Orkut Social Application - An Alert Script trouble !

As been described here

" When one of my friends told this, I didn t take it very seriously. Because, what he told was not happening for me. What he told was  Hey G, whenever I come to your profile, a alert box appears with the name askoppal. Do you know who it is

Well, askoppal is my friend and is in my friends list, but nothing of that sort happened, because I was using opera then and scripts were blocked. But the interesting happened today morning when I used firefox, yes a alert box was indeed appearing when I visited my profile.

Primary Investigations showed me that there wasn t anything in the source that could be causing this. Then I went to askoppal s profile page and found that his profile name was
alert( askoppal )

and hence an alert box was appearing even in his profile page. But why in mine?

So what I did was I changed my title to a similar one.
alert( Jithin K.Rajeev )
And then I observed that even my name too was displayed in the alert box, but two times it appeared and then askoppal s name.

Now the question was, is there any possibility of compromising your account using this bug. If yes, has anyone already started exploiting this bug? I posted my thoughts at Hacker s Library. And Vipul responded back in my scrapbook. (I don t think I can recreate the conversation here as he keeps his scrap book empty.L.) Anyway let me see.

These are Vipul s perspective about how this bug can be exploited.

You can successfully make an XSS attack using the TypeRacer app s bug.

How about a link to an external script.
Actually name field has limited letters, so you can simply so is we can connect it via external scripts. But still, it s not good to have such a flaw!

The basic of XSS is if you re able to execute scripts on a remote machine using a bug from a live site.
We can just publish that malicious scripts can be executed in orkut can cause a  Man in Middle attack.

How are we able to execute script?
In what ways, one way is by typing in the First Name - Last name fields.

It s just working with profile name, nothing else.
Actually the profile name flashes in the TypeRacer app, that s why!

Then I tried using document.cookie in the script (javascript:alert( document.cookie ) when executed in your address bar displays the cookies set.) But the outcome was a blank alert box. This means that document.cookie did not carry any value. It was null, when executed via TypeRacer app.

To this Vipul replied

How about the spammers?
They can make fake accounts and add themselves in typeracer and then they put the redirection script to advertisement sites and can gain profits. A script hosted on a different server which contains the bunch of those click fraud URLs.

Then after some profile surfing, I found that it was irritating at times to have a bunch of alerts, in profile having TypeRacer app. It seems that JavaApplet can be executed via similar scripting. In a community discussion, I found the code which claimed to be  a orkut trojan

http://f4.filecrunch.com/files/20080512/cd347c7536557e269ff599fb5756fd9a/hi3.js

What this code does shall be discussed later. It basically mails your cookies and transfers your communities. But using latest firefox and ie7 avoids session and cookie hijacks and for transferring communities, the password is now required. So there isn t any possibility of account and community hijack. Only some irritating scripts might run. Well, use firefox with NoScript addon installed, to avoid all problems.

Best Solution : Remove TypeRacer App at least till the problem is resolved by the brains behind the application. And do use Firefox with NoScript addon."

50+ Google Reader Productivity Hacks

Google Reader is already a tool that can be used to boost your productivity throughout the day by letting you view your favorite blog’s feeds and posts in one spot: through your Google account. But for those of us who tend to get bogged down in a lot of useless subscriptions and really need to cut down on the minutes (or hours) we spend procrastinating each day, there are a lot of little hacks to make Google Reader more productive. We’ve compiled a list of over 50 of our favorites here.

Keyboard Shortcuts

Use these basic but necessary keyboard shortcuts to make searching, organizing, sharing and reading your feeds more efficient.

1. /: Use the forward slash to move your cursor to the search box and start looking for new stuff or saved items.
2. g then u: Type g then u to go to your subscriptions.
3. g then d: This shortcut will take you to the recommended page. If there are no recommendations, typing g then d will take you to the browse page.
4. 2: Press 2 to see your subscriptions in a list view or headline view.
5. ?: Find more keyboard shortcuts just for Google Reader by pressing the question mark.
6. Shift-s: Pressing Shift-S will share or un-share the selected item.
7. s: Star and un-star your highlighted items simply by pressing s.
8. Shift-o: Open up the highlighted subscription or folder with this shortcut.
9. g then h: Press g then h to go back to the Google Reader homepage.
10. g then shift-s: This shortcut will take you to the “Your Shared Items” page.
11. shift-n/p: n/p stands for Next/Previous, and using this combination will select the Next/Previous selection or folder.
12. v: Open up the original page of the selected item in Google Reader.
13. e: Quickly e-mail a page or other selection by pressing e when you’re in Google Reader.
14. r: Check to see if anymore unread updates have been added when you hit the r button in the navigation.

For Firefox

Firefox users like their browser’s speed and ability to add on new scripts or buttons. Check out several Google Reader-specific hacks for Firefox here.

15. Enhance Google Reader Preview: This script adds a Preview button so that you don’t have to open up an article or post all the way to read it.
16. BlogThis2Me: The BlogThis2Me script lets you “blog Google Reader’s “BlogThis!” to your own blog system, not to blogger.com,” as long as you have Firefox and Greasemonkey.
17. Smart Google Reader Subscribe Button: this script “adds an overlayed check icon when you’re subscribed to at least one of the feeds that the site advertises via auto-discovery.”
18. Gbutts 1.5.1: Gbutts is short for Google buttons, and you can add your Google Reader button, as well as any other Google buttons, to your Firefox address bar.
19. Better GReader: Better GReader works with Firefox adds a menu with extra options and features like Smart Subscribe, Preview Inline, Optimized Skin and others.
20. Google Reader Watcher: Google Reader Watcher is an add-on that makes Firefox check your Google Reader for unread fees. This download does not require Greasemonkey.
21. Quick Hide Message: Shave off milliseconds with this script, which “quickly hides the message displayed in Google Reader after performing renames, folder changes,” and other actions.
22. Auto Add Feed: The Auto Add Feed script only adds feeds to Google Reader, instead of asking you where you want it to be saved.
23. Title Unread Count: This hack moves the unread count in Google Reader to the front.
24. Greasereader: Add even more hot keys to your Google Reader systems by reading this guide.
25. Google Reader All Starred: Extract all of your starred items as links from Google Reader so that you don’t have to download each one.
26. Google Reader Read by Mouse: Set up this script so that you can use a mouse-only system to read your feeds. It uses mouse buttons for the following actions: next item, previous item, and more.

Real Time Savers

If you’re serious about making your Google Reader visits more efficient, learn how to categorize by priority, use the “next” bookmarklet, and implement scripts that let you autoscroll, review your subscriptions and more.

27. Categorize by priority: Stepcase Lifehack recommends categorizing your feeds by priority so that you don’t get bogged down in irrelevant articles.
28. Google Reader Autoscroll: The autoscroll script lets you “view and mark items as read by means of a mouse wheel and keyboard shortcuts.”
29. Mark All as Read: If you only want to read one article from a feed, you can mark everything else as read to weed out your extra entries.
30. Google Reader Scroll Reducer: With this script, you’re able to comment on and view the original site without having to scroll to the top of page to get to the URL.
31. The “Next” Bookmarklet: The Google Reader Blog discusses this hack, which “allows you to use Google Reader through just one link — clicking on it takes your browser to the next unread item in your reading list.”
32. Review your subscriptions: Are you still getting subscriptions for some obscure hobby you were only interested in a year ago? Go through your subscriptions and delete any that you don’t really want emptied into your account regularly.
33. Print Button v2.0: The Google Reader Print Button v2.0 allows users to print either the selected content or everything that’s displayed on the page in Google Reader.
34. Gmail + Google Reader: Add Google Reader into your Gmail account so you don’t have to constantly switch back and forth.
35. Google Reader Filter: Get rid of duplicate and unwanted content with this script.
36. Tag your items: Take advantage of the tagging feature on Google Reader. It’s there to help you stay organized and more productive.

Social Media Hacks

How much time do you waste each day checking all of your social media accounts? These hacks let you sync up Google Reader with Facebook, Twitter, Tumblr, Google Chat and more.

37. Google Reader + ma.gnolia: This basic script lets you add a Google Reader post to ma.gnolia.
38. Google Reader Digg News: Add a Digg button to your Google Reader posts with this script.
39. Tumblr: Sync up your Google Reader and Tumblr with this script. You can attach your reblog button or Share-on-Tumblr at the bottom of articles on Google Reader.
40. Managing Your Shared Items: This post from the Google Reader Blog shows you how to add and remove friends from your Gmail or GChat account.
41. Google Reader and Flickr: Now you embed Flickr videos into your Google Reader, so you don’t have to switch back and forth to share with extra friends or read their comments.
42. Facebook Sharer + Google Reader: Share your favorite posts and articles with Google Reader friends and Facebook friends.
43. Google Reader + del.icio.us: Use this script to define tags and links for a faster way of posting to del.icio.us.
44. Google Reader + Twitter: Use this script to add reader posts to Twitter.

Add-Ons and Solutions

Try out these add-ons to customize your Google Reader experience and streamline your Google accounts.

45. Google Reader Notifier: This extension keeps you updated by showing you how many unread items you have in your account.
46. Add a Search: Add a search engine to your Google Reader account to make searching for items faster.
47. Google Reader Optimized: Use this script to view Google Reader in a larger space. The last official update was in 2006, but Google Reader users have submitted updates.
48. Google Reader Romeo Script: Check out this script to access Google Reader from your cell phone — if you don’t have an iPhone.
49. Google Reader Button for Internet Explorer: IE users can add on a Google Reader to their browser using this tutorial.
50. iPhone Skin: iPhone users can easily view Google Reader on their phones with this special skin from developer David Cann.
51. Iris: View your Google Reader subscriptions in a Firefox sidebar.
52. Go behind the scenes: If you want to know how many people have subscribed to a certain feed, you can use this tutorial to speed up your search times.

Thank You !

ALL ABOUT NETSTAT - A TUTORIAL

Note- This tutorial may bear a resemblance to tutorials written by other authors. I have acknowledged to tutorials or articles that I referred before writing this tutorial. It is possible that there may be other tutorials I have not referred and are similar to my tutorial. It is not possible for me to give acknowledgment to such tutorials and hence there must be no copyright or legal issues regarding this tutorial.

Dear reader

In this tutorial I am going teach how to use a very useful command netstat. By using netstat you will be able to find out the ip address of your computer and of the remote computer connected to your computer and most importantly you will be able to know what ports are open on our computer - this will help you know if your computer is infected by a Trojan. Let us see how to launch netstat command. netstat is a MS-DOS based command, you can not use mouse to interact with this utility. To launch this command simply run MS-DOS prompt. To do this just click on 'Run...' after clicking on Start button and then type command and press enter key. Alternatively you can select MS-DOS prompt from Start menu if you are using windows 98 or from accessories if you are using windows NT,2000 or XP. After launching command prompt you will get

C:\windows>

or

C:\>

To launch netstat type netstat -a and press enter key.

C:\windows>netstat -a

This will give output similar to this.

Active Connections

Proto Local Address Foreign Address State

TCP gaurav:1753 www.ethicalhackers.tk:http ESTABLISHED

TCP gaurav:1081 ftp.mycgiserver.com:ftp ESTABLISHED

TCP gaurav:1036 ftp.mycgiserver.com:ftp-data TIME_WAIT

TCP gaurav:1145 mail.sec33.com:pop3 ESTABLISHED

Let us try to understand this output in some detail.

Proto Its full name is Protocol. A protocol is simply a set of rules that your computer follows to communicate to other computers.

The TCP shown under the heading Proto shows that our computer is using the TCP (Transfer Control Protocol ) to communicate to the other computer. An other type of protocol is UDP

Local Address This is the address of our computer. Under this heading we can see gauarv:1081. gaurav is the name of our computer. This is the name asked by windows setup during installation.1081 is our local port number and is randomly generated. A port is simply a virtual 'road' on which internet data 'travels'

Foreign Address This is very important for us. Under this heading we can see ftp.mycgiserver.com This shows that our computer is connected to computer having name ftp.mycgiserver.com

State This tells about the state of our connection. Following table will help you in understanding these.

STATE	WHAT DOES IT MEAN
CLOSED	There is no connection between your computer and remote host.
CLOSING	Your computer and remote computer have both agreed to close connection.
CLOSE WAIT	The remote computer has initiated to close the connection
ESTABLISHED	There is a connection.
FIN WAIT 1	The software using connection (like msn messenger) has finished using the connection
FIN WAIT 2	The remote computer has agreed to close connection.
LAST ACK	The connection is waiting for all the data packets to destroy.
LISTEN	Your computer is listening for incoming connection
SYN RCVD	Remote computer is sending a request for connection
SYN SENT	Your computer has initiated to open a connection
TIMED WAIT	same as LAST ACK

Now let us see some other options available with the netstat command. If you want to know the options available you can pass /? as an argument to the netstat command i.e.

---

c:\windows>netstat /?

We will get the following output.

Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-e] [-n] [-s] [-p proto] [-r] [interval]

-a Displays all connections and listening ports. (Server-side connections are normally not shown).

-e Displays Ethernet statistics. This may be combined with the -s option.

-n Displays addresses and port numbers in numerical form.

-p proto Shows connections for the protocol specified by proto; proto may be tcp or udp. If used with the

-s option to display per-protocol statistics, proto may be tcp, udp, or ip.

-r Displays the contents of the routing table.

-s Displays per-protocol statistics. By default, statistics are shown for TCP, UDP and IP; the -p

option may be used to specify a subset of the default.

interval Redisplays selected statistics, pausing interval seconds between each display. Press CTRL+C to

stop redisplaying statistics. If omitted, netstat will print the current configuration information

once.

---

Before we explore all the options let us apply the knowledge we have just gathered. Let suppose we want to find out if our computer is infected with a Trojan. For those who don't know about Trojans I would like to tell them that Trojans malicious programs that may have come in form of a email attachment or in the form of infected software. These Trojans generally listen on some port for connections and after accepting the connection the remote computer user may execute any command on your computer. The most popular trojan is Back Orifice

So if you want to check out whether your computer is infected with Back Orifice you will run command netstat -a and if it shows that your computer is listening on port 31337 you must download some Trojan removal software. Please note that these Trojans have options that allow the remote attacker allow to change default port for accepting connections. For example a remote attacker may have changed the default port from 31337 to 54871. So you must look for suspicious ports. Click here to get a list of such Trojans and the default ports on which they accept connections.

Now let us explore all the options available with the netstat command. We have already used -a option that shows all the connections and listening ports. Let use explore -n option.

The netstat -n command will display the numbers in place of the names i.e. instead of name of our computer we will get the ip address of our computer. This option is helpful if we want to know the ip address of our computer and of the remote computer connected to our computer.

The netstat -p command is used to get information related to a particular protocol. Suppose we want to know only about the connections using UDP we will use command netstat -p udp and netstat -p tcp for connections using tcp. Please note that we can combine options. For example the command netstat -a -p udp and this will give us information about all the connections using UDP.

The netstat -s and netstat -e command are used to display detailed statistics about the different protocols. These commands are generally to correcting network problems.

The netstat -r is used to display routing tables. We need not go in details but I would like to tell you that routing table is used by computers to figure out by which route they should pass on the data. If a computer can not find out a suitable route it will discard the data packet.

Now before I end this tutorial let us see the use of interval option. If you specify a number in place of interval the netstat command will run again and again after that period of seconds. e.g. netstat -a 1 To exit from the command you will have to press CTRL+C.

NETBIOS BASED HACKING TUTORIAL - For Edu. purpose only ~

Note- This tutorial may bear a resemblance to tutorials written by other authors. I have acknowledged to tutorials or articles that I referred before writing this tutorial. It is possible that there may be other tutorials I have not referred and are similar to my tutorial. It is not possible for me to give acknowledgment to such tutorials and hence there must be no copyright or legal issues regarding thistutorial.

Preface

Dear reader I have written this tutorial keeping in mind that readers having only the basic knowledge will also be able to know how hackers hack using NetBIOS. Using NetBIOS for hacking is the probably the easiest way to hack remotely. I strongly oppose hacking but not ethical hacking. An ethical hacker is one that hacks computer networks not for anti social reasons but to let the network administrators know about the security holes so that they can prevent their computers from hacking.

Contents-

A brief lesson on NetBIOS

The NBTSTAT command

What you need to hack ?

Types of attacks

Searching for a victim

Lets Hack - Part 1 Remotely reading/writing to a victim's computer

Cracking "Share "passwords

Using IPC$ to hack Windows NT

Penetrating in to the victim's computer

Lets Hack - Part 2 Denial of service attack

How to protect yourself

Thanks You and our readers.