5397 items (0 unread) in 69 feeds
Watchfire Application Security Insider
sirdarckcat
Google Online Security Blog
Switch/Twitch
mybeNi websecurity
cat slave diary
Alex's Corner
Billy (BK) Rios
Chris Shiflett
christian's weblog
GNUCITIZEN
The Spanner
hackademix.net
Ruby on Rails Security Project
It's a shampoo world anyway
ha.ckers.org web application security lab
Yet Another Infosec Blog
PHP Security Blog
Sunnet Beskerming Security Advisories
Disenchant's Blog
Sylvan von Stuppe
Larholm.com
Jeremiah Grossman
Anurag Agarwal - Application Security Evangelist
Ivan Ristic
omg.wtf.bbq.
Tactical Web Application Security
tssci security
Plynt Penetration Testing Blog
Security Retentive
Schneier on Security
Rational Survivability
terminal23
1 Raindrop
hiredhacker.com
Matasano Chargen
Michael on Security - Musings on Information Security
:: extra ::
GDS Security Blog
Vodun.org
Mark Curphey - SecurityBuddha.com
Liminal states
Security Ripcord
Do you have a blog/forum/mailing list? Do you want to do a review of [YACG] Mass Installer? Then you just won a free copy!
Send me an email at busin3ss [at] gmail [dot] com if you’re interested, and I’ll hook you up with a pre-release version of [YACG] that includes a lot of sweet things.
If you don’t know yet what is [YACG] Mass Installer then you’re lost, you should go ahead asap and take a look at the sales pages and the demos.
My friend beni just released a nifty and free Mozilla Firefox extension that atomates the tedious task of posting comments on Wordpress blogs. It will automatically find the form and add all the necessary information, so you just have to write the comment.
Check it out here: [blog.bf-itservice.de] (Scroll down to see the english version)
Want an 80% of discount on the first month and a 25% lifetime discount on [blogfarmexplosion.com]? What about a 50% discount on [YACG] Mass Installer?
Send me a reply at [twitter.com] and if you are between the first ten on doing it, you just won!
First come, first served so hurry!
Want an 80% of discount on the first month and a 25% lifetime discount on [blogfarmexplosion.com]? What about a 50% discount on [YACG] Mass Installer?
Send me a reply at [twitter.com] and if you are between the first ten on doing it, you just won!
First come, first served so hurry!
Any exhibitor or sponsor out there that could hook me up with a coupon code for Pubcon? (Yes, I’m being cheap!)
I’m planning on attending this year, should be pretty fun! If you are interested in chit-chatting with me over there, send me an email to busin3ss [at] gmail [dot] com…
The contest will be held before the end of the month, so make sure you add me to [twitter.com] if you want to participate and win some great discounts for http://blogfarmexplosion.com and http://yacgmassinstaller.com!
There will be other surprises aswell.
Lately I’ve seen a rise of referrers like this on several of my sites:
[20/Sep/2008:07:02:26 -0500] “GET /hotmail-captcha-extraction HTTP/1.1″ 200 11473 “http://www.google.co.in/search?hl=en&q=%2B%22Leave+a+Reply%22+%2B%22Name+(required)%22+%2BEmail+(required)&start=130&sa=N” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)”
You can add all the captchas you want, but you’ll never defeat someone manually spamming your sites 
I’m going to hold a small contest over twitter, over 50% discount on http://blogfarmexplosion.com and http://yacgmassinstaller.com! Make sure you add me [twitter.com] so you’re able to participate
Please start by reading this post where I explain everything about this code, thanks!
This is the code for the Hotmail Image Captcha, and the one for the audio captcha is below the jump
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
//This script pulls CAPTCHAs from $urlHotmail and saves them to folder $saveHotmail from the range $startImage to $endImage.
$urlHotmail = "http://hipservice.live.com/hipImageDirect.srf?id=68692&config=Hard8Char&tk=1205287476696";
$saveHotmail = "hotmail/";
$startImage = 0;
$endImage = 999;
//These two lines force the output to be constantly flushed and updated for the user. (ideally)
ob_implicit_flush(true);
ob_end_flush();
echo "Script Started.n";
//Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini.
for ($i=$startImage;$i<=$endImage;$i++) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $urlHotmail."&rand=".$i);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$image = curl_exec($ch);
curl_close($ch);
//Save CAPTCHA to a file with the same name as $i.
if(!is_dir($saveHotmail)) mkdir($saveHotmail);
$fh = fopen($saveHotmail.$i.".jpg","w");
fwrite($fh,$image);
fclose($fh);
//Don't allow it to timeout.
set_time_limit(40);
//Output occasional progress.
if ($i%10 == 0) {
echo $i." CAPTCHA captured.n";
flush();
}
}
echo "Script Complete.";
//-maluc
|
About this captcha:
length: 8
range: A-Z,2-3,5-6,8-9
case-sensitive: no
background: always gray
text color: always dark blue
overlay: short line paths with 0-3 bends, always dark blue
size: 3200-4400 bytes
width: always 218px
height: alway 48px
other: looks easiest to solve, font size varies
Here is the code for the Hotmail Audio Captcha:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 |
//This script pulls CAPTCHAs URL from $urlHotmailAudio with POST parameters $paramsHotmailAudio, then gets the CAPTCHA and saves them to folder $saveHotmailAudio from the range $startSound to $endSound.
$urlHotmailAudio = "https://signup.live.com/nexus.fpp?cnmn=Microsoft.Msn.MemberExperience.Nexus.NexusService.GetHipAudioData&ptid=0&a=3ba63739-06f1-491a-9aa3-3f98a343b5d1";
$paramsHotmailAudio = "cn=Microsoft.Msn.MemberExperience.Nexus.NexusService&mn=GetHipAudioData&d=%22en%22,%223ba63739-06f1-491a-9aa3-3f98a343b5d1%22&v=1";
$saveHotmailAudio = "hotmailaudio/";
$startSound = 0;
$endSound = 999;
//Make carraige returns appear correctly in all browsers. (ideally)
echo "<PRE>";
//These two lines force the output to be constantly flushed and updated for the user. (ideally)
ob_implicit_flush(true);
ob_end_flush();
echo "Script Started.n";
//Pull in the CAPTCHA image as a string with cURL, and save to a file. The curl extension must first be enabled in php.ini.
for ($i=$startSound;$i<=$endSound;$i++) {
//First extract a unique URL for each CAPTCHA from the $urlHotmailAudio.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $urlHotmailAudio."&rand=".$i);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $paramsHotmailAudio);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
//If you're having difficulties with SSL, this may need to be enabled.
//curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$result = curl_exec($ch);
//Enable this if you're having difficulties.
//echo "Error is: ".curl_error($ch);
curl_close($ch);
//Parse out the URL, and retrieve the CAPTCHA for it.
$resultArray = explode('"',$result);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $resultArray[5]."&rand=".$i);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$sound = curl_exec($ch);
//Enable this if you're having difficulties.
//echo "Error is: ".curl_error($ch);
curl_close($ch);
//Save CAPTCHA to a file with the same name as $i.
if(!is_dir($saveHotmailAudio)) mkdir($saveHotmailAudio);
$fh = fopen($saveHotmailAudio.$i.".wav","w");
fwrite($fh,$sound);
fclose($fh);
//Don't allow it to timeout.
set_time_limit(40);
//Output occasional progress.
if ($i%10 == 0) {
echo $i." CAPTCHA captured.n";
flush();
}
}
echo "Script Complete.";
//-maluc
|
And info about the audio captchas as well:
length: 10
range: 0-9
case-sensitive: N/A
background: lower volume gibberish, sounds like numbers really fast with extra noise
size: 46000-131000 bytes
other: numbers seem to follow a steady pace, pitch varies and either a higher pitched woman or low pitched male with robotic senthesizing
