WonderHowTo

Learn to Code in Python, Part One: Variables, Input and Output

ChristopherVoute — Sat, 25 Feb 2012 07:58:42 GMT

In this article, I'll be exploring the basics of Python, i.e. variables, input and output. You'll need Python (2.7+), a computer, and some free time.

Variables

Simply put, variables are like envelopes. They are empty and meaningless until we place objects and meaning into them and give the envelope a name. When you call up a variable in Python, you "give" or "associate" data with a labeled container. For example:

red=1

This simple program associates the integer '1' with the container 'red'. '1' can be replaced with any integer, so long as it is a number. However, say you wanted to write a program that asked a user his/her name. This can be done by associating 'red' with a string. Strings are basically a series of characters-letters, numbers, special symbols like (_) and (.) etc., enclosed in single quotes ('), double quotes ("), or triple quotes ('''). For example:

red='Hi, my name is robot, what is yours?'

This program will associate that string of text enclosed in single quotes with the container 'red'. A more complicated rendition of strings involves the percentage symbol (%), however I will cover that in the second part of this introductory series.

Input and Output

We've covered how to store data in variables/containers, but how do we access it? When a program runs, the basic I/O (input/output) functions are print, raw_input(), and input().

print

One of the most useful tools available in Python is the print function. This simply allows the program to display or print data for the user to read. For example:

red='Hi, how are you?'

print red

When run, this simple program will associate the string in single quotes with the container 'red', then print the data associated with 'red'.

raw_input()

This is also a very useful tool. It basically allows the program to accept characters (like strings) into the program. The two brackets at the end of the function can be used to display a string, or variable data. For example:

print "Hi, my name is Robot. What's your name?"

Note: Notice how I used double quotes to enclose this string. This is because there is an apostrophe in the sentence (what's).

answer=raw_input()

print 'Hi '+answer+', how are you?'

This simple program will first print Robot's introduction and question, wait for a response, then greet the user with his name and another question.

input()

This function will only work for integers. It's useful when dealing with numerical user input, like in a calculator. If a user inputs characters that are not numerical, Python will display an error message stating that the entered data is not defined, which simply means Python understood the input as a request for a variable, but couldn't find the variable in the program.

Here's an example of a simple program that adds two integers together using the input() function:

print 'Please enter two integers:'

integer1=input('Integer one: ')

integer2=input('Integer two: ')

finaladd=integer1+integer2

print 'The numbers added together are: ', finaladd

Note: Notice how I use a comma (,) in place of an addition symbol (+) when "adding" integers into strings.

Stay tuned for part two, which will cover more on strings, as well as an introduction to definitions.

Photo by kapook

Via Learn to Code in Python, Part One: Variables, Input and Output on null-byte.wonderhowto.com.

Related:

Give Your Jacob's Ladder More Spark with High-Voltage Capacitors

ChristopherVoute — Fri, 24 Feb 2012 02:07:26 GMT

Here's a simple and easy addition to your own Jacob's Ladder. If you don't have one, here's how to make a Jacob's ladder.

All you need is a couple high-voltage 15KV capacitors connected in series to each of the ladder's prongs. Basically, rather than arcing right away, the high voltage transformer charges up the capacitors. Then, once they reach the "arc threshold", the capacitors discharge across the Jacob's ladder arc-guides, creating a loud, violent spark. This process happens several times a second, creating bright flashes of light.

Here's a video of it in action (the two gray "blobs" at the bottom of the ladder are the capacitors attached in series with the transformer output and ladder prongs):

Click here to watch the video

Warnings

High voltage is dangerous! Be careful.
Always make sure to discharge capacitors after use! They can hold a charge and shock you.
I am not responsible for any damage or harm you cause.

Photo by Wikipedia

Via Give Your Jacob's Ladder More Spark with High-Voltage Capacitors on fear-of-lightning.wonderhowto.com.

Related:

Hide Your Secrets: How to Password-Lock a Folder in Windows 7 with No Additional Software

Mr Unknown — Sat, 25 Feb 2012 07:55:40 GMT

Today's guide is on creating a password protected folder on Windows 7 without any additional software. Yes, you heard that right. No extra software at all! This guide is intended for beginners. But please note, this method should not be used to store financial or otherwise highly confidential material. It might be a good place to hide a planning document for a family member's birthday party or similar occasion where you need to keep something secret temporarily.

How to Create the Password Protected Folder

The first thing you should do is go into "Documents" and create a new folder. Name it whatever you like.

When you have done that, double-click on the folder and create a text document. This can be achieved by going into the contextual menu (right-click anywhere inside the folder -> New -> Text Document). Double-click on the text document and paste the following code into it:

cls
@ECHO OFF
title Folder Private
if EXIST "HTG Locker" goto UNLOCK
if NOT EXIST Private goto MDLOCKER
:CONFIRM
echo Are you sure you want to lock the folder(Y/N)
set/p "cho=>"
if %cho%==Y goto LOCK
if %cho%==y goto LOCK
if %cho%==n goto END
if %cho%==N goto END
echo Invalid choice.
goto CONFIRM
:LOCK
ren Private "HTG Locker"
attrib +h +s "HTG Locker"
echo Folder locked
goto End
:UNLOCK
echo Enter password to unlock folder
set/p "pass=>"
if NOT %pass%== PASSWORD_GOES_HERE goto FAIL
attrib -h -s "HTG Locker"
ren "HTG Locker" Private
echo Folder Unlocked successfully
goto End
:FAIL
echo Invalid password
goto end
:MDLOCKER
md Private
echo Private created successfully
goto End
:End

The next step is to change the PASSWORD_GOES_HERE text to whatever you'd like your password to be. Don't use an easy-to-guess password.

Now we need to save the text document.

NOTE: The text file must use the .bat extension. Therefore, I have named it locker.bat and saved it as a batch file.

When you have saved your batch file, you will need to delete the text document (.txt).

When you have deleted it, you may now double-click on your batch file. The first time you run the program, it will add a folder titled "Private". This is where you can store your documents to keep away from praying eyes. Go ahead and put some stuff in it now.

Above is a picture of the "Private" folder and "locker.bat".

When you have finished adding your documents to the Private folder, double-click on locker.bat. You will now be prompted whether you wish to lock the document or not. Select "Y" to lock it. When you do this, you will notice that the Private folder quickly disappears.

When you double-click locker again, it will ask you to enter the password.

Warning!

This is NOT the place to store confidential information, such as medical records, financial information or passwords. This is not the best place to hide things from an IT professional, but it should work against newbies or people with intermediate computer skills.

How Do You Bypass It?

Go into Folder Options -> View -> and uncheck "Hide protected operating system files".

However, when they attempt to un-check, it they will get this warning which may make them think twice before disabling it.

Credit: We found this script on many different websites going back years and years and have no idea who made it. If you have proof that you originally wrote the script, please get in contact with us and we will amend the article accordingly.

Photo by gizmowatch

Via Hide Your Secrets: How to Password-Lock a Folder in Windows 7 with No Additional Software on ws-technologies.wonderhowto.com.

Related:

Anonymity, Darknets and Staying Out of Federal Custody, Part Four: The Invisible Internet

Allen Freeman — Sun, 26 Feb 2012 08:44:48 GMT

In the last article, we left off with the Tor network and its hidden services. As I mentioned, Tor is not the only option in the game, and I want to offer a general introduction to I2P.

For a web browsing proxy and hidden services host, Tor gets the job done well. But if you are looking to expand your options for secure communication, then enter I2P! This article will show you how to obtain and set up I2P, and in the process, we will also configure an IRC client to access the IRC2P network and get you up and running.

Invisible Internet and Onion Routing

I2P initially began in 2003 as a proposed modification to Freenet. To deal with a wide range of attacks, I2P is fully distributed with no centralized resources— hence there are no directory servers keeping statistics regarding the performance and reliability of routers within the network. I2P is not 100% secure, as nothing is 100% secure, but using it will provide you with meaningful security nonetheless.

Content sent over I2P is encrypted through three-layer garlic encryption, used to verify the delivery of the message to the recipient. All messages passing through a tunnel are encrypted by the tunnel gateway to the tunnel endpoint, and undergo inter-router transport layer encryption along the way. You also have the ability to tunnel TCP/IP based applications (IRC, Jabber, steaming music, etc.) through the network. In fact, you can even tunnel your torrent downloads!

Step 1 Download I2P

Let's start with a visit to the download page to grab the Windows binary or source code, if needed. If you are using Debian/Ubuntu or Mint, we can add the repositories by simply typing:

$ sudo apt-add-repository ppa:i2p-maintainers/i2p
$ sudo apt-get update
$ sudo apt-get install i2p

This downloads and installs the I2P router on your computer.

Step 2 Start the I2P Router

Now that we have the packages downloaded and installed, we must start the service. We do this by simply typing:

$ i2prouter start

After we type that command, the I2P router will begin to bootstrap itself into the network. It is recommended to give this process some time as it seeks out and adds other nodes for you to route traffic through. After a few seconds, I2P will open a browser with the router console as seen below. You may close this.

Step 3 Invisible Internet Relay Chat

Some of you might have a preferred IRC client already. I use Irssi myself, but Xchat will work for most people. Normally, when you open the client you have the chance to connect to a server and port number. Because I2P runs as a service connected to your loopback address, we need to connect to it to access the IRC2P network by typing:

/server localhost 6668

That's it! You are now connected to the IRC2P network. You can use normal IRC commands such as /list to locate channels. Also please feel free to /join #nullbyte and #i2p and say hello!

tl;dr

Just want the commands to get up and running? Look no further.

$ sudo apt-add-repository ppa:i2p-maintainers/i2p
$ sudo apt-get update
$ sudo apt-get install i2p
$ i2prouter start

Then start your IRC client and type:

/server localhost 6668
/join #nullbyte

See you in the Deep Web!

Image by Innovat

Via Anonymity, Darknets and Staying Out of Federal Custody, Part Four: The Invisible Internet on null-byte.wonderhowto.com.

Related:

Important Astronomers: Galileo Galilei

Cerek Tunca — Sat, 25 Feb 2012 02:36:28 GMT

I'm starting a series on the top astronomers, with probably about eleven astronomers that I will be covering overall. So, let's start out from the top, with the top most important astronomer. In my opinion, Galileo Galilei is the top astronomer.

Galileo Galilei (February 15, 1564 - January 8, 1642)

Galileo was born to a poor family in Pisa, Italy in 1564 to Vincenzo Galilei and Giulia Ammannati. He had six other siblings. Galileo wanted to be priest, but his father forced him to go to the University of Pisa with a medical degree (which turned out to be a good idea).

Galileo talked his father into letting him go into mathematics instead of science. His first big accomplishment was creating a thermometer, called the Galileo Thermometer, which can be seen below. It is truly beautiful and is used mostly as decoration now.

By 1589, Galileo was the top mathematics professor in Pisa. In 1592, Galileo moved to the University of Padua, and taught mathematics and astronomy. He made major accomplishments in the field of physics and astrology during this time period.

Around 1608, Galileo created a telescope with 3x magnification. Over the next few years, he created many other versions of his telescope, eventually boosting the magnification up to about 28x. He demonstrated his telescope to a range of different audiences, too.

Galileo used these telescopes to make a ton of scientific discoveries:

Neptune: All Galileo really did was observe Neptune. He followed it for a while and noticed it moved differently than the stars around it. He then lost track of it.

Venus: After observing Venus for a while, Galileo discovered that it had phases just like the moon. Not only was this an interesting discovery, but it also supported the theory of heliocentrism.

Saturn: Galileo also observed Saturn for a long time. Its rings confused Galileo, making him believe there were three planets. After Saturn lined up with Earth, he thought the rings disappeared. When they appeared again, he was even more confused.

Moon: Basically, Galileo observed the moon for a while, and linked the moon's dark side with topological markers. He pretty much understood what the shadows on the moon where.

Jupiter and its moons: After observing Jupiter for a while, in 1610, Galileo discovered three 'stars' around it. He observed them for a few days, and saw that the way they were moving couldn't be that of a star. He concluded that they must be orbiting around Jupiter. The moons he discovered were Ganymede, Europa, and Io. He later discovered a fourth moon, Callisto. This also proved an important point. Aristotelian Cosmology, which said that all astronomical bodies rotate around Earth, was obviously proved wrong by the discoveries of Galileo.

Sunspots: Galileo was one of the first people to observe sunspots on the sun. He actually grew blind at age 72 due to not using proper equipment while observing the sun.

Galileo, in the early 1630s, defended his theory of heliocentrism. This basically said that Earth rotates around the Sun, not that the Sun rotates around it. In a brief summary, Galileo was put on trial for defending heliocentrism, and although he lost the trial, he afterwards said that he never supported heliocentrism and pretty much walked away with only a house arrest. He would have been sentenced to death, otherwise.

Galileo eventually died on January 8, 1642, at age 77. He died from a high fever and irregular heartbeat. He was buried in a small room close to main body of the Basilica of Santa Croce. In 1737, he was located to the main body of the Basilica of Santa Croce. This is his tomb:

Galileo Galilei was an amazing person and deserves to be remembered for everything he's done for astronomy and beyond.

Photos by PBS, Wikipedia

Via Important Astronomers: Galileo Galilei on astronomy.wonderhowto.com.

Related:

Winspiration: 16 Crazy Stock Photos to Inspire Your WTFoto Contest Submissions

James Carr — Sat, 25 Feb 2012 21:50:22 GMT

So far, there have been some excellent entries to our WTFoto Stock Photo Challenge, but the battle is not over yet. You still have a couple days left to submit your best find to the WTFoto community corkboard for a chance to take the crown. Remember, we're looking for an absurd stock photo image that nobody's ever seen before. Entries are due Monday, February 27th, 11:59:59pm PST. One second later and, well... I'll probably just let it slide. But 2 seconds later and you're out!

To help get your creative juices flowing, here are some examples of what holds stock in a stock-off from my personal collection:

Image by Getty Images

Image by 123rf

Image by Thinkstock

Image by iStock

Image by 123rf

Photo by iStock

Photo by 123rf

Photo by iStock

Photo by Bigstock

Photo by Shutterstock

Photo by Dreamstime

Just a reminder—photos of Stockard Channing will not be accepted. Nor will photos of beef stock, Pippi Longstocking, or the New York Stock exchange.

DON'T FORGET TO CITE YOUR SOURCES, EVEN IF YOU ARE THE MODEL IN THE PHOTO (that's me in the last one.)

Can't wait to see what you all find.

Via Winspiration: 16 Crazy Stock Photos to Inspire Your WTFoto Contest Submissions on wtfoto.wonderhowto.com.

Related:

Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden Services

Allen Freeman — Sat, 25 Feb 2012 02:10:00 GMT

For a moment, picture a situation where you want to host some files or images, but you do not want it traced back to you. Perhaps you're working on a project with others and need secure data storage. Anonymity is the new shield of the 21st century—and you best protect yourself. As always here at Null Byte, we are trying to make that happen. Before someone can learn how to root a box, they need to learn how not to be found. I can not stress that point enough.

In the last article, we spent some time going over the concepts of onion routing and how it can be useful to you. Before that, we covered the concept of deep web. In this article I will talk about Tor hidden services, what they are, and what they can be used for.

Tor Hidden Services

A Tor hidden service is simply a web server that runs locally and only takes requests from inside the Tor network. It is bound to localhost, so it is not visible or accessible to the outside Internet. Hidden services do not require registration or processing because they are anonymous, so there is no domain name to purchase and use. You may simply set up a web server, and point it to your loopback address. The network will then generate a Tor host name to be located by. Knowing this also explains the sometimes varied uptime of hidden services in general.

Due to the nature of hidden services being anonymous to a degree, the content can be extreme. Like anything in life, please exercise caution, but enjoy yourself. You will find hackers, crackers, porn and political discontent. You will find places to have your hashes cracked and places that sell drugs. It is the wild west of the modern day Internet. Viewer discretion is advised.

Setting Up Your Own Hidden Service

If you have gotten this far in my series, you are probably interested in setting up your own service. This can be for your friends or even to share things with random people across the world. You could even encrypt files and place them on your hidden service to be picked up by others, adding extra security.

Step 1 Get the Tor Client

In the previous article, we downloaded and used the Tor browser bundle. This works great for simple web browsing, but if we want to operate a hidden service, we need to download and install the actual Tor client. The installation is a simple matter in most cases, but might require a few extra steps for Ubuntu/Debian users.

After we're finished, we have the Tor client running on a default port of 9050 and are ready to go!

Step 2 Set Up Your Web Server

If you are using Linux, your absolute best choice for a web server is ThttpD. You may use more mainstream servers like Apache. Windows users will find a good home there, but in this tutorial, we will focus on ThttpD.

$ wget http://www.acme.com/software/thttpd/thttpd-2.25b.tar.gz
$ tar zxvf thttpd-2.25b.tar.gz

Move into the new directory to configure and compile from source:

$ sudo ./configure && make
$ mkdir hidserv; cd hidserv
$ cd ..
$ ./thttpd -p 5222 -h localhost

Tip

Adding a semi colon to a command allows us to follow it up with another command!

The last command started the web server and told it to use port 5222 and localhost as its host. You can click this link to see if it worked. If you see the page below, you are on the right track.

That's it! We are now ready to finish up and connect with Tor!

Step 3 Turning Your Web Server into a Hidden Service

Navigate to your /etc/tor directory and open the file named torrc with your favorite editor (I use vim). This is a configuration file for letting Tor know you are running a hidden service. Scroll down about halfway until you see the title:

### This section is just for location-hidden services ###

And add the following lines under that:

HiddenServiceDir /home/username/hidden_service/
HiddenServicePort 80 127.0.0.1:5222

Username is the name you log into on your Linux box with and hidden_service is whatever name you wish to give it.

Now restart Tor. When it starts back up, it reads the file torrc, follows the instructions, and bootstraps your service into the Tor network. It will then automatically create the 'hidden_service' directory that you specified (if necessary), and it will create two files there, private_key and hostname.

The private key is identical to the idea we discussed in our GPG article. Keep this key secret! Anyone who obtains it can impersonate your hidden service!

The hostname is a URL created by the network used to identify you from other services, it should look something like uy4htf7ssvv3gfh8g.onion.

Conclusion

This was just a taste of what's out there. From here you can branch out to configure your service however you need it. I implore you to spend some time on the Tor network and see what is all there. However, for the more savvy and security minded, Tor is not the best choice. In my next and final article in this series, I will go over the Invisible Internet Project known as i2p. The development of i2p started where Tor left off, improving upon its base and adding more features for the security minded.

UPDATE: Continue to Part Four to Learn About the Invisible Internet Project (I2P)

Questions? Concerns? Leave me a comment or drop by our IRC channel and say hello.

Photo by MyHosting

Via Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden Services on null-byte.wonderhowto.com.

Related:

How to Code a Simple Java App to Kill Any Process After a Specified Time

JT Newsome — Thu, 23 Feb 2012 02:25:21 GMT

I may be a bit weird, but I enjoy listening to music at night as I fall asleep. Sure, you could create a playlist of songs so that it stopped after all the songs finished playing, but I have a rather extensive database of music and I enjoy listening to them randomly. Also, I like to ensure it terminates after a specific amount of time (I don't want it playing all night). Or sometimes I use it when I am cooking so that when the music stops, I know I need to check on my food, etc.

I primarily use this to kill my music player after a certain amount of time, but it can easily be changed to kill any process that you choose (see below).

Feel free to download the following for your enjoyment: source-code, Spotify, and VLC. The source-code is a .java file of the code used to create the program. Spotify and VLC kill the given programs after a specified amount of time. They are .jar files, so you will need to have Java installed on your machine, which most people will have already. You can view the source-code using a text editor, but will need an IDE if you want to create your own program. I recommend Eclipse.

Warning

Be careful of what processes you terminate, we are not responsible for any damage you may inadvertently cause.

How the Code Works

There is really only one thing that you really need to be worried about, and that is what process you are killing. Refer to the execKill() method:

On line #26, the string "TASKKILL /F /IM spotify.exe" tells the program what command to execute after a certain amount of time. All you really need to do is change "spotify.exe" to whatever process you want to kill. You can view all processes currently running by pressing ctrl+alt+del.

Example with Firefox

Suppose you wanted to close your web-browser after 15 minutes, here are the detailed steps on how to do this:

Step 1 Getting Java Ready

Make sure you have downloaded Java and an IDE (Eclipse/NetBeans), then open up your IDE.
In the package explorer, right-click and select "New" -> "Java Project". Name it whatever you want to, then click "Finish".
Right-click your new project and select "New" -> "Package". Name it something useful, perhaps the name of the program you want to kill.
Right-click the package you just selected and select "New" -> "Class". You can name this whatever you want, but if you name it something other than "spotifyKiller", make sure to change it in the source code.

Step 2 Readying the Code

Download the source-code file (above), if you haven't already.
Open it with a text editor, such as WordPad or Notepad.
Press ctrl+a (selects all), then ctrl+c (copies code).
Go to the IDE and inside the class and put your cursor between the two curly braces by clicking there and then press ctrl+v to paste what we copied.

Step 3 Modifying the Code

As in the "How the Code Works", change spotify.exe to firefox.exe.
Press ctrl+s to save the code, then open an instance of Firefox.
Click the "Run" button in Eclipse (it looks like a green play button). This should cause a window to pop up. Type "1" into the box and press "Start" and wait 1 minute. If all went well Firefox will have closed. If so, proceed, otherwise go back over the steps and try to figure out what went wrong.

Step 4 Exporting

Now your code should be working as we want. We don't want to have to run the code from our IDE every time, so we are going to export it to a runnable file:

Make sure your code is saved.
Look in the top left-hand corner of Eclipse and select "File" -> "Export...".
A window will pop up, when this happens select "Runnable Jar File" and then "Next".
Make sure your screen looks something like the picture below. You can specify where you want to be exported, so you can find it easily later on:

5. Finally, click "Finish"!

Step 5 Running the Program

Now all you have to do is double click on the file you just created and input how many minutes you want until Firefox should close. For this example, we put "15" and click "Start" and voilà! Firefox closes after 15 minutes have passed, yay!

Thank you for reading! Stay tuned for more Invisible Computer articles!

Photo by twentyeighttwelve

Via How to Code a Simple Java App to Kill Any Process After a Specified Time on invisiblecomputer.wonderhowto.com.

Related:

How to Make Realistic Looking Fake Blood

Yumi Sakugawa — Fri, 24 Feb 2012 02:09:18 GMT

In the mood to whip yourself up a bowl of fake, realistic-looking blood? Chances are, your kitchen and bathroom already contain the things you need to make that perfect red goo that will be the finishing touch for your next gory costume party, violent music video shoot or super-scary prank. Who said that fake blood is only good for Halloween?

Got your own tips for making legit-looking fake blood? Share with us in the comments below.

Click on image below to enlarge.

Via How to Make Realistic Looking Fake Blood on thesecretyumiverse.wonderhowto.com.

Related:

How to Make a Killer Bottle Opener from a .50 Caliber Bullet

ChristopherVoute — Fri, 24 Feb 2012 18:30:22 GMT

In this article, I'll show you how you can make your very own bullet/shell bottle opener. All you need is a .50 caliber deactivated round and some workshop tools!

Step 1 Materials and Tools

.50 caliber bullet/shell (look online, or you can get one here)
Hacksaw (a saw intended to cut metal; can be purchased at most hardware stores)
Benchtop vice
Black Sharpie or similar marker
Some sandpaper
Metal file

Step 2 The Procedure

1. First, take your bullet shell and draw the outline of the cut, like so:

2. Secure the bullet in your vice and cut along the mark slanted from the back of the casing towards the copper slug on top.

3. Now, cut the second slit slanted slightly towards the casing's end, until you reach the end of your last cut, freeing the piece of metal, and creating a hole.

4. This is the hardest part. Lay the file inside the hole so that it sits just inside the left side of the hole (if you're facing the bullet with the end at your right). File down that portion until you create a large lip. This lip is what grabs the bottle lid and yanks it off.

The notch:

5. Finally, sand off the rough edges with the sandpaper and give the bullet a polish.

Enjoy impressing your friends :)

Warnings

DO NOT attempt this with a live bullet! Ensure the bullet has been disarmed before sawing into it. No powder should be inside the casing and the primer should be spent.
Hacksaws and files can be dangerous! Be careful.
I am not responsible for any damage or harm you cause.

Photos by Vat19, Cool Material, LikeCool

Via How to Make a Killer Bottle Opener from a .50 Caliber Bullet on fear-of-lightning.wonderhowto.com.

Related:

How To Protect Your PHP Website from SQL Injection Hacks

Adam Velma — Fri, 24 Feb 2012 20:59:06 GMT

As a web developer, I often read articles about hackers (from the lowly to the knowledgeable) infiltrating websites via the dreaded 'SQL Injection' method and completely taking control, changing, gaining access, or destroying the owner's data. As a fellow web developer, I'm sure you want to know how to protect against it. Well, here it is! In this article, you will find out what SQL Injection is, what you can do to protect against it, and additional recommendations that are easy to do and only makes your data more secure.

Please note: I am not an 'absolute' expert, but none of my projects have ever been hacked (yet), are SQL Injection proof (as far as I know), and I love to learn. I guarantee nothing.

What Is SQL Injection and How Is It Used?

Basically, SQL Injection is a method used against websites and applications to gain access to the website's or application's data, stored in a SQL database. SQL Injection is used to gain access to a database's information (or an entire company), to destroy a database's information, or to manipulate a database's information. It is a method used to exploit the security vulnerability of an application or website. There are different types of SQL Injection, but in this article we will only cover the basics.

Let's see how it is used, to further understand what it is. I am going to use PHP as my scripting language in these examples. You can use substitute any language(s) you use. The focus should be on the SQL commands.

Example

Suppose you are a professional with your own business. You have created an SQL database with a table that contains all of your clients' information, that you use to send out important notifications, billing, etc. It took you an entire year to gain 50,000 very important clients. You manage your database by logging in online, as you travel, and doing whatever you need to do, directly from your website.

Your SQL query in your PHP log-in script, on your website:

$q = "SELECT `id` FROM `users` WHERE `username`= ' " .$_GET['username']. " ' AND `password`= ' " .$_GET['password']. " ' ";

One day a self-proclaimed hacker stumbles upon your website. He clicks the 'Log In' button.

He enters the following in the 'username' field:

' ; SHOW TABLES;

The hacker now has been shown every table you have in your database.

Since he knows your table's name, he enters :

'; DROP TABLE [your table's name];

All of your information is gone.

Note: There are attempts that are much more complicated than this, and someone can spend a lot of time to get into your database, or they can even use a program to try to exploit the vulnerability of your website, database, application, etc.

Step 1 Use mysql_real_escape_string()

This PHP function escapes special characters for use in SQL queries and protects you from attack.

The query would now look like this:

$q = "SELECT `id` FROM `users` WHERE `username`= ' " .mysql_real_escape_string( $_GET['username'] ). " ' AND `password`= ' " .mysql_real_escape_string( $_GET['password'] ). " ' ";

Step 2 Use mysql_query()

Using 'mysql_query()' has additional protection against SQL Injection. A query not wrapped in 'mysql_query()' could allow a hacker to use multiple SQL commands from your 'username' field, instead of just one, which is another vulnerability. 'mysql_query()' only allows one command at a time.

So, our query would now look like this:

//connection
$database = mysql_connect("localhost", "username","password");

//db selection
mysql_select_db("database", $database);

$q = mysql_query("SELECT `id` FROM `users` WHERE `username`= ' " .mysql_real_escape_string( $_GET['username'] ). " ' AND `password`= ' " .mysql_real_escape_string( $_GET['password'] ). " ' ", $database);

Recommendation: Centralize Your Connections

In your script, you should centralize your connections to one page.

On each page that needs it, just use the 'include()' function to include the page that hosts your SQL database connection information. This would force you to create queries with the same format on every page you create, and reduces the chances of a mistake leaving a vulnerability open.

So, let's say we make a page called 'connections.php' and put in the following:

//connection
$database = mysql_connect("localhost", "username","password");

//db selection
mysql_select_db("database", $database);

We could modify our query using the new setup. Our log-in page would have:

include("connections.php");

Recommendation: Clean Data at the Beginning of the Page

Many programming languages force you to declare variables before you can use them throughout the script. PHP does not force you to do this, however, it's a good habit to clean out your variables at the beginning of the page anyway!

Sure someone can ask, "If I'm cleaning each variable throughout the page, why should I clean the variables at the top? Aren't I doing the same thing with your recommendation?".

It is easier on you to clean variables at the beginning of the page for a few different reasons, beyond formatting.

It reduces the amount of code you have to write.
Once the variable is clean, you can use it freely throughout the page, without the fear of vulnerabilities.
It is cleaner and more organized, allows you to work easier, and avoids mistakes.

If we cleaned variables at the beginning of the page, our script would look like this:

include("connections.php");

$username = mysql_real_escape_string( $_GET['username'] );
$password = mysql_real_escape_string( $_GET['password'] );

$q = mysql_query("SELECT `id` FROM `users` WHERE `username`= ' " .$username. " ' AND `password`= ' " .$password. " ' ", $database);

You could even go as far as creating a function to do all cleaning for you, reducing the amount you have to type further. Look at the following example.

function cleaner($input){

//clean variable, including mysql_real_escape_string()

}

include("connections.php");

$username = cleaner( $_GET['username'] );
$password = cleaner( $_GET['password'] );

$q = mysql_query("SELECT `id` FROM `users` WHERE `username`= ' " .$username. " ' AND `password`= ' " .$password. " ' ", $database);

Recommendation: Check Even After It Is Cleaned

You can have additional checks in place to guard against unnecessary processing on your server. This is achieved by adding checks to your script before you ever get to the point of running the query; only running the query when you find the data acceptable.

function cleaner($input){

//clean variable, including mysql_real_escape_string()

}

include("connections.php");

$username = cleaner( $_GET['username'] );
$password = cleaner( $_GET['password'] );

//Check if the input is blank.

if( ($password == '') || ($username == '')){

//dont let them pass

}

//Check if they are putting in way too many characters than should be allowed.

else if( (strlen($username) > 20) || (strlen($password)> 20) ){

//dont let them pass

}

//Passed all of our checks! Run query.

else {

$q = mysql_query("SELECT `id` FROM `users` WHERE `username`= ' " .$username. " ' AND `password`= ' " .$password. " ' ", $database);

}

That's pretty much it.

If you have any questions, feel free to ask!

Via How To Protect Your PHP Website from SQL Injection Hacks on WonderHowTo.

Related:

Master the Power: How to Make Fluorescent Tubes Glow with Your Bare Hands

ChristopherVoute — Thu, 23 Feb 2012 07:14:20 GMT

I'm sure most everyone has some kind of fluorescent light source in their home; those long white tubes that emit a bright white light when turned on, or maybe a few of the CFL power-saver bulbs. These bulbs actually require very little "power" (i.e. a high voltage:almost no current ratio) to emit light. In fact, static electricity is enough to make them flicker. Inside these tubes is a gas, and when electricity flows through that gas, it gets "excited" and produces light.

Using this same simplistic concept, we can power these bulbs with electricity flowing "on the surface" of our skin. However, first it's necessary to create the voltage. This can be achieved by "charging" up our bodies with high voltage (harmless; almost no current), then touching a fluorescent tube.

The Voltage Source

Two possible circuits can be used as the voltage source. The first one is intended to wirelessly transmit energy, but you can use it with a small modification. Once you've built the device, attach a wire from the high voltage output to your skin. MAKE SURE you are not grounded and have attached the wire to yourself before turning the device on. This means standing on a plastic chair, wearing rubber-soled shoes, etc. However, BE CAREFUL! Touching anything grounded will result in a startling shock similar to a static shock from a doorknob. Once turned on, hold a fluorescent tube in your hand. It will light up!!

Note: The first circuit modification should only be attempted by those with extensive experience in electricity, high-voltage, and general electrical safety.

The second circuit, and probably the easiest and most effective, can be found here, with no modifications needed. Simply hold a fluorescent tube with the device turned on! Here's a video demonstration:

Click here to watch the video

Warnings

Again, high voltage is very, very dangerous!!! Do not attempt either of these circuits unless you know what you're doing!
Fluorescent tubes can break easily, resulting in very sharp glass shards. Be careful!
I am not responsible for any damage or harm you cause.

Via Master the Power: How to Make Fluorescent Tubes Glow with Your Bare Hands on fear-of-lightning.wonderhowto.com.

Related:

Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and Daggers

Allen Freeman — Fri, 24 Feb 2012 20:45:23 GMT

In the first part of this series, we learned about darknets, as well as how they came about. But these patches of forgotten Internet are not the oasis of free information you might think. Despite being hidden—or just harder to come across—these networks are no more safe then anywhere else on the 'clear' Internet. The nature of networking and routing means your location is always known in server logs. It only takes one phone call to your ISP with your IP address to obtain both your physical address and a search warrant along with it. Therefore, a method must be used to cloak your action from those ever-growing prying eyes.

Enter Tor and Onion Routing

Simple traffic analysis and deep packet inspection can give up what you are sending, where you are sending it, where it is coming from and who it is going to. This is performed by your ISP to enforce data limits or anti-spam and piracy measures, and it can be performed by anyone with access to your network. This could be the FBI outside in a parked van or even your neighbor after he cracked your wireless password.

Tor works on the idea of onion routing. Let's take a more in-depth look at the idea behind this, as it's critical to how the Tor (and i2p) network operates. Each machine that's running the Tor service is running a Tor router on their network. Each of those routers (which we'll refer to as "nodes" from now on) work by forwarding traffic from other random nodes.

When you wish to send some data on the network, your node calculates a path though all the running nodes, and wraps your data in that many layers of encryption. When each of these random nodes receives your packet, they can only decrypt the layer assigned to them (only they have the key). As such, each node can only see the previous node a packet came from and the next node the packet should be sent to. At no point can the nodes dig deeper into the packet. They can only peel away the layer assigned to them. In this way, each layer is peeled away, one at a time, giving us the term onion routing.

The figure below illustrates how each layer of the "test" packet is peeled away one at a time on its way to the web server.

Exit Nodes and Escaping Content Filtering Firewalls

Inside the Tor network, there is a wide range of hidden content, a lot of which is not for the weak of heart. This is because Tor allows you to create your own internal website, known as a Tor Hidden Service. We'll dive deeper into those services in the next part of this series. For now, let's go over how Tor allows you to browse the web anonymously.

Normally you send your request to a web server using the normal HTTP port of 80. The server then reads what you need, and sends it over to you. By the very nature of this system, the server needs to know your router's IP address to communicate back to you, and this is contained in the header of the each packet sent. Essentially, it's connecting what you are doing on the Internet to where you live.

The problem occurs when a company or ISP peeks into those packets and blocks access based on their contents. You have seen examples of this at your high school computer lab and maybe even in your office at work. Websites and content that are not wanted can be filtered out before it even reaches you. Sometimes this is undertaken on a national level, like in China and Iran, by filtering directly at the ISP.

To reach regular websites on the 'clear' Internet, some Tor nodes are configured as exit nodes, which route traffic in and out of the Tor network. This hides who you are from the police, the web server, your ISP and anyone else listening in. As far as any of them know, you are the exit node! Also, as Tor uses its own port and encrypts the traffic, your content restrictions can be bypassed with ease.

Even as these exit nodes are often in other countries, there are still methods of tracking you down. None the less, putting a few layers between yourself and the world can never hurt. At the end of this article, I will explain the most efficient way to obtain the software you need and provide you a few links to start your adventure with.

Why Aren't We All Using Tor Then!?

Tor has a few serious issues with it that do need to be addressed. The most critical is a lack of end-to-end encryption. This means anyone who can sniff the traffic from an exit node can see EVERYTHING. They still have to trace packets back and forth to determine a location, but all the encryption is gone. Any personal info you transmitted will be wide open for the stealing. You can negate this by wrapping your data in a presentation-layer protocol like SSH, but that's not always an option.

Tor also does not provide protection against end-to-end timing attacks. If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit and locate you. This problem is tied into the one above in a way, as well.

Why Should I Use It?

Tor is still very effective at outsmarting firewalls and port scanning, and though more advanced, tunneling SQL injections. Tor is secure enough to communicate with and even better if you wrap that data in application-layer encryption beforehand. It is not 100 percent, but it's better than just rolling dice and hoping no one is watching.

Over the years, the model has been improved upon and added to. If you are looking for the next step up from Tor, you need to enter the world of i2p. In my next article, I will explain how they're similar and how they differ, sometimes drastically.

tl;dr

Tor is great at browsing the web anonymously and accessing the network's hidden services. The best way is to download the browser bundle directly from the website. There is no installation required, and you can even put it on a USB drive for mobile use as en emergency proxy!

Simply download and extract the archive, navigate to its directory and:

$ ./start-tor-browser

That's it! The Tor/Vidalia bundle includes the script that starts and connects to the Tor proxy and a modified version of Firefox that is set up to be secure and work with Tor out of the box. This includes disabling Javascript, Flash and any other add-ons that can be tricked into giving up your real IP.

Below is a list of links for a few Tor hidden services to start you off.

dppmfxaacucguzpc.onion - The TorDIR, a listing of various hidden services, some on and offline.
kpvz7k12v5agwt35.onion - The Hidden Wiki, a listing of more links and services. Be careful here.
eqt5g4fuenphqinx.onion - Core.Onion, a great intro for new users.

Questions? Concerns? Leave me a comment or drop by our IRC channel and say hello.

UPDATE: Continue to Part 3 to learn about how to set up your own Hidden Services...

Images by Cervantes, Hackertarget, OnionWiki, Ars, Ars, BGR

Via Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and Daggers on null-byte.wonderhowto.com.

Related:

Hidden Redstone Treasures and Pixel Art Top This Week's Staff Choice Awards

Kendra W — Fri, 24 Feb 2012 19:27:03 GMT

Welcome to Minecraft World! Check out our tutorials, post to the community corkboard, and come play on our free server!

Everyone seems to really be enjoying the current Weekly Challenge, so it was a little hard to find some finished builds. There are some work-in-progress builds that are absolutely STUNNING in their current state, so... get to work guys (you know who you are)! I've been dying to show off some of these, but I know they probably want me to wait until they're finished!

Even though this week was tough, admins were still able to find some amazing builds! If you missed last week's winners, be sure to check those out!

If you didn't win this week, don't fret! We will be doing the Weekly Staff Choice Awards every single week. If you would like to know what prizes will be given out for the Staff Choice Awards, check out the latest Weekly Challenge to see what perks you could win! The prizes given out for the Weekly Staff Choice Awards will always be the same as the prizes for the Weekly Challenge.

For next week, if you would like to enter your build, please do so by posting a video, screenshots, and some information about your build to the community corkboard.

You can also message me (Maroselis) in-game if you would like to recommend someone else for that week! If I'm not in game at the time, just type "/mail send Maroselis [And your message here]" (without the quotes). Please try to include the coordinates of the build that you are recommending to make it easier for me to find it! Hit f3 in game to see your current coordinates.

Grand Prize Winners: Zbuck and BlackyNine07

Zbuck just joined the server this week and is already hard at work! So far, he's created several awesome pixel art characters and they keep popping up everywhere. He seems to have quite a knack for pixel art, and the pixel art he did this week is absolutely flawless!

Click here to watch the video

BlackyNine07 created a "creeper cave" with several redstone surprises throughout. It's the perfect little hideout shelter! It has hidden lighting, a fireplace (click the button and it's a disposal) and a mystery door behind bookcases that leads you to the private balcony! It has a very cozy vibe to it, so I'm not sure I would call it a cave... but it is on the side of a mountain!

Click here to watch the video

Prizes

1 Grand Prize winner - Contributor rank in game + Nyan Cat (/nyan)!
Honorable Mentions - Contributor rank in game!

* Contributor rank in game allows you to change your gamemode (survival/creative), put yourself in godmode (/god), set 20 homes, claim 50 (16x16) plots and wear hats with /hat!

* Nyan Cat is a plugin I just installed for the winners of this week. Here's a quick video showing what it does:

Nyan Cat plugin
Click here to watch the video

Congratulations!

Congratulations to the winners, you guys did an outstanding job! I can't wait to see what everyone has in store for the admins next week!

Don't forget to hop on the server this Saturday, Feb 25th at 2 PM PST / 5 PM EST where we will be recreating this working movie screen! If you need to convert the time to another time zone, try this handy convertor.

We use TeamSpeak3 for our tutorials; you can download it free here.

Our channel is: ts.wonderhowto.com.

Follow us on Twitter @MinecraftHowTo!

Via Hidden Redstone Treasures and Pixel Art Top This Week's Staff Choice Awards on minecraft.wonderhowto.com.

Related:

How to Sneak into Your Roommate's Computer by Bypassing the Windows Login Screen

JT Newsome — Wed, 22 Feb 2012 05:40:14 GMT

Have you ever forgotten your password and didn't know how to get back on your computer? Or ever had an annoying roommate you wanted to play a trick on to teach them a lesson? Or perhaps overly religious parents who think the internet is of the devil and won't let you read online articles about elliptic curve cryptography applications to C++? Well, then this article is for you!

In this article, you will learn a variety of techniques that will allow you to regain access to your computer. We will start with the most simple and archaic of methods, then progress to more complicated and robust ones.

Warnings

Use this information in a responsible manner.
Do not use on computers you are not authorized to use.
Check if encryption/decryption software is legal where you live.
We are not responsible for anything you may or may not do with this.

Step 1 Win-XP Backdoor

Tip

If you are running something newer than XP, which is likely, then skip to the next step.

When you log onto a Windows XP machine, you will typically be greeted with an icon which you click to log on, called the "classic logon". We don't want this:

We want something like this:

We can switch to this log on screen by pressing "ctrl+alt+del" repeatedly on the classic log on screen.

The default User name and Password are typically: {"Admin", "admin"}, or some variation of these (e.g. "Administrator"), respectively.

If you can't seem to gain access, which is fairly likely, especially if you are running something other than XP (since most newer Win-OSs don't have this backdoor), then move onto the next step.

Step 2 Keylogger

Tips

If you are not computer savvy or simply malware paranoid and don't mind a bit of espionage, then skip to step 3. Come back if all other methods fail.
Also be aware that many antivirus programs will see this software as malicious, so don't be surprised if that happens.

Another option that is pretty simple, is to install a keylogger. You can usually find a semi-reliable one on CNET (just search for "keylogger"). Make sure to read the reviews and user-ratings and whether it is free or not. Keep it simple, we aren't trying to dig up someone's whole personal life (well, you might be, but that's your business). Free and simple things usually work best in my experience.

After you install it (pray it hasn't done anything too psychotic to the computer), it will probably give you a secret series of keystrokes you need to push to bring up the keylogger, make sure to memorize or write it down somewhere safe. Also, make sure you activate the keylogger. It would be a shame if you "snuck" on the computer and then you didn't log anything!

Now you just have to wait until the person who knows the password comes on the computer and enters in the password you want. Once they have, sneak back on the computer and pull up the keylogger and search the logs for what you want. Knowing a time period when they entered it may be helpful for this part. And voilà, hopefully you will have got what you wanted!

Afraid someone will do this to you?

Look into getting an "online screen keyboard", that forces you to click a keyboard on the screen so that the keystrokes are never logged. I will try making a tutorial in the future that expands on prevention of keyloggers, but just be wary of what software you install and be familiar with what processes are running in the background of your computer. Also, if you want to go all out, there is actually hardware that functions as a keylogger that you place between the keyboard cord and the computer; just search around on eBay/Google. Wireless keyboards could also theoretically be intercepted, but I haven't contemplated in depth exactly how that could be done.

Step 3 Cain & Abel

This is probably the most effective, simple piece of software that I have seen around, for password acquisition! You can download Cain & Abel here. The only downside is that I don't recall there ever being a Linux version, but then again, the software specifically targets Windows systems most of the time.

How do you use this to gain the password?

Simply install it, which may be slightly difficult if your antivirus doesn't like it, such as with the keylogger, which is probable. After that, simply run it, then click on the "LSA secrets" -> "+" and it will ask you some stuff about getting it from the hive or local machine, etc. You should be able to just click "next". Then, it will automatically dump all the password hashes, decrypt them and display the plain text!

In my experience, this works best with XP. I have had difficulty with other operating systems. I grew up hacking XP computers, so sorry if you are still yelling: "I don't want to get into an XP system!" Don't worry, the next step should hopefully cover that.

Tips

Check out the other features of this program, such as the network sniffing utilities or decryption tools! They are fun to play around with. :)

Step 4 Ophcrack

Okay, if none of the other methods have worked, then this one probably will! It is one of the more complicated ones, but it typically has a higher success rate, especially if the computer you are trying to get on had a crappy password.

What you need to do is download Ophcrack.

You can go down two different alleys for this:

Live CD
Direct Installation

Essentially, you always want to go through the Live CD way unless you have unlimited access to the computer. I have it installed on my computer, just so I could see if I could hack my own password. You may actually want to try this out and familiarize yourself with the software prior to using it on another computer.

Download the software and then prepare it to be burned to a CD, but do not do it quite yet, there is more to do. Another alternative, is to put it on a flashdrive, which is what I did because I don't have many CDs lying around. For a tutorial on doing this, click here.

What you also need to do is download and extract any rainbow tables that you want to use. Rainbow tables essentially contain an organized table of all the possible hashes that exist given a certain set of characters (e.g. uppercase letters, lowercase letters, special, etc.), which is much more efficient since you don't have to compute the hashes when you are cracking. Based on the suspected maximum length and type of characters of the password on the computer, you need to select the appropriate table (see the Ophcrack download page). If you are on Windows 7, then use the Vista tables, they should be sufficient. After you have downloaded a table, then place it/them in the "tables/" folder on your CD.

Burn the CD and you are almost all ready!

Simply insert the CD into the computer and restart it. You may have to call up the boot menu by pressing F12 or something, but it may automatically boot from the CD/USB drive you inserted. Next, the Ophcrack Linux distro will boot up, which takes about a minute. Then you simply select the passwords you want to crack and click "start"... and hope for the best! Some passwords are cracked in 3 seconds and some take an hour—it really just depends on the password length and randomness (and of course, if you selected the most efficient rainbow table).

I have had times when I could simply not crack using this method, but it works most of the time. If not, I resorted to more surreptitious espionage methods as in Steps 1 through 3. Where there is a will there is a way, as I always say! :D

Just never give up. Keep trying. Keep learning, researching, asking questions until you find your answer! Nothing is impossible unless you believe it is. :)

Stay tuned for more Invisible Computer articles and how-to's!

Photo by stopcyberbullies

Via How to Sneak into Your Roommate's Computer by Bypassing the Windows Login Screen on invisiblecomputer.wonderhowto.com.

Related:

Weekend Homework: How to Become a Null Byte Contributor (2/24/2012)

Allen Freeman — Fri, 24 Feb 2012 16:10:38 GMT

Are you the expert hacker we're looking for? Do you have a great idea for an article on Null Byte? Do you have a passion to write, and more importantly... teach?

We're officially looking for Null Byters on a weekly basis who are willing to take the time to educate the community. Contributors will write tutorials, which will be featured on the Null Byte blog, as well as the front page of WonderHowTo (providing it's up to par, of course).

There is no need to be intimidated if you fear you lack the writing skills. I will edit your drafts if necessary and get them looking great! You don't need to be a college professor to share your hard earned knowledge with everyone!

How Else Can I Help?

If you did not notice yet, I am new here! It would be great to get to know the community better and hear your ideas on the future of Null Byte. I look forward to discussing information security with you on the forums or in our IRC channel.

If you have skills and want to share knowledge on any of the topics below, please leave a response in the comments with which topic you would like to write, or message me privately. If you have any additional ideas at all, please submit them below.

And one last thing, if you come across a great news article or some helpful links, please post them to our Community Corkboard to share with the everyone!

Topic Ideas

Intro to Sqlmap — SQL injections are a hot topic today! Teach the community a little about code injections with an overview of sqlmap.
How to use Nmap from Behind a Proxy — Teach users how to Nmap from behind a proxy to mask traffic. Extra points if you use Tor or I2P!
Intro to Programming — (Thanks ChristopherVoute! See his article here.) We have some mid-level python articles on Null Byte, but we could use some more entry-level texts!
How to use Virtual Machines to Run Multiple Operating Systems — Let's face it, WINE is old and sometimes you need to get into a Mac environment.
How to Config Openbox on Backtrack (sound must work!) — Sometimes you don't want all the fluff and pomp of Gnome or KDE. Show us how to configure Openbox as our window manager in Backtrack 5.
Give us Your Best Social Engineering Tips — Can you talk your way out of anything? Can you talk your way into anything? Do you have any tips you could share with the rest of us? Why break a password when you can simply ask for it, right?
How to Harden Your Linux Box — Fresh Linux install? Walk us through some of the steps of making it more secure then it is out of the box. Bonus points for defense in depth!
Intro to TCP/IP — Are you a networking person? We could use an introduction to TCP/IP, its history and its use.
How to Buy Hardware — The computer hardware market is changing every day. Help new users make informed decisions by giving an overview of what's hot and available out there.
How to Torrent Securely — Explain how to use anonymous networks and private trackers to download safe from the prying eyes of your ISP.

Comments? Questions? Concerns? Leave me a comment!

Photo by EastSidebooks

Via Weekend Homework: How to Become a Null Byte Contributor (2/24/2012) on null-byte.wonderhowto.com.

Related:

Anonymity, Darknets and Staying Out of Federal Custody, Part One: Deep Web

Allen Freeman — Thu, 23 Feb 2012 19:15:02 GMT

You've probably seen those deep-web images floating around on the Internet. Usually, it goes something like this: There is a towering iceberg and the deeper the underwater portion extends, the more “hidden” and “exotic” the content is described to be. Sometimes these images are accurate to a point, but most are just making things up.

So what exactly is 'deep web' then? Are there really hidden secrets and treasure buried under some cloak and dagger type conspiracy? Well, in short, the answer depends on your idea of treasure and conspiracy.

In this series of articles, I am going to break down the idea of a deep web, what is it, how it got there, and most importantly, how we can use it for our security—maybe even for lulz.

Anonymity and Darknets

As it stands today, practical knowledge of how darknets (non-indexed portions of the Internet) function will allow you to make more informed decisions regarding risks when rooting a box, hiding files, or communicating securely. Now, keep in mind that nothing short of unplugging your computer will make you 100% anonymous. You can have fifty proxies and a handful of VPNs, but never consider yourself to be completely masked. Look at anonymity as a trade off between function and speed.

The idea is to have enough masking, while maintaining a level of usefulness. While it is not impossible to track your actions, ideally you want to make it logistically too complex to be attempted in a realistic way.

If you need to escape your school's firewall, a simple HTTP proxy may work for this. If you are rooting an AT&T server, you will want several layers between yourself and the target. Cyber crime laws are changing rapidly around the world, from Cairo to Chicago, and learning how to blend in with the masses is a valuable skill to have. You are harder to track when you are nobody at all.

First though, we need to talk about Google. Yes Google.

Why Google?

When you use Google to search, it does not take your query and search the entire Internet for results; there is simply too much data for that. It runs your search on databases of sites that have already been located by Google’s web crawlers. These crawlers are bots, coded to search for, find, and index content on the web. Primarily, this is achieved by 'seeding' the crawler with a few initial links to start with. It scans for more hyperlinks on those websites, connecting to and repeating this process over and over while creating a 'map' of the results.

It is this 'map' of collected links that your search request is actually looking at. While this is innovative, it contains a few inherent flaws.

The Internet is large. In fact, the Internet is very large, and estimates on just how much of it is actually indexed and publicly searchable range from 40 to 70 percent. Problems arise in the fact that most search engines do not crawl through non-HTTP protocols like Gopher or FTP. And if they choose to, developers can take steps to minimize indexing of their sites altogether (controls like the robots.txt standard and spider traps are commonly used). It is worth noting that network resources requiring authorization are not crawled, under normal circumstances.

The surface web makes up over 90 percent of what you use and do online. The remaining network services require you to directly connect to them, log in to them, or otherwise know they are there beforehand.

So, what good is all of this for you?

Right now, not as much as you might think. Though the content might not be searched, and is sometimes exciting and risque, you are still held to the basic laws of the Internet, TCP/IP.

Every packet you send that zips back and forth has your IP address inside. It has to have your IP address, or the remote server would not know where to route the requests back to. This means that even if you are snooping around where you shouldn't be, even if it’s not on an indexed site, those server logs can still give you up, even when a normal HTTP/SOCKS proxy is used. When your door gets kicked open and the Feds storm your living room, you will have wished you took the time to truly hide yourself.

Picture the Internet like a city, with each building as a resource with an address. Envision the non-indexed parts as alleyways, still connected to the main streets, but lacking public addresses of their own.

Let’s take it one step farther... what if these alleyways had gates? What if you could create a path through the city using just the alley and your own private keys? You would be much harder to locate and follow. You could always pop out into the city, go into a house as you needed; people would only see you come and go from the alley, would not know where you started nor where you intend to go.

This is the basic idea behind low-latency anonymous networks like Tor and i2p. We will go over both of these in more detail, including installation and configuration, in the upcoming articles, so stay tuned.

UPDATE: Continue to Part Two: Onions and Daggers

Photos by TheNewsJunkie, Wikipedia, OSTI, eschipul, Ubertech

Via Anonymity, Darknets and Staying Out of Federal Custody, Part One: Deep Web on null-byte.wonderhowto.com.

Related:

My Drawings: And a Newfound Sense of MADNESS!!!L@L!!!

William Bartlett — Fri, 24 Feb 2012 13:14:19 GMT

Via My Drawings: And a Newfound Sense of MADNESS!!!L@L!!! on mathcraft.wonderhowto.com.

Related:

How to Use Firefox Add-Ons and Greasemonkey to Make Google+ Perfect

toastykitten — Wed, 22 Feb 2012 22:28:58 GMT

Although +Google Chrome has been getting many deserved kudos for its innovations and speed, many people still prefer to use +Mozilla Firefox as their primary browser. If you’re a dedicated Google+ user, you know that there are many Google+ Chrome browser extensions available to modify your Google+ experience. What you may not know is that there are also Firefox extensions you can use for Google+.

Since Google+ changes so quickly, some of the Firefox add-ons I originally collected have quickly become outdated, or disappeared altogether. There aren’t as many as in Chrome, and what is there isn’t updated as frequently.

10 Firefox Add-Ons to Use With Google+

For overall Google+ management, you can’t go wrong with the Google+ Manager add-on, which does everything from providing keyboard shortcuts to translating posts and cross-posting to other social networks.

If you’re using Google+, chances are you still have other social media accounts you can quite seem to let go of. With SGPlus.me, and G++, you can cross-post your updates to Facebook and Twitter. As a bonus, you can use these extensions to get your Facebook and Twitter streams inside your Google+ account, so theoretically you won't ever have to leave the comfort of Google+.

If what bothers you about Google+ is the notification bar in all the Google products, OnlyPlusOnPlus will remove the notification bar from all Google products except for Google+.

Want some more flexibility with your photos in Google+? The Fullsize Image Viewer, by +Nick Smith, will let you open just about any image in Google+ in full size in a new tab. Thumbnail Zoom Plus lets you view images in their full sizes when you hover over them, and it also works for other sites besides Google+, including Reddit, Facebook, Flickr, and more.

Are you having fun with the +1 button? To +1 just about anything, try the Plus one Any, the Plus One Button, or the Google +1 Button by +Oliver Shlobe. If you’re a grump, though, and you’d like to show your disapproval, install the gminus extension.

Greasemonkey + Userscripts = Perfect Google+ Experience

One of the most popular ways to modify your browsing experience on Firefox is to install the Greasemonkey extension, and then install the userscripts of your choice. There are a lot of userscripts available for Google+. Try out the following and let us know what you think.

Google+ Tweaks: Get image previews, toggle comments, a mute button, and more.
Static Share for Google+: This extension will keep the Google+ share box in a fixed space on your browser window.
Go Away! Google Plus: If you want to keep Google+ separate from your other Google products, this script hides the Google+ notification and share buttons on all Google sites except for Google+.
Google Plus Right Side Bar Remover: Want more room? Hide the right side bar, and give yourself more space for content.
Google Plus Star: This script lets you star content you want to remember, similar to the function in Google Reader.
Google+ Fxxking Filter: If you’re sick of all the swearing, you con use this script to filter out words you don’t care to see.
Google Plus Auto Pager: This extension lets you automatically load more posts when you reach the end of your stream.
Google+ Expander+: Automatically load more posts at the end of your stream, and view enlarged images when you hover over them.
Unofficial Google+ Dense Theme: This theme condenses posts so you can see twice as much content.
Google+ Notifications Blocker: This script hides Google+ notifications in all Google products except for Google+.
Google+ Hover Zoom: Use this script to enlarge thumbnails, batch download photos, and more.

Warning

I didn't test out most of the Greasemonkey scripts; proceed with caution. The majority of extensions and scripts were created close after the initial launch of Google+, so some of them may not work as well now. Because Google+ ships new features just about every day, it's impossible for the creators to be on top of all the changes. If an extension you installed isn't working properly, don't forget to provide feedback to the creator so they can make the appropriate improvements.

Photo by ~Thanh

Via How to Use Firefox Add-Ons and Greasemonkey to Make Google+ Perfect on googleplus.wonderhowto.com.

Related:

WTFoto of the Day: Dead Serious Rules of the Indian Railways

James Carr — Thu, 23 Feb 2012 15:54:11 GMT

No dead bodies. Unless of course you buy them a ticket. Then it's easy sailing.

Stay tuned tomorrow for out-of-place panda!

Photo by James Carr

Via WTFoto of the Day: Dead Serious Rules of the Indian Railways on wtfoto.wonderhowto.com.

Related: