here’s a good way find an arbitrary string of text in a subversion repository. toss this in you .bashrc file:
function svngrep(){
find . | grep -iv .svn | xargs grep -Hv —color=auto $1
}
keeping this one for my own sake :)
/note: assumes “.” is the directory you want to search…
User-Agent: Mylyn/3.3.0 TracConnector Eclipse/3.5.1 (org.eclipse.epp.package.jee.product) HttpClient/3.1 Java/1.6.0_16 (Sun) Linux/2.6.31-15-generic (amd64; en_US)
user agent strings are the new network service banners. this kinda makes it trivial to fingerprint a user when they browse to your site, no?
http://www.securityfocus.com/bid/8562/info - Null byte bypass (2003) - PATCHED
http://secunia.com/advisories/20999/ - URL Bypass to gain access to files (2006) - PATCHED
http://www.portcullis-security.com/184.php - Bypassing ASP.Net Validation Protection for XSS with IE (2007) - PATCHED
http://securityvulns.ru/files/bypassing-dot-NET-ValidateRequest.pdf - Bypassing ValidateRequest (2008) - PATCHED, but are the new variations?
http://soroush.secproject.com/blog/2009/12/microsoft-iis-semi-colon-vulnerability/ - File Upload Validation Bypass (Dec 2009) - UNPATCHED
Other ASP.NET info:
http://msdn.microsoft.com/en-us/library/aa479045.aspx - A detailed examination of the workings of ASP.NET validation Web controls. (15 printed pages)
ASP.NET 1.X Vulnerabilties - 4/7 unpatched according to Secunia - http://secunia.com/advisories/product/2173/?task=advisories
Found here: http://www.howtogeek.com/howto/ubuntu/set-gmail-as-default-mail-client-in-ubuntu/
Choose Gmail as the mailto handler in your Firefox Preferences (default option in 9.10 NBR), then set Firefox to be the Ubuntu mail handler (that is, choose Custom and point it to “firefox %s”). Since Firefox is configured to handle mailto: addresses correctly you no longer need a script to do anything messy, plus Firefox can now handle mailto: links on webpages internally without having to call an external script.
To set up Google Apps to work, do these steps –
Go to about:config and toggle this:
gecko.handlerService.allowRegisterFromDifferentHost
Type this into the address bar and hit enter:
javascript:window.navigator.registerProtocolHandler(”mailto”,”https://mail.google.com/a/yourdomain.com/mail/?extsrc=mailto&url=%s”,”YourDomain.com”)
Then do the same thing as mentioned above.
well, i’ve run out of space on my local hdd - now vms go on the wd travel-external. not an ideal situation, but let’s just see…
the internal sata:
jcran@aldatmak:~$ sudo hdparm -t /dev/sda
/dev/sda:
Timing buffered disk reads: 202 MB in 3.00 seconds = 67.31 MB/sec
the wd external:
jcran@aldatmak:~$ sudo hdparm -t /dev/sdb
/dev/sdb:
Timing buffered disk reads: 2 MB in 4.02 seconds = 509.34 kB/sec
ay curumba. let’s try that again after spinup:
jcran@aldatmak:~$ sudo hdparm -t /dev/sdb
/dev/sdb:
Timing buffered disk reads: 92 MB in 3.06 seconds = 30.05 MB/sec
better, but still crappy. anyone selling internal terabyte drives yet?
obtained from a verizon aircard as i traveled down the eastern seaboard:
Delaware
ppp0 Link encap:Point-to-Point Protocol
inet addr:75.198.255.124 P-t-P:66.174.112.64 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:484 errors:0 dropped:0 overruns:0 frame:0
TX packets:549 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:191751 (191.7 KB) TX bytes:75962 (75.9 KB)
Baltimore, MD
ppp0 Link encap:Point-to-Point Protocol
inet addr:75.226.246.149 P-t-P:66.174.112.192 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:261 errors:0 dropped:0 overruns:0 frame:0
TX packets:275 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:72193 (72.1 KB) TX bytes:28525 (28.5 KB)
relay, maryland
ppp0 Link encap:Point-to-Point Protocol
inet addr:75.197.90.127 P-t-P:66.174.112.192 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:484 errors:0 dropped:0 overruns:0 frame:0
TX packets:528 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:138789 (138.7 KB) TX bytes:58867 (58.8 KB)
Washington DC
ppp0 Link encap:Point-to-Point Protocol
inet addr:75.226.66.118 P-t-P:66.174.112.192 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:437 errors:0 dropped:0 overruns:0 frame:0
TX packets:465 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:144214 (144.2 KB) TX bytes:62289 (62.2 KB)
Manassass, VA
ppp0 Link encap:Point-to-Point Protocol
inet addr:75.196.6.54 P-t-P:66.174.112.192 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:177 errors:0 dropped:0 overruns:0 frame:0
TX packets:192 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:55872 (55.8 KB) TX bytes:21057 (21.0 KB)
if you’re looking to crack passwords, this may be the single best resource on the web. check it out: http://www.hashkiller.com.
giving all my personal info to facebook. my phone, my address, photos of me drinking copious amounts of alcohol. and yet… i wouldn’t be comfortable putting those same photos and info into an open source database where anyone could access them.
why is it that i trust facebook? do they have any responsibility for my data? for protecting me? implied trust, i suppose. but… i have the strange feeling all that data is eventually going to be used against me. :/
I’ve just integrated all my web2.0 services to friendfeed. In doing so, i realized how easy feedback loops are to create among internet services.
In short, you can have your facebook post to your tumblog which can, in turn, post to your twitter, which then posts to your friendfeed, which then posts back to facebook. Thus, starting the cycle again. This is called a feedback loop.
It’s certainly easy to imagine that this sort of loop could be used to take down a service. I haven’t tried this, as i mainly don’t want to annoy the hell out of the internet. It would be interesting to figure out if importers such as facebook’s RSS -> wall post importer are sufficiently rate-limited.
I haven’t heard of any conversation around this, but it’s feasible to think that it’s a fairly significant vulnerability with any service that aggregates other feeds like RSS, or twitter. Thoughts?
