Shut Down system by double Clicking on Internet Explorer !!!

Double click on Internet explorer to Restart the Computer:

1) Goto Desktop
2) Right click > new > Shortcut
3) In “Type the Location of the item” > write: “C:\WINDOWS\system32\shutdown.exe -r -t 00″ without coutes.
4) Click next and in “Type a name for this shortcut” write ” Internet Explorer” and click Finish.
5) Now Right Click on the shortcut of Internet Explorer and goto “Change Icon” and select the icon of Internet Explorer.

6) Now Virus is Ready….. check it out.. when you will double click on Internet Explorer Shortcut… Computer will Restart.

7) This is just  a Prank… don’t Misuse it..

How to make a folder with name “con” ?

"CON" is the system keyword and you can't create it using normal method. Just try cmd .

Folder with Name "con"

Goto command Prompt,

Goto the location where you want to make the folder with name “con”.

write the command: mkdir \\.\e:\con

To remove the folder again: rmdir \\.\e:\con

Conceal XSS Injection in HTML5

history.pushState() was introduced in HTML5 and it’s meant for modifying history entries.

By using pushState() we’re allowed to alter the visible URL in address bar without reloading the document itself

The Harmful Part : -

The harmful part is that we can conceal the real location and replace it with anything we want. Although the hostname can’t be replaced, we can completely change the pathname.

so, I made a brief PoC about hiding a non-persistent XSS exploit. It’s about executing a malicious script on a login page through a non-validated query parameter (quite common situation). The script redefines form.action and then removes the malicious query parameters of the URL shown in address bar.

Proof of Concept : -

This PoC works only in modern browsers that has implemented this HTML5 proposal. This only works in Google Chrome 9 and Firefox 4 Beta.

pushState() works properly also in Safari 5, but it’s security control refuses to load external scripts or execute injected scripts.

I’ll inject some malicious code via query parameter:

Code:

?username=”>


As you can see the URL is pretty ugly. Therefore shortened it in a trusted URL shortener service (like everyone does nowadays): http://bit.ly/pushStateXSS.

Just visit this URL to see how pushState() behaves and what is shown in address bar.


Conclusion : -

Can this be considered as a security flaw?

Definitely yes.

How it should be fixed? –

There should be a property, eg. history.allowPushState which would be set to false by default. And website developers could explicitly set it to true while being aware of the risks. Edit: I’ve received some feedback about this.

And you’re right – this wouldn’t fix anything since it could be set to true in injection.

Online SQLI Scanning Website !!

You can use all these website for online SQLI Scanning. For these you will need a Little Knowledge of  SQL Injection

    http://www.be007.gigfa.com/scanner/scanner.php
    http://scanner.drie88.tk/
    http://localvn.biz/Tools/tools/Hack-Shop/SQLI-Scan
    http://wolfscps.com/gscanner.php

How to Hide text behind images ? (Stegonography)

Step 1 Copy an image file to c: of your computer.

Step 2 Copy the text(which you want to hide) to clipboard, by writing it in notepad and selecting it, right clicking it, then copy.

Step 3 Open cmd, by going to Start — All Programs — Accessories — Command Prompt.

Step 4 In cmd type :

cd \

echo “your text to hide” >> “image.jpg”.

Step 5 Now right click on image.jpg — Open with — Notepad. You can see your hidden text at the end of your image file contents.

How to find who is Invisible on Yahoo messenger ?

Sometimes some of your friends who appear offline in yahoo messenger may not be actually offline, they may in the ‘Invisible’ mode. This maybe if they are trying to ignore you or are too busy to talk to anyone.

There is this small trick that you can use to find out what the truth is.

Firstly open your yahoo messenger main window and double click on the name of the person whom you want to check. The chat window will open obviously.
Click IMVironment button, select See all IMVironments, select Yahoo! Tools or Interactive Fun, and click on Doodle.
After loading the Doodle imvironment there can be two possibilities

1.If the user is offline Doodle are will show this “waiting for your friend to load Doodle” continuously .See in the picture below:

2. If the user is online (but in invisible mode), after few seconds (it can take up to one minute, depending on your connection speed), you should get a blank page like in the picture below. So you know that the user is online.

How to Reset the Ubuntu Password....

Reset Your Ubuntu Password

Reboot your computer, and then as soon as you see the GRUB Loading screen, make sure to hit the ESC key so that you can get to the menu.

Root Shell – Easy Method

If you have the option, you can choose the “recovery mode” item on the menu, usually found right below your default kernel option.

Then choose “Drop to root shell prompt” from this menu.

This should give you a root shell prompt.

Alternate Root Shell Method

If you don’t have the recovery mode option, this is the alternate way to manually edit the grub options to allow for a root shell.

First you’ll want to make sure to choose the regular boot kernel that you use (typically just the default one), and then use the “e” key to choose to edit that boot option.

Now just hit the down arrow key over to the “kernel” option, and then use the “e” key to switch to edit mode for the kernel option.

You’ll first be presented with a screen where you can find this written “ro single”

You’ll want to remove the “ro single” part with the backspace key, and then add this onto the end:

rw init=/bin/bash

Once you hit enter after adjusting the kernel line, you’ll need to use the B key to choose to boot with that option.

At this point the system should boot up very quickly to a command prompt.

Changing the Actual Password

You can use the following command to reset your password:

passwd <username>

After changing your password, use the following commands to reboot your system. (The sync command makes sure to write out data to the disk before rebooting)

sync

reboot –f

I found that the –f parameter was necessary to get the reboot command to work for some reason. You could always hardware reset instead, but make sure to use the sync command first.

And now you should be able to login without any issues.