Albertux# ./Blog

Magic June

48 61 63 6b 20 54 68 65 20 50 6c 61 6e 65 74

Many changes in this month.

I was go to Hacker Dojo. I meet Rob Brown a Javascript hacker, he develop this great tool: Aardvark

function currentTime() {
    currentTime = new Date();
    return {
        year: currentTime.getFullYear(),
        month: currentTime.getMonth() + 1,
        day: currentTime.getDate()
    };
}
 
now = currentTime();
 
if ( ( now.day == 14 ) && ( now.month == 6 ) && ( now.year == 2010 ) ){
    Albertux.prototype.age = 26; // Another year of life.
}

I always like hamburger with fries inside:

Pictures and videos for me:

I’m not EMO!!!

Now I’m working on 2 projects as outsourcing for a moment:

• www.3taps.com
• www.rrripple.com (not more)

I do some stuff from rrripple for free, why calling me ? and asking me to do a specific schedule, but anyway the bugs I discover are here:

Duplicate items (not validation):

Percent go crazy after upload something.

Download Videos:

• Write notes sucks
• rrripple sessions on many browsers without cookies (they only validate remote address)
• Easy to brute force (only you need to write a script and wordlist (password are on md5))

You need VLC to watch this videos

The bugs I discover not watching the source code, only using the application Firefox with firebug and use cURL to show the brute force login and only using the application less than a hour.

But there are good news:

Tech Crunch Review from rrripple.com

My personal comment:

I never work for free, sucks, sucks, sucks.

Library Pics

You know I always follow the rules

My Job for a moment is seeking Job hahahaha XD

And June is almost over but not yet.

More Codes, Hacks and Girls in the next Post.

Talking with Preth00nker, says check Samurai Distro (Oriented to pen-testing Web Applications)

Link: http://samurai.inguardians.com/

Insecurity

Tools:
Nikto.pl Web Scanner
nmap Network Scanner
Metasploit Framework
wfuzz Brute Force Web App
Wireshark Network Protocol Analyzer
Snort IDS
Nessus (vulnerability scanner)
Hydra Cracker Password
John the Ripper Cracker Password (Passive)

Linux Distros:
BackTrack Wireless Tools and others
Damn Vulnerable Linux

Others:
http://sectools.org/
http://www.milw0rm.com/
http://www.exploit-db.com/
http://www.securityfocus.com/

Firewalls

smothwall
ipcop
untangle
endian
m0n0wall
vyatta
pfsense

Other option: install any linux flavor + squid + iptables

Good option for windows users: http://personalfirewall.comodo.com/

Block Messenger (squid + iptables)

In Mexico i was installed a firewall and squid on a server the important options are:

squid.conf:

acl no_permitido dstdomain "/etc/squid/blocked.domains"
acl msn_mime req_mime_type -i ^application/x-msn-messenger$
acl msn_gw url_regex -i gateway.dll
http_access deny all msn_mime
http_access deny all msn_gw

blocked.domains:

.ebuddy.com
.messengerfx.com
.iloveim.com
.meebo.com
...

iptables:

iptables -I FORWARD -p tcp --dport 1863 -j REJECT