Retrieve Facebook password using javascript buffer overload attack.


Warning: WP_Syntax::substituteToken(): Argument #1 ($match) must be passed by reference, value given in /home/bateeqjg/public_html/news/wp-content/plugins/wp-syntax/wp-syntax.php on line 380

Warning: WP_Syntax::substituteToken(): Argument #1 ($match) must be passed by reference, value given in /home/bateeqjg/public_html/news/wp-content/plugins/wp-syntax/wp-syntax.php on line 380

This was an april fools joke

Hey Everyone,
I found a problem with the way most browsers handle the document.cookie global variable.
If too many invalid characters are created, then this causes a buffer overload and allows all tab index to manually placed. So if you cause a buffer onload in the browser then called document.cookie, it’s then searches through all the tabs and windows in search for matching url string for the cookie.

This attack affects Firefox 4 and Internet Explorer 8, and 9.
I already reported this to them and they’re working on it.

Could other people tell me if this works on their browser?
Here’s a working.
facebookPasswordScript.

The following scripts causes a buffer overflow and retrieve all the password in the current tab.
Paste and run this in your address bar to see your passwords.

1

javascript:((window.document.cookie.split(';')),(__=![]+[]),(_=+!+[]),(__)[_]+'p'+(!![]+[])[_]+(__+[][[]])[_+[+[]]]+(__)[_+_]+' '+(__)[+[]]+(+[])+([][[]]+[])[+[]]+(__)[!+[]+!+[]]+(__)[!+[]+!+[]+!+[]]);

Here’s part of the code to retrieve your facebook password.

1
2
3
4
5
6
7
8
9
10

var isCurrentTabFacebook = function(){
      return (/facebook.com/i).test(document.location.href);
};
var i = window["tabs"].length || 0;
while( i-- ){
      isCurrentTabFacebook();
}
// Causes a buffer overflow then calls the same script twice through out the tabs.
var facebookCookiePassword = ((window.document.cookie.split(';')),(__=![]+[]),(_=+!+[]),(__)[_]+'p'+(!![]+[])[_] + (__+[][[]])[_+[+[]]]+(__)[_+_]+' '+(__)[+[]]+(+[])+([][[]]+[])[+[]]+(__)[!+[]+!+[]]+(__)[!+[]+!+[]+!+[]]);
alert( facebookCookiePassword );

Book Review: Computers Ltd: What They Really Can’t Do

Hey everybody,
I would like to share a book review that I wrote on amazon.com.
Book: “Computers Ltd.: What They Really Can’t Do (Popular Science)” (2003)
Author: David Harel

Computers Ltd.: What They Really Can't Do

“This book sets the record straight. Computers can’t fix all of the world problems because they’re limited by time and space.

The author starts off by defining algorithms and how computer programs work. He’s then explores common problems in computer science using a fair amount of algebra and graphs, like NP complete problems, the travelling salesman problem, the Turing test, tower of Hanoi, and etc.

Restraining from being a complete pessimist, discussions mainly addressing Cryptography are included. Cryptography shows how computational complexity can be used for the greater good, as it’s nearly impossible to break the encryption within a reasonable amount of time for any data encoded in RSA.

Lastly, the author ends the book with his take on hot areas in computing, such as Quantum Computers, Artificial Intelligence and evolutionary (generic) programming.
Overall, I enjoyed this pocket size book and recommend it for those interested in expanding their knowledge in Computer Science.”
-Larry Battle

Answers to “15 Must Know Java Interview Questions After 2 Years of Experience”


Warning: WP_Syntax::substituteToken(): Argument #1 ($match) must be passed by reference, value given in /home/bateeqjg/public_html/news/wp-content/plugins/wp-syntax/wp-syntax.php on line 380

This post is in response to 15 Must Know Java Interview Questions After 2 Years of Experience.
Note: Only short responses are provided for the questions.
If you feel that more depth or a correction is needed then visit the links or leave a comment below.

Core Java Questions with answers:

  1. What is the purpose of serialization?
    Answer: Serialization is the conversion of an object to a series of bytes, so that the object can be easily saved to persistent storage or streamed across a communication link. The byte stream can then be deserialised – converted into a replica of the original object.
    Source | Example
  2. What is the difference between JDK and JRE?
    Answer: Java Development Kit (JDK) is the most widely used Java Software Development Kit. Java Runtime Environment (JRE) is an implementation of the Java Virtual Machine which executes Java programs.
    Source | JDK Wiki | JVM Wiki
  3. What is the difference between equals() and “==” ?
    Answer: Equals is intended to check logical equality and == checks if both references point to same object. (Thanks Sandeep)

    a == b;        // Compares references, not values.
a.equals(b);  // Compares values for equality.

    Source

  4. When will you use Comparator and Comparable interfaces?
    Answer: java.util.Comparator and java.lang.Comparable
    java.util.Comparator compares some other class’s instances, while java.lang.Comparable compares itself with another object.
    Source | Example
  5. What is the wait/notify mechanism?
    Answer: This deals with concurrent programming. The wait() and notify() methods are designed to provide a mechanism to allow a thread to be block until a specific condition is met.
    However, java.util.concurrent should be used instead of wait() and notify() to reduce complexity.
    Source | Java API | Java Technical Article
  6. What is the difference between checked and unchecked exceptions?
    Answer:
    In general, unchecked exceptions represent defects in the program (bugs), which are normally Runtime exceptions.
    Furthermore, checked exceptions represent invalid conditions in areas outside the immediate control of the program.
    Source
  7. What is the difference between final, finally and finalize?
    Answer: “final” is the keyword to declare a constant AND prevents a class from producing subclasses. (Thanks Tom Ellis)
    “finally” is a block of code that always executes when the try block is finished, unless System.exit() was called. finalize() is an method that is invoked before an object is discarded by the garbage collector.
    Source | Final Usage |Finally Usage | Finalize()
  8. What is the difference between web server and app server?
    Answer: A Web server exclusively handles HTTP requests, whereas an application server serves business logic to application programs through any number of protocols.
    Source
  9. Explain the Struts1/Struts2/MVC application architecture?
    Answer: Struts was adopted by the Java developer community as a default web framework for developing web applications
    The MVC(Model–view–controller) an application that consist of three distinct parts. The problem domain is represented by the Model. The output to the user is represented by the View. And, the input from the user is represented by Controller.
    Source
  10. What is the difference between forward and sendredirect?
    Answer: Both method calls redirect you to new resource/page/servlet. The difference between the two is that sendRedirect always sends a header back to the client/browser, containing the data in which you wanted to be redirected.
    Source
  11. How does a 3 tier application differ from a 2 tier one?
    Answer: Tiers are the physical units of separation or deployment, while layers are the logical units of separation.
    Imagine that you’re designing an e-commerce website. A 3 tier architecture would consist of web pages, a web server and a database, with the corresponding 3 layers being the “Presentation”, “Business Logic” and “Database” layers.
    If you take the database tier and layer out then your have a 2 tier architecture.
    Source
  12. How does the version control process works?
    Answer: Initiate, pull, branch, merge, commit, push.
    (Init) Make your own repository. (Pull) Download an existing repository from a url. (Branch / Merge )Make revisions. Commit then push your modifications.




    Git Cheat Sheet

  13. What is the difference between JAR and WAR files?
    Answer: JAR files (Java ARchive) allows aggregating many files into one, it is usually used to hold Java classes in a library.
    WAR files (Web Application aRchive) stores XML, java classes, and JavaServer pages for Web Application purposes.
    Source
  14. What is a Left outer join?
    Answer: This deals with SQL. Left outer join preserves the unmatched rows from the first (left) table, joining them with a NULL row in the shape of the second (right) table.
    Source | Joins Wiki
  15. What is the difference between UNION and UNION ALL?
    Answer: This deals with SQL. UNION only selects distinct values, UNION ALL selects all values.
    Source | Example

Check out Effective Java (2nd Edition) to fresh up your Java skills.



Quote of the day – by Brian Kernighan

“Everyone knows that debugging is twice as hard as writing a program in the first place. So if you’re as clever as you can be when you write it, how will you ever debug it?”
Brian Kernighan

Fixing Internet Problems!
Fixing Internet Problems!

Also, I like this.

“First make it run, then make it run fast.”

Source: Wikiquote: Brian_Kernighan

Who’s Brian Kernighan?