Infi-Zeal's Blog

PC troubleshooting is becoming less common in larger organizations, but consultants and techs in smaller shops still have to get their hands dirty identifying and fixing desktop problems. Oftentimes, troubleshooting Windows 7 means delving into the command line. Here are 10 fundamental Windows 7 commands you might find helpful. Before I begin... This article is intended solely as an introduction to some useful troubleshooting commands. Many of them offer numerous optional switches, which I won't cover here due to space limitations. 1: System File Checker Malicious software will often attempt to replace core system files with modified versions in an effort to take control of the system. The System File Checker can be used to verify the integrity of the Windows system files. If any of the files are found to be missing or corrupt, they will be replaced. You can run the System File Checker by using this command: sfc /scannow 2: File Signature Verification One way to veri

Chinese scientists have successfully developed a new cheaper way of getting connected to internet by using signals sent through light bulbs instead of radio frequencies as in 'Wi-Fi', a move expected to radically change process of online connectivity.  Four computers can be connected to internet through one- watt LED bulb using light as a carrier instead of traditional radio frequencies, as in Wi-Fi, said Chi Nan, an information technology professor with Shanghai's Fudan University. Under the new discovery dubbed as 'Li-Fi', a light bulb with embedded microchips can produce data rates as fast as 150 megabits per second, which is speedier than the average broadband connection in China, said Chi, who leads a Li-Fi research team including scientists from the Shanghai Institute of Technical Physics of the Chinese Academy of Sciences.  Four computers can be connected to internet through one- watt LED bulb using light as a carrier instead of traditional radio frequenci

Syrian hackers known for their hardcore support for President Bashar Ul Assad from  Syrian Electronic Army  are back in news, this time the army has claimed to have breached into the official website of Swedish based TrueCaller ( truecaller.com ), a global phone directory application for smartphones and feature phones, and accessible via a Web site. The claim was announced by the hackers on their official  website , saying that the databases contains hundred of millions of phone numbers and details of who owned these numbers, in addition of millions of Facebook, Twitter, Linkedin and Gmail accounts. Apart of that, the information has been dumped and sent to Syrian government. The list of the databases that been downloaded is mentioned below: truecaller_ugc: 459GB truecaller : 100GB truecaller_profiles : 4GB truecaller_api : 123KB truecaller_PushMe: 2.2KB tc_admin : 7MB tc_www: 70MB Syrian Electronic Army has released a screenshot of TrueCaller website’s t

A group of  Anonymous  hacker has said to hack into a server used by Federal Emergency Management. According to them, the data secured through this breach is highly prolific and could beat the recent documents leaked by  Snowden   on  PRISM  project. In one of the documents published online the group unleashed the type of data they have gotten hold of. Most of it was email address and passwords of users which seem to government employees because most of the email addresses were hosted to .gov or .mil. The Anonymous group also disclosed the reasons behind this hack, according to them, they wanted disclose them as force especially in relation to crackdown attempts made against the hackers these days.Furthermore, they wanted government’s attention in regard to their intervention with the private sector for gathering sensitive information. One of Anonymous group’s member said: Anonymous does not wave the white flag. Not while we are faced with a daily stream of abominable rev

Anonymous  hackers have claimed to breached the official website of US congress and its mail server (mail.house.gov and senate.gov), as a result around 1800 email addresses along with their passwords have been leaked online. Hackers claim that emails and passwords belong to   US Congress and their staff which have been compromised to make it clear on congress that Anonymous hackers have been keeping an eye on them over ongoing issues such as  NSA , FISA and  PRISM . The leaked data which has been dumped online shows email addresses and their clear-text passwords along with a message, which has been expressed in following words: For the purposes of being far too generous with you guys, we have removed some of the passwords and shuffled the order of the remaining ones,” the hackers wrote next to the data. These are all current, valid credentials but they are not in the original pairings. We reserve the right to spontaneously decide this restraint was unjustified. The lea

Turn Android Emulator into a Pwnage Weapon Today, we’re going to look at a scenario where the Android Emulator can be re-purposed as an exploitation tool. Specifically, we will look at attacks that involve cloning an application and user data from a stolen Android phone onto a computer running the Android emulator. An attacker that does this will be able to use the application as if they were the user. They would also be able to return the phone to the user before the target becomes aware of the compromise. A natural defense to this sort of attack would be to have the application verify what device is running it before giving the user access. The application would only be allowed to run on a device registered with the user’s account. A natural defense against this kind of attack would be to have the application verify the device and to run only on a device registered with the user’s account. We will demonstrate a new tool that repurposes the Android emulator to give

Computers have pretty much stayed the same since the visual user interface was introduced. It was a huge success when it was first released, and we’re still using upgraded versions of it today. But is there really no other concept of interacting with our computers than what we are using today? I mean, the keyboard and the mouse (and of course the WYSIWYG user interface) is good and all, but maybe a transparent computer could replace our now dated ways of interacting with computers. We have seen conceptual prototypes of transparent displays at conventions before, but not as a complete interaction solution. This transparent computer (and I don’t mean the actual computer here) is a pretty neat project that if further developed could come to change how we interact with computers in general. The system, dubbed the SpaceTop 3D Desktop Computer, works in several dimensions at once. Its purpose is to give the user new ways to manipulate, navigate and interact with what’s on the screen.

  Linux terminal is one of the coolest tools I’ve ever come across Note: I’ve tested these steps on Ubuntu 12.04 and Fedora 16. Security certificate Before proceeding, we need Gmail’s security certificate on our system. Why? Gmail sends encrypted data over SSL (Secure Sockets Layer) for security; this certificate is necessary for encryption of data. Ideally, you should have the file Equifax_Secure_CA.crt under /usr/share/ca-certificates/mozilla/ . If you do, you’re ready to move on. SSL Certificate We want to connect to Google securely which means you'll need the latest SSL certificates. To get those, use the openssl client onyour machine. Run: openssl s_client -connect imap.gmail.com:993 -showcerts which should show two blocks of ----- BEGIN CERTIFICATE ----- ... ----- END CERTIFICATE ----- in the output. You'll want to take each block (including the BEGIN/END CERTIFICATE lines), and put each of them into their own file. I put the first one

Top five Web security assessment tools Scanning websites is an entirely different ballgame from network scans. In the case of websites, the scope of the scan ranges from Layer 2 to 7, considering the intrusiveness of the latest vulnerabilities. The correct approach for scanning websites starts from Web-level access, right up to scanning all backend components such as databases. While most Web security scanners are automated, there could be a need for manual scripting, based on the situation. Nikto Let’s start with this tool because of its feature set. This open source tool is widely used to scan websites, mainly because it supports HTTP and HTTPS, and also provides findings in an interactive fashion. Nikto can crawl a website just the way a human would, and that too in the least amount of time. It uses a technique called mutation, whereby it creates combinations of various HTTP tests together to form an attack, based on the Web server configuration and the hosted c

 fork bomb is a denial-of-service attack whereby a process continually replicates itself to deplete available system resources. It can be prevented by limiting user processes.  Limiting user processes is important for running a stable system. To limit user process just add user name or group or all users to /etc/security/limits.conf file and impose process limitations. Understanding /etc/security/limits.conf file <domain> can be: an user name a group name, with @group syntax the wildcard *, for default entry the wildcard %, can be also used with %group syntax, for maxlogin limit <type> can have the two values: "soft" for enforcing the soft limits "hard" for enforcing hard limits <item> can be one of the following: core - limits the core file size (KB) <value> can be one of the following: core - limits the core file size (KB) data - max data size (KB) fsize - maximum filesize (KB)

Due to their nature, fork bombs can be difficult to stop once started. Stopping a fork bomb from reproducing further requires the termination of all running copies, which can be difficult to achieve. One problem faced is that a separate program to terminate the fork bomb cannot execute if the process table is fully saturated. The second major problem is that in the time taken between finding the processes to terminate and actually terminating them, more may have been created. Some fork bombs can be stopped relatively easily. Consider the shell fork bomb: : (){ : | : & } ;: By replacing the function identifier and re-indenting, the code reads: bomb () { bomb | bomb & } ; bomb The fork bomb in this case is a recursive function that runs in the background, thanks to the ampersand operator. This ensures that the child process does not die and keeps forking new copies of the function, consuming system resources. One important "featur