“Advisories” has been updated

I am quite busy these days and I cannot finish my articles or even write about the vulnerabilities in details. Moreover, I need to update my “Excel Advanced Search” Add-In to be compatible with Office 2010, and also I need to put my “Secure Text Steganography Techniques by using Markov Chain” in this blog in near future [this project is actually from summer 2008].

However, I have updated the “Advisories” section with my new reported issues in Some Mozilla Products, IIS, and Adobe Reader/Acrobat.

I hope I can find more free time soon

Excel Advanced Search Add-In Application

This is a handy Excel Add-In which helps you to search/replace inside of your excel files better and simpler. The best thing about this Add-In is that it’s free and open source. Therefore, you can simply customize it for your needs.
Unfortunately the built-in search function of Microsoft Excel is too weak, and it cannot even do the simple tasks. Moreover, other useful search applications that can search/replace inside of Excel files are not free. As a result, I decided to write this tool in order to have more power in Excel searching process.
As this application is quite new, it is not free of fault. Please let me know if you find any issue. I will try to update this section in future in case of having a new release for this application.

Features

- Accepting Regular Expressions
- Supporting Inclusion or Exclusion
- Case sensitivity option
- Selecting unique results option
- Ability to export the results to an Excel file
- Searching in multiple files at the same time
- Detecting opened Workbooks
- Flexible result view
- Having search and replace functionality
- Having Formula Schema option (currently it just have credit card number checker)
- Having logbook to keep the previous keywords
- Capable to search inside of different versions of Excel files

Download

Version: 2.6.1
Date: 14 August 2010
Author: Soroush Dalili
Price: Free and open source!
Download Link: http://soroush.secproject.com/downloadable/excel_search_app.zip
Download Link (Mirror): http://www.0me.me/files/soroush.secproject.com/excel_search_app.zip
URL: http://soroush.secproject.com/blog/projects/exceladvancedsearchapplication/

Screen Shots:

Clicking on an offline message link in Yahoo Messenger can lead to Session Hijacking

Clicking on an offline message link in Yahoo Messenger is the same as clicking on an unknown link in your yahoo mail! In fact, Yahoo authenticates you before opening the destination link by using this URL:
http://login.yahoo.com/config/reset_cookies_token?.token=[Your Valid Token]&.done=[Destination Link]
Note 1: Fortunately, the destination cannot read your valid token by using referrer section of the HTTP request. However, this valid token is stored at your browser’s history, and if you do not sign-out from Yahoo, it can be dangerous.
Now you may ask why clicking on link while you are authenticating in yahoo is dangerous:
There are a lot of Cross Site Scripting (XSS) vulnerabilities in yahoo.com sub-domains. Some of these XSS attacks are simply detectable by IE8 and/or NoScript (a recommended Mozilla Firefox Add-on), and some aren’t. For example, some of Asian sub-domains of yahoo.com still have SQL Injection. And it is simply possible to cover an XSS attack by using a simple SQL Injection. Moreover, there are some points with different encoded inputs such as UTF-7 or Base64 which can be used to bypass the client-side protections. There are some other types as well that I do not want to talk about them here (I do not want to teach how to find XSS in this post). Some examples: http://www.xssed.com/search?key=yahoo.com

I’m scared. What should I do then?
1- Only open your email in private browsing mode.
2- Do not click on unknown links which are sent to you via offline messages or your email. If you want to open that link, simply open another private browsing and copy/paste that link there to open it. Moreover, you can open those links in a different browser from your open yahoo mail or your default browser.
3- Please always look at the link destination and do not trust its name. For example this link will redirect you to google.com instead of: http://www.yahoo.com/.

I clicked on a link by mistake. What should I do?
1- If you have knowledge of web security, you can open that link while monitoring your browser by using a local proxy such as Fiddler or BurpSuite. You will see if there is any request to yahoo.com or any other domains then.
2- If you are not sure about what you have done, you MUST change your password immediately. This is the only way that you can protect yourself. Even decreasing the life time of your Yahoo session (Cookie) cannot solve your problem.

What will happen if I don’t care?
1- Attackers will have access to your Yahoo.com account without knowing your password. Fortunately, they cannot change your password directly (they still can use forgot password section).

New update – July 2010

I want to update my blog with this new post:
- I learned good things from BlackHat 2010 although I was not there! JavaSnoop is a great tool by the way. Although there are some minor bugs, this tool is solving many of my problems!

- Some software are immune against my reports like Fortify! I’m not sure if it’s a good thing for them however! This is not my policy!

- Burpsuite Pro is great and I’m waiting for the new version after fixing my issues (current version is 1.3.07).

- A dangerous CSRF vulnerability in Secunia Community has been fixed – in which attacker could change a user’s email address and then use forgot password feature to reset his/her password – immediately after my report.

More info: http://secunia.com/community/forum/thread/show/4856/notification_of_fixed_csrf_issue

- CodeProject.com wants to fix a vulnerability that I’ve reported 1 month ago.

- I’ve reported a Microsoft .Net security vulnerability to them and I’ve just received their first “thank you” email. Now, I’m waiting to see what would happen.

- I reported a dangerous CSRF vulnerability in BlogFa.com to them several months ago. Although they’ve fixed that issue, they did not give me any credit! Should I report their flaws in future? I’m not so sure!

- I want to release a powerful tool for Steganography in text soon! This is my MSc. project that I’ve changed it a bit.

Another Simple DOM Viewer

What is inside of an object in my browser? What about you?

I’d written a simple JavaScript code in order to list the content of an HTML object. Now, I want to share it with you as well. Although in Mozilla Firefox it is not as good as FireBug, it is very simple and makes life easier! Moreover, it is very useful to get some ideas about misusing the DOMs for example to bypass the Same Origin Policy or even for Steganographic purposes. However, I do not advise you to use this JS code to steal users’ HTML objects in case of having an XSS in an application as you can write a faster and more reliable code for any special target.

So, it is just a code for playing in order to gain more experience and also having fun with DOMs. Please cite me or let me know if you find anything interesting by using it.

Click here for the demo and the code: http://0me.me/demo/tricks/DOM_Obj_Browse.html

Save it, Modify it, Enjoy and please do not forget me

از این کد می توانید به منظور دیدن تمامی objectهای موجود در یک صفحه HTML استفاده کنید. این کد به شما کمک خواهد کرد تا شناخت بیشتری نسبت به اشیا موجود به دست بیاورید. حتی ممکن است بتوانید به کمک آن SOP را بایپس کنید یا از آن برای پیدا کردن ایده برای نهان نگاری (Steganography) استفاده کنید. لطفا در صورت یافتن اطلاعات جالب و یا آسیب پذیری مرورگرهی وب مرا نیز در جریان تحقیق خود قرار دهید. موفق باشید.

The Web Application Security Consortium Threat Classification v2.0

After OWASP updated its Top 10, now I’m very glad to quote this:

The Web Application Security Consortium (WASC) is pleased to announce the long awaited release of the WASC Threat Classification v2.0.

You can read more information from these links: http://projects.webappsec.org/Threat-Classification and http://projects.webappsec.org/f/WASC-TC-v2_0.pdf

Cheers,

Soroush

Mirror Blog

As my website cannot be opened from Iran, I made a mirror blog at: http://irsdl.wordpress.com/

However, I do not think that I can sync. the comments.

Cheers,

Soroush

Google captured my privacy!

Google will be the best Firewall and Forensic Tool of the near future!

Google will (or already) know the users’ information!

News:

“Google pushes security with Public DNS” -> So, Google DNS can collect all the websites which is viewed by the users …

“Browsers use Google to detect web forgery -> So, a browser send a request to Google before openning a website for you! …

“The best search engine for all” -> So, Google can collect your keywords! …

“The best public mail service” -> So, Google can collect your emails …

“Google owned Youtube” -> So, Google can collect your videos …

“Google codes” -> So, Google can collect your source codes …

“Google documents” -> So, Google can collect your documents …

“Google photos” -> So, Google can collect your photos …

“Google messenger” -> So, Google can collect the messages …

“Most of the websites use Google web analyzer (tracker)” -> So, Google can track the websites’ information and also their customers! …

“Google Wave” -> So, Google can collect the blogs ,e-mails, instant messaging, FTPs, social networking’s, and so on’s information! …

“Google powerful translators” -> So, Google can understand why you are saying in other languages!

“Searchable images/sounds/videos by text or another object!” -> So, Google can search in users’ collected data …

“Chrome OS” -> So, Google can do anything with your computer …

AND etc (see http://www.google.co.uk/intl/en/options/ and http://www.googlelabs.com/)…

We are waiting for the most powerful shopping centre by Google!

However, we should trust Google in order to have happier and easier life!

Google = No Pain, No Gain!

Best wishes

Soroush

Travian Game Vulnerabilities in progress…

3 weeks ago, I sent an email about some small but effective vulnerabilities in Travian online game to its providers. By using these vulnerabilities a player can make several accounts by the same email address (because of a logical flaw), and also, he/she can login to other players’ accounts (by using an XSS vulnerability which is completely proved).

Now, I’m still waiting for their final response as I don’t want to be harmful for them!

How to stop hardware key-loggers

Nowadays new generations of hardware key-loggers are emerged, and unfortunately attackers are using them intensively to steal the keystrokes of users. These key-loggers are OS independent and are in different shapes. They are even capable of stealing the BIOS password. Most of them look like a convertor for PS/2 and/or USB to PS/2 and/or USB (Fig. 1). Besides, some of them are chipsets which are embedded in the keyboard itself (Fig. 2). And others use electromagnetic features to steal the keystrokes which are put around the wire of the keyboard or work remotely by capturing the frequency spectrum of the keyboard communication[1]. The problem is that these hardware key-loggers have become very cheap and simply available[2]. Moreover, there are some free articles about how to make their circuits[3].

So, how can we stop it if we could not remove its hardware from our computer or there is a danger of electromagnetic key-logger?

The first and the simplest idea is using an on-screen keyboard and click on it by using a mouse. However in order to get the best result, this on-screen keyboard should be dynamic in order to prevent a hardware key-logger for the mouse itself, which captures the mouse movements and its clicks. Another way is using encryption between the keyboard and its driver. For instance, there is no doubt that by using TPM and having strong encryption methods between keyboard and motherboard (or OS itself), the keyboard can encrypt the keystrokes before sending them to the computer. But, I want to be more initiative. Another idea can be using an optical-dynamic keyboard device which shows a keyboard on your desk or on your palm, and you can touch it in order to press a key (Fig. 3). There is also an application which claims that it can detect a hardware key-logger, but I have not tried it yet and I think it is still possible to hide a hardware key-logger completely from the OS.

Figure 3.

This text is completely based on my own idea, so please respect the copyright.

---

[1] http://keznews.com/4985_Researchers_hack_wired_keyboards__hijack_keystrokes

[2] http://www.google.co.uk/products?q=hardware+keylogger

[3] http://derek.chezmarcotte.ca/?page_id=24

.

So, how can we stop it if we could not remove its hardware from our computer or there is a danger of electromagnetic key-logger?

The first and the simplest idea is using an on-screen keyboard and click on it by using a mouse. However in order to get the best result, this on-screen keyboard should be dynamic in order to prevent a hardware key-logger for the mouse itself, which captures the mouse movements and its clicks. Another way is using encryption between the keyboard and its driver. For instance, there is no doubt that by using TPM and having strong encryption methods between keyboard and motherboard (or OS itself), the keyboard can encrypt the keystrokes before sending them to the computer. But, I want to be more initiative. Another idea can be using an optical-dynamic keyboard device which shows a keyboard on your desk or on your palm, and you can touch it in order to press a key (Fig. 3). There is also an application which claims that it can detect a hardware key-logger, but I have not tried it yet and I think it is still possible to hide a hardware key-logger completely from the OS.

This text is completely based on my own idea, so please respect the copyright.

---

[1] http://keznews.com/4985_Researchers_hack_wired_keyboards__hijack_keystrokes

[2] http://www.google.co.uk/products?q=hardware+keylogger

[3] http://derek.chezmarcotte.ca/?page_id=24

Domain for sale was added to my webblog!

I added Domain 4 Sale section to my weblog.
Hope you enjoy these domains.

http://soroush.secproject.com/blog/domain4sale/

March 2009 Updated: FaceBook Automatic Friends Adder from the Apllications' Walls

March 2009 Updated:

Facebook changed some forms and modules in its website in March 2009, so I updated my previous code to the new one:

At last I wrote the universal friend adder for the Facebook.com!

So, you can use this code to add your friends from your arbitrary wall such as Mobwars, Mafia Wars, Eleven Blood, Knighthood, and so on.

There are some important notes:

0- You must download and setup the iMacros first from here (http://www.iopus.com/download/).

1- You must bypass the CAPTCHA by adding more than 30 friends (maybe a bit less or more than this) manually.

2- You must find your application ID number by going to your application page and check the URL. There is always something like this:

http://www.facebook.com/apps/application.php?id=XXXXXXXXX

Which “XXXXXXXXX” is the application number which you must set it as “applicationIDNumber” in this code.

3- Please configure your settings in this code before usage if you want to get the best result.

Note: Unfortunately in this fast revision, you must choose a “friend list” name for the new friends which stands before all the friend list names. For ex. this name can be look  like: “000000myfriendlist“

You can copy/paste it as Facebook_Wall_Add.js to your iMacros.

/********* FaceBook Automatic Friends Adder from Apllications' Walls (After Passing the CAPTCHA manually)*********/
/********* You can bypass the CAPTCHA by adding more than 30 friends manually at the first *********/
/********* By Soroush Dalili March-2009 Soroush.SecProject.Com *********/
/********* Begin Configuration - You can change these settings *********/
var startPage = 2; // You can change this value to your page number!
var mobInviteMessage = "Please invite me to your Mafia Wars!"; // You can add your message here
var mobFriendList = "000000myfriendlist"; // You can add your special friend list (you must made it before)
var showImages = "1"; // You can change it to "0" (for disabling) and to "1" (for enabling)
// Wall ID Number: Mobwars = 8743457343 /  Mafia Wars = 56556324950 /  Eleven Blood = 29886835263 / Knighthood = 5541055185
// Just goto your application page which is something like "http://www.facebook.com/apps/application.php?id=XXXXXXXXX". This "XXXXXXXXX" is your application number
var applicationIDNumber = "56556324950"; // Default = MobWars Wall = 8743457343
/********* End Configuration - You can change these settings *********/

/********* Begin Code *********/
// Replace <SP> instead of space character
mobInviteMessage = addImacrosSpace(mobInviteMessage);
mobFriendList = addImacrosSpace(mobFriendList);
var jsNewLine="\n";

/********* Begin Openning Mobwars Wall's Pages *********/
var FaceBook_AddFromWall_Pages_Code;
FaceBook_AddFromWall_Pages_Code = "CODE:";
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"SET !ERRORIGNORE YES" + jsNewLine;
if(showImages == "0"){
// Disable images to have more speed
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"FILTER TYPE=IMAGES STATUS=ON" + jsNewLine;
}
// Open mobwars wall
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"URL GOTO=http://www.facebook.com/wall.php?id=" + applicationIDNumber + "&page={{PageNumber}}" + jsNewLine;
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"FILTER TYPE=IMAGES STATUS=OFF" + jsNewLine;
FaceBook_AddFromWall_Pages_Code = FaceBook_AddFromWall_Pages_Code+"WAIT SECONDS=1";
/********* End Openning Mobwars Wall's Pages *********/

/********* Begin Openning Mobwars Wall's Links *********/
var FaceBook_AddFromWall_Links_Code;
FaceBook_AddFromWall_Links_Code = "CODE:";
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"SET !ERRORIGNORE NO" + jsNewLine;
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"SET !TIMEOUT 15" + jsNewLine;
if(showImages == "0"){
// Disable images to have more speed
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"FILTER TYPE=IMAGES STATUS=ON" + jsNewLine;
}
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"TAG POS={{LinkNumber}} TYPE=A ATTR=HREF:http://www.facebook.com/s.php?k=100000080*&&CLASS:profile_link" + jsNewLine;
FaceBook_AddFromWall_Links_Code = FaceBook_AddFromWall_Links_Code+"WAIT SECONDS=1";
/********* End Openning Mobwars Wall's Links *********/

/********* Begin Add  - Step1: Press "Add As Friend" *********/
var FaceBook_AddFromWall_Add_Step1_Code;
FaceBook_AddFromWall_Add_Step1_Code = "CODE:";
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"SET !ERRORIGNORE NO" + jsNewLine;
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"SET !TIMEOUT 15" + jsNewLine;
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"TAG POS=1 TYPE=A ATTR=TXT:Add<SP>as<SP>Friend" + jsNewLine;
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"FILTER TYPE=IMAGES STATUS=OFF" + jsNewLine;
FaceBook_AddFromWall_Add_Step1_Code = FaceBook_AddFromWall_Add_Step1_Code+"WAIT SECONDS=1";
/********* End Add  - Step1: Press "Add As Friend" *********/

/********* Begin Add  - Step2: Fill the forms *********/
var FaceBook_AddFromWall_Add_Step2_Code;
FaceBook_AddFromWall_Add_Step2_Code = "CODE:";
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"SET !ERRORIGNORE YES" + jsNewLine;
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"SET !TIMEOUT 15" + jsNewLine;
// Insert Message
if(mobInviteMessage!=""){
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=A ATTR=TXT:Add<SP>a<SP>personal<SP>message*" + jsNewLine;
//FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"WAIT SECONDS=1"+ jsNewLine;
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=TEXTAREA ATTR=ID:message CONTENT=" + mobInviteMessage + jsNewLine;
}
// Select Friendlist
if(mobFriendList!=""){
	//FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=SELECT FORM=NAME:NoFormName ATTR=ID:add_to_friend_list_widget_select_* CONTENT=$" + mobFriendList + jsNewLine;
	FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=SPAN ATTR=BINDPOINT:main&&CLASS:UIActionMenu_Main" + jsNewLine;
	FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=A ATTR=CLASS:UICheckList_Label CONTENT=" + mobFriendList + jsNewLine;
	//FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=INPUT:TEXT ATTR=CLASS:inputtext FriendAddingTool_CreateNewList CONTENT=" + mobFriendList + jsNewLine;
}
// Press Add Button
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"TAG POS=1 TYPE=INPUT:BUTTON ATTR=ID:dialog_button1" + jsNewLine;
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"FILTER TYPE=IMAGES STATUS=OFF" + jsNewLine;
FaceBook_AddFromWall_Add_Step2_Code = FaceBook_AddFromWall_Add_Step2_Code+"WAIT SECONDS=2";

/********* End Add - Step2: Fill the forms *********/

/********* Begin Close Box *********/
var FaceBook_AddFromWall_Close_Code;

FaceBook_AddFromWall_Close_Code = "CODE:";
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"SET !ERRORIGNORE YES" + jsNewLine;
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"SET !TIMEOUT 15" + jsNewLine;
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"TAG POS=1 TYPE=INPUT:BUTTON ATTR=NAME:close&&VALUE:Close" + jsNewLine;
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"FILTER TYPE=IMAGES STATUS=OFF" + jsNewLine;
FaceBook_AddFromWall_Close_Code = FaceBook_AddFromWall_Close_Code+"WAIT SECONDS=2";

/********* End Close Box *********/

/********* Begin Internal JavaScript Code *********/
var i1=0;
var i2=0;
var i3=0;
var i4=0;
var j=0;
var p=0;
for(p=startPage;p>=0;p--){
	iimSet ("-var_PageNumber", p);
	i1 = iimPlay(FaceBook_AddFromWall_Pages_Code);
	for(j=0;j<20;j++){
		iimSet ("-var_LinkNumber", j*2+1);
		i2 = iimPlay(FaceBook_AddFromWall_Links_Code);

		if (i2 >= 0) {
			iimSet ("-var_LinkNumber", j);
		    i3 = iimPlay(FaceBook_AddFromWall_Add_Step1_Code);
			if(i3 >= 0)
				i4 = iimPlay(FaceBook_AddFromWall_Add_Step2_Code);
		}else{
			break;
		}

	}
}

function addImacrosSpace(str){
	str = str.replace(/ /g, "<SP>");
	return str;
}
/********* End Internal JavaScript Code *********/
/********* End Code*********/
/********* By Soroush Dalili March-2009 Soroush.SecProject.Com *********/

Blog Template Was Updated

I found some XSS vulnerabilities in my blog’s template, so I reported them to its creator (Inanis).

Thanks from Inanis because of fast fix and also for this beautiful template.

You can see these in this link:

http://www.inanis.net/blog/index.php/downloads/inanis-glass-wordpress-theme/inanis-glass-readme/

FaceBook MobWars New Cheat Updated: Automatic Friends Add in Facebook Technique by using iMacros!

Thanks from Mark because of telling me a good point about MobWars cheat. (In this link Please read this first if you are new)

So, I updated the codes to this new version:

Now you can send your special message and also select your friend list. Also, there is a trick to disable images during this operation in order to save the bandwidth and time!

Download .js file
or
Just save below codes as “AddmobwarsFriend.js” file and run it with iMacros. For more help, check this post.

//—————————-Begin “AddmobwarsFriend.js” ————————————

/********* By Soroush Dalili Jan-2009 Soroush.SecProject.Com *********/
/********* Begin Configuration – You can change these settings *********/
var startPage = 20; // You can change this value to your page number!
var mobInviteMessage = “Welcome to my MobWars!”; // You can add your message here
var mobFriendList = “”; // You can add your special friend list (you must made it before)
var showImages = “0″; // You can change it to “0″ (for disabling) and to “1″ (for enabling)
/********* End Configuration – You can change these settings *********/

/********* Begin Code *********/
// Replace <SP> instead of space character
mobInviteMessage = addImacrosSpace(mobInviteMessage);
mobFriendList = addImacrosSpace(mobFriendList);
var jsNewLine=”\n”;

/********* Begin Openning Mobwars Wall’s Pages *********/
var MW_AddFromWall_Pages_Code;
MW_AddFromWall_Pages_Code = “CODE:”;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”SET !ERRORIGNORE YES” + jsNewLine;
if(showImages == “0″){
// Disable images to have more speed
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”FILTER TYPE=IMAGES STATUS=ON” + jsNewLine;
}
// Open mobwars wall
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”URL GOTO=http://www.facebook.com/wall.php?id=8743457343&page={{PageNumber}}” + jsNewLine;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”FILTER TYPE=IMAGES STATUS=OFF” + jsNewLine;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”WAIT SECONDS=2″;
/********* End Openning Mobwars Wall’s Pages *********/

/********* Begin Openning Mobwars Wall’s Links *********/
var MW_AddFromWall_Links_Code;
MW_AddFromWall_Links_Code = “CODE:”;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”SET !ERRORIGNORE YES” + jsNewLine;
if(showImages == “0″){
// Disable images to have more speed
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”FILTER TYPE=IMAGES STATUS=ON” + jsNewLine;
}
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS={{LinkNumber}} TYPE=A ATTR=HREF:http://www.facebook.com/s.php?k=100000080*” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=A ATTR=TXT:Add<SP>as<SP>Friend” + jsNewLine;
// Insert Message
if(mobInviteMessage!=”"){
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=A ATTR=TXT:Add<SP>a<SP>personal<SP>message*” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”WAIT SECONDS=1″+ jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=TEXTAREA ATTR=ID:message CONTENT=” + mobInviteMessage + jsNewLine;
}
// Select Friendlist
if(mobFriendList!=”"){
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=SELECT FORM=NAME:NoFormName ATTR=ID:add_to_friend_list_widget_select_* CONTENT=$” + mobFriendList + jsNewLine;
}
// Press Add Button
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=INPUT:BUTTON ATTR=ID:dialog_button1″ + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”FILTER TYPE=IMAGES STATUS=OFF” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”WAIT SECONDS=1″;
/********* End Openning Mobwars Wall’s Links *********/

/********* Begin Internal JavaScript Code *********/
var i1=0;
var i2=0;
var j=0;
var p=0;
for(p=startPage;p>=0;p–){
iimSet (“-var_PageNumber”, p);
i1 = iimPlay(MW_AddFromWall_Pages_Code);
for(j=1;j<40;j+=2){
iimSet (“-var_LinkNumber”, j);
i2 = iimPlay(MW_AddFromWall_Links_Code);
}
}

function addImacrosSpace(str){
str = str.replace(/ /g, “<SP>”);
return str;
}
/********* End Internal JavaScript Code *********/
/********* End Code*********/
/********* By Soroush Dalili Jan-2009 Soroush.SecProject.Com *********/
//—————————-End “AddmobwarsFriend.js” ————————————

Vote in Toluna.com with a Script Automatically!

In this text, I’ll show you how to use iMacros for voting in Toluna automatically.
Note 1: you should not do that because of Toluna.com policy. This text is only for educational purpose.
Note 2: I think Toluna.com must use some CAPTCHAs and neutralize this way.

I used iMacros and write a simple script with it.
So, follow these steps:
1. You need to download and install iMacros in your browser (I use mozilla version) [http://www.iopus.com/iMacros/firefox/]
2. Download this file from [http://rapidshare.com/files/181424393/Toluna.zip] and extract it to see “Toluna.iim”
3. Copy “Toluna.iim” to Macros folder of iMacros (You can find it in iMacros>Edit>Options>Paths):
4. Login to your Toluna.com account
5. Run “Toluna.iim” in iMacros and see the wonderful results

So, you can write your own scripts to do the same in other websites. Please link and inform me if you do that.

Cheers

Cell Phone IMEI Numbers' Algorithm Is As Same As The Credit Card Algorithm

Each cell phone has a unique number which is IMEI. You can find it by entering this code in your cell phone *#06# or see the back of your cell phone battery.

This IMEI number is something like this: ABCDEF-GH-IJKLMNO-X (without “-” characters)

For example: 350077523237513

In our example ABCDEF-GH-IJKLMNO-X:

AB is Reporting Body Identifier such as 35 = “British Approvals Board of Telecommunications (BABT)”

ABCDEF is Type Approval Code

GH is Final Assembly Code

IJKLMNO is Serial Number

X is Check Digit

—

As I told you in “http://soroush.secproject.com/blog/2009/01/credit-card-algorithm/” everything has an algorithm!

Here we have an algorithm to check valid IMEI number too, but the algorithm for IMEI number is as same as the credit card numbers!

So, I do not want to repeat my words, and I refer you to that post here. You can use the credit card validation JavaScript to validate the IMEI numbers too.

You can check your IMEI numbers here for validation.

FaceBook MobWars New Cheat: Automatic Friends Add in Facebook Technique by using iMacros!

By this way you can add a lot of friends in half an hour from MobWars wall:
1. You need to add some friends from MobWars wall [http://www.facebook.com/wall.php?id=8743457343] manually while it does not show you the CAPTCHA (strange mixture image) again.
2. You need to download and install iMacros in your browser (I use mozilla version) [http://www.iopus.com/iMacros/firefox/]
3. Open this link in your browser: [Click Here]
or
create “MW-AddFromWall.js” in Macros folder of iMacros (You can find it in iMacros>Edit>Options>Paths):

/* ———– Begin “MW-AddFromWall.js” ———– */
/* Copyright: Soroush Dalili (soroush.secproject.com) Jan 2009 */
var startPage = 20; // You can change this value to your page number!
var jsNewLine=”\n”;
var MW_AddFromWall_Pages_Code;
MW_AddFromWall_Pages_Code = “CODE:”;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”SET !ERRORIGNORE YES” + jsNewLine;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”FILTER TYPE=IMAGES STATUS=Off” + jsNewLine;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”URL GOTO=http://www.facebook.com/wall.php?id=8743457343&page={{PageNumber}}” + jsNewLine;
MW_AddFromWall_Pages_Code = MW_AddFromWall_Pages_Code+”WAIT SECONDS=2″;
var MW_AddFromWall_Links_Code;
MW_AddFromWall_Links_Code = “CODE:”;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”SET !ERRORIGNORE YES” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”FILTER TYPE=IMAGES STATUS=Off” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS={{LinkNumber}} TYPE=A ATTR=HREF:http://www.facebook.com/s.php?k=100000080*” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=A ATTR=TXT:Add<SP>as<SP>Friend” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=SELECT ATTR=ID:add_to_friend_list_widget_select_1276215665 CONTENT=%choose” + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”TAG POS=1 TYPE=INPUT:BUTTON ATTR=ID:dialog_button1″ + jsNewLine;
MW_AddFromWall_Links_Code = MW_AddFromWall_Links_Code+”WAIT SECONDS=1″;
var i1=0;
var i2=0;
var j=0;
var p=0;
for(p=startPage;p>=0;p–){
iimSet (“-var_PageNumber”, p);
i1 = iimPlay(MW_AddFromWall_Pages_Code);
for(j=1;j<40;j+=2){
iimSet (“-var_LinkNumber”, j);
i2 = iimPlay(MW_AddFromWall_Links_Code);
}
}
/* Copyright: Soroush Dalili (soroush.secproject.com) Jan 2009 */
/* ———– End “MW-AddFromWall.js” ———– */

Note: Sometimes you must close “firefox.exe” process manually after close it!

Iranian National ID Algorithm

In Iran each person has a national code which is called “Code Melli” or “کد ملی”. And, its algorithm is very similar to ISBN algorithm:
The rules are:
1- This number has 10 digits like: C[1] C[2] C[3] C[4] C[5] C[6] C[7] C[8] C[9] C[10]
2- 3 digits of left must not be equal to 000 (c[1]c[2]c[3]000)
3- C[10] is a control digit (like ISBN algorithm)
The formula to determine C[10] is:
Let A = (C[1]*10)+ (C[2]*9)+ (C[3]*8)+ (C[4]*7)+ (C[5]*6)+ (C[6]*5)+ (C[7]*4)+ (C[8]*3)+ (C[9]*2)
Let B = A MOD 11
If B == 0 Then C[10]=B Else C[10] = 11-B
This JavaScript function is useful to validation:

<script>
//————— Begin Iranian national code checker function —————
// Usage: IsIRNationalCode(‘Number’) Return -> True-False
// Copyright: Soroush Dalili – October 2008
//
/**
* IsIRNationalCode is a function to validate Iranian National ID
* @param  theNum National ID number as an input
* @return true if the input number is a valid Iranian National ID, otherwise false
*/
function IsIRNationalCode(theNum)
{
if(theNum.length!=10)
{
return false;
}
else
{
if(theNum.substr(0,3)==’000′) return false;
var check = 0;
for(var i=0;i< theNum.length;i++)
{
var num = theNum.substr(i,1);
check += num*(10-i)
}
if(check%11)
{
return false;
}
else
{
return true;
}
}
}
// Copyright: Soroush Dalili – October 2008
//————— End Iranian national code checker function —————
</script>

Credit Card Algorithm

Everything has an algorithm except something that we do not know about it!
I knew Credit Card Algorithm from 2000, and I found out it from a Pascal program which checks the credit cards.
I googled for this topic in 2008 and found a lot of articles about it! So, there isn’t any secret now!
My proofs are:

http://www.beachnet.com/~hstiles/cardtype.html

http://www.google.co.uk/search?hl=en&q=%22credit+card+algorithm%22

I know that no one can use the credit card generator nowadays because of the credit card online validation checking.
So, I explain it more:
If you have a credit card number like this (16 or 15):
ABCD-EFGH-IJKL-MNOP
Or in array:
C[1]C[2]C[3]C[4]-C[5]C[6]C[7]C[8]-C[9]C[10]C[11]C[12]-C[13]C[14]C[15]C[16]
Now the formula is:
(If there is a number more than 9, then subtract 9)
+
(Even array numbers value)
= Result
And, Result MOD 10 must be 0
For Example we want to know whether the below number is a valid credit card number or not:
CC= 4321-9871-2345-3328
The formula is:
(4*2) + 3 + (2*2) + 1 + (9*2-9) + 8 + (7*2-9) + 1 + (2*2) + 3 + (4*2) + 5 + (3*2) + 3 + (2*2) + 8
=
8 + 3 + 4 + 1 + 9 + 8 + 5 + 1 + 4 + 3 + 8 + 5 + 6 + 3 + 4 + 8 = 80
80 Mod 10 = 0
So this is a valid credit card number!
What about the 4444-3333-2222-1111? Check it, it is a valid credit card number!
I found two good JavaScript codes from:

http://www.experts-exchange.com/Programming/Languages/Scripting/JavaScript/Q_22031163.html

Which are:

By Zvonko:

<script>
function checkCardNum(theField){
var theNum = theField.value;
var check = 0;
for(var i=0;i<theNum.length;i++){
var num = theNum.substr(i,1);
num *= ((i+theNum.length)%2)?1:2;
check += (num>9)?num%10+1:num;
}
if(check%10){
alert(“Wrong CreditCard number.”);
theField.select();
theField.focus();
return false;
}
return true;
}
</script>

And another one
By Rama NUTI (rama_krishna580):

<script>
function isValidCreditCard(type, ccnum) {
if (type == “Visa”) {
// Visa: length 16, prefix 4, dashes optional.
var re = /^4\d{3}-?\d{4}-?\d{4}-?\d{4}$/;
} else if (type == “MC”) {
// Mastercard: length 16, prefix 51-55, dashes optional.
var re = /^5[1-5]\d{2}-?\d{4}-?\d{4}-?\d{4}$/;
} else if (type == “Disc”) {
// Discover: length 16, prefix 6011, dashes optional.
var re = /^6011-?\d{4}-?\d{4}-?\d{4}$/;
} else if (type == “AmEx”) {
// American Express: length 15, prefix 34 or 37.
var re = /^3[4,7]\d{13}$/;
} else if (type == “Diners”) {
// Diners: length 14, prefix 30, 36, or 38.
var re = /^3[0,6,8]\d{12}$/;
}
if (!re.test(ccnum)) return false;
// Remove all dashes for the checksum checks to eliminate negative numbers
ccnum = ccnum.split(“-”).join(“”);
// Checksum (“Mod 10″)
// Add even digits in even length strings or odd digits in odd length strings.
var checksum = 0;
for (var i=(2-(ccnum.length % 2)); i<=ccnum.length; i+=2) {
checksum += parseInt(ccnum.charAt(i-1));
}
// Analyze odd digits in even length strings or even digits in odd length strings.
for (var i=(ccnum.length % 2) + 1; i<ccnum.length; i+=2) {
var digit = parseInt(ccnum.charAt(i-1)) * 2;
if (digit < 10) { checksum += digit; } else { checksum += (digit-9); }
}
if ((checksum % 10) == 0) return true; else return false;
}
</script>

Iranian users cannot see my website

Unfortunately, I understood that no one from Iran can see both of “www.secproject.com” and “soroush.secproject.com”.

I sent an email to my web support and wrote them about this problem. And they answered me:

“Thank you for contacting Online Support. Some countries and ISP’s actively block connections to our network. Unfortunately, this is not within our control. As we are able to visit your site without any issues there does not appear to be any errors on our end. We apologize for any inconvenience.”

So, could you please help me if you know how to solve this problem? Please send me an email to my yahoomail or write down your comments here.