Archive for the ‘Writing’ Category

Save MySQL : The Petition

Sunday, January 10th, 2010

In April 2009, Oracle announced that it had agreed to acquire Sun. Since Sun had acquired MySQL the previous year, this would mean that Oracle, the market leader for closed source databases, would get to own MySQL, the most popular open source database.

If Oracle acquired MySQL on that basis, it would have as much control over MySQL as money can possibly buy over an open source project. In fact, for most open source projects (such as Linux or Apache) there isn’t any comparable way for a competitor to buy even one tenth as much influence. But MySQL’s success has always depended on the company behind it that develops, sells and promotes it. That company (initially MySQL AB, then Sun) has always owned the important intellectual property rights (IPRs), most notably the trademark, copyright and (so far only for defensive purposes) patents. It has used the IPRs to produce income and has reinvested a large part of those revenues in development, getting not only bigger but also better with time.

If those IPRs fall into the hands of MySQL’s primary competitor, then MySQL immediately ceases to be an alternative to Oracle’s own high-priced products. So far, customers had the choice to use MySQL in new projects instead of Oracle’s products. Some large companies even migrated (switched) from Oracle to MySQL for existing software solutions. And every one could credibly threaten Oracle’s salespeople with using MySQL unless a major discount was granted. If Oracle owns MySQL, it will only laugh when customers try this. Getting rid of this problem is easily worth one billion dollars a year to Oracle, if not more.

Sign the Petition – Save MySQL

XSS Revenge : eu2010.es HACKED

Wednesday, January 6th, 2010

Political websites have been hacked over the past 24 hours to leave leaders with red faces.

A report on BBC News said that visitors to Spain’s EU presidency website were greeted by an image of comedy character Mr Bean instead of the Spanish Prime Minister Jose Luis Rodriguez Zapatero.

The government said that the site – www.eu2010.es – had not been attacked and that a hacker had taken a screenshot of the homepage to make a photo montage using a cross-site scripting (XSS) vulnerability. Visitors found an image of Mr Bean complete with a benign smile and the words ‘Hi there’.

Whitehouse.gov Mind Insecurity

Wednesday, November 4th, 2009

The incredible news is that Whitehouse has decided to go open source with the CMS system Drupal. It’s right, the crazy reality. “Ahaha” in this case, it’s right. I’m talking about the same Drupal that you all probably know. Oh, yes, there are “only” pages and pages of vulnerabilities on PacketStorm, Milw0rm and OSVDB about this “CMS”. Many of are truly ridiculous (but remote) like sqli or rce, and by kids. I’m sure that it’s the big websecurity mistake of the century. Wow.
You can take here a look of this. Very, very ridiculous. I’m sure that a 12year kid could write more security code of Drupal’s “monkeys” developers. But, at the end it’s a free and opensource content manager system, if you are stupid or you can’t code your own , you can chose it, or NOT. Indeed you could learn to write more security code after 3 hours of PHP study.
But, in my mind, the question is: Why security WhiteHouse experts chose it? Are they crazy or out of mind? Probably yes. This is a complete and totally fallacy.
Yes, opensource is more to appreciate than closed in philosophy, but not in security. Why? (Seriously are you asking me why??)
I can hack Drupal CMS all life without try my attacks on Whitehouse website, with the risk of being localized. I can search vulnerabilities looking the clean code lines, the modules and so on.
Yes, obviously if you expect the same drupal that you can download from the supplier, you’re crazy. The WhiteHouse’s a definitely hardened version, cleansed of unnecessary code, with modules written owners and revision of vulnerability acknowledged. So, it’s probably more difficult than hacking Drupal.org
But, yes, it’s also more easy than hacking a own system coded by security experts and pen-testers of the government. So, it’s a crazy choice. Ever and forever.

Google says Seo and Seo is. (Search Engine Optimization)

Saturday, October 24th, 2009

Google says Seo and Seo is.
Recently Google Services has released an interesting presentation about Search Engine Optimization (SEO), the process of improving the volume or quality of traffic to a web site from search engines, explaining a lot of criteria followed by Google algorithm to index sites.
This presentation’s very interesting and provides useful tips and information about indexing techniques used by the first search engine in the world. You can find the presentation here, provided by Google’s Service.
So, based on my experience in the seo optimization , I have summarized the arguments of the Google’s presentation in this article, have fun.

The first questions you’d ask to yourself about your website:

- Is site discoverable and does Google know your pages exist?
- Are your pages crawlable, or have you inadvertently put a big KEEP OUT sign on your virtual lawn?
- Can Google understand what your pages are about?
- Are your pages optimally showing up in search results?
- People can understand how to move on your site? (personally my most fun is not do this, using h4×0red expressions like “weird”, “meh”, but you know, I’m a bit silly)
- Is your site optimized for Google’s bot? (You have to think about this like the Lynx browser, so flash/ajax and 3.0 sucks too)

Exchange links for better indexing by Google, you use a stated page rank.
Once you’ve built a great site and you’re ready to have it indexed in Google, you’ll want to ensure that Google knows about your site’s pages. In many cases, Google may already be aware of your pages because one or more quality sites have included a relevant link to your site on theirs.  Indeed, naturally acquiring such links is a great way for Google to learn about your site’s pages. If you’d like Google to know about a brand new site of yours, however, you’re welcome to jumpstart the process by submitting your site via the AddURL link here.  No need to list all your pages; just the top level one, like www.example.com, is sufficient.

Use of XML sitemap in your site.
Whether your site is old or new, it’s highly recommend that you create an XML sitemap, which can help Google and other search engines better find and understand pages on your site.  These are especially useful for sites that feature dynamic content or a large set of new and updated pages, or have few incoming links.  You can create a general XML sitemap in minutes, as well as XML sitemaps for other types of information like video; learn more from the links listed here.  Note that this isn’t the same thing as an HTML, or user-visible sitemap.  HTML sitemaps can complement XML sitemaps, and can help people quickly discover and navigate to content deep within your site.

Use of robots.txt or noindex metatag.
For pages that you don’t want access, you can use one of two reliable methods for blocking Google and Googlebot from this content:  a “Disallow” line in your robots.txt file or a noindex meta tag on each you don’t want indexed.

Make your site accessible to ensure a good users experience.
An important way is making the appropriate content on your site accessible to users and Google. Accessible, in this context, means that both Googlebot and users, including those using screen readers or mobile devices, can navigate from page to page and, within reason, enjoy the core content throughout your site.  It’s important to make your site accessible, to ensure a good experience for your users and also to help Google understand and list more of your pages.
In striving to make your pages accessible, it’s helpful to understand what Googlebot can and cannot most effectively tackle. HTML files and other document types comprised mostly of text are pretty straightforward for Googlebot.  Music, images, and movies are harder for Googlebot to understand.  So, too, are dynamic pages,those pages with frequently changing or on-the-fly-generated content, potentially problematic. You can see your site almost as Googlebot does by viewing your site in a text browser, like Lynx, or in a different browser with images, JavaScript, and Flash turned off.
To help Google better understand the images on your site, you can also annotate your image in alt text, as shown above, and optionally in plain visible text near your image.  Your visible comment before or after the image can be whatever you like, but it’s best to stick with a concise version for the alt-text; no need, for instance, to include the word “image” or “photo,” since Googlebot already sees the image tag. Using descriptive filenames can be helpful to Google, and also for your users who may download your images.  “googlebot.jpg,” for instance, instead of “photo.jpg.” By annotating your images in these ways, you’re not only helping sight-impaired users who may be accessing your site with a screen reader, but you’re also giving Google a better understanding of the images and improving the chances of your images showing up for relevant queries in Google Image Search.
Along with images, many web designers like to integrate rich-media or interactive aspects into their site, often using technologies like Flash or AJAX.  While these can provide an engaging experience for users, Googlebot may have trouble discovering or following links on these sites.  For example, textual content is sometimes stored in Flash as images, making it difficult for Google to capture the words, much less understand the meaning of the pages. With careful planning, however, sites can include dynamic and media-rich elements while still remaining reasonably accessible to users and Googlebot.  Consider structuring your site so that these elements are “extras,” with your site’s core information and navigation rendered in plain text for Googlebot AND all users without Flash.

Find the best title and description for your site.
After you’ve ensured that your site is both findable and accessible, don’t let your great content languish with uninspired introductions.  Think of the titles and descriptions on your pages together as an advertising billboard: You have just a few words to let people know what each page is about and convince them that it’s worth a visit.   
The title tag of your page is likely to be displayed anytime Google shows your page in its search results, and it’s also what people will typically see in various places in their web browser and even on social sharing sites on the web.  Therefore, it’s important to have a concise, descriptive title for each page on your site. You can use Google’s Webmaster Tools’ “Content Analysis” feature to help you optimize your page titles and descriptions.

The Page Rank.
Yes, how to get pages into Google and how to prevent private pages from appearing in our search results, but webmasters also typically want their pages to rank higher in Google’s search results. The reality is that pages get listed in search results based upon two core principles:  Relevance and importance. A page is deemed relevant if it matches both the query and the interest of the user.  The first is rather intuitive:  if a user searches using the query “swing dancing,” for example, Google’s likely to list resources associated with swing dance venues, shoes, teachers, etc. Queries relevant to the phrase typed.  Personalization also plays a role, however, both in the aggregate and at the individual level.  Google tailor results by geography; for instance, on a search for “Banks,” it’ll show primarily Canadian banks to Canadian searchers and British banks to folks in the UK.  Search results may also be slightly customized to each individuals’ search history. But with so many web pages out there and, for many queries, millions of relevant pages, Google has to further narrow down and prioritize results, and this is done by evaluating the importance of each page.
Google’s original algorithm set that assessed the importance of web pages was dubbed PageRank. It’s now just one of over two hundred components that go into Google’s ranking of web pages; however it does still play a significant role :
- Each page’s score is based upon the quantity, and more important, the quality of pages that link to it. This means that a relevant link from, for instance, a respected online magazine will be likely worth more than a link from a friend’s guestbook.
- Attempting to buy or sell links that pass PageRank is a violation of Google’s webmaster guidelines and could end up harming your site’s presence in Google.
- The best ways to increase your pages’ PageRank are to create great content, participate thoughtfully in relevant communities online and offline, and from this garner quality links naturally.
- If you do buy or sell online advertising, you’ll want to make sure those links don’t pass PageRank by using the nofollow attribute or other means recommended in Google’s Webmaster Help Center.
As Google updates index, rankings do naturally fluctuate, sometimes a little, sometimes a lot, and for a great variety of reasons. In Google’s early days, experts updated index in large, occasional batches, playfully nicknamed “Google Dances.”  Nowadays, however, experts updated index incrementally.  Typically, this results in subtle changes, but some sites can be affected more significantly. And while Google is moving forward, the web is changing at a frantic pace as well.  The changes in site, combined with the constant content and link updates around the web, also can noticeably affect your site’s presence in Google. In some cases, however, a site can fall to a lower ranking because it was determined to violate the Webmaster Guidelines.  In such situations, you and ideally an unbiased friend or expert should carefully evaluate your site, identifying and fixing any issues.  Note that these violations may have been caused by someone who worked on the site previously, or even a hacker who crupulously added sometimes-hidden links to your pages.  Google frequently sends informational notices about webmaster violations through the Message Center in Webmaster Tools, so be sure you’ve signed up for this free service.
Of course, you should provide content designed for users, not search engines, making sure to treat search engine bots as just other users and never sending them different content.  But beyond that, it makes sense to consider how your users are likely to search for this content. Regularly verify that all your links are still pointing to relevant resources that reflect well on you and your organization.

Provide a site interaction with Google’s web and social services.
Your site could benefit from a more interactivity, be sure to explore Google services like YouTube and Picasa for videos and photos, Sketchup for engaging 3D models, Calendar for events listings, Maps and Earth for directions to your business and richly annotated tours, Blogger for the latest announcements, and so on.

Use Google Analytics to know more about your visitors.
Google Analytics provides comprehensive information on where your visitors come from, how they interact with their site, and how often they perform desired actions, such as subscribe to your newsletter or buy one of your products. While Analytics lets you reflect back on site performance, Website Optimizer helps you look forward, enabling you to test out different combinations of content on your site to find out which versions work best with your visitors.

Use Google Trends to compare keywords and Google Reader to be updated.
Use Google Trends to compare the prevalence of searches and news articles for different keywords, evaluating which product has captured more attention or which issue excites more of your potential customers. Google Reader enables you to stay on top of the latest articles without having to manually jump from site to site.  You can follow specific topics or keywords from popular news papers, insightful bloggers, even your favorite photo or video sites.

Metasploit UNLEASHED – Mastering the Framework

Wednesday, October 7th, 2009

METASPLOIT UNLEASHED – MASTERING THE FRAMEWORK
In borning Metasploit Framework 3.3 stable, Metasploit Project in collaboration with Offensive-security and Hackers for Charity, presents :

Metasploit Project – Offensive-Security presents the most complete and in-depth open course about the Metasploit Framework.
If you enjoy it and find it useful, you can make a donation to Hackers For Charity Project, to help underprivileged children in East Africa.
You can purchase the full pdf with videos on Offensive-Security courses page, or follow the online courses for free.

Subjects :

- Information Gathering
- Vulnerability Scanning
- Writing a Simple Fuzzer
- Exploit Development
- Client Side Exploits
- MSF Post Exploitation
- Meterpreter Scripting
- Maintaining Access

Referers :
Hackers For Charity and Johnny Long
Offensive-Security Team
Metasploit Project