XfinalfantasyX
Yesterday, 12:50 PM EDT
Just found this on the net, so I gave it a try.

Lo and behold, it actually works.

Very handy if you are an Ebayer.
Enjoy

When you look at an item and click on bid history all the bid amount are replaced with "-" until the end of the auction.

To view these amounts before the auction ends when viewing the item change


http://cgi.ebay.co.uk/ws/eBayISAPI.dll


in the address bar to


http://cgi.ebay.com/ws/eBayISAPI.dll


And then click on the bid history. The bid amounts will be shown.

XfinalfantasyX
Yesterday, 12:51 PM EDT
Yes, firefox is already pretty damn fast but did you know that you can tweak it and improve the speed even more?


That's the beauty of this program being open source.
Here's what you do:
In the URL bar, type “about:config” and press enter. This will bring up the configuration “menu” where you can change the parameters of Firefox.

Note that these are what I’ve found to REALLY speed up my Firefox significantly - and these settings seem to be common among everybody else as well. But these settings are optimized for broadband connections - I mean with as much concurrent requests we’re going to open up with pipelining… lol… you’d better have a big connection.

Double Click on the following settins and put in the numbers below - for the true / false booleans - they’ll change when you double click.

Code:
browser.tabs.showSingleWindowModePrefs – true
network.http.max-connections – 48
network.http.max-connections-per-server – 16
network.http.max-persistent-connections-per-proxy – 8
network.http.max-persistent-connections-per-server – 4
network.http.pipelining – true
network.http.pipelining.maxrequests – 100
network.http.proxy.pipelining – true
network.http.request.timeout – 300


One more thing… Right-click somewhere on that screen and add a NEW -> Integer. Name it “nglayout.initialpaint.delay” and set its value to “0”. This value is the amount of time the browser waits before it acts on information it receives. Since you’re broadband - it shouldn’t have to wait.

Now you should notice you’re loading pages MUCH faster now!

One of the most common techniques used by hackers to penetrate your network, is just plain-old password guessing. This goes for external hacking attempts as well as internal hacking attempts. In this article I will discuss how hackers can use tools to perform brute force password hacking in your Terminal Server environments and what you can to prevent these kinds of attacks.

Introduction

Guessing passwords is one of the oldest, yet one of the most effective techniques to gain access to a system. The reason that it is one of the most effective hacking techniques is because there’s aweak link in the whole process: humans. This is because humans like “samantha1” better for a password than “Tr15%^<!+”. Although the latter would be far more difficult to hack than the first password, there’s a good chance that no user would ever get the latter password memorized. This is what hackers take advantage of. The only thing a hacker needs is a logon “vehicle”. This could be a command prompt, a web page or… the Microsoft Remote Desktop Connection conveniently included in every recent version of Windows or readily available from Microsoft’s download site.

Hacking Slang

For clarity’s sake, I’ll briefly discuss some of the terms used in relation to password hacking. Basically, there are two kinds of password hacking attacks:

• Brute force hacking a.k.a. dictionary hacking attacks
• Password cracking a.k.a hash hacking attacks.

In this article we will be focusing on brute force hacking, using dictionary attacks. This simply means that the hacker will use a tool to automate the password guessing with an accompanying dictionary file: a file that contains every single password the hacker wants to try. Usually there aretens of thousands of passwords in a dictionary file and the hacking tool tries them all, pounding the server with logon attempts: hence the term brute force hacking.

Impact Of Password Guessing in Terminal Server environments

As in other fields of security, Terminal Server environments take up a special place. This is because Terminal Servers, by their very nature, allow interactive access. Interactive access in this context means that you’re logged on to the server itself. This is the same effect as if you were walking up to the console in the datacenter and logging on there. This basically allows you to execute any program you can get your hands on and run it in the memory space of that server. Another significant issue that arises from the fact that Terminal Servers are in the business of allowing interactive access, is an issue with the admin lockout. As you probably know, by default, the local administrator account cannot be locked out. Even if you use the passprop utility, you can only lock out the administrator account for remote logons, not interactive (Terminal Server logons). Only using passprop on Windows Server 2003 allows you to lock out the local administrator account. Because this could effectively completely lock you out of your own network, this isn’t a configuration that is used a lot. Hackers know this and use this knowledge to perform brute force hacking attempts on administrator accounts.

Terminal Server Brute Force Hacking tool: TSGrinder

There are a couple of tools out there which allow you to perform brute-force password guessing in your Terminal Server environment. The most well-known however is a free tool called TSGrinder. TSGrinder is a command line tool which very basically allows automating password guessing via RDP connections. TSGrinder is a "dictionary" based attack tool, supports multiple attack windows from a single dictionary file (you can specify this on the program command line). A very interesting option in the program is the “leet” function. This leet function enables the program to cope with a popular development in password-land. What I mean is that, from the knowledgeable user up, people tend to secure their passwords by replacing letterswith well-known symbols. For example, password becomes p@ssw0rd (replacing a’s with @’s and o’s with 0’s). This is a very well thought thorough option because as we will see trying these passwords does not require you to change your dictionary file. Another very interesting option is the “banner” option. What this option does, is acknowledge any messages prior to log on. These are the kind of messages that you have to acknowledge before you can log on to a server, usually a legal disclaimer of some sort. This logon message can be set in Group Policy in Computer Policies > Security Settings > Local Policies > Security Settings > Interactive Logon. This was an issue in earlier versions of TSGrinder but that has been fixed now. This option basically renders the banner message useless as a countermeasure to these kinds of attacks. TSGrinder also supports multiple password attempts in the same connection, and allows you to specify how many times to try a username/password combination within a particular connection (the default is 5) . This is used by hackers to help avoiding detection, because by default after 5 unsuccessful logon attempts, the Terminal Server ends the connection and an event is logged to the Terminal Server event log. The event looks like this:

 

 So in the default config of TSGrinder you could have someone trying about 1,000,000 passwords and there would not be a single event in the event log (auditing excluded, we’ll get to that). Let’s take a look at TSGrinder. The program comes with a very limited dictionary and leet file. You can be sure that hackers have far more advanced dictionaries. Running TSGrinder from the command line yields the help:

Usage: tsgrinder.exe [options] server Options: -w dictionary file (default 'dict') -l 'leet' translation file -d domain name -u username (default 'administrator' -b banner flag -n number of simultaneous threads -D debug level (default 9, lower number is more output) Example: tsgrinder.exe -w words -l leet -d workgroup -u administrator -b -n 2 10.1.1.1

As you can see usage is pretty straight-forward. You can try it on your own test server, just like I did.

Disclaimer: Use extreme caution when using this tool. Using TSGrinder could result in legal actions taken against you because your actions could be considered a real hacking attempt.

In this very simple example we will assume that:

• we have a dictionary file called “testdict”
• we have a leetfile called “testleet”
• the username we are attacking is the default, administrator
• we want to acknowledge any logon banner messages
• we want to have 1 simultaneous thread
• the server we are attacking has the following IP address: 192.168.62.53

That would leave us with the following command line:

tsgrinder.exe -w testdict -l testleet -b -n 1 -D 8 192.168.62.53

As you can see in the screenshot below, after a while, tsgrinder neatly finds that I’ve been using P@55w0rd! as my administrator password. It’s that easy. 

 

Countermeasures

OK, now that you’ve seen how easy it is to attack your Terminal Server environment, it’s time to take countermeasures. Here are some concrete suggestions that can help prevent these kinds of attacks. Rename administrator account You should know that renaming the administrator account is considered a best practice. If you were not aware of that earlier, I sure hope you are now. When you rename the (local) administrator account, the hacker cannot use the administrator account to attack and must know the exact name of the renamed administrator account. This also has the added advantage that you can create a dummy administrator account that can be locked out (you do have account lock outs configured, right?) Connection Security Ideally you would want to make sure that users are already somehow checked before they attempt to logon to a Terminal Server. This used to be a huge hassle but now there’s a free tool available that does just that and more! The tool is called 2X SecureRDP. 2X SecureRDP works by accepting or denying incoming RDP connections by IP, Mac address, computer name, client version or based on time of day, before the logon screen is even displayed. This significantly enhances the control you have over your Terminal Servers. As an added bonus you can limit users to one concurrent session. This doesn’t really prevent brute force attacks from happening but it’s a very nice feature that I know many administrators are looking for. Another great feature of this program is that you can log information for every allowed or denied connection and save it to a log file. Below is a screenshot of 2X SecureRDP. 

 

 Of course, this tool is not just for Terminal Servers,. It greatly suits every server you access via RDP. In fact, I recommend using this tool on every RDP enabled server. Auditing Enable extensive auditing. OK, so this doesn’t prevent brute force attacks from happening but at the very least it allows you too log these kinds of attacks. You should audit successful and failed logons events. Because these audit logs tend to get cluttered very soon on a busy server, you should consider an automated audit tool. These kinds of tools monitor and filter the security event logs for you so that you can see what you need to see and be alerted when anything goes bad. An example and my personal favorite of such a program is SELM (Security Event Log Monitor) from GFI. See a list of well-known similar programs here. Logon Message You should configure all of your servers to display a message at logon that must beacknowledged before you can proceed to log on to a server. This really isn’t a technical countermeasure but more of a legal one. Once you’ve acknowledged the logon message, there’s no way the perp can say: “I had no idea I wasn’t supposed to log on to that server”……..

 

Conclusion

Terminal Server environments are juicy targets for hackers. In this article I showedsome techniques hackers can use to perform brute force attacks against local administrator accounts. I also showed you what you can do to prevent these attacks. Please keep in mind that these are just pointers and only make up a small part of thesteps you should take to secure your Terminal Server environment.

 

magine the security nightmare if general users are able to bypass your operating system security and logon as Administrator or root account having all privileges by simply inserting an floppy or CD, now this scary situation is possible using a prototype software KON-BOOT which hacks into Windows and linux kernel on the fly while booting, the novice friendly softwares allows users to bypass logon passwords completely by simply booting via the KON-BOOT CD or Floppy disk, in its current incarnation the software has been tested to bypass logon passwords on Windows 7, Windows Vista, Windows XP, Windows Server 2003/2008, Gentoo, Ubuntu, Debian and Fedora.
Just follow the simple steps ahead to create KON-BOOT bootable CD or Floppy and bypass logon passwords easily.

1. Download the KON-BOOT bootable CD or Floppy image, If your anti-virus software complaints disable it for a while.
2. Burn the disk images to suitable media and configure BIOS to boot from the media first.

Here is an video demonstration of the whole process using Windows XP SP3:

If you own a 32-Bit computer with more then 3 GB of RAM you must be knowing that your operating-system can only make use of roughly 3 GB RAM and rest remains unused because of memory addressing space limitation on 32 Bit systems, today I will be showing how you can make use of this wasted memory improving your computer speed significantly. The best way to utilize this wasted memory and speed-up your computer is to use it as an RAMDISK, storing frequently accessed temporary files like system pagefile, temp-files and web-browser cache, since I/O operations to RAM is significantly faster then disk you will greatly benefit from using RAMDISK as a temporary file storage.
 Follow the simple guide next to create a RAMDISK and use it to store temporary files.

1. Download and install free Gavotte Ramdisk Utility.
2. Extract the archive and launch ramdisk.exe.
3. Click Install Ramdisk button. 

Once installed, configuration options will get enabled select disk-size and drive-letter as per your requirements, now select media-type as Fixed Media and click Apply button, this process will take few seconds to complete and a success confirmation dialog will get displayed.
 You can now click OK and exit the application, the new RAMDISK will be now visible in My Computer.

1. The RamDisk can now be used as a regular disk-drive but keep in mind its temporary and any data on it will get lost on power-off, so better use it for temporary storage like pagefile, browser cache and temp file storage.
2. To use RAMDISK as pagefile right-click My Computer and navigate to Properties -> Advanced -> Performance - Settings -> Advanced -> Virtual Memory - Change, now select the RAMDISK and set the pagefile.
3. NOTE : If the utility fails to recognize full installed RAM capacity, simply enable the PAE mode in BOOT.INI and merge ram4g.reg registry file found in archive followed by an system reboot.  

Step 1 - Modify Explorer.exe File In order to make the changes, the file explorer.exe located at C:\Windows needs to be edited. Since explorer.exe is a binary file it requires a special editor. For purposes of this article I have used Resource Hacker. Resource HackerTM is a freeware utility to view, modify, rename, add, delete and extract resources in 32bit Windows executables and resource files (*.res). It incorporates an internal resource script compiler and decompiler and works on Microsoft Windows 95/98/ME, Windows NT, Windows 2000 and Windows XP operating systems. get this from http://delphi.icm.edu.pl/ftp/tools/ResHack.zip The first step is to make a backup copy of the file explorer.exe located at C:\Windows\explorer. Place it in a folder somewhere on your hard drive where it will be safe. Start Resource Hacker and open explorer.exe located at C:\Windows\explorer.exe. The category we are going to be using is "String Table". Expand it by clicking the plus sign then navigate down to and expand string 37 followed by highlighting 1033. If you are using the Classic Layout rather than the XP Layout, use number 38. The right hand pane will display the stringtable. We’re going to modify item 578, currently showing the word “start” just as it displays on the current Start button. There is no magic here. Just double click on the word “start” so that it’s highlighted, making sure the quotation marks are not part of the highlight. They need to remain in place, surrounding the new text that you’ll type. Go ahead and type your new entry. In my case I used Click Me!You’ll notice that after the new text string has been entered the Compile Script button that was grayed out is now active. I won’t get into what’s involved in compiling a script, but suffice it to say it’s going to make this exercise worthwhile. Click Compile Script and then save the altered file using the Save As command on the File Menu. Do not use the Save command – Make sure to use the Save As command and choose a name for the file. Save the newly named file to C:\Windows. Step 2 – Modify the Registry !!!make a backup of your registry before making changes!!! Now that the modified explorer.exe has been created it’s necessary to modify the registry so the file will be recognized when the user logs on to the system. If you don’t know how to access the registry I’m not sure this article is for you, but just in case it’s a temporary memory lapse, go to Start (soon to be something else) Run and type regedit in the Open field. Navigate to:HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ Winlogon In the right pane, double click the "Shell" entry to open the Edit String dialog box. In Value data: line, enter the name that was used to save the modified explorer.exe file. Click OK. Close Registry Editor and either log off the system and log back in, or reboot the entire system if that’s your preference. If all went as planned you should see your new Start button with the revised text.[/b]

Microsoft reserves 20% of your available bandwidth for their own purposes like Windows Updates and interrogating your PC etc. Don't you want to get it back for your self? Here is the trick how to get 100% of your available bandwidth.
Increase internet speed :ugeek:

To get it back:
Click Start then Run and type "gpedit.msc" without quotes.

This opens the "group policy editor" and go to: "Local Computer Policy"

Then "Computer Configuration" Then "Administrative Templates"

Then select "Network" then "QOS Packet Scheduler"

After that select "Limit Reservable Bandwidth".
Double click on Limit Reservable bandwidth. It will say it is not configured, but the truth is under the 'Explain' tab i.e." By default, the Packet Scheduler limits the system to 20 percent of the bandwidth of a connection, but you can use this setting to override the default."
So the trick is to ENABLE reservable bandwidth, then set it to ZERO. This will allow the system to reserve nothing, rather than the default 20

How would you like to be able to download software intended to be used on a free trial basis and use it indefinitely without cost never to expire? Well, there is a way you can take any free trial download and use it free for as long as you please. System Mechanic 6 Pro 30 day free trial then 69.95
Get it Free forever Kaspersky Anti-Hacker
Get it Free with System Mechanic Pro
Smart Protector Pro 15 day free trial then 39.90
Get It Free forever All you have to do is set your clock to some date in the distant future using adjust/date/time in Windows, download your free trial software, run the program once and rollback your time setting to the current date. After you’ve run the program for the first time, the Windows registry will be loaded with a Free Trial Key reflecting an expiration date that you’ve predetermined, and your good to go. Another roundabout way to do this after a trial has already expired would be to bring up the Registry Editor in Windows, find the trial key and delete it. Then download the program again and start the free trial period over. This is pretty easy to do, but if you’re using alot of free trials you may find it to be a hassle editing registers and downloading programs over again everytime one expires. Its much easier to simply adjust your date/time to 2009 or something, download your free trials, rollback to the current date and enjoy them for the next 3 years or so hassle free. By the way I’ve found that when doing this I’m still able to get the notifications when updated versions come along, and download them with no problem. The above screenshots are just 3 examples of the many programs that I’ve been doing this with for an extended time. If your the geek type, manipulating the dates in the registers will also work. Do some experimenting and see what you can find, there are tons of possibilities, and this is something you can have alot of fun with.

Many thanks and a tip of the hat to TNPCer Jerry Newman for pointing me to the DSLReports Web site for optimizing a DSL connection.
If you have DSL you start wondering if you're getting the throughput you're paying for. I've scratched my head and puzzled, "Is the Internet just slow today or has my provider dropped the ball?" The good news is that you can test your connection's downstream and upstream speeds right from the DSLReports Web site. What's more you can study their plentiful, well-documented tips on how to optimize your system settings to get all the speed you can from your connection.
The speed test link is:
http://www.TheNakedPC.com/t/308/tr.cgi?dsl1
The tips link is:
http://www.TheNakedPC.com/t/308/tr.cgi?dsl2
When you get to this page select your operating system (Windows, Mac, UNIX, etc.) from the "Jump to" list box then click on the Show button.
After having performed the tests numerous times, and having read and applied the tweaks, I recommend you follow these steps.
1. Since this is a Registry hack, all the usual caveats about editing the Registry apply. Before doing anything else, you want to see if by some happenstance your system is already optimized using the Registry "DefaultRcvWindow" hack.
1.a. Click Start, choose Run, type "regedit" and press Enter.
1.b. Browse to the key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\VxD\MSTCP
1.c. Check to see if there's a value named DefaultRcvWindow.
1.d. If there is no DefaultRcvWindow value, then your system is not yet optimized; if there is, note its setting but leave it alone for now.
If there is a DefaultRcvWindow value your system may have been optimized already.
1.e. Close the Registry Editor.
2. Close all running applications.
3. Start your browser and clear its cache. For IE5, select Tools, Internet Options, click the Delete Files button then click OK. For Navigator, select Edit, Preferences, Advanced, and click on Clear Memory Cache and Clear Disk Cache.
4. Close your browser then re-open it to the speed test link.
5. Follow the DSLReports steps 1-4 (use the Verbose test mode), remember to select the nearest download speed (nearest to what you're paying for) from the speed drop-down control, click the Test button and wait for the test to finish. The test takes about 30 seconds on my 768/128 Kbps downstream/upstream DSL connection.
My first-time test results--not having applied the DSLReports performance tweak--were 391/121 down/up. That's 50% slower on the downstream side than what I'm paying for! Certainly a non- optimized situation. So I followed their suggestions regarding implementing the Registry DefaultRcvWindow hack. Here's what I did.
1. I downloaded one of the ready-to-go REG files that will add the correct registry settings for you automatically. (See the table in the middle of the Windows tweaks page.) I opted to use the "Medium (32KB)" REG file for Windows 98: Rwin98-m.reg.
2. Once I had downloaded the REG file, a quick double-click on it in Windows Explorer updated my Registry. It's appropriate to click Yes when prompted "Are you sure you want to add the information in \.reg to the registry?"
3. Next, and this is critical, I restarted my PC. Before you retest the speed connection, if you really want to be meticulous, clear your browser's cache and restart it. (I did.) Now go to the speed test link and perform the test once more.
My second-time test results were 624/82 Kbps. On the downstream side that's a 1.6x improvement. I FEEL THE NEED, THE NEED FOR SPEED! For a week I continued to run these tests daily by removing the DefaultRcvWindow value, rebooting, re-testing, then applying the DefaultRcvWindow hack again, rebooting, re- testing... you get the picture.
My results are consistently averaging 680 Kbps downstream OPTIMIZED and around 390 Kbps UN-OPTIMIZED. I've also been cross-checking the DSLReports test results by downloading the same large file with an FTP client. T.J., upon following these steps, also got a nice kick: a 50% improvement in his downstream speed.
Folks, if you have DSL I STRONGLY recommend you run through this procedure. It's given me on average a 60% improvement in my download times.

Make FREE calls quickly

Simply type gizmocall.com/18005551212 into your browsers address bar.
(put the number you want to dial in place of 18005551212)

Make FREE calls to landline and mobile phones in over 60 countries by participating in the All Calls Free plan.

Users NEW to the All Calls Free plan get 20 minutes of free calling simply by getting ONE friend to sign up for a new Gizmo account. There are no commitments and no hidden fees.

Get Started Now!

1. Tell a friend to download Gizmo5 and have them add their phone number to their profile.
img-calls-1 Free Calls
2. Add each other to your contact lists and you can call that person for FREE using Gizmo5.
img-calls-3 Free Calls
3. Be sure to make at least 1 Gizmo5 to Gizmo5 call per week or your free minutes will expire.
img-calls-free-app Free Calls

A very amazing offer for Ufone users, which is that they can use GPRS over their Ufone numbers for FREE. Remember it’s a trick, not an official offer from Ufone…

A user has found this bug in Ufone’s GPRS network, and claims that it works fine. I personally tested it and found it working…

Updated: September 13, 2009

Homepage: wap.ufone.com
User: ufone
Password: ufone
IP Address: 172.016.013.023
Proxy: 8080
Access Point: ufone.ppt.wap2

You would be amazed to hear that a contributor claims that he has been using Free and Unlimited Mobilink to Mobilink Calls for last two months… wow! That’s really amazing, and i would love to test this trick.

How it Works:

Step 1: First of all activate Mobitunes Service, yes mobi tunes is the main thing required in this trick. Once you MobiTune Service is activated, don’t change your default Mobi Tune, which would be “Hum Bolain Mohabbat ki Zuban”….!

Step 2: Now call from your friend’s number to your own number… and you will hear “Hum Bolain Mohabat ki Zuban”

After a while, in 20/22 seconds, the automated voice will speak up and say “Apkey Matloba Number number sey jawab musul nehi ho rha”

At very this instace, when operator say “App kay matlooba number….” pick your phone … and your call will be connected, and you can talk freely without eyeing your call timer.

You can also note the time, about how long Mobi Tune is played before the operator says “App kay matlooba number…” for example its 30 seconds… just note this time. Now whenever someone will call you, you are supposed to pick the phone after 30 seconds, and allow your friends to call you for free…!




I will test it myself too, but let me know if its working… Remember its a hack, so enjoy unlimited calling, until its debugged…!

Dev Team has released PwanageTool 3.1.4. Unfortunately, there is still no support for the iPod Touch 3G. But for the majority of users their latest release will do. Here is summary by the Dev Team:

iPhone 3G

Use PwnageTool to do the magic and then restore with iTunes using your newly created .ipsw

iPhone 3G(S)

Use PwnageTool to do the magic and then restore with iTunes using your newly created .ipsw

iPhone 2G (1st Generation)

Use PwnageTool to do the magic and then restore with iTunes using your newly created .ipsw ‘nuff said, you don’t need to worry about anything, the baseband will be unlocked, the phone jailbroken.







iPod Touch 1G (Original iPod Touch)

Use PwnageTool to create a firmware image and restore with that .ipsw using iTunes.

iPod Touch 2G

Use PwnageTool to create a firmware image and restore with that .ipsw to your already jailbroken device using iTunes.

iPod Touch 3G

At this time PwnageTool does not support this device.

* the above applies to devices that HAVE BEEN PREVIOUSLY JAILBROKEN. There is no current program that will jailbreak iPod Touches who have not jailbroken before, but the dev team said they will make one if demand peaks.

* PwnageTool will create your .ipsw. Then go into iTunes and hold down shift will clicking restore to locate the .ipsw.

HERE IS PwnageTool 3.1.4

Have Fun,

Rooster

RAPID SHARE 100% FILE HOSTING

(c) Speedtest

please rate