Malayalam, Tamil and Hindi Music Lyrics online

kanthari

Welcome to my 4th new tutorial of the series of networking. In this blog you'll the content about network switches. You'll learn about how to make a communication successful and secure in the same network (LAN) by using STP. As Spanning tree protocol (STP) we used in multi-switched networks. Why we use this protocol in multi-switched network etc.

What is Switch?

A switch is an intelligent device used to connect multiple devices within the same network. The intelligence of is that it requires Media Access Control (MAC) address for communication and doesn't allow broadcast. Let's understand the whole thing by a little example, consider there is a network having 3 end devices name Device-A, Device-B,Device-C connected with each other respectively with the help of switch. When a Device-A sends data to Device-C so that data will only forwarded by switch to Device-C not to Device-B.

What is Media Access Control (MAC) address?

A Media Access Control (MAC) address is 48-bit unique physical address given to network interface controller (NIC) or network adapter, for communication within the same network which is given by its manufacturer. It is made up of hexadecimal numbers like a1:b1:cc:ac:2e:f1.

What is STP?

STP stands for Spanning tree protocol which is basically used in bridge and switches to prevent loops when you have a redundant links in the Ethernet networks. If the loop is present in the Ethernet network so the whole network will suffer because there will MAC instability in the MAC table, duplicate frames generation and so on. Let's move to the video for further detail.

Read more

kanthari

Information gathering can be broken into seven logical steps. Footprinting is performed during the first two steps of unearthing initial information and locating the network range.

Footprinting

Footprinting is defined as the process of establishing a scenario or creating a map of an organization's network and systems. Information gathering is also known as footprinting an organization. Footprinting is an important part of reconnaissance process which is typically used for collecting possible information about a targeted computer system or network. Active and Passive both could be Footprinting. The example of passive footprinting is assessment of a company's website, whereas attempting to gain access to sensitive information through social engineering is an example of active information gathering. Basically footprinting is the beginning step of hacker to get hacked someone because having information about targeted computer system is the main aspect of hacking. If you have an information about individual you wanna hack so you can easily hacked that individual. The basic purpose of information gathering is at least decide what type of attacks will be more suitable for the target. Here are some of the pieces of information to be gathered about a target
during footprinting:

Domain name
Network blocks
Network services and applications
System architecture
Intrusion detection system
Authentication mechanisms
Specific IP addresses
Access control mechanisms
Phone numbers
Contact addresses

Once this information is assemble, it can give a hacker better perception into the organization, where important information is stored, and how it can be accessed.

Footprinting Tools

Footprinting can be done using hacking tools, either applications or websites, which allow the hacker to locate information passively. By using these footprinting tools, a hacker can gain some basic information on, or "footprint," the target. By first footprinting the target, a hacker can eliminate tools that will not work against the target systems or network. For example, if a graphics design firm uses all Macintosh computers, then all hacking software that targets Windows systems can be eliminated. Footprinting not only speeds up the hacking process by eliminating certain tool sets but also minimizes the chance of detection as fewer hacking attempts can be made by using the right tool for the job. Some of the common tools used for footprinting and information gathering are as follows:

Domain name lookup
Whois
NSlookup
Sam Spade

Before we discuss these tools, keep in mind that open source information can also yield a wealth of information about a target, such as phone numbers and addresses. Performing Whois requests, searching domain name system (DNS) tables, and using other lookup web tools are forms of open source footprinting. Most of this information is fairly easy to get and legal to obtain.

Footprinting a Target

Footprinting is part of the preparatory pre-attack phase and involves accumulating data regarding a target's environment and architecture, usually for the purpose of finding ways to intrude into that environment. Footprinting can reveal system vulnerabilities and identify the ease with which they can be exploited. This is the easiest way for hackers to gather information about computer systems and the companies they belong to. The purpose of this preparatory phase is to learn as much as you can about a system, its remote access capabilities, its ports and services, and any specific aspects of its security.

DNS Enumeration

DNS enumeration is the process of locating all the DNS servers and their corresponding records for an organization. A company may have both internal and external DNS servers that can yield information such as usernames, computer names, and IP addresses of potential target systems.

NSlookup and DNSstuff

One powerful tool you should be familiar with is NSlookup (see Figure 2.2). This tool queries DNS servers for record information. It's included in Unix, Linux, and Windows operating systems. Hacking tools such as Sam Spade also include NSlookup tools. Building on the information gathered from Whois, you can use NSlookup to find additional IP addresses for servers and other hosts. Using the authoritative name server information from Whois ( AUTH1.NS.NYI.NET ), you can discover the IP address of the mail server.

Syntax
nslookup www.sitename.com

nslookup www.usociety4.com

Performing DNS Lookup

This search reveals all the alias records for www.google.com and the IP address of the web server. You can even discover all the name servers and associated IP addresses.

Understanding Whois and ARIN Lookups

Whois evolved from the Unix operating system, but it can now be found in many operating systems as well as in hacking toolkits and on the Internet. This tool identifies who has registered domain names used for email or websites. A uniform resource locator (URL), such as www.Microsoft.com , contains the domain name ( Microsoft.com ) and a hostname or alias ( www ).
The Internet Corporation for Assigned Names and Numbers (ICANN) requires registration of domain names to ensure that only a single company uses a specific domain name. The Whois tool queries the registration database to retrieve contact information about the individual or organization that holds a domain registration.

Using Whois

Go to the DNSStuff.com website and scroll down to the free tools at the bottom of the page.
Enter your target company URL in the WHOIS Lookup field and click the WHOIS button.
Examine the results and determine the following:
- Registered address
- Technical and DNS contacts
- Contact email
- Contact phone number
- Expiration date

Visit the company website and see if the contact information from WHOIS matches up to any contact names, addresses, and email addresses listed on the website.

If so, use Google to search on the employee names or email addresses. You can learn the email naming convention used by the organization, and whether there is any information that should not be publicly available.

Syntax
whois sitename.com
whois usociety4.com

Syntax of PHP

<?php

//type here the code

?>

How to save the PHP file

You should save your PHP file in the root directory of the server. In XAMPP the "htdocs" is the root directory of the server. In WAMPP "www" is the root directory. Now how to save the file?

Step 1:

Press CTRL + S button to safe the file.

Step 2:

Go to the server location where it has been installed. By default it is installed in Local Disk C. Got C drive.

Step 3:

Go to XAMPP directory.

Step 4:

Go to htdocs diretory.

Step 5:

Save a file there with extension ".php". You can create a different folders for different projects in htdocs directory. So first create the folder in htdocs and then save your files in the folder.

How to Run PHP Script

Step 1:

Open a XAMPP control panel and start Apache and Mysql services.

Step 2:

Open your web browser.

Step 3:

Type localhost/yourFolderName/yourFileName.php and hit enter. For example: localhost/myFolder/index.php.

More information

kanthari

Smart Contract Exploitation and Hacking Course Announcement

What Is this:

For those who have been hitting me up on twitter and YouTube for more blockchain smart contract exploitation content this blog is for you. I have posted a video below explaining what this is and included a course outline of the content we are providing free for everyone. I was actually told recently that I am crazy for giving out this level of detailed content and training for free.. However, I believe in the original hacker ethic code from long ago, that information should be freely available for everyone!! In this frame of mind, the only pay for content will be if you wish to go the extra mile. For the person who wants to prove to themselves or others that they learned something via a certification package with detailed exam prep targets and guides, followed by a final exam CTF and reporting write-up.

So I hope you enjoy this content. The content and walk through labs will be all free. This content will be posted regularly over the next few months 90% of it is already written and ready to go.

We will start off with the differences between Solidity and other languages and do a quick coding overview before we start hacking. This way everyone is on the same page when we start looking at coding examples of vulnerable targets or reviewing case study code. Then we will cover a wide range of typical issues that effect decentralized applications(DApps) and smart contracts on the Ethereum blockchain. How to spot them and exploit them with full walk-through style learning. Subjects we have already released (Re-Entrancy, Integer Attacks, Authorization) have been updated with new code, new examples, and case studies etc. Some of the learning content will be the same but with a lot of newly added content. And in the case of Authorization completely re-written and expanded on.

Basically this course was created to get the information out there in a clear concise way. Because when I started researching blockchain hacking all I found was a paragraph here and there on something that was overly technical or completely theoretical. I couldn't find any clear concise learning or examples. This drove me nuts trying to figure everything out, until I gave up and just coded my own vulnerabilities and hacked them. So hopefully this fills the knowledge gap to offer a clear and concise, Zero Fluff resource to those on the same path.

CTF Exam:

If you do enjoy this series over the next few months and want to challenge your skills and certify that you learned something we will be also offering pay for certification bundle that includes Decentralized Application (DApp) targets and detailed lab guides as preparation for a final exam against a more comprehensive CTF certification challenge target. More info on this as the months progress.

Bug Bounty of Sorts:

These labs are completed but we are working on a way to deliver the content which requires me to code up a course delivery software. So feel free to hack the course delivery software once its up, if you break in or bypass authorizations I will give you the full course for free provided you help me fix it. :P

Pre- Requisites:

This is more of a intermediate / advanced course with a white box code approach to bug hunting and a dynamic approach to application hacking and exploiting targets, with that said you will need the following pre-requisites:

Ability to code in some language and understanding of coding concepts.
Application hacking or development background with firm understanding of vulnerabilities

Contact Info:

As this is free, I only ask that you provide constructive feedback as we are creating other more advanced hacking courses on random subjects we are interested in. Most of which will be free. And feedback helps us not do things which are not useful and integrate new ideas where they make sense.

Cheers and I hope this finds you well.

Twitter:

Email:

info@cclabs.io

WebPage:

Course Outline / Release Order:

Orange = = Whats included additionally for the full course

Blue = = What will be released free in blogs / videos

(Mostly every Mondays) over the next few months

Building and Scoping Things

Chapter 1: Cliff Notes on Blockchain

Intro:

What is a Blockchain and how is it secured

Smart Contracts

What is a Decentralized Application (DApp)?

Diving into Blockchain Components:

Distributed Vs Decentralized

Provenance Use Case:

Consensus and Mining:

Hands on Lab - Blockchain Consensus walkthrough Lab

Summary:

References:

Chapter 2: Threat Modeling and Scoping Engagements

Architecture Considerations:

Business Logic Locations and Technology Decisions

Development Environments

Threat Modeling

Summary

References:

Chapter 3 – Solidity for Penetration Testers Part 1 (Hello World)

About Solidity

Hands on Lab - Remix interface overview

Structure of a Smart Contract

Hands on Lab – HelloWorld

Summary

References:

Chapter 4 – Solidity for Penetration Testers Part 2

Beyond Hello World

Hands on Lab – Code HelloWorld bank

Code Level Walk Through of HelloWorld Bank

Checks Effects Interactions:

Summary

Part 2: Hacking and Exploiting Things

Chapter 5 - Glass Half Full or Glass Half Empty: Integer Attacks

Underflows and Overflows

Withdraw Function Vulnerable to an underflow

Transfer Function Vulnerable to a Batch Overflow

Batch Overflow Code Explanation:

ERC20 Batch Overflow Case-Study

Walkthrough of The Vulnerable Function

Reviewing the Real Attack Transaction

Hands on Lab - Exploiting Our Own ERC20 Batch Overflow

Hands on Lab - Fixing the ERC20 Overflow

Exam Prep - DApp Target + Detailed Lab Guide

Hands on Lab -Safe Math Walk Through

Integer Attacks Summary

Integer Attacks References

Chapter 6 - You Again: Leveraging Reentrancy Attacks

Reentrancy Intro

Checks Effects Interactions Pattern

Simple Reentrancy Example Code

Passing the Checks:

Looping the Interaction:

Updating the Effects:

Attacking Code Example:

Hands on Lab - Attacking a Simple Reentrancy

Hands on Lab - Fixing the Checks Effects interaction Pattern

Send vs Transfer Vs Call.Value

Case Study – The Dao Hack

Exam Prep - DApp Target + Detailed Lab Guide

Reentrancy Summary

Reentrancy References

Chapter 7 Do You Have a Hall Pass: Access Control Attacks

Understanding Smart Contract Authorization and Visibility

Visibility:

Simple Visibility Example:

Implementing Authorization:

Example Walk-through of No Authorization

Thinking about Smart Contracts as unpublished API's for DApps

Case of the Video Game Heist

Enumerating functions in a contract

Hands on Lab - Directly Calling Public Functions with Web3

Hands on Lab - Example Fix with Simple Authorization

Exit Scam Warning

Hands on Lab - Example Fix-2 Using Modifiers for Simple Authentication

Hands on Lab - Example Using Openzeppelin for Role Based Access Control

Exam Prep - DApp Target + Detailed Lab Guide

Authorization Summary:

Authorization References

Chapter 8 - Dude Where's My Data: Storage Vs Memory Attacks

Intro - Not Written Yet – Up Next

Code Example - Not Written Yet – Up Next

Case study? - Not Written Yet – Up Next

Exploiting vulnerability - Not Written Yet – Up Next

Summary - Not Written Yet – Up Next

References - Not Written Yet – Up Next

Chapter 9 - Do I know you: TxOrigin vs Message.sender Attacks

What's the difference?

Man In the Middle Via tx.origin

Hands on Lab - Simple tx.origin Example Walkthrough

Hands on Lab - Vulnerable TX.Origin Example Walkthrough

Exam Prep - DApp Target + Detailed Lab Guide

Action steps to familiarize yourself with the contract:

Attack Options:

Summary

References

Chapter 10 - Who Am I: Delegate Call Attacks

How delegate calls work:

Delegate Call vs Call

Simple Delegate Call Example Code

Simple Delegate Code Example Walkthrough

Hands on Lab - Simple Delegate Example Walkthrough

Variable Memory Issues with Delegate Calls

DelegateCall Storage Simple Example Code

Hands on Lab - DelegateCall Storage Walkthrough

Exam Prep - DApp Target + Detailed Lab Guide

Case Study - Parity Wallet Attack:

Attack Transactions Explained

Dangerous fallback function using delegatecall

The Parity Wallet Code

Delegate Chapter Summary

Delegate References:

Chapter 11 - Look into My Crystal Ball: Bad Randomness Issues

Cryptographic Implementations and Predictable PRNGs

Simple BlockHash Example

Hands on Lab - BlockHash Vulnerability Walk and Talk

Exam Prep - DApp Target + Detailed Lab Guide

Preventing Randomness Issues

Bad Randomness Summary

Bad Randomness References

Chapter 12 - Automated Static Application Security Testing

Content - Not written - Up Next

Hands On Lab - Not written - Up Next

Summary Not written - Up Next

References - Not written - Up Next

Chapter 13 - CTF Exam

Final Exam and CTF Certification Exam Target

Final Exam Reporting

Appendices:

Appendix I – Pre-Requisite Suggestions:

Programming Pre-Requisites:

Web Application Hacking Pre-Requisites:

Appendix II – Other Blockchain Learning Resources and Certifications

Appendix III – Non-Exhaustive Scoping Questions

Appendix IV – Non-Exhaustive List of things to check for

Malayalam, Tamil and Hindi Music Lyrics online

Wednesday, May 31, 2023

Networking | Routing And Switching | Tutorial 4 | 2018

What is Switch?

What is Media Access Control (MAC) address?

What is STP?

CEH Practical: Information-Gathering Methodology

Footprinting

Footprinting Tools

Footprinting a Target

DNS Enumeration

NSlookup and DNSstuff

Syntax

Understanding Whois and ARIN Lookups

Using Whois

Syntax

Read more

How To Connect Database With PHP | Cool Interface Software | Tutorial 2

Syntax of PHP

How to save the PHP file

How to Run PHP Script

More information

Tuesday, May 30, 2023

Blockchain Decentralized Application Hacking Course - A Journey Into Smart Contract Hacking And DApp Penetration Testing (Web 3.0)

Smart Contract Exploitation and Hacking Course Announcement

What Is this:

CTF Exam:

Bug Bounty of Sorts:

Pre- Requisites:

Contact Info:

Course Outline / Release Order:

Orange = = Whats included additionally for the full course

Blue = = What will be released free in blogs / videos

(Mostly every Mondays) over the next few months

Related word

Welcome

Counter

Blog Archive

Good Sites