SQLi hunter is a tool to scan for an SQLi Injection vulnerability in a website on auto-pilot. It automates the search of SQLi vulnerable links from Google using different dorks. SQLi hunter can also find admin panel page of any website by using some predefined admin page lists. Download SQLi hunter v1.2.
FEATURES
– Supports 500 results – Url List can be Imported / Exported – The setting for connection timeout – Proxy Settings
If you're not totally satisfied with this tool, you can try other sql injection tools like havij , sqli dumper and sqlmap. These tools are incredibly super flexible with their advanced injection features.
Bob was tasked to break into XYZcorporation, so he pulled up the facility on google maps to see what the layout was. He was looking for any possible entry paths into the company headquarters. Online maps showed that the whole facility was surrounded by a security access gate. Not much else could be determined remotely so bob decided to take a drive to the facility and get a closer look.
Bob parked down the street in view of the entry gate. Upon arrival he noted the gate was un-manned and cars were rolling up to the gate typing in an access code or simply driving up to the gate as it opening automatically.Interestingly there was some kind of wireless technology in use.
How do we go from watching a car go through a gate, to having a physical device that opens the gate?
We will take a look at reversing a signal from an actual gate to program a remote with the proper RF signal.Learning how to perform these steps manually to get a better understanding of how RF remotes work in conjunction with automating processes with RFCrack.
In the the previous blogs, we sniffed signals and replayed them to perform actions. In this blog we are going to take a look at a signal and reverse it to create a physical device that will act as a replacement for the original device. Depending on the scenario this may be a better approach if you plan to enter the facility off hours when there is no signal to capture or you don't want to look suspicious.
Recon:
Lets first use the scanning functionality in RFCrack to find known frequencies. Weneed to understand the frequencies that gates usually use. This way we can set our scanner to a limited number of frequencies to rotate through. The smaller rage of frequencies used will provide a better chance of capturing a signal when a car opens the target gate. This would be beneficial if the scanning device is left unattended within a dropbox created with something like a Kali on a Raspberry Pi. One could access it from a good distance away by setting up a wifi hotspot or cellular connection.
Based on research remotes tend to use 315Mhz, 390Mhz, 433Mhz and a few other frequencies. So in our case we will start up RFCrack on those likely used frequencies and just let it run. We can also look up the FCID of our clicker to see what Frequencies manufactures are using. Although not standardized, similar technologies tend to use similar configurations. Below is from the data sheet located at https://fccid.io/HBW7922/Test-Report/test-report-1755584 which indicates that if this gate is compatible with a universal remote it should be using the 300,310, 315, 372, 390 Frequencies. Most notably the 310, 315 and 390 as the others are only on a couple configurations.
RFCrack Scanning:
Since the most used ranges are 310, 315, 390 within our universal clicker, lets set RFCrack scanner to rotate through those and scan for signals.If a number of cars go through the gate and there are no captures we can adjust the scanner later over our wifi connection from a distance.
Currently Scanning: 433000000 To cancel hit enter and wait a few seconds
Example of logging output:
From the above output you will see that a frequency was found on 390. However, if you had left this running for a few hours you could easily see all of the output in the log file located in your RFCrack/scanning_logs directory.For example the following captures were found in the log file in an easily parseable format:
Analyzing the signal to determine toggle switches:
Ok sweet, now we have a valid signal which will open the gate. Of course we could just replay this and open the gate, but we are going to create a physical device we can pass along to whoever needs entry regardless if they understand RF. No need to fumble around with a computer and look suspicious.Also replaying a signal with RFCrack is just to easy, nothing new to learn taking the easy route.
The first thing we are going to do is graph the capture and take a look at the wave pattern it creates. This can give us a lot of clues that might prove beneficial in figuring out the toggle switch pattern found in remotes. There are a few ways we can do this. If you don't have a yardstick at home you can capture the initial signal with your cheap RTL-SDR dongle as we did in the first RF blog. We could then open it in audacity. This signal is shown below.
Let RFCrack Plot the Signal For you:
The other option is let RFCrack help you out by taking a signal from the log output above and let RFCrack plot it for you.This saves time and allows you to use only one piece of hardware for all of the work.This can easily be done with the following command:
From the graph output we see 2 distinct crest lengths and some junk at either end we can throw away. These 2 unique crests correspond to our toggle switch positions of up/down giving us the following 2 possible scenarios using a 9 toggle switch remote based on the 9 crests above:
Possible toggle switch scenarios:
down down up up up down down down down
up up down down down up up up up
Configuring a remote:
Proper toggle switch configuration allows us to program a universal remote that sends a signal to the gate. However even with the proper toggle switch configuration the remote has many different signals it sends based on the manufacturer or type of signal.In order to figure out which configuration the gate is using without physically watching the gate open, we will rely on local signal analysis/comparison.
Programming a remote is done by clicking the device with the proper toggle switch configuration until the gate opens and the correct manufacturer is configured. Since we don't have access to the gate after capturing the initial signal we will instead compare each signal from he remote to the original captured signal.
Comparing Signals:
This can be done a few ways, one way is to use an RTLSDR and capture all of the presses followed by visually comparing the output in audacity. Instead I prefer to use one tool and automate this process with RFCrack so that on each click of the device we can compare a signal with the original capture. Since there are multiple signals sent with each click it will analyze all of them and provide a percent likelihood of match of all the signals in that click followed by a comparing the highest % match graph for visual confirmation. If you are seeing a 80-90% match you should have the correct signal match.
Note:Not every click will show output as some clicks will be on different frequencies, these don't matter since our recon confirmed the gate is communicating on 390Mhz.
In order to analyze the signals in real time you will need to open up your clicker and set the proper toggle switch settings followed by setting up a sniffer and live analysis with RFCrack:
Open up 2 terminals and use the following commands:
#Setup a sniffer on 390mhz Setup sniffer:python RFCrack.py -k -c -f 390000000.
#Monitor the log file, and provide the gates original signal Setup Analysis: python RFCrack.py -c -u 1f0fffe0fffc01ff803ff007fe0fffc1fff83fff07ffe0007c -n.
Cmd switches used
-k = known frequency
-c = compare mode
-f = frequency
-n = no yardstick needed for analysis
Make sure your remote is configured for one of the possible toggle configurations determined above. In the below example I am using the first configuration, any extra toggles left in the down position: (down down up up up down down down down)
Analyze Your Clicks:
Now with the two terminals open and running click the reset switch to the bottom left and hold till it flashes. Then keep clicking the left button and viewing the output in the sniffing analysis terminal which will provide the comparisons as graphs are loaded to validate the output.If you click the device and no output is seen, all that means is that the device is communicating on a frequency which we are not listening on.We don't care about those signals since they don't pertain to our target.
At around the 11th click you will see high likelihood of a match and a graph which is near identical. A few click outputs are shown below with the graph from the last output with a 97% match.It will always graph the highest percentage within a click.Sometimes there will be blank graphs when the data is wacky and doesn't work so well. This is fine since we don't care about wacky data.
You will notice the previous clicks did not show even close to a match, so its pretty easy to determine which is the right manufacture and setup for your target gate. Now just click the right hand button on the remote and it should be configured with the gates setup even though you are in another location setting up for your test.
For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png
----------Start Signals In Press--------------
Percent Chance of Match for press is: 0.05
Percent Chance of Match for press is: 0.14
Percent Chance of Match for press is: 0.14
Percent Chance of Match for press is: 0.12
----------End Signals In Press------------
For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png
----------Start Signals In Press--------------
Percent Chance of Match for press is: 0.14
Percent Chance of Match for press is: 0.20
Percent Chance of Match for press is: 0.19
Percent Chance of Match for press is: 0.25
----------End Signals In Press------------
For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png
----------Start Signals In Press--------------
Percent Chance of Match for press is: 0.93
Percent Chance of Match for press is: 0.93
Percent Chance of Match for press is: 0.97
Percent Chance of Match for press is: 0.90
Percent Chance of Match for press is: 0.88
Percent Chance of Match for press is: 0.44
----------End Signals In Press------------
For Visual of the last signal comparison go to ./imageOutput/LiveComparison.png
Graph Comparison Output for 97% Match:
Conclusion:
You have now walked through successfully reversing a toggle switch remote for a security gate. You took a raw signal and created a working device using only a Yardstick and RFCrack.This was just a quick tutorial on leveraging the skillsets you gained in previous blogs in order to learn how to analyzeRF signals within embedded devices. There are many scenarios these same techniques could assist in.We also covered a few new features in RF crack regarding logging, graphing and comparing signals.These are just a few of the features which have been added since the initial release. For more info and other features check the wiki.
We know, we know – there hasn't been a blog update in a long time, but we're making up for it! Today marks the 5th anniversary of Oceanhorn first launch on iOS, the perfect occasion for a few things. First of all, we'd like to say 'thank you' to our incredible community – over the years and for each platform release we've seen an incredible amount of passion and support for the world we created. We wouldn't be here without you, and we'll always keep that in mind.
Solve the mysteries of the ancient Arcadians in Oceanhorn 2
It's also an excellent time to talk about Oceanhorn 2: Knights of the Lost Realm. The game is coming along great, and we're confident it will be worth the wait! We are targeting 2019 for the announced iOS release. Over the next few months we'll have updates on various aspects of the game, but for now, you can feast your eyes on the brand newOceanhorn website we are launching today. It features never-before-seen screenshots and info about Oceanhorn 2, with more to come. If you'd like to cover the game in one of your channels, head to the Press page and download our Press Kit.
Oh, one last thing: we're also setting up an Oceanhorn newsletter, where we plan to send updates on the game before they become public and celebrate the fifth anniversary this whole year in one way or another. If you want to be the first to know what we are up to, make sure you sign up on oceanhorn.com homepage!
We've already discussed Storium's first (and my favorite) Neutral card type, the Subplot, but that's not the only Neutral card type in Storium. Today, I'm going to discuss the other two types: Assets and Goals.
Unlike all the other cards in Storium, Assets and Goals are not things that you start with - they aren't part of your character from the beginning, and they aren't chosen at Refreshes or upon spending a stack or anything like that. Whether you have these cards or not isn't up to you, entirely - it depends on the narrator. These are both given to players - or provided for pickup - by the narrator at his will.
Assets represent things like items, people, or other resources that are sufficiently important to the story to be specifically noted. Narrators vary in how they use them—some toss out a ton, some toss out generic ones that players can customize (more on that later), and some provide only very specific, story-critical assets. The use is the same, regardless: You play the card and move things forward, telling how that resource is important in pushing the challenge closer to conclusion. It can sometimes be easier to write asset moves if you play a Strength or Weakness with them, so you can write how you use that asset well or badly.
Goals are kind of like Subplots, but they're things the narrator would like to see you address during the game. Like assets, narrators use these for all sorts of purposes. I've seen them used to represent injuries, enchantments, objectives…I've seen them used as requests to world-build or create NPCs that the narrator can use…all sorts of things. They work similarly to subplots - you get a stack, and when you play all the cards of that stack, you get a free Wild Strength as a reward. Basically, these are the narrator's way of saying, "Hey, talk about this in the story or show this happening, and if you do it, you can get a Strength card for making the story more interesting."
Narrators may give Assets or Goals to you directly, or may lay them out to be picked up. You can pick up a card that a narrator set out by using the "pick up cards" button at the bottom of your move editing window when writing a move. If picking a card up, you'll often want to actually show the item being picked up as part of your move, or show your character now thinking about the Goal and deciding to take it up, but that isn't always necessary (for instance, I often use Assets to represent other characters traveling with the group).
Whether given to you or picked up by you, you can then hold on to the asset card until you feel like playing it. You can also pick up and play an asset card in the same move.
Like subplots, assets and goals are neutral cards–they push a challenge closer to conclusion but don't themselves tip the scale one way or another. I look at it like this: You might have a gun, and that might matter to a scene, but whether it is a good thing or a bad thing really depends on how you use it…so Strengths and Weaknesses are still what you use to affect outcomes. That's not to say you have to play one of those cards along with an asset or goal, but I do have to say I generally find it easier to write moves for asset or goal cards if I play them with a Strength or Weakness myself.
If you play an asset or goal card on its own, think like you do for Subplot cards: the card is important to the scene and pushes things towards a conclusion, but doesn't change the current Strong/Weak balance so things still feel like they're headed for the ending they were headed for before, overall. As with Subplots, that can feel good if things were headed towards a Strong outcome, or bad if they were headed for a Weak outcome, or just...well...uncertain if they were headed for an Uncertain outcome. The overall feel of the situation hasn't changed, but now there's less time to change it.
Asset cards can be rewritten, as I've noted above. If an asset card has multiple uses (a "stack"), you can use the "browse your cards" button in your move writing window to look at it and rewrite the asset. This consumes one use of the asset card stack, but lets you rename it to something that seems more narratively important at the time. That means that if you have, say, a stack of asset cards representing a gun and you don't have access to that gun in the story presently, you can just rewrite the stack into something else–maybe your character always keeps a city map around.
Note that not all narrators allow that – some really prefer assets to represent one thing and one thing only. But the basic idea of how they're set up is to give you something to use when you feel like your character would have something to help out and you want to highlight that. I believe Stephen Hood called them "ways to plug holes in the plot," and that's a pretty apt description.
Assets and Goals will feature majorly in some games, and barely at all in others, depending on the narrator's style, but they're cards you need to be aware of. I actually haven't written all that much on Assets and Goals over the course of my writing on this blog, as in my own narration they are cards I don't use much! This is a case where I suggest talking with other players and narrators on Storium more than looking to my writing for advice. That said, here are a few articles that cover Neutral cards more generally:
I was drawn to the Kickstarter campaign for Deadwood 1876 by its terrific artwork and simple, elegant graphic design, so let's talk about that first.
It is a great looking game. It comes packaged (like all of the games in the "dark city" series from Facade Games) in a box designed to look like an old leather bound book with a magnetic lid. All the game components other than the cards are made of wood (no plastic) and beautifully designed, especially the three engraved discs that represent the locations in the game. The artwork on the cards is very well-rendered, in a style that is just cartoony enough to be expressive but without looking silly.
The game's design is also very minimal, which appeals to me as a respite from the current trend towards overproduced Kickstarter games with hundreds of plastic miniatures and overdone, hard to read boards and rulebooks. Finally something simple and (hopefully) easy to play.
Or is it?
The rules and mechanics of the game are simple enough. The game consists of Safe cards, Deadwood cards, and three locations at the center of the table. Each player starts with two face down safe cards in front of them, and there is a stack of three more in the center; Safe cards consist mainly of gold in various denominations, with a few guns and other items sprinkled in.
Players also start with a hand of Deadwood cards that represent items used to perform actions: guns for fighting, horses for movement, and various bits of leatherwork such as hats and holsters for manipulating the cards in various ways. Player pawns are randomly distributed among the three locations (more on this in a moment).
The goal of the game is to be in the location whose occupants collectively have the most gold (depicted on their face down Safe cards) at the end of the game. Once the winning location has been determined, the occupants of that location use their remaining weapon cards to fight it out to see who the final winner is.
Play consists of each player playing one Deadwood card from their hand. A card can be played as a weapon to attack another player, in order to either take one of their safes, or to switch places with another player's pawn or force them to leave your location. Weapons have variable strengths but use dice to determine the outcome of combat, so a lower card isn't necessarily a lost cause. Or, it can be played for another effect such as moving between locations (if there's room, each location is limited to a certain number of player pawns), peeking at face down Safe cards, or drawing extra Deadwood cards from the deck.
After each player has had a turn to play a card, there is a heist round, where players use weapon cards to fight it out for one of the safes in the middle of the table. Then another round of play begins, and so on, until all the safes in the center have been claimed. At that point there is one final round, and then the winning location is determined and the final showdown happens.
It sounds like there's a lot going on, and there is, but there is one critical problem. A key strategy to the game is figuring out who has the high value safes, so you can either steal them or make sure you're at the location with the most gold at the end. It's supposed to be a "game of shifting alliances" where you side with the others in your location to make sure you collectively have the most gold, and then backstab them in the final showdown. The problem is that with only four turns per player before the final showdown, you just don't have enough time for the amount of social deduction or level of strategy that the game calls for.
Because of the amount of bluffing and secret information involved, the game relies on all the players having a roughly equal understanding of the rules and especially the strategy, which makes it very difficult to teach. This is a major problem for a game that, like any "shifting alliances" game, needs a large number of players to be interesting.
On the other hand, I think there is a fun game here somewhere, and the gorgeous design and components make me want to keep trying to make it work.
Rating: 3 (out of 5) Too much social deduction for a board game, or perhaps too much structure for a social deduction game, but the game is beautiful to look at.
Prince is auditioning for the role of Arthur Fleck (BTW, notice the picture showing wizard goblin with his friends from the first game)
Last time, Prince had just been possessed by a demon, and the wizard goblin suggested using water from his fountain. The water did separate the demon from the prince, but this wasn't just a good thing.
Captured again
Prince was gone, wizard was of no use and I had no idea what to do. It was back to testing random things - and mostly enraging the wizard in the process. I quickly found a pencil, and if a goblin tried to draw with it on wizard's portrait, the wizard would throw a boomerang, which the other goblin could catch. If then a goblin would pour water on the wizard, the wizard would throw a toothpick, which the other goblin could catch with the boomerang. The toothpick could then be used on the teeth of the skeleton, which would open its chest cavity and reveal a bottle which would fall down on the floor and break, leaving only a wet puddle.
I also tried to use the pencil to draw a caricature of the wizard on the blackboard. The wizard wiped it away a few times and finally threw his sponge on the floor. I could then use the sponge to clean the puddle of water. If I then blew the pipe to make some smoke and used the wet sponge on smoke, a portal appeared. Yep, the puzzles have become a bit arbitrary at this point of the game.
Surprise, it's the same demon we defeated once!
The portal took us to the kingdom of death, where the demon Amoniak was the holding prince in his arms. It was again time to test the various hotspots with both of the gobliins. One "button" particularly threw out eye balls, which a goblin could ride to get to a part of the screen where he could catch a mouse.
Yes, it's a flying eyeball
The mouse could be used to lure a crocodile to lift its head from one of the holes. Jumping on the crocodile would make the goblin fly through the air. The demon would try to catch the flying goblin, which would allow me to throw a boomerang at a nearby stalactite and hit the demon's hand with it (yet another tight spot requiring quick timing). At this point, Amoniak lost his grip and the prince ran off.
You can see a monster trying to stop the prince and another eyeball convincing it to let go
I had achieved one goal, and I could now pause and decide what to do next. I was still in the realm of death, with no obvious exit. This was again a time for random experimentation. After a considerable amount of false leads, I noticed that I could drop my wet sponge on a rock and then throw the prince with the eyeball machine on it, making the rock wet in the process. I could then use my pencil to draw something on the rock (yes, the puzzles have become a bit arbitrary).
A doorway!
Bye
This is it, this is the ending?
A bit of a letdown, I have to say. Oh well, I'll return next week with the ratings.
Read more
