Sunday, October 24, 2010

Protecting email address on web pages from spambots

This tip will help you in protecting your email address from spambots. Avoiding spam is not easy and there are several steps you can take to stop spam. However, this tip describes just one of ways of protection against it. The tip describes how to prevent spambots from picking your email address from your web site.

What is 'spam' and how to they get your email from a web page?

SPAM is unsolicited email. It's something you never asked for and most of the times, it's garbage!
When you include a mailto tag in a web page, you expose your email to spammers. Getting an email address from a mailto tag is quite easy. You would have noticed that email addresses follow a set format. Spambots are spider like programs that move around on the internet checking HTML documents for this format. When they find it, they extract the email address and store it for their diabolical needs.
But there is a way to fool spambots. If you write the email address as a series of special characters, instead of alphabet, it's highly unlikely that spambots would be able to pick it up.
Each lowercase alphabet has a corresponding special character that we call a Character Entity. In addition to lowercase alphabet, there are special characters for @, the underscore, the period and the hyphen. You can find the full list of HTML Special Characters of Character Entities in the Web Design section.
Each special character starts with an ampersand sign, followed by a hash, then a specific numeric value and ends with a semicolon. Thus, the special character for a is a for b is b and so on.
Now if you have an email address like bard@somewhere.com, you should write it as a series of special characters:

bard@somew
mere.com
This looks really messed up.. but that's the price you have to pay to protect yourself from spam.




However, the above method is not foolproof. Addition of a few lines of code to the spambot can ensure that the script searches for email addresses in both human and character entity formats. The safest way to display an email address on a page is to use it as an image or a Flash file. However, with images if you use mailto, the purpose is lost. So a Flash file would be the best.
Update: Google search engine can now read flash files so I guess spambots would be able to read these too (if not now then sometime in the near future).
So what are you left with? - Use HTMl forms and server-side programming to receive visitor inputs.



An example of munging "user@example.com" via client-side scripting would be:

< (remove this text)script type="text/javascript">
var name = 'user';
var at = '@';
var domain = 'example.com';
document.write(name + at + domain);

Monday, October 18, 2010

tutorial of telnet session with gmail to send mail via smtp protocol

hi friends here is working tutorial of telnet session with gmail to send mail via smtp protocol


basic
go to
http://www.motobit.com/util/base64-decoder-encoder.asp
convert your username and password to hex string
then

go to command prompt
type
telnet smtp.gamil.com 587
then


##########################################3


250 mx.google.com at your service
auth login
334 VXNlcm5hbWU6
uuuuuuuuuuuuuuu1111111111<-------user name hex string
334 UGFzc3dvcmQ6
pppppppppppppppp222222222<-------password hex string
235 2.7.0 Accepted
MAIL FROM:
250 2.1.0 OK f14sm12564610wbe.20
RCPT TO:
250 2.1.5 OK f14sm12564610wbe.20

data i lake this telnet stuff
354  Go ahead f14sm12564610wbe.20
subject: smtp
.
250 2.0.0 OK 1287428373 f14sm12564610wbe.20
quit
221 2.0.0 closing connection f14sm12564610wbe.20


Connection to host lost.

C:\Documents and Settings\omie>

rock on ...........check your inbox you have mail now...how to put data u work out...

Saturday, October 16, 2010

Google finely crafted searches

Using Google, and some finely crafted searches we can find a lot of interesting information.

For Example we can find:
Credit Card Numbers
Passwords
Software / MP3's
...... (and on and on and on)
Presented below is just a sample of interesting searches that we can send to google to obtain info that some people might not want us having.. After you get a taste using some of these, try your own crafted searches to find info that you would be interested in.

Try a few of these searches:
intitle:"Index of" passwords modifiedallinurl:auth_user_file.txt
"access denied for user" "using password"
"A syntax error has occurred" filetype:ihtml
allinurl: admin mdb
"ORA-00921: unexpected end of SQL command"
inurl:passlist.txt
"Index of /backup"
"Chatologica MetaSearch" "stack tracking:"

Amex Numbers: 300000000000000..399999999999999
MC Numbers: 5178000000000000..5178999999999999
visa 4356000000000000..4356999999999999

"parent directory " /appz/ -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " DVDRip -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory "Xvid -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Gamez -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " MP3 -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
"parent directory " Name of Singer or album -xxx -html -htm -php -shtml -opendivx -md5 -md5sums
Notice that I am only changing the word after the parent directory, change it to what you want and you will get a lot of stuff.
METHOD 2
put this string in google search:
?intitle:index.of? mp3
You only need add the name of the song/artist/singer.
Example: ?intitle:index.of? mp3 jackson
METHOD 3
put this string in google search:
inurl:microsoft filetype:iso
You can change the string to watever you want, ex. microsoft to adobe, iso to zip etc…
"# -FrontPage-" inurl:service.pwd
Frontpage passwords.. very nice clean search results listing !!

"AutoCreate=TRUE password=*"
This searches the password for "Website Access Analyzer", a Japanese software that creates webstatistics. For those who can read Japanese, check out the author's site at: http://www.coara.or.jp/~passy/

"http://*:*@www" domainname
This is a query to get inline passwords from search engines (not just Google), you must type in the query followed with the the domain name without the .com or .net

"http://*:*@www" bangbus or "http://*:*@www"bangbus

Another way is by just typing
"http://bob:bob@www"

"sets mode: +k"
This search reveals channel keys (passwords) on IRC as revealed from IRC chat logs.

allinurl: admin mdb

Not all of these pages are administrator's access databases containing usernames, passwords and other sensitive information, but many are!

allinurl:auth_user_file.txt
DCForum's password file. This file gives a list of (crackable) passwords, usernames and email addresses for DCForum and for DCShop (a shopping cart program(!!!). Some lists are bigger than others, all are fun, and all belong to googledorks. =)


intitle:"Index of" config.php
This search brings up sites with "config.php" files. To skip the technical discussion, this configuration file contains both a username and a password for an SQL database. Most sites with forums run a PHP message base. This file gives you the keys to that forum, including FULL ADMIN access to the database.

eggdrop filetype:user user
These are eggdrop config files. Avoiding a full-blown descussion about eggdrops and IRC bots, suffice it to say that this file contains usernames and passwords for IRC users.

intitle:index.of.etc
This search gets you access to the etc directory, where many many many types of password files can be found. This link is not as reliable, but crawling etc directories can be really fun!

filetype:bak inurl:"htaccess|passwd|shadow|htusers"
This will search for backup files (*.bak) created by some editors or even by the administrator himself (before activating a new version).
Every attacker knows that changing the extenstion of a file on a webserver can have ugly consequences.

Let's pretend you need a serial number for windows xp pro.
In the google search bar type in just like this - "Windows XP Professional" 94FBR
the key is the 94FBR code.. it was included with many MS Office registration codes so this will help you dramatically reduce the amount of 'fake' porn sites that trick you.
or if you want to find the serial for winzip 8.1 - "Winzip 8.1" 94FBR

Google Login Searches

intitle:”remote assessment” OpenAanval Console
intitle:opengroupware.org “resistance is obsolete” “Report Bugs” “Username” “password”
“IMail Server Web Messaging” intitle:login
“Login – Sun Cobalt RaQ”
“Login to Usermin” inurl:20000
“Microsoft CRM : Unsupported Browser Version”
“OPENSRS Domain Management” inurl:manage.cgi
“please log in”
“powered by CuteNews *.* © * CutePHP
“SysCP – login”
“ttawlogin.cgi/?action=”
“VHCS Pro ver” -demo
“VNC Desktop” inurl:5800
“Web Control Panel” “Enter your password here”
“WebExplorer Server – Login” “Welcome to WebExplorer Server”
“WebSTAR Mail – Please Log In”
(inurl:”ars/cgi-bin/arweb?O=0″ | inurl:arweb.jsp) -site:remedy.com -site:mil
4images Administration Control Panel
allinurl:”exchange/logon.asp”
ASP.login_aspx “ASP.NET_SessionId”
CGI:IRC Login
ez Publish administration
filetype:php inurl:”webeditor.php”
filetype:pl “Download: SuSE Linux Openexchange Server CA”
filetype:r2w r2w
intext:”"BiTBOARD v2.0″ BiTSHiFTERS Bulletin Board”
intext:”Mail admins login here to administrate your domain.”
intext:”Storage Management Server for” intitle:”Server Administration”
intitle:”Athens Authentication Point”
intitle:”ColdFusion Administrator Login”
intitle:”Dell Remote Access Controller”
intitle:”ePowerSwitch Login”
intitle:”Icecast Administration Admin Page”
intitle:”ISPMan : Unauthorized Access prohibited”
intitle:”ITS System Information” “Please log on to the SAP System”
intitle:”Login – powered by Easy File Sharing Web Server”
intitle:”MailMan Login”
intitle:”microsoft certificate services” inurl:certsrv
intitle:”MikroTik RouterOS Managing Webpage”
intitle:”MX Control Console” “If you can’t remember”
intitle:”Novell Web Services” intext:”Select a service and a language.”
intitle:”oMail-admin Administration – Login” -inurl:omnis.ch
intitle:”Philex 0.2*” -script -site:freelists.org
intitle:”PHP Advanced Transfer” inurl:”login.php”
intitle:”php icalendar administration” -site:sourceforge.net
intitle:”php icalendar administration” -site:sourceforge.net
intitle:”please login” “your password is *”
intitle:”Remote Desktop Web Connection” inurl:tsweb
intitle:”teamspeak server-administration
intitle:”Tomcat Server Administration”
intitle:”TUTOS Login”
intitle:”vhost” intext:”vHost . 2000-2004″
intitle:”Virtual Server Administration System”
intitle:”VitalQIP IP Management System”
intitle:”VNC viewer for Java”
intitle:”WebLogic Server” intitle:”Console Login” inurl:console
intitle:”Welcome Site/User Administrator” “Please select the language” -demos
intitle:”welcome to netware *” -site:novell.com
intitle:”ZyXEL Prestige Router” “Enter password”
intitle:Group-Office “Enter your username and password to login”
intitle:Login * Webmailer
intitle:Login intext:”RT is © Copyright”
intitle:Node.List Win32.Version.3.11
intitle:Novell intitle:WebAccess “Copyright *-* Novell, Inc”
intitle:plesk inurl:login.php3
inurl:”1220/parse_xml.cgi?”
inurl:”631/admin” (inurl:”op=*”) | (intitle:CUPS)
inurl:”:10000″ intext:webmin
inurl:”Activex/default.htm” “Demo”
inurl:”calendar.asp?action=login”
inurl:”gs/adminlogin.aspx”
inurl:”typo3/index.php?u=” -demo
inurl:”usysinfo?login=true”
inurl:”utilities/TreeView.asp”
inurl:/admin/login.asp
inurl:/cgi-bin/sqwebmail?noframes=1
inurl:/Citrix/Nfuse17/
inurl:/dana-na/auth/welcome.html
inurl:/eprise/
inurl:/webedit.* intext:WebEdit Professional -html
inurl:1810 “Oracle Enterprise Manager”
inurl:administrator “welcome to mambo”
inurl:cgi-bin/ultimatebb.cgi?ubb=login
inurl:confixx inurl:login|anmeldung
inurl:coranto.cgi intitle:Login (Authorized Users Only)
inurl:default.asp intitle:”WebCommander”
inurl:irc filetype:cgi cgi:irc
inurl:login filetype:swf swf
inurl:login.asp
inurl:login.cfm
inurl:login.php “SquirrelMail version”
inurl:metaframexp/default/login.asp | intitle:”Metaframe XP Login”
inurl:mewebmail
inurl:names.nsf?opendatabase
inurl:orasso.wwsso_app_admin.ls_login
inurl:postfixadmin intitle:”postfix admin” ext:php
inurl:search/admin.php
Login (“Powered by Jetbox One CMS ª” | “Powered by Jetstream © *”)
Novell NetWare intext:”netware management portal version”
Outlook Web Access (a better way)
pcANYWHERE EXPRESS Java Client
PhotoPost PHP Upload
PHPhotoalbum Statistics
PHPhotoalbum Upload
phpWebMail
Powered by INDEXU
Ultima Online loginservers
url:”webadmin” filetype:nsf

Hacker’s Laws

Hacker’s Laws

LAWS OF COMPUTER PROGRAMMING
—————————-
1. There is always one more bug.
2. Any given program, when running, is obsolete
3. If a program is useless, it will have to be documented.
4. If a program is useful, it will have to be changed.
5. Any program will expand to fill all available memory.
6. The value of a program is proportional to the weight of its output.
7.Program complexity grows until it exceeds the capability of the programmer to maintain it.
8. Make it possible for programmers to write in English and you will find out that programmers cannot write in English.

WEINBERG’S LAW
————–
 If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization.

HARE’S LAW OF LARGE PROGRAMS
—————————-
 Inside every large program is a small program struggling to get out.

TROUTMAN’S PROGRAMMING LAWS
—————————
1.If a test installation functions subsequent systems will malfunction.
2. Not until a program has been in production for at least six months will the most harmful error then be discovered.
3. Job control cards that cannot be arranged in improper order will be.
4. Interchangeable tapes won’t
5. If the input editor has been designed to reject all bad input,an ingenious idiot will discover a method to get bad data past it.
6.Machines work, people should think.

GOLUB’S LAWS OF COMPUTERDOM
—————————
1. A carelessly planned project takes three times longer to completed than expected; a carefully planned project will take only twice as long.
2. The effort required to correct the error increases geometrically with time.

BRADLEY’S BROMIDE
—————–
 If computers get too powerful, we can organize them into a committee – that will do them in.