Xanda’s Blog !~!

My small patch..

But NO its not finalize yet. Plus it haven’t been fully tested yet. Going to use Metasploit for the test tomorrow..

Hi.. yeah as usually there will be a silent moment gap between posts..

Here is my short update..

I’ve recently presented at HITB Security Conference 2011 in Kuala Lumpur, Malaysia on Fun With JavaScript DeObfuscaton

It covers:

• Multiple basic obfuscations
• javascriptobfuscator.com obfuscation
• Edward Packer’s obfuscation
• JSidle obfuscation
• JSF*ck obfuscation
• jjencode obfuscation

It was done by having demo on each obfuscation explained. You can download my slides at http://conference.hitb.org/hitbsecconf2011kul/materials/ and if you have any questions/suggestions, we can have a private discussion at Skype / GTalk. Ping me in comment section or twitter and I’ll drop you my details.

For those who are on N900 (Maemo) and having problem in launching or installing [1] Khweeteur v0.5* this is the workaround for the problem

[1] Error in installing means: if you found the following error during installation :

Listing /usr/lib/python2.5/site-packages/khweeteur ...
Listing /usr/lib/python2.5/site-packages/khweeteur/icons ...
Listing /usr/lib/python2.5/site-packages/khweeteur/oauth ...
Listing /usr/lib/python2.5/site-packages/khweeteur/oauth2 ...
Segmentation fault
Segmentation fault
dpkg: error processing khweeteur (--configure):

So here is the temporary workaround for this problem

1) Install older version of python-pyside

sudo apt-get install libpyside1.0=1.0.3-1maemo2 python-pyside=1.0.3-1maemo2 libshiboken1.0=1.0.3-1maemo1 python-pyside.phonon=1.0.3-1maemo2 python-pyside.qtcore=1.0.3-1maemo2 python-pyside.qtgui=1.0.3-1maemo2 python-pyside.qtdeclarative=1.0.3-1maemo2 python-pyside.qtmaemo5=1.0.3-1maemo2 python-pyside.qtmultimedia=1.0.3-1maemo2 python-pyside.qtnetwork=1.0.3-1maemo2 python-pyside.qtopengl=1.0.3-1maemo2 python-pyside.qtscript=1.0.3-1maemo2 python-pyside.qtsql=1.0.3-1maemo2 python-pyside.qtsvg=1.0.3-1maemo2 python-pyside.qtwebkit=1.0.3-1maemo2 python-pyside.qtxml=1.0.3-1maemo2 python-pyside.qtxmlpatterns=1.0.3-1maemo2

2) Install pyside-mobility

sudo apt-get install pyside-mobility

3) Now install you khweeteur or khweeteur-experimental

sudo apt-get install khweeteur-experimental

P/S: Do not update your pyside to the latest version until khweeteur has change the code to suite the latest pyside accordingly.

If you are a system administrator of websites that is hosted in Malaysia or owner of the domains ended with .MY.. or.. hosting company, you might heard/read about “MyLipas” somewhere, somehow.. maybe in the email subject or something

Ok here are short descriptions of MyLipas and what is he capable with:

• Named MyLipas due to the ugly code (coded in 2 nights)
• Was around since early February 2009
• Highly inspired by Shaun’s (Australian Honeynet Project) Skynet project
• Crawl for the defaced/hacked websites that are hosted in Malaysia (Malaysia IP range) or domain ended with .MY
• Crawler “abuse” Google search and Zone-H list to look for the defaced websites (based on keywords)
1. Yes it can bypass the Zone-H’s captcha
2. If you are a CSM staff and you claim yourself as a Google-Fu, but you don’t know how to Google for websites that is hosted in Malaysia but not limited to those ended with .MY, you brought shame upon yourself
• MyLipas can also receive manual (single or bulk) URL submission
• All URLs will be grouped by IP (of the hosting) and the following information will be collected (automagically!) :
1. IP address
2. Web server information
3. Domain owner/hosting email address (for reporting)
• Email will be sent to MyCERT (grouped by IP) with the information above, for incident escalation process
• Screenshot will automagically be taken for each URL
• Defacer name will be captured into database
• Data will be mapped into damn nice Ajax and flashy Flash graphs and bars.. [Thanks to Nymkum mYnN and @m4ysix]
• The main job of MyLipas is to crawl for defaced website.. But it can easily customized to become SQL injection vulnerability crawler, leaked information crawler etc etc..
• Enough for now…

The oldest person in the whole world is in Malaysia! Most of people born in 18xx are still alive

I’ve posted this entry back in 2008 about Semakan Daftar Pemilih, and SPR has removed the information of the pengundi.. [link]

Lets see how long does it take to remove these information pulak

• 790610740022
• 850710740048
• 800501030028

Feel free to check it yourself at this page :- http://daftarj.spr.gov.my/NEWDAFTARJ/DaftarjBM.aspx