remover is here to rescue you.

Vanity remover is a simple tool to recursively delete the empty folders off your hard disk.

More information and downloads from the Official site

Read more...

Torrent 2 Text for bypassing .torrent filter by ISPs

I have just completed this pretty simple script to let you download the torrent files as text files. I wrote it because ISA server was actually blocking me to download the .torrent files so I quickly wrote this and now I am putting it online.

To use this little script, all you have to do is copy the link location of the .torrent file and paste in the textbox.

Torrent to text tool

Have fun :)

Read more...

Art of hacking 1 - spyd3rm4n's guide to hacking

This series of articles can be very useful for many beginners out there but after the thedefaced and darkmindz went down, I haven't really seen these articles anywhere else. So I thought to share this article over here. Its NOT written by me and I would like to provide the full credit to the original author as well.


Art of hacking [ 1 ] 

spyd3rm4n's guide to hacking

Part I

[0x01] Definition
[0x02] Method
[0x03] Side_Notes
[0x04] Credits

Sub Definition{
a : to write computer programs for enjoyment
b : to gain access to a computer illegally
}

Sub Method{
These are the boundaries that differentiate a hacker, from a cracker. A cracker will use the same methods of a hacker, but instead of leaving it at just that, they will take it one step beyond, and use the information gained to extort another person and/or cause damage.

Now that has been cleared up, I will just inform you of one of my most common method of hacking.

When I hack, it is a golden rule that I must know what I am hacking. If it's a website, I must know what language is it written in. If I do not, I will learn the language, or at least be able to read it and pick out human errors in the programming.

I usually start like this:
I will first search the website for vulnerable user-input fields. Something that interacts with the viewer. It should include fields that are POST and GET. I will test these fields for penetration. The most common fields vulnerable, are search forms. These can be vulnerable to almost any type of injection, HTML, JAVASCRIPT, or SQL. To test if a field is injectable with HTML, I will usually type "<h1>hello</h1>." If the page returns the word hello in big bold letters, I know it's vulnerable. I then will step it up to JAVASCRIPT. I will type "<script>alert(1)</script>", <script language="Javascript">alert(1)</script>m etc.." If the returned page contains an alert message printing the number 1, I know I can cross-site script it (XSS). SQL on the other hand has a number of pen-testing syntaxes. I usually type a single quote, if it returns SQL errors, I know its vulnerable to injection. If it doesn't, I will sometimes try different combinations of SQL attacks. I will try most commonly, and my favorite, a union injection. Syntax: '+union+select+1-- 
If that returns with any sort of SQL error, I then know I hit the jackpot. The most common error with union selections is "The UNION SELECT statement is missing the correct number of columns" or something of that sort. It means that you have to select more than one column. This can be the longest part of injecting. You then have to '+union+select+1,2-- each time, adding on another number separated by a comma until your UNION SELECT statement has no errors, and returns a value from that field. I will then look for the returned page for a number. If for example, lets say I did '+union+select+1,2,3,4,5,6--
and the page returns a series of pictures, and in the blue, there is just the number 6 on that page, I will then do '+union+select+1,2,3,4,5,table_name+from+information_schema.tables--
This will select the table name from the information schema, if its allowed. That's all I'm going to say about that for now. If you want to know more, you can learn up on your SQL.

Next, if I find the site is pretty secure, it is always important not to rule out other methods of intrusion. My 2nd and favorite method, is the capturing of the host. With a simple WHOIS lookup, I can find the host of their site. Now, if I pen-test their host and find a vulnerability, that is just as good as hacking their site because it allows for a way in. If all else fails, you can do a reverse IP lookup on the domain of the website. Take a look at all the other websites on that IP and pen-test their security. If you can get rights to upload on one of their sites, you can upload a PHP-Shell and work your way into their directory, viewing their files. If you want to take it further, you can go ahead and try to root the server. Rooting is pretty easy if you know what you're looking for/know any stack/buffer overflows for the OS. Most servers run linux, so it's best to look for overflows for that specific kernel version that contain "Local Root" in it. Other than that, there are so many ways of obtaining root. These include but are not limited to key-logging, phishing, and social engineering. That's pretty much the basis of one of my most common methods of hacking. If you would like to know more, well.. I'm sorry, but you're going to have to pick up the knowledge as you continue your career hacking.
}

Sub Side_Notes{
If you want to learn more, you can check out the mini-books on Hide My Ass, XSS Injection, SQL Injection, Navigating towards root in a PHP Shell, and Stack Overflows in a nuttshell.
}

Sub Credits{
I'm sure you're all wondering who I am going to credit in this. The thing is that over the years, I have encountered many talented hackers. Too many to name in fact. But, there is one person I have to give credit to for being probably one of the most talented hackers I have "read" from. This person is unknown, and I'm sure many of you have read some of their docs. This person is the author of the ZFO (Zero For Owned) series. If you haven't read them, I highly suggest you do a google dork for Zeroforowned. Not to sure on how many of them are still public/around. (You'll notice the style of documentation similarity that I have put in this document, with the ZFO).
}

- Credits : Kr3w of TheDefaced 

Read more...

Octave and QtOctave - Open source alternative to Matlab

Octave is a (mostly Matlab (R) compatible) high-level language, primarily intended for numerical computations. It provides a convenient interface for solving linear and nonlinear problems numerically.

Octave is quite similar with the Matlab language so most of the Octave codes are portable. It also provides extensive graphics capabilities for data visualization and manipulation. QtOctave is the graphical frontend to GNU octave and provides very easy to use graphical data entry, shortcuts and displays.

To install gnuplot, octave and qtoctave under ubuntu, type the following in terminal:

sudo apt-get install gnuplot octave qtoctave

I hope you enjoy your time with this open source alternative of matlab. Also, scilab is another software for the same purpose i.e. numerical computations.

I hope it helped you. :-)

Read more...

Download.com.np : A nepali download portal

I came across this nepali download portal Download.com.np which seems to be powered by MOS.

Mercantile communications, a leading Kathmandu based IT Company, developed a useful website download.com.np for most of the download users who frequently requires different kinds of freeware/shareware programs in their day to day professional life. Download.com.np aims to be a window for collection of the different Freeware and shareware programs with easier and faster downloading from the local network.


Visit the site

Happy downloadings, Nepali users :)

Read more...

Supertux2 console scripting hacks/tricks

SuperTux is a classic 2D jump and run sidescroller game in a similar style like the original SuperMario games. It is similar to mario with its hero as the Tux, the official mascot of the linux kernel. Well there are few interesting tricks that can be used in the console mode of this game so enjoy this post.

For the cheats to work, you need to enable the console mode either by editing the config file situated at $HOME/.supertux2/ or by running the supertux2 with the --console argument. IInd way is easier.
So we first need to start the program by typing in the Run command[Alt+F2]

supertux2 --console

Now console mode can be toggled by using a specific keyboard input which is ^ by default and can be modified from the options menu. I prefer ` as the console key.

Now while playing the game, we will press the console key and then a new overlapping console will be seen. There we will be typing the commands which will be listed in this post.

There are different kinds of functions that can be enlisted by pressing Tab when console screen is on.

Following are few interesting global functions that can be called by typing as they are below:

play_music(string musicfile) Changes music to musicfile

play_sound(string soundfile) Plays a soundfile

grease() Speeds Tux's horizontal velocity by a factor of 3.

ghost() Makes Tux a ghost, letting him float around and through objects.

invincible() Make Tux invincible for 10000 units of game time.

mortal() Recall Tux's invincibility or ghost status. (Even when not given with above 2 commands)

restart() Reinitialize and respawn Tux at the beginning of the current level.

whereami() Print out Tux's coordinates to the console.

gotoend() Moves Tux horizontally 2 screens away from the end.

camera() Display the current camera's coordinates. (top-left corner)

quit() Exits the game. (Not recommended for use in levels!)

Apart from these global ones, we can access the other objects such as Tux(object of Player class), Camera, etc. In the following list of Player class's function, you can access each of them by typing sector.Tux.function_name(). For example, to call do_cheer(), you would type sector.Tux.do_cheer() in the console.

add_bonus(string bonusname) Gives Tux the specified bonus. Replace bonusname with either of "grow", "fireflower" or "iceflower".

add_coins(int number) Gives Tux number coins.

make_invincible() Makes the player invincible for either a predefined amount of time.

deactivate() Stops the player and blocks the movement controls.

activate() Reactivates the player's movement controls.

walk(float speed) Make Tux walk

set_visible(bool visible) Shows or hides Tux according to the value of visible. Note: Tux doesn't interact with objects or badguys while invisible.

get_visible() Returns: bool; is Tux visible?

kill(bool completely) Hurts a player, if completely=true then the player will be killed even if he had grow or fireflower bonus.

set_ghost_mode(bool enable) Switches ghost mode on/off.
Lets Tux float around and through solid objects.

get_ghost_mode() Returns whether ghost mode is currently enabled

do_cheer() Makes Tux cheer, if possible.

do_duck() Makes Tux duck, if possible.

do_standup() Makes Tux stand up, if possible.

do_backflip() Makes Tux backflip, if possible.

do_jump() Makes Tux jump, if possible.

For more scripting reference, please visit this link.

Happy Supertuxing :-)

Read more...

Convert UIF file to ISO with uif2iso under ubuntu

uif2iso is a command line tool to convert the compressed magicISO file format uif(Universal Image Format) to the uncompressed ISO file format and few other formats. The output format (iso, cue/bin, mds/mdf, ccd, nrg) and corresponding extension are automatically chosen by the tool, depending on what the original format of the input file was.

To install uif2iso, open the terminal and type:

sudo apt-get install uif2iso

To use this tool, type as following:

uif2iso <inputfile.uif> <output>

Thanks :)

Read more...

Changing desktop background in windows 7 starter edition

Earlier, I was working on newly bought netbook of my friend and I was trying to change the desktop background which was not working. I tried to find the default wallpaper image and replace that image with the desired wallpaper image, but no luck. A quick google search revealed that it was actually the limitation of the windows 7 starter edition. With few more google search, I came across a win 7 starter edition's background changer tool by Oceanis. This tool was able to change the background easily.


You can get this tool from the link below:
Oceanis win 7 starter edition background changer

Edit: Alternative download link

Credits: Oceanis + www.sevenforums.com

Read more...

Paros Proxy - A tool for security pentester

Paros proxy can be used as the security pentest tool for evaluating the security of the web application. Written in JAVA, this tool can be used to intercept and modify all HTTP and HTTPS data between server and client, including cookies and form fields. Moreover this tool comes with an inbuilt session ID analyzer and fuzzing tool too.


For more information and downloads, you can visit the Official Site.

Thanks. :)

Read more...

ieHTTPHeaders : An IE alternative for livehttpheaders add-on

Well IE sucks but still if you need to use it and require some http header viewing addon like livehttpheaders for mozilla firefox, then there exists a tool called ieHTTPHeaders serving the same purpose.

I won't write much about it, just visit the official webpage for more information and download links:
Official webpage of ieHTTPheaders
Thanks.

Read more...

How to remove OS Boot Options from GRUB 2

Well due to number of updates, my ubuntu installation was showing numbers of OS boot options and I had to clean up the boot options. With new grub2, removing the older kernel packages from synaptic package manager is sufficient to remove these extra entries from grub. All you have to do is remove the kernel package and then update grub configuration.

In my case, I'll be removing the kernel package version 2.6.35-23 generic so I do search for it in the synaptic package manager.

Now from the search result, I chose the 2.6.35-23 generic and then right clicked and selected Mark for Complete Removal option. Now, we just need to apply the changes and wait for few minutes while everything is being done. The update-grub is done automatically and in case, it is not done, you can do sudo update-grub from terminal.

I hope this helps you. Enjoy :)

Read more...

Bittorrent Client for mobiles [Symbian and Java]

We've been using tons of bittorrent clients for P2P file sharing in our computers but now we have now got such bittorrent clients for mobile phones too. Applied Mobile Research Group (AMORG) from Hungary has developed the two bittorrent clients that will work in symbian based phones and java enabled phones.

Symtorrent is the first symbian OS based bittorrent client which supports multiple torrent downloads with both download and upload options. It has every feature that a basic torrent client should have and works in the Symbian OS 3rd and 5th edition. More information on Symtorrent in the official webpage




Mobtorrent is the bittorrent client for the JAVA powered phones so you don't need to worry if you don't have s60 phones.

Also, both of these tools are released under GNU GPL license and hence are free and open source tools. Hope this is informative for you guys. :)

Read more...

DoudouLinux - Linux designed for children

While going through internet, I came across this interesting linux distribution and just thought to share over here. This distribution is the linux distro called DoudouLinux and is targetted for the children.

It is designed to be very simple and reliable to use for the children and provides applications that suite for the small children of the age range 2-12.
You can read more about and get the download link from HERE.

DOWNLOAD PAGE for DoudouLinux

Read more...

Multiple accounts with single email account in forums/facebook and other sites

Hi everybody, its been a long time. I was in vacation and tour and was completely away from internet for a while. I will now start to post more regularly. Anyway in this post, I will show you how you can make multiple accounts in different discussion forums, social networking sites and other different sites (and even maybe in IRCs and others) with the single email account. This trick requires a single gmail account.

I accidentally mistyped the extra dot in my gmail account while registering in one forum. But in around a minute, my gmail tab was showing 1 new message in inbox and when I checked it, it was the forum's registration message. Then I tried to find what was going on and even a quick google search revealed that this would actually work.
So the idea is just registering in your target site with multiple forms of your gmail account with dot (.) in different positions. This google answer provides the answer for this so the account coolsamar207@gmail.com would be equivalent to:
cool.samar207@gmail.com
or
coolsamar.207@gmail.com
or
coOlsamar2.07@gmail.com
etc.

This means you can register in the forums/sites with any of the above(and much more) gmail accounts and still the email confirmation would come to your email account. I mean each accounts in the site would be actually associated with the single gmail account.

I tested this with fluxbb and facebook and was working well. I guess it would work for other social networking sites like myspace, twitter, etc. This might come handy for many of you guys for different purposes. If you got any queries, feel free to ask here.

Read more...