JavaScript is a widely used technology within websites and web based applications. JavaScript can be used for all sorts of useful things and functions. But along with this comes some additional security issues that need to be thought of and tested for. JavaScript can be used not only for good purposes, but also for malicious purposes.JavaScript injection is a nifty little technique that allows you to alter a sites contents without actually leaving the site.This can be very usefull when say, you need to spoof the server by editing some form options.JavaScript injection is a fun technique that allows you to change a websites content without leaving the site, reloading the page, or saving the site to your desktop. It can be very useful when you need to change hidden data before you send it to the server. Let’s start with some basic injection techniques.
I. Injection Basics
JavaScript injections are run from the URL bar of the page you are visiting. To use them, you must first completly empty the URL from the URL bar. That means no "http://" or whatever.
JavaScript is run from the URL bar by using the javascript: protocol. In this tutorial I will only teach you the bare bones of using this, but if you are a JavaScript guru, you can expand on this using plain old JavaScript.
The two commands covered in this tutorial are the alert(); and void(); commands. These are pretty much all you will need in most situations. For your first JavaScript, you will make a simple window appear, first go to any website and then type the following into your URL bar:
You can also have more than one command run at the same time:
II. Cookie Editing
First off, check to see if the site you are visiting has set any cookies by using this script:
It is also useful to tack an alert(document.cookie); at the end of the same line to see what effect your altering had.
III. Form Editing
Sometimes, to edit values sent to a given website through a form, you can simply download that html and edit it slightly to allow you to submit what you want. However, sometimes the website checks to see if you actually submitted it from the website you were supposed to. To get around this, we can just edit the form straight from javascript. Note: The changes are only temporary, so it’s no tuse trying to deface a site through javascript injection like this.
Every form on a given webpage (unless named otherwise) is stored in the forms[x] array… where “x” is the number, in order from top to bottom, of all the forms in a page. Note that the forms start at 0, so the first form on the page would actually be 0, and the second would be 1 and so on. Lets take this example:
Say this form was used to email, say vital server information to the admin of the website. You can’t just download the script and edit it because the submit.php page looks for a referer. You can check to see what value a certain form element has by using this script:
In this case, It would pop up an alert that says “admin@website.com”
So here’s how to Inject your email into it. You can use pretty much the same technique as the cookies editing shown earlier:
Then you could use the alert(); script shown above to check your work. Or you can couple both of these commands on one line.
That completes this post about JavaScript injection as you can see all kinds of fun things can be done with these techniques. Use your imagination and with a little work you can test your site and keep it secure from malicious hackers.
Posted by XERO . Thanks to NeoXdyne , testingsecurity.com
--> Read Full Article...
I. Injection Basics
JavaScript injections are run from the URL bar of the page you are visiting. To use them, you must first completly empty the URL from the URL bar. That means no "http://" or whatever.
JavaScript is run from the URL bar by using the javascript: protocol. In this tutorial I will only teach you the bare bones of using this, but if you are a JavaScript guru, you can expand on this using plain old JavaScript.
The two commands covered in this tutorial are the alert(); and void(); commands. These are pretty much all you will need in most situations. For your first JavaScript, you will make a simple window appear, first go to any website and then type the following into your URL bar:
javascript:alert(’Hello, World’);You should get a little dialog box that says “Hello, World”. This will be altered later to have more practical uses.
You can also have more than one command run at the same time:
javascript:alert(’Hello’); alert(’World’);This would pop up a box that said ‘Hello’ and than another that says ‘World’.
II. Cookie Editing
First off, check to see if the site you are visiting has set any cookies by using this script:
javascript:alert(document.cookie);This will pop up any information stored in the sites cookies. To edit any information, we make use of the void(); command.
javascript:void(document.cookie=”Field = myValue”);This command can either alter existing information or create entirely new values. Replace “Field” with either an existing field found using the alert(document.cookie); command, or insert your very own value. Then replace “myValue” with whatever you want the field to be. For example:
javascript:void(document.cookie=”Authorized=yes”);Would either make the field “authorized” or edit it to say “yes”… now whether or not this does anything of value depends on the site you are injecting it on.
It is also useful to tack an alert(document.cookie); at the end of the same line to see what effect your altering had.
III. Form Editing
Sometimes, to edit values sent to a given website through a form, you can simply download that html and edit it slightly to allow you to submit what you want. However, sometimes the website checks to see if you actually submitted it from the website you were supposed to. To get around this, we can just edit the form straight from javascript. Note: The changes are only temporary, so it’s no tuse trying to deface a site through javascript injection like this.
Every form on a given webpage (unless named otherwise) is stored in the forms[x] array… where “x” is the number, in order from top to bottom, of all the forms in a page. Note that the forms start at 0, so the first form on the page would actually be 0, and the second would be 1 and so on. Lets take this example:
<form action=”http://www.website.com/submit.php” method=”post”>Note:Since this is the first form on the page, it is forms[0]
<input type=”hidden” name=”to” value=”admin@website.com”>
Say this form was used to email, say vital server information to the admin of the website. You can’t just download the script and edit it because the submit.php page looks for a referer. You can check to see what value a certain form element has by using this script:
javascript:alert(document.forms[0].to.value)This is similar to the alert(document.cookie); discussed previously.
In this case, It would pop up an alert that says “admin@website.com”
So here’s how to Inject your email into it. You can use pretty much the same technique as the cookies editing shown earlier:
javascript:void(document.forms[0].to.value=”email@nhacks.com”)This would change the email of the form to be “email@nhacks.com”.
Then you could use the alert(); script shown above to check your work. Or you can couple both of these commands on one line.
That completes this post about JavaScript injection as you can see all kinds of fun things can be done with these techniques. Use your imagination and with a little work you can test your site and keep it secure from malicious hackers.
Posted by XERO . Thanks to NeoXdyne , testingsecurity.com
Technorati Tags: hacking, programming, internet, tutorials, rdhacker.blogspot.com, javascript, rdhacker, prohack, injection
An upgraded version of the newest 
Need for Speed: Undercover is the twelfth installment of the popular racing video 
FireFTP is a free, secure, cross-platform 
Initial speculation pegged the game as a sandbox third person 
of Linux , but it's great for accessing NTFS-formatted hard drives--especially if you're not comfortable with Linux's whole mount concept. Just open the Drives window and select a drive, and Puppy will mount it for you--in read/write mode, if possible. 
The BartPE operating system makes a pretty good boot disc on its own, getting you into Windows and letting you access your drive. It doesn't have much in the way of repair utilities, but it has chkdsk, which should probably be the first one you try. And it can run any portable Windows utility (that that doesn't require an installation) you care to give it. 
It looked like Microsoft was finally going to do the right thing. Beta versions of Vista SP1 came with a modern equivalent of the old Windows Boot Floppy--a Start menu option called "Create a Recovery Disc" that burned a Windows PE-based emergency CD. 
This BartPE-based boot disc comes with a huge selection of tools to access your data and get your PC booting properly again. Some of them are even useful. 
Finally, we come to a boot disc that offers useful tools, is easy to use, and can be created from virtually any XP or Vista computer. The catch? At $80, it costs $80 more than the other five options put together. 
Google takes aim squarely at Microsoft with the release of its new Web browser, 
After running through a quick import checklist, Chrome opens on your desktop--and right away you begin to experience the Web in a new way. Chrome's layout is very simple: You'll see a row of tabs running along the top, a Web address bar, and a bookmarks bar that runs beneath the address bar. A separate recent bookmarks box appears at the right of the screen, as does a history search field. 
For many Windows users, the thought of using the Command Prompt is either a scary experience or something that they will never need. But for some, the command prompt is a powerful tool that can be far more useful than many graphical tools available in Windows.
