yahoo session cookie generator

gammarays has release a paper and a video showing proof of concept on how to bypass yahoo security by simply generating his own cookie and totally leaving login.yahoo.com out of the picture.....If you own a yahoo account, then this may be of a concern to you.....Doesn't surprise me that something like this would happen to another microsoft shop...seeing as this is only one layer user authentication....Security matters...I hope they resolve this issue faster than I can finish playing bee on guitar hero...Who needs to hijack cookie when you have yahoo cookie generator, eh...Next we should see viruses and spam coming from your trusty contacts... Just like CAPTCHA, I tell you. It's not in the algo you use to construct the image. It's in how you present it to the user that determines it's strength.

edited:
video:
milw0rm.com/video/watch.php?id=84

paper:
milw0rm.com/papers/270

more on this from Rizki:
ilmuhacking.com/web-security/yahoo-session-cookie-generator/

learn dd command

nice thread about dd command.....check it

linuxquestions.org/questions/linux-newbie-8/learn-the-dd-command-362506/

If you want a good book on this subject also check out File System Forensic Analysis by Brian Carrier (creator of TSK)

No sense in me, doubling someones efforts...

SSL broken! Hackers create rogue CA certificate using MD5 collisions

Wow, what a way to start the new year.

It was a matter of time before SSL would be broken.

It's about time. Will be interesting to see what will come of this.


blogs.zdnet.com/security/?p=2339


HAPPY 2009!

How To Convert PDF Document To Images and Vice Versa

To Convert PDF to JPG:
convert some.pdf some.jpg
# this will create some.jpg.PAGE# for each page in the PDF

Alternately if you want custom naming scheme:
convert some.pdf some%03d.png
# this will create somePAGE#.png

To create PDF out of multiple image in a directory:
cd img_dir && convert *jpg some.pdf
#places each image on it's own PAGE

If you need more info than this don't stop Googling.

How to By-Pass Stats/Tracking Systems

There are a number of ways that one can bypass statistics and user tracking systems that are in use on alot of websites these days. Most systems that employ user tracking either do it via the url/uri string,1x1 pixel images,web server logs, etc...

1. Use lynx/links/links2 for browsing web pages. (This won't load any images and browsing experience is not the same, but you can still see text, which is the most important part anyway)

2. Disable JS(NoScript/FlashBlock) and showing of images in browser. If you use Firefox Web Browser you can find Extensions that will block those pesky 1x1 tracker images for you. AdBlock

3. Pay Attention on what you click and instead off clicking on a link. copy/paste it with minor modifications(removal of a unique id off some sort or something)

4. Modify your User Agent string in your browsers configuration.

5. Use a proxy. There are plenty of proxy lists out there for you to use. Be sure to check the RBL for the proxy you use or you may have problems with accessing some sites/services since they may check proxies ip in RBL. Yes, spammers use proxies to send spam, but so do people that don't send spam and want a little anonymity.

6. Disable cookies. NOTE: Not all sites will work without cookies. You may want to disable cookies on a per site/domain bases. eg. regex.

7. Delete cookies when changing IP or moving to different proxy, etc...

Also:
Make sure to protect yourself with Firefox Addons (Noscript, LocalRodeo, RequestPolicy)

Of course this is not full proof and really depends on the tracking system at hand. If you would like to comment I would appreciate any more ways/ techniques to bypass tracking and stats systems.
Enjoy!

Load different application based on ip address in CI(CodeIgniter)

You can modify the default index.php that comes with codeigniter to load a different application based on ip address. Why would I want to do that? You ask. Well, this would allow you to host the main application on a single internal server. While allowing your other servers that face client application. What this means is that you can create the meat of multiple different sites/domain and host them on the one. Then you can access this internal server from the childs and they will display data to the clients. Basically you would create a domain/site, host one file on it to get site based on domain and other options and display it to client. You can also create some basic caching capability.

Add this basic code in your index.php file:

if($_SERVER["REMOTE_ADDR"]=="192.168.1.5")
$application_folder = "app";
else
$application_folder = "application";

Of course you could create an array and setup multiple domains with the index.php file that receives the site and sends it to the client. Everything would go thru the uri string and you can implement a highly encrypted string and licensing to the internal server with all apps on it. Then just make sure that same index.php file is on all supported domains. :)