Sunday, March 24, 2013

Sleep Mode and Hibernate: What is the Difference?


If you have ever owned a laptop, netbook, or another device that runs on a battery, chances are you have put that device to “sleep” when you have disconnected it from a power source. Many times when we use the device after putting it to sleep, it starts really quickly.

Operating systems support a sleep mode as well as another power down state called hibernate. Both modes are different in how they store data and the amount of power they use. Understanding the difference can help you determine which state you should leave your computer in once you are done using it.

Sleep Mode
For those that use a laptop, or similar device, on a regular basis, you are probably familiar with this mode – especially if you even talk about putting your laptop to “sleep.”

When a computer enters this mode, the data remains in RAM (memory) so when the user uses the computer again, the computer instantly starts up from where they left off.

In this state, the RAM in the computer still remains powered to retain the information that is stored in memory. This means, that while power is reduce, or cut off from the rest of the system, there is still power being used for the RAM.

For laptop computers, the battery is still being drained to keep the RAM powered. The benefit is that the computer starts up really quickly since there is no need to reload the operating systems again along with any programs. The drawback is that if power is ever lost – the battery is drained – all work that wasn’t saved would be lost.

To avoid losing any data, you can put your computer into a hibernate state.

Hibernate
While the sleep mode of a computer keeps data in memory, and also keeps the memory powered, the hibernate state moves the data from memory and stores it on the hard drive, and then powers down the computer. Once the computer is restarted, the data that was previously stored in memory is moved from the hard drive and back into memory.

Since the local hard drive is not volatile, meaning it won’t lose the data when the power if turned off, this helps to prevent any loss of data. The one drawback is that a computer restart isn’t as fast as sleep mode because the data must be copied from the hard drive to memory before the user can use the computer. Hibernate is faster, however, than starting a computer from a cold boot (from a complete shutdown).

Also, because the contents of memory must be copied to the hard drive, you must have enough space on the hard drive equivalent to the amount of memory. If you have 4 gigabytes of RAM installed, then you must have 4 gigabytes of hard drive space. Windows creates a hibernate file on the computer when the hibernate option is enabled.

Hybrid Sleep
The hybrid sleep mode is a mix between sleep mode and hibernate. The contents of memory stays in RAM, and is also transferred to the hard drive. The memory of the computer remains powered.

When the computer is restarted, and no power was lost during sleep mode, the computer will start up instantly because of the data being stored in memory.

If, however, power was lost while in sleep mode, the data that was once stored in memory (which is now lost because of the power outage), is retrieved from the hard drive, just as it does with hibernate.

Naming Conventions
Since computer began providing a means of entering a sleep mode, the actual name of the sleep mode has changed. Here is a list of what various operating systems have called sleep mode:



Sleep Mode NameOperating System
SuspendWindows 95
Linux
Stand ByWindows 98 – Windows 2003
SleepWindows Vista – Windows 2008
Mac OS 8 – OS X

Regardless of the naming convention that is used, putting your computer into sleep mode, or in the hibernate state can be a good idea to conserve power and provide a quicker startup.

Source(s) - http://technicallyeasy.net - Paul Salmon

Wednesday, January 30, 2013

Using Bzip2 Compression with Cmd.exe and PowerShell


- Alex Angelopoulos
Executive Summary:
Bzip2 is a free command-line tool for compressing and decompressing data that you can also use within scripts. You can write bzip2-compressed data to a new file or append the data to an existing file. If you want to output or append bzip2 data from within Windows PowerShell, you'll have to use a batch file to spawn cmd.exe from within PowerShell.
Although the graphical Windows shell has built-in support for compressing data into .zip files and then extracting it, Windows shell doesn't include tools that you can use from a command prompt or in a batch file. One of the handier free tools you can find for compressing data is the open-source bzip2 console application. However, if you're used to graphical tools such as WinZip, bzip2 isn't an intuitive tool. So, after telling you how to get bzip2, I'll demonstrate how to use it from scripts and at the command prompt. I'll also examine the tradeoffs in using bzip2. Although it offers good compression, it can be very CPU-intensive.
Getting Bzip2
You can download bzip2 from the bzip2 Web site's download page (http://www.bzip.org/downloads.html). The downloaded file is the actual executable, with a name in the form bzip2-version-target cpu-target platform.exe. I'm using version 1.0.4, compiled for x86 processors and 32-bit Windows OSs; the name of the file therefore is bzip2-104-x86-win32.exe. Be sure to download the current version, then rename it to bzip2.exe.
To further simplify using bzip2, you might want to do one more thing: Create copies of bzip2.exe with the names bunzip2.exe and bzcat.exe. From a command prompt in the same directory as bzip2.exe, just enter the following cmd.exe commands to make the copies:
copy bzip2.exe bunzip2.exe
copy bzip2.exe bzcat.exe
The renamed copies are useful because bzip2 is actually three different tools: a file compressor (bzip2.exe), a file decompressor (bunzip2.exe), and a tool for reading compressed data and decompressing it directly to a console window (bzcat.exe). Bzip2 is aware of the names it has and automatically switches to the appropriate mode when invoked as bunzip2 or bzcat. In the rest of my explanations, I'll assume you’ve created the duplicate files.
Bzip2 is designed to work in a command prompt window, and it does so very well. Any tool that reads or writes console streams should work with bzip2. For simplicity, I'll put bzip2 through its paces using standard cmd.exe commands, but you can substitute any tool that uses console input and output.
Compressing Data
When migrating users to new PCs, I usually make a catalog of the files present in key locations on their computers. One of the places I check is the local Documents and Settings folder. Typically, I make a generic listing of the complete path to each file, using a command such as
dir /s /b "C:\Documents and Settings" > userfiles.txt
The resulting file is usually very large, so there might be some benefit to compressing it. Although you could use a standard GUI zipping tool for occasionally compressing result data, it's easier to compress the data as you collect it—which bzip2 lets you do. Within the cmd.exe environment, you can pipe the data into bzip2, then redirect bzip2's output to a file:
dir /s /b "C:\Documents and Settings" | bzip2 > userfiles.txt.bz2
Note that I've added .bz2, the standard extension for bzip2-compressed files, to the target file.


If you want to compress each file within a directory, you can use

bzip2 dir/*

                                               rjlee - http://www.linuxquestions.org

To do this recursively you'll need to use find:
find dir -exec bzip2 '{}' ';'

                                               rjlee - http://www.linuxquestions.org
Appending Compressed Data
If you want to add more information to the output file, bzip2's design lets you append data using file redirection. Bzip2 writes data as blocks with clearly defined headers and footers. This method means that if you want to add more compressed data to a file, you can simply append it using standard console redirection; you won't mangle the .bz2 file in the process.
For example, if you want to add a listing of the Program Files directory to the existing userfiles.txt file, you use the >> redirection symbol within cmd.exe to append the new data:
dir /s /b "C:\Program Files" >> userfiles.txt
The same procedure works with bzip2:
dir /s /b "C:\Program Files" | bzip2 >> userfiles.txt.bz2
Reading Bzip2-Compressed Data
When using a console tool, you usually use the Type command to get data from a text file into the console window:
type userfiles.txt
For compressed files, the Bzcat command is analogous to the Type command. The Bzcat command decompresses and sends the content to the console window. You use a command such as
bzcat userfiles.txt.bz2
Because the output in this example is plain text, text-manipulation tools will work with bzcat output. If you want to page through the output, you can use the More command:
bzcat userfiles.txt.bz2 | more
When you've found what you're after, you can exit More by using Ctrl+c; bzcat terminates as well.
If you want to search the listing for RDP files used by Terminal Services, you can use the Find command:
bzcat userfiles.txt.bz2 | find /i ".rdp"
This method works the same for any similar tools. You can even create an uncompressed copy of the data by redirecting the output to a file:
bzcat userfiles.txt.bz2 > userfiles.txt
Decompressing and Compressing Files
There might be situations where you want to convert the data to decompressed form, or compress pre-existing uncompressed files. You can decompress a bzip2 file by using bunzip2 with the compressed file provided as an argument:
bunzip2 userfiles.txt.bz2
This command creates the file userfiles.txt and deletes the file userfiles.txt.bz2. Bunzip2 essentially toggles the state of the file from compressed to decompressed, which can help you avoid confusion about which file is the original data source. You can modify the file or use it as necessary, then recompress it using
bzip2 userfiles.txt
which creates the compressed file userfiles.txt.bz2 and deletes userfiles.txt. If you want to hang onto the file when compressing or decompressing, use the -k (for keep) option:
bunzip2 -k userfiles.txt.bz2
or
bzip2 -k userfiles.txt
PowerShell and Bzip2: Output and Append
As I mentioned earlier, the simple output and append methods for bzip2 work from cmd.exe. You can't use the same method from within Windows PowerShell. PowerShell's > and >> redirection operators don't work for binary data. In fact, it's safest to think of PowerShell's > and >> operators as screen dump facilities because of how they handle data.
You can still use bzip2 with PowerShell, however. The trick is to use cmd.exe within PowerShell, which you can do transparently. I have two standard batch files I use for PowerShell compatibility: Write-Bzip2.cmd and Add-Bzip2.cmd.
Write-Bzip2 is one line of code that directly overwrites or creates the specified file from within cmd.exe, avoiding the PowerShell pipeline:
@bzip2 > %1
Because this code is a .cmd file, the cmd.exe shell automatically spawns and runs the script. PowerShell pipes the raw text data to the script, and bzip2 reads it. Then, within cmd.exe, the output is redirected to the file you specified as an argument of Write-Bzip2.
The Add-Bzip2 batch file works similarly but appends instead of overwrites. Again, it's just one line of code:
@bzip2 >> %1
So, you can use this command from within PowerShell to write a new archive:
Get-ChildItem "C:\Documents and Settings" -Name –Recurse | Write-Bzip2 userfiles.txt.bz2
The following command appends data to an existing archive:
Get-ChildItem "C:\Program Files" -Name -Recurse | Add-Bzip2 userfiles.txt.bz2
PowerShell works well with bzcat for reading files. You can also use bzip2 and bunzip2 with PowerShell for compressing and decompressing files without a problem.
Tradeoffs of Using Bzip2
You should have a good idea of how to use bzip2 now, but the real question is whether it makes sense for you to use it. Let's look at some of the characteristics bzip2 has as a tool from the perspective of IT support work.
If you want transparent compression for scripts, bzip2 is just about as simple a solution as possible. Pre-existing scripts or tools don't need to know anything about compression or decompression; they just use the data. If a tool you need to use doesn't work with command-line input or output, you can still use bzip2 separately to decompress input files before using the tool or compress output files after running the tool. If high compression is your goal, bzip2 also comes out ahead of most commonly available tools. Although there are some predictive compression schemes with 10 to 15 percent higher compression than bzip2, bzip2 provides much higher compression than alternatives such as WinZip, gzip, and Info-ZIP.
Performance is probably the weakest point of bzip2. Although it doesn't hog memory, it is CPU-intensive. Scripts that do very little processing work but are reading or writing large amounts of data will most likely produce the biggest performance hit. In general, if you're running a script locally on an overloaded server and speed of completion of the script is a major factor, bzip2 probably isn't your best choice. In such a case, it might be better to work with decompressed local data instead. This problem isn't unique to bzip2, though—all compression tools take extra processing power to work—but bzip2 is generally the most CPU-intensive.
Bzip2 is available for free under the GNU General Public License (GPL), so there aren't licensing restrictions on reuse and redistribution. It also runs on every Windows OS from Windows 95 forward as well as most Unix-like OSs.
You might prefer to have a graphical interface when working with .bz2 files. Although bzip2 doesn't have a GUI, there are some GUI archiving tools which can handle bzip2 compression and decompression. The most notable is the free 7-Zip (http://www.7-zip.org).
Despite the performance limitations of bzip2, it can make an excellent addition to any administrative toolkit. The method I used for making bzip2 compression work from within PowerShell is also a useful concept to take with you. When you need to use a command-line application within PowerShell and PowerShell mangles the application's output stream, you can always use a batch file wrapper to redirect the output to a file from within cmd.exe, just as I've shown you with bzip2.




Tuesday, November 13, 2012

Hacking Gmail account using GX cookie

Disclaimer: This post is only for education purpose. 

Introduction



Hacking web application was always curious for the script kiddies. And hacking free web email account is every geek first attempt. The method which I will describe in this post is not new; the same method can be applied to yahoo and other free web email services too.

The method we will be using is cookie stealing and replaying the same back to the Gmail server. There are many ways you can steal cookie, one of them is XSS (Cross site scripting) discussed by other is earlier post. But we won’t be using any XSS here, in our part of attack we will use some local tool to steal cookie and use that cookie to get an access to Gmail account.

Assumption:
  • You are in Local Area Network (LAN) in a switched / wireless environment : example : office , cyber cafĂ©, Mall etc.
  • You know basic networking.

Tool used for this attack:
  • Cain & Abel
  • Network Miner
  • Firefox web browser with Cookie Editor add-ons

Attack in detail:

We assume you are connected to LAN/Wireless network. Our main goal is to capture Gmail GX cookie from the network. We can only capture cookie when someone is actually using his gmail. I’ve noticed normally in lunch time in office, or during shift start people normally check their emails. If you are in cyber cafĂ© or in Mall then there are more chances of catching people using Gmail.

We will go step by step,
If you are using Wireless network then you can skip this Step A.

A] Using Cain to do ARP poisoning and routing:



Switch allows unicast traffic mainly to pass through its ports. When X and Y are communicating eachother in switch network then Z will not come to know what X & Y are communicating, so inorder to sniff that communication you would have to poison ARP table of switch for X & Y. In Wireless you don’t have to do poisoning because Wireless Access points act like HUB which forwards any communication to all its ports (recipients). 
  • Start Cain from Start > Program > Cain > Cain
  • Click on Start/Stop Snigger tool icon from the tool bar, we will first scan the network to see what all IPs are used in the network and this list will also help us to launch an attack on the victim.
  • Then click on Sniffer Tab then Host Tab below. Right click within that spreadsheet and click on Scan Mac Addresses, from the Target section select
All hosts in my subnet and then press Ok. This will list all host connected in your network. You will notice you won’t see your Physical IP of your machine in that list. 
How to check your physical IP ?
> Click on start > Run type cmd and press enter, in the command prompt type 
Ipconfig and enter. This should show your IP address assign to your PC.
It will have following outputs:


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : xyz.com
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
Main thing to know here is your IP address and your Default Gateway.

Make a note of your IP Address & default gateway. From Cain you will see list of IP addresses, here you have to choose any free IP address which is not used anywhere. We assume IP 192.168.1.10 is not used anywhere in the network.

  • Click on Configure > APR > Use Spoof ed IP and MAC Address > IP
Type in 192.168.1.10 and from the poisoning section click on “Use ARP request Packets” and click on OK.

  • Within the Sniffer Tab , below click on APR Tab, from the left hand side click on APR and now click on the right hand top spreadsheet then click on plus sign tool from top. The moment you click that it will show you list of IP address on left hand side. Here we will target the victim IP address and the default gateway.

The purpose is to do ARP poisoning between victim and the default gateway and route the victim traffic via your machine. From the left side click on Victim IP address, we assume victim is using 192.168.1.15. The moment you click on victim IP you will see remaining list on the right hand side here you have to select default gateway IP address i.e. 192.168.1.1 then click on OK.
  • Finally, Click on Start/Stop Sniffer tool menu once again and next click on Start/Stop APR. This will start poisoning victim and default gateway.

B] Using Network Miner to capture cookie in plain text



We are using Network miner to capture cookie, but Network miner can be used for manythings from capturing text , image, HTTP parameters, files. Network Miner is normally used in Passive reconnaissance to collect IP, domain and OS finger print of the connected device to your machine. If you don’t have Network miner you can use any other sniffer available like Wireshark, Iris network scanner, NetWitness etc.

We are using This tool because of its ease to use.

  • Open Network Miner by clicking its exe (pls note it requires .Net framework to work).
  • From the “---Select network adaptor in the list---“ click on down arrow and select your adaptor If you are using Ethernet wired network then your adaptor would have Ethernet name and IP address of your machine and if you are using wireless then adaptor name would contain wireless and your IP address. Select the one which you are using and click on start.
Important thing before you start this make sure you are not browsing any websites, or using any Instant Mesaging and you have cleared all cookies from firefox.
  • Click on Credential Tab above. This tab will capture all HTTP cookies , pay a close look on “Host” column you should see somewhere mail.google.com. If you could locate mail.google.com entry then in the same entry right click at Username column and click on “copy username” then open notepad and paste the copied content there.
  • Remove word wrap from notepad and search for GX in the line. Cookie which you have captured will contain many cookies from gmail each would be separated by semicolon ( GX cookie will start with GX= and will end with semicolon you would have to copy everything between = and semicolon
Example : GX= axcvb1mzdwkfefv ; Ăźcopy only axcvb1mzdwkfefv

Now we have captured GX cookie its time now to use this cookie and replay the attack and log in to victim email id, for this we will use firefox and cookie editor add-ons.

C] Using Firefox & cookie Editor to replay attack.



  • Open Firefox and log in your gmail email account.
  • from firefox click on Tools > cookie Editor.
  • In the filter box type .google.com and Press Filter and from below list search for cookiename GX. If you locate GX then double click on that GX cookie and then from content box delete everything and paste your captured GX cookie from stepB.4 and click on save and then close.
  • From the Address bar of Firefox type mail.google.com and press enter, this should replay victim GX cookie to Gmail server and you would get logged in to victim Gmail email account.
  • Sorry! You can’t change password with cookie attack.

How to be saved from this kind of attack?
Google has provided a way out for this attack where you can use secure cookie instead of unsecure cookie. You can enable secure cookie option to always use https from Gmail settings. 
Settings > Browser connection > Always use https



Source(s) - http://www.go4expert.com

Thursday, August 30, 2012

How to Copy Text from any Restricted Copying Site?

NOTE - The methods illustrated here are for educational purposes only. It is not advised to copy any copyrighted material in any webpage for commercial purposes. The methods illustrated are STRICTLY for non - commercial, personal use only. 


1. Using Firefox - 
1. Like Opera, Firefox allows you to configure JavaScript on any web. If you want to turn if of, just hit the Tools menu on the top bar and click Option.
2. Accessing Content panel, here you can easily control JavaScript by enable it (check it in the box) or disable it (uncheck the box option). Hit the OK button to finish.
turn off JavaScript on Firefox
Now, you can easily select and copy text from any web site.

2. Using Chrome - 

1. Open Your Chrome Browser 
2. In the Tools Menu  - 
How to Disable JavaScript In Chrome for Windows
(Image © Scott Orgera)

Click on the Chrome "wrench" icon, located in the upper right hand corner of your browser window. When the drop-down menu appears, select the choice labeled Settings.
3. Chrome Settings
How to Disable JavaScript In Chrome for Windows
(Image © Scott Orgera)

Chrome's Settings page should now be displayed in a new browser tab or window, depending on your browser's configuration. Scroll to the bottom of the page and click on the Show advanced settings... link, circled in the example above.
4. Content Settings
How to Disable JavaScript In Chrome for Windows
(Image © Scott Orgera)

The Settings page should now be expanded to display more options. Locate the Privacy section and click on the Content settings... button, circled in the example above.
5. Disable JavaScript
How to Disable JavaScript In Chrome for Windows
(Image © Scott Orgera)

Chrome's Content Settings should now be displayed. Locate the JavaScript section, containing two options each accompanied by a radio button. To disable JavaScript, select the option labeled Do not allow any site to run JavaScript. After making this selection, click on the OKbutton to return to the previous screen.

Source(s) - 1. http://www.about.com
                   2. http://starblogger.net

Sunday, April 22, 2012

Fixing the IE 8 warning – ‘Do you want to view only the webpage content that was delivered securely?’

In IE 7 and ealier, this dialog would cause annoyance to users but generally didn’t cause any other significant problems. This was because it was worded in such a way that most users would click on the Yes button and allow non-secure content to be downloaded.

However, the wording in the IE 8 version of this dialog has changed:

IE8 Security Warning

To download the content a user would now have to click on the No button. As we know, most people using the web onlyscan text and avoid reading it if at all possible! They will usually go for the Yes button if there is not an OK button.

Some sites are going to find that their secure pages in IE 8 have the following problems:

  • Any non-secure HTTP image beacons used for analytics data gathering will often be ignored
  • The page may not display or even work correctly if it relies on non-secure images, CSS or Javascript

Therefore, avoiding mixed content on HTTPS pages is even more important now that IE 8 has been released. It often becomes an issue when using third party services such as analytics or Content Delivery Networks (CDN). For example, weavoided the use of Google hosted Ajax libraries on our site until Google added HTTPS support.

As mention in the previous blog post, an IE user you can disable this warning by:

  1. Going to Tools->Internet Options->Security
  2. Select the Security tab
  3. Click on the Internet zone icon at the top of the tab page
  4. Click the Custom Level button
  5. In the Miscellaneous section change Display mixed content to Enable
  6. Repeat steps 1 – 5 for the Local intranet and Trusted sites zones

However, if you are developing a web site you can’t expect your visitors to do this. It is better to fix the cause of the problem so that the warning is not displayed by default in IE 8. The only way to do this warning is to ensure that your HTTPS pages only access embedded resources using the HTTPS protocol. You can do this by following these steps:

  1. Use a sniffer like HttpWatch that supports HTTPS and shows files being read from the browser cache. The free Basic Edition is sufficient for this because you only need to see the URLs being accessed.
  2. Access the page causing the problem and click No when you see the security warning dialog.
  3. Any HTTP resources shown in the HttpWatch window are the source of the problem; even if they loaded directly from the browser cache and didn’t cause a network round trip:Mixed Content in HttpWatch
  4. If you don’t initially see any HTTP based resources, try refreshing the page because a non-secure image may have been retrieved from the IE or Firefox image cache

EDIT #1: If you are a web developer trying to track down why your page causes this warning please also take a look athttp://blog.httpwatch.com/2009/09/17/even-more-problems-with-the-ie-8-mixed-content-warning/ where we cover some javascript snippets that can also trigger this warning. The comments section of both of these posts also contain useful information where people have found and solved related issues.

EDIT #2: Updated instructions to apply the change to all network zones

Monday, February 13, 2012

Why is insert equation editor greyed out in word 2007?

Because we are working the old 1997-2003 .DOC format. The file should be saved as a 2007/2010 .DOCX format and all will be well.