Paros User-Agent Removal

Paros is a great little tool, however it can leave traces of its use due to an altered User-Agent header. (Adding Paros/x.x.x at the end of the UA, where x is the version). This can lead to problems some of which, including this fix, are detailed at Security Ripcord and Armor.

To remove this download the source and edit line 80 of Constant.java from

public static final String USER_AGENT = PROGRAM_NAME + "/" + PROGRAM_VERSION;

to

public static final String USER_AGENT = "";

and recompile.

This should remove the obvious traces!

February 28th, 2008
By Joe | filed under Security, Tools | No Comments »

Reading Facebook E-Mail Image Captcha’s

Facebook stops automatic e-mail harvesting, by saving each e-mail address on a profile as an image. It is possible to read some of the images with a certain level of accuracy, but the effort required just isn’t worth using OCR alone.

Using some fuzzy matching, its possible to get a rough list of addresses for a domain, but manual verification is needed for each address found.

The scripts below can be used to train GOCR on facebook images, and can then attempt to pick addresses matching a certain domain from a directory of images.

The scripts are Training Script here and Matching Script here. You’ll need GOCR installed, String::Approx, and the ability to ignore silly Perl.

First download a selection of Facebook E-Mail images, we’ll use these with the training script to give GOCR something to go on.

Then run the matching script on the images you wish to convert, it’ll do some fuzzy matching if you give it domain to look for.

If I can improve this, I’ll try and automate it all a little more and work out some stats.

November 17th, 2007
By Joe | filed under Projects | No Comments »

IPv6 Tunnel from SiXX’s on WRT54G/DD-WRT

A Linksys WRT54G provides a cheap and easy linux platform in a small package. I use the DD-WRT firmware available from www.dd-wrt.com. It also provides an easy way of enabling IPv6 access to your network

To enable IPv6 you first need to create an account with a tunnel provider such as SiXXs. A guide to doing this can be found at the Sixxs site. This gives you a remote endpoint for your IPv6 in IPv4 tunnel.

Once the account is setup enable IPv6 on the router via the “IPv6 Support” option under Administration, and then the Management tab.

The following script added to the routers startup config will start the tunnel when the router is rebooted.

ip tunnel add sixxs mode sit local aaa.aaa.aaa.aaa remote bbb.bbb.bbb.bbb
ip link set sixxs up
ip link set mtu 1280 dev sixxs
ip tunnel change sixxs ttl 64
ip -6 addr add 2051:4bd1:2002:9b::2/64 dev sixxs
ip -6 ro add default via 2001:4bd0:2000:9b::1 dev sixxs

aaa.aaa.aaa.aaa – A local, externally accesible IPv4 address.
bbb.bbb.bbb.bbb – The IPv4 address of the pop to connect to.

2051:4bd1:2002:9b::2/64 – Local IPv6 address.
2051:4bd1:2002:9b::1/64 – Remote IPv6 address.

Once the tunnel has been working for a week. SiXXs will allow you to assign a subnet to it that you can distribute using Radvd.

July 28th, 2007
By Joe | filed under Network | No Comments »