BUG: "Expected Identifier" Error Message on Default.aspx ASP.NET Page

The C# WebForm outputs illegal JavaScript to the client. The C# WebForm outputs an HTML form named "default" and then references that form with "document.default".

For example:

In JavaScript, "document.default" is an illegal usage of the keyword "default". Therefore, the browser displays a run-time error.

This illegal code is generated by any control that performs a PostBack.

Resolution

To work around this problem, rename the form in the Default.aspx WebForm by following these steps:

1. Open Default.aspx in Visual Studio .NET designer.
2. Click the HTML tab to view the HTML code.
3. Change the following HTML code
   to the following code:

Status

Microsoft has confirmed that this is a bug in the Microsoft products that are listed at the beginning of this article.

More Information

Steps to Reproduce the Problem

1. Open Microsoft Visual Studio .NET.
2. On the File menu, point to New, and then click Project.
3. In the New Project dialog box, click Visual C# Projects under Project Type, and then click ASP.NET Web Application under Templates.
4. In the Location text box, type the project name as TestApplication by replacing the default 'WebApplication#' name in the URL path.
5. Add a LinkButton server control to WebForm1.aspx.
6. On the File menu, click Save.
7. On the Build menu, click Build Solution.
8. In the Solution Explorer window, right-click WebForm1.aspx, and then click View in Browser.

https://support.microsoft.com/en-us/help/315990/bug-expected-identifier-error-message-on-default.aspx-asp.net-page

Scribbles allegedly embeds a web beacon-style tag into watermarks located on Microsoft Word documents that can report document analytics back to the CIA.

Distributing Word Documents with a 'locating beacon' 30 Aug. 2000

Summary

The Privacy Foundation has discovered that it is possible to add "Web bugs" to Microsoft Word documents. A "Web bug" could allow an author to track where a document is being read and how often. In addition, the author can watch how a "bugged" document is passed from one person to another or from one organization to another. Some possible uses of Web bugs in Word documents include:  * Detecting and tracking leaks of confidential documents from a company.  * Tracking possible copyright infringement of newsletters and reports.  * Monitoring the distribution of a press release.  * Tracking the quoting of text when it is copied from one Word document to a new document. These web bugs are made possible by the ability in Microsoft Word of a document to link to an image file that is located on a remote Web server. Because only the URL of the Web bug is stored in a document and not the actual image, Microsoft Word must fetch the image from a Web server each and every time the document is opened. This image-linking feature then puts a remote server in the position to monitor when and where a document file is being opened. The server knows the IP address and host name of the computer that is opening the document. A host name will typically include a company name if a computer is located at a business. The host name of a home computer usually has the name of a user's Internet Service Provider (ISP). An additional issue, and one that could magnify the potential surveillance, is that Web bugs in Word documents can also read and write browser cookies belonging to Internet Explorer. Cookies could allow an author to match up the computer viewer of a Word document to their visits to the author's Web site. Web bugs are used extensively today by Internet advertising companies on Web pages and in HTML-based email messages for tracking. They are typically 1-by-1 pixel in size to make them invisible on the screen to disguise the fact that they are used for tracking. Although the Privacy Foundation has found no evidence that Web bugs are being used in Word documents today, there is little to prevent their use. Short of removing the feature that allows linking to Web images in Microsoft Word, there does not appear to be a good preventative solution. However, the Privacy Foundation has recommended to Microsoft that cookies be disabled in Microsoft Word through a software patch. In addition to Word documents, Web bugs can also be used in Excel 2000 and PowerPoint 2000 documents Detailed Description: Microsoft Word from the beginning has supported the ability to include picture files in Word documents. Originally the picture files would reside on the local hard drive and then be copied into a document as part of Word .DOC file. However, beginning with Word 97, Microsoft provided the ability to copy images from the Internet. All that is required to use this feature is to know the URL (Web address) of the image. Besides copying the Web image into the document, Word also allows the Web image to be linked to the document via its URL. Linking to the image results in smaller Word document files because only a URL needs to be stored in the file instead of the entire image. When a document contains a linked Web image, Word will automatically fetch the image each time the document is opened. This is necessary to display the image on the screen or to print it out as part of the document. Because a linked Web image must be fetched from a remote Web server, the server is in a position to track when a Word document is opened and possibly by whom. Furthermore, it is possible to include an image in a Word document solely for the purpose of tracking. Such an image is called a Web Bug. Web bugs today are already used extensively by Internet marketing companies on Web pages and embedded in HTML email messages. When a Web bug is embedded in a Word document, the following information is sent to the remote Web server when the document containing the bug is opened:  * The full URL of the Web bug image  * The IP address and the host name of the computer requesting the Web bug  * A Web browser cookie (optional) This information is typically saved in an ordinary log file by Web server software. Because the author of the document has control of the URL of the document, they can put whatever information they choose in this URL. For example, a URL might contain a unique document ID number or the name of the person to whom the document was originally sent. These tracking abilities might be used in any number of ways. In most cases, the reader of a particular document will not know that the document is bugged, or that the Web bug is surreptitiously sending identifying information back through the Internet. One example of this tracking ability is to monitor the path of a confidential document, either within or beyond a company's computer network. The confidential document could be "bugged" to "phone home" each time it is opened. If the company's Web server ever received a "server hit" from an IP address for the bug outside the organization, then it could learn immediately about the leak. Because the server log would include the host name of the computer where the document was opened, a company could know that the organization that received the leaked document was a competitor or media outlet. All original copies of a confidential document could also be numbered so that a company could track the source of a leak. A unique serial number could be encoded in the query string of the Web bug URL. If the document is leaked, the server hit for the Web bug will indicate which copy was leaked. A serial number could be added to a Web bug in a document either manually - right before a copy of a document is saved - or automatically through a simple utility program. The utility program would scan a document for the Web bug URL and add a serial number in the query string. A Perl script of less than 20 lines of code could easily be written to do this sort of serialization. Another use of Web bugs in Word documents is to detect copyright infringement. For example, a publishing company could "bug" all outgoing copies of its newsletter. The Web bugs in a newsletter could contain unique customer ID numbers to detect how widely an individual newsletter is copied and distributed. A third possible use of Web bugs is for market research purposes. For example, a company could place Web bugs in a press release distributed as a Word document. The server log hits for the Web bugs would then tell the company what organizations have actually viewed the press release. The company could also observe how a press release is passed along within an organization, or to other organizations. In an academic setting, Web bugs might be used to detect plagiarism. A document could be bugged before it is distributed. An invisible Web bug could be placed within each paragraph in the document. If text were to be cut and pasted from the document, it is likely that a Web bug would be picked up also and copied into the new document To place a Web bug in a Word document is relatively simple. These are the steps in Word 2000: 1. Select the Insert | Picture | From File... menu command 2. Type in the URL of the Web Bug in the "File Name" field of the Insert Picture dialog box. 3. Select the "Link to File" option of the "Insert" button. Access to the sender's server logs is required to monitor the movement of such Web bugs. The Privacy Foundation ran simple experiments with Excel and PowerPoint files and found that these files can also be "bugged" in Office 2000. The Privacy Foundation continues to investigate this issue with regard to other software programs. The Privacy Foundation has set up a demonstration of a Web bug in a Word document. The demo document can be downloaded from the University of Denver Privacy Center Web site at this URL: http://www.privacycenter.du.edu/demos/bugged.doc The document contains a visible Web bug. When the document is opened, the Web bug will show the host name of the computer that fetched the image. In addition, a non-identifying Web browser cookie will be set on your computer. The cookie is non-identifying because everyone gets the same cookie value, which is simple test string. Demonstrations of "bugged" Excel and PowerPoint files are also available for download from the Privacy Center Web site: http://www.privacycenter.du.edu/demos/bugged.xls http://www.privacycenter.du.edu/demos/bugged.ppt The use of Web bugs in Word does point to a more general problem. Any file format that supports automatic linking to Web pages or images could lead to the same problem. Software engineers should take this privacy issue into consideration when designing new file formats. This issue is potentially critical for music file formats such as MP3 files where piracy concerns are high. For example, it is easy to imagine an extended MP3 file format that supports embedded HTML for showing song credits, cover artwork, lyrics, and so on. The embedded HTML with embedded Web bugs could also be used to track how many times a song is played and by which computer, identified by its IP address. Vendor Contact and Response: Microsoft was contacted about this issue on 8/4/00, and again on 8/25/00. They confirmed that Microsoft Word would access the Internet in order to fetch Web images that are linked to in a Word document. They went on to say that Word uses Internet Explorer to fetch images and therefore standard Web browser cookies can be both read and set from inside a Word document. However, the company claims that Word users can mitigate the use of cookies. Regarding the potential use of Web bugs to track Word documents, Microsoft said that there is no evidence that such activities are occurring. Recommendations: Short of getting rid of the ability to link to Web images from Word documents, there really is no solution to being able to track Word documents using Web bugs. Because this linking ability is a useful feature, the Privacy Foundation does not recommend its removal. However, the Foundation does believe that the Web browser cookies should be disabled inside of Word documents. There appears to be very little need for cookies outside of a Web browser. In general, the Foundation believes that cookies should be disabled by default any time Internet Explorer is reused inside of other applications such as Word, Excel, or Outlook. They would like to see Microsoft make this change in the next release of Internet Explorer. Users concerned about being tracked can use a program such as ZoneAlarm (www.zonelabs.com) to warn about Web bugs in Word documents. ZoneAlarm monitors all software and warns if an unauthorized program is attempting to access the Internet. ZoneAlarm is designed to catch Trojan Horses and Spyware. However, because Word typically does not access the Internet, ZoneAlarms can also be used to catch "bugged" Word documents. http://www.securiteam.com/securitynews/5CP13002AA.html

OK...HUM HUM...DRONES HACKING..HUM HUM

double escape sequence inside a url : The request filtering module is configured to deny a request that contains a double escape sequence

What I am wondering is that what kind of security holes I am opening with this implementation.

On my ASP.NET MVC application, I am trying to implement a URL like below :

/product/tags/for+families
When I try to run my application with default configurations, I am getting this message with 404.11 Response Code :

HTTP Error 404.11 - Not Found

The request filtering module is configured to deny a request that contains a double escape sequence.
I can get around with this error by implementing the below code inside my web.config :

So, now I am not getting any 404.11.

http://stackoverflow.com/questions/7739233/double-escape-sequence-inside-a-url-the-request-filtering-module-is-configured

HUM HUM...DRONES

1. WHAT IS ZAXNET?
2. ZaxNet is a wireless network that runs on a user selectable 2.4 GHz RF signal. ZaxNet is used for the distribution of timecode, IFB audio and metadata. That same ZaxNet signal is also is used to control TRX wireless transmitters.
3. ZaxNet gives you the ability to control any Zaxcom TRX wireless remotely, so there is no need to approach talent and fumble with a transmitter anymore. You can remotely change the
4. frequency, pre-amp gain, transmitter output power and have the ability to place
5. the transmitter’s built-in recorder into record, playback and stop modes. All TRX transmitters also receive timecode for the built-in recorder via ZaxNet.
6. ZaxNet will also distribute audio, timecode and metadata over the same ZaxNet 2.4GHz frequency. This allows you to send timecode and audio throughout your set. An ERX-TCDwill receive Zaxnet and simultaneously output frame accurate timecode and audio. So an ERX-TCD mounted on a camera or digital slate will keep everything in perfect sync since the ERX will be constantly be re-jamming its timecode via ZaxNet. Another option is to use the ERX-TCD to simultaneously feed both timecode as well as a mono audio track to any camera (even if the camera does not have a  timecode input).
7. An ERX body pack receiver can also be used on set for anyone to monitor audio via the same ZaxNet signal. Not only can you use an ERX for monitoring audio but it can also aid in taking script notes since the LCD on the ERX can display timecode, user bits, and scene and take information.

Mechanic: Resurrection (2016) – Official Trailer - Jason Statham, Jessic...

gain on hacking television broadcast; since LTE there's no more rogue modems; the MIM's its typically pivoting penetrating offensive; IT have dual horned connections; let's imagine that you attack LTE by sniffing the base station:

Subframe: 0
BCCH-BCH-Message
message
dl-Bandwidth: n50
phich-Config
phich-Duration: normal
phich-Resource: one
systemFrameNumber: {8
bits|0x17}
spare: {10 bits|0x0000|Right
Aligned}

http://www.ee.columbia.edu/~roger/ShmooCon_talk_final_01162016.pdf

Elsa David

3 min · 

and then, while you're in the midlea .

How to restart RDP without rebooting windows

WARNING: Test this process before you try it on an production system, to make sure you like the results and have the process down.

Problem:

RDP has stopped working but your server still work just users can’t connect to modify applications

The most common fix is to reboot windows, because “Remote Desktop Services” aka TermService can’t be restarted at least thats the case on 2003 as the option is grayed out. This will also create an outage just for a remote control issue and thats not always desirable.

The fix: (remotely)

from command line

1. tasklist /s \\servername /svc /fi “imagename eq svchost.exe” (locate PID for TermService)
2. taskkill /s \\servername /pid xxxx (may need /f to force, UAC might give problems as well)
3. sc \\servername start TermService

The Fix: (local, using remote admin card/other remote control software/other remote command line)

From command line

1. tasklist /svc /fi “imagename eq svchost.exe” (locate PID for TermService)
2. taskkill /pid xxxx (may need /f to force, UAC might give problems as well)
3. sc \\servername start TermService

more helpful RDP troubleshooting

http://support.microsoft.com/kb/2477176

https://theregime.wordpress.com/2013/05/16/how-to-restart-rdp-without-rebooting-windows/

NITROGLICERINE CANDLES TO PRAY TO GOD

An explosive composition comprises a porous fuel and an oxidizer. The porous fuel is a solid with a structure size measuring between about 2 nm and 1000 nm

Integrated thin film explosive micro-detonator 
US 7597046 B1

RESUMO

A method of making a thin film explosive detonator includes forming a substrate layer; depositing a metal layer in situ on the substrate layer; and reacting the metal layer to form a primary explosive layer. The method and apparatus formed thereby integrates fabrication of a micro-detonator in a monolithic MEMS structure using “in-situ” production of the explosive material within the apparatus, in sizes with linear dimensions below about 1 mm. The method is applicable to high-volume low-cost manufacturing of MEMS safety-and-arming devices. The apparatus can be initiated either electrically or mechanically at either a single point or multiple points, using energies of less than about 1 mJ.

https://www.google.ch/patents/US7597046

http://www.google.be/patents/US6984274?hl=nl&cl=de

ALCOHOL ADDICTION SUBSTITUTE

Gamma-hydroxybutyrate (GHB)
Basic Synthesis Procedure

This piece is intended to describe the basic GHB synthesis procedure for those who are interested. It is not meant to be instructions for how to make GHB. It does not (and is not intended to) contain all the information you would need if you were actually going to attempt the procedure. Please do not contact us asking for further instructions.

---

Production of GHB consists simply of mixing "lactone" (short for gamma butyrlactone) and lye (sodium hydroxide) in the proper amounts. The only equipment necessary for doing this in grey and black market production are: a scale which can measure grams accurately (or premeasured chemicals such as what comes with a GHB kit, though kits are much less available now that GHB has been scheduled in the U.S.), a container for the reaction, pH papers, and some human-safe acid such as vinegar or lemon juice, and someblue food coloring. The chemicals are mixed according to simple ratios which are available on the internet.

The biggest dangers of black market GHB is that the originating chemicals are often not human-consumption grade and may contain impurities or contaminants. In practice, however, high grade lactone and sodium hydroxide have been easily accessible from online and local chemical suppliers. Neither lactone nor lye are currently controlled anywhere in the US to my knowledge (Jan '99). There are many chemical suppliers on the net and otherwise who sell these very common chemicals.

Sodium hydroxide (lye) is a powerful and dangerous base which can and will burn exposed skin. Unreacted lye which is swallowed or that contacts sensitive areas like the mouth will burn and can kill. Lye is normally stored as a dry material and when kept very dry it does not react quickly; thus the main danger is getting it wet and then leaving it. Gamma butyrlactone, on the other hand, is a relatively safe chemical to handle.

The chemical reaction between the gamma butyrlactone and the sodium hydroxide (lye) is exothermic, meaning it creates energy/heat when they are mixed. This requires that the GHB chemist have a pyrex or borosilicate glass beaker which won't crack when heated. Metal pans should not be used as the chemicals can react with the pan leaving the chemist with metal in their finished product. Pyrex or borosilicate beakers can be purchased at chemical supply stores, and some home chemists use extra large pyrex measuring cups available at home stores.

The actual process of making GHB is considered some of the simplest home chemistry possible in the grey/black market, which is one of the main reasons for GHB's popularity and wide spread use. The process consists of putting lactone into the heat-resistant container, adding a small amount of water, and then mixing NaOH slowly into the solution. This is usually done over a hot water bath to make it easier for the sodium hydroxide to go into solution. The solution of NaOH and lactone are heated for 10-30 minutes over simmering water in order to force any residual lactone and NaOH to react.

By smelling GHB liquids it is possible to tell whether there is unreacted lactone in the solution. The primary indicator used to determine if the reaction is complete and useable is pH. The pH of safe liquids are generally between pH 6 and 8. Home chemists use pH papers to test the acidity/alkalinity of their products and then use more NaOH or a little lemon juice or vinegar (acetic acid) to adjust the pH to between 7 and 8. Some chemists say that it is best to keep the acididity of their liquid GHB nearer 8 in order to keep the lactone from 'coming back out of solution'.

Because of the shift in laws, other GHB-relatives have been popular as well including 1,4 butanediol and just straight lactone (it is said to convert to GHB in the stomach). Some 'diols' are said to be heavy kidney loads, but there have been no reports yet of serious long term health problems resulting from ingestion of 1,4b.

Consuming any GHB salt should be combined with consuming excess water as it is a very heavy salt load -- normal dosages of Na-GHB or K-GHB are in the 1-3 gram range, sometimes taken multiple times per day. Each gram of GHB contains a large amount of either Potassium (K) or Sodium (Na) salt. A high salt diet can be hard on the kidneys as well as causing other health problems. Making sure to drink plenty of water with GHB might help reduce kidney problems.

Once the GHB has been adjusted to the correct pH it should be cooled (either at room temperature, or in the refrigerator). When it is cool, add a little blue food coloring to the GHB. GHB is a clear liquid which visually can be easily mistaken for water. Despite it's relatively strong taste there have been quite a few cases of accidental ingestion of GHB where an individual takes a drink of what they think is water...only realizing after they've swallowed that it obviously was something else. Making sure to color GHB blue can help prevent this (Blue was chosen as a good color to try to set as the standard. Red, yellow, and orange could all possibly be mistaken for some sort of juice, while green is traditionally the color of absinthe.) Erowid strongly recommends that people color their GHB blue; simply add a couple of drops of food coloring and mix it in.

https://erowid.org/chemicals/ghb/ghb_synthesis.shtml

PHP script for SMS sending

Description

Simple and easy for modification, PHP script for SMS text messages sending API. SMS Gateway (Australia, United Kingdom, United States, Brazil, Türkiye, España, Suomi, México, Italia, India, France, Malaysia, Argentina, Colombia, Canada, Indonesia, Deutschland, Nigeria, Kenya, Ethiopia, Egypt, Philippines and Worldwide coverage!) through HTTP with your Virtual mobile number and delivery reports. You just have to type your account information ( https://www.proovl.com  ) and upload file on server. 

https://www.youtube.com/watch?v=dfPh7Qs_twk 
https://www.youtube.com/channel/UCYuMRNb_SRZ4FMsZjnHRZUA 


https://www.proovl.com/websms 

Numbers for SMS => https://www.proovl.com 
One-day SMS numbers => https://www.groovl.com 

receive sms online script
https://sourceforge.net/projects/sms-number/
Bulk SMS script
https://sourceforge.net/projects/bulk-sms-script/
http://aaronsmith-tech.blogspot.com/2017/04/send-text-messages-from-website-using.html 

PHP script for SMS sending Web Site 

https://sourceforge.net/projects/send-sms-script/?source=typ_redirect

THE "SYSTEM" ISN'T THAT STUPID, OR IT WOULD BE ALREADY DEAD

Hardware-backed Keystore

The availability of a trusted execution environment in a system on a chip (SoC) offers an opportunity for Android devices to provide hardware-backed, strong security services to the Android OS, to platform services, and even to third-party apps. Developers seeking the Android-specific extensions should go to android.security.keystore .

Keystore has been significantly enhanced in Android 6.0 with the addition of symmetric cryptographic primitives, AES and HMAC, and the addition of an access control system for hardware-backed keys. Access controls are specified during key generation and enforced for the lifetime of the key. Keys can be restricted to be usable only after the user has authenticated, and only for specified purposes or with specified cryptographic parameters. For more information, please see the Implementer's Reference .

Before Android 6.0, Android already had a simple, hardware-backed crypto services API, provided by versions 0.2 and 0.3 of the Keymaster Hardware Abstraction Layer (HAL). Keystore provided digital signing and verification operations, plus generation and import of asymmetric signing key pairs. This is already implemented on many devices, but there are many security goals that cannot easily be achieved with only a signature API. Keystore in Android 6.0 extends the Keystore API to provide a broader range of capabilities.

Goals

The goal of the Android 6.0 Keystore API and the underlying Keymaster 1.0 HAL is to provide a basic but adequate set of cryptographic primitives to allow the implementation of protocols using access-controlled, hardware-backed keys.

In addition to expanding the range of cryptographic primitives, Keystore in Android 6.0 adds the following:

• A usage control scheme to allow key usage to be limited, to mitigate the risk of security compromise due to misuse of keys
• An access control scheme to enable restriction of keys to specified users, clients, and a defined time range

Architecture

The Keymaster HAL is an OEM-provided, dynamically-loadable library used by the Keystore service to provide hardware-backed cryptographic services. HAL implementations must not perform any sensitive operations in user space, or even in kernel space. Sensitive operations are delegated to a secure processor reached through some kernel interface. The resulting architecture looks like the following:

Figure 1. Access to Keymaster

Within an Android device, the "client" of the Keymaster HAL consists of multiple layers (eg app, framework, Keystore daemon), but that can be ignored for the purposes of this document. This means that the described Keymaster HAL API is low-level, used by platform-internal components, and not exposed to app developers. The higher-level API, for API level 23, is described on the Android Developer site .

The purpose of the Keymaster HAL is not to implement the security-sensitive algorithms but only to marshal and unmarshal requests to the secure world. The wire format is implementation-defined.

Compatibility with previous versions

The Keymaster v1.0 HAL is completely incompatible with the previously-released HALs, eg Keymaster v0.2 and v0.3. To facilitate interoperability on pre-Marshmallow devices that launched with the older Keymaster HALs, Keystore provides an adapter that implements the 1.0 HAL with calls to the existing hardware library. The result cannot provide the full range of functionality in the 1.0 HAL. In particular, it will only support RSA and ECDSA algorithms, and all of the key authorization enforcement will be performed by the adapter, in the non-secure world.

https://translate.google.pt/translate?hl=pt-PT&sl=en&tl=pt&u=https%3A%2F%2Fsource.android.com%2Fsecurity%2Fkeystore%2F&anno=2