Messages posted by: Ken

Em mới kiếm đc cái này, ko bít có làm ăn gì ko vì ko có iPhone để test [ smilie

]
http://www.pqdvd.com/dvd-to-ipod-movie-video-converter.html#iphoneunlock

Ghétt down ở mấyy thằnngg rapid share quá smilie

Defeating Citibank Virtual Keyboard protection using screenshot method

By Yash K.S <yashks@gmail.com>

http://www.tracingbug.com

Disclaimer:

Author takes no responsibilities for any actions with provided information’s or codes. The copyright for any material created by the author is reserved. Any duplication of codes or texts provided here in electronic or printed publications is not permitted without the author's agreement.

Description:

Citibank Virtual Keyboard is a security enhancement for protecting from the key loggers. Using this virtual keyboard user can enter Card no and IPIN using mouse. This keyboard will display a keys in random position in a virtual keyboard on the screen where it makes little difficult for password capture. This only gives confidence for end user from key loggers not from other methods. Local attacker can use Win32 API’s to capture using screen shot method and obtain sensitive information including Credit Card/Debit Card (Suvidha Account), IPIN and misuse it.

Note:

My intension is to help people to try out the POC and understand themself (offcourse, if you can code yourself one, Please, do it)

Platforms Affected:

* Microsoft Corporation: Windows 98 Any version
* Microsoft Corporation: Windows Me Any version
* Microsoft Corporation: Windows XP Any version
* Microsoft Corporation: Windows 2000 Any version
* Microsoft Corporation: Windows 2003 Any version
* Microsoft Corporation: Windows NT 4.0 Any version
* Citi-Bank: Citi-Bank Virtual Keyboard Any version

Browsers:

* Microsoft Internet Explorer Any version
* Mozilla FireFox Any version
* Any browser runs on Win32 platform( with slight modification )

References:

CitiBank Web site - http://www.citibank.com/us

Step by Step Demo(People who likes to check POC can do so, it does not have any malware):

§ Download POC from http://tracingbug.com/downloads/citihook.zip and unzip to some directory

§ Launch citihook.exe, this will watch only https://www.online.citibank.co.in/ URL

§ Visit https://www.online.citibank.co.in/

§ In Right side of the screen in “Login to Citibank online” click “Go” button

§ You will land in following screen for typing card number and IPIN
[img]
http://www.tracingbug.com/html_images/CitiLog1.JPG
[/img]
§ Any click happens on above screen will be captured by the citihook module. All the screen shot will be placed in directory c:\citilogon and you can read the bitmaps one by one and you can construct the password manually. To determine the order of the keys you can check the filenames. In following screen shot you can see user has entered “YASHKS”
[img]
http://www.tracingbug.com/html_images/CitiLog2.JPG
[/img]
§ Local attacker can make sure he can send this file to remote location for doing further damage. This can be done easily since file size is less. Attacker can do lot of optimization based on this method.

Muốn down quá nhưng lại trên Rapidshare... ;(

Mấy cái sách kiểu này mình cũng khoái lắm nhưng mà nhìn thấy ở trên Rapidshare nên nản, chả mún down ;(

Hì hì, toàn mấy câu tiếng anh đơn giản thôi mà bạn
Tóm lại là tool này hỗ trợ IntelliSense cho lúc viết SQL code :p

Vẫn dùng update ngon lành cành đào. Nếu ko update đc bạn chịu khó down phần definition về cài lấy

Best way to write SQL code
+ How to use Query Analyzer tool of Microsoft SQL Server program for best performance?
+ How to solve your problems when you write SQL commands in case of forgetting its tabl+B262es name, columns name, type of data,... or structures?
+ Do you want to work faster when you write SQL code?
+ ...
The answer for questions above is very simple, that is using SQL Prompt tool.
This is a free tool developed by Red Gate Software Ltd.
SQL Prompt provides IntelliSense® style word completion for Microsoft® SQL Server editors, enabling you to build accurate SQL scripts much more quickly.
Not only do you get SQL intellisense, but you also get keyword formatting and code snippet integration, making you even more productive. SQL Prompt integrates with Query Analyzer, SQL Server Management Studio, and other SQL editors so you can make your favorite environment more productive.
SQL Prompt's SQL intellisense gives you the alternatives you need to rapidly create your query. It integrates with Query Analyzer, SQL Server Management Studio, and other SQL editors so you can make your favorite environment more productive.
To Install, use and more information about this tool, please download the file following link below:
http://www.paroxysm.co.uk/csharp/SQLPromptSetup.zip

Thay vì dùng phpmyadmin, bro dùng thử MySQL Front xem sao smilie

Có cái tool này rất dễ dùng mà lại free. Giao diện cũng khá đẹp
http://www.audiograbber.com-us.net/download.html

Bạn tìm hiểu thêm về Rewrite URL for IIS hoặc Apache.