Rising Star in Pakistan for Cyber Security & Research

Rising Star in Pakistan for Cyber Security & Research 

Pakistani Star

Rafay Baloch is the founder/CEO of RHAinfosec, He runs one of the top security blogs in Pakistan with more than 25k+ subscribers and 100k+ Facebook fan. Rafay has helped major industrial giants such as Google, Facebook, twitter, paypal, adobe, apple etc to improve and secure their online presense. Rafay managed to find a Remote Code execution vulnerability inside paypal for which he was awarded 10,000$ and also was offered a job inside of Paypal as a security ninja.

Currently, the major area of Rafay's research are bypassing modern security defenses, HTML 5 and other client side javascript. Rafay holds CPTE, OSCP, CCNP Route, WAPT certifications. He also earned ECCS from Voice of Green Hats. Rafay's work has been featured in enormous amounts of articles, newspaper, magazines and local TV channels.

Q: What was your first finding? How did you felt at that moment?

I really don’t remember if it was my first finding, However as far as i can catch up my memory it was a SQL injection authentication bypass attack, at that time i really didn’t know why it worked but i felt really surprised at that time.

Q: You hunt bugs for what? Money, Fun, Fame or you want to make the Internet a safe place?

Well, honestly, Little of every thing, First of all, I don’t only hunt vulnerabilities on websites having bug bounty programs, I also report to websites that do not have them. Some to get listed in responsible disclosures and ofcourse to make the world a better place.

Q: Rafay, you have received a bug bounty of $10,000 from PayPal. What was the real story behind it?

It was a remote code execution vulnerability i found inside paypal, which allowed me to execute any commands on the server. For that Paypal rewarded me 10,000$.

Q: Why you didn’t accepted Job Offer from PayPal? I think that was a Golden Chance for you.

Well, I am in middle of my bachelors, therefore i think i did not accept that offer and honestly i am not in a favor of doing a job or working for something, i would rather prefer working with some one rather than working for some one. However, i still think i can avail it after my bachelors.

Q: Every one have someone who have inspired him. Who is your inspiration

Kevin Mitnick is definitely an inspiration for every one, his social engineering techniques were really amazing, he has shown a different approach towards hacking.

Q: Google and Facebook have also Paid you Bug Bounties, how you feel when you receive Bounties?

Bounties add an extra income to my pocket every month, however, i really feel lucky to receive bounties from so many companies.

Q: You are much Famous my bro, tell me on how many sites you are listed as a Security Researcher?

Alot, On linkedin profile i listed more than 50 websites who have listed me on their responsible disclosure/whitehats pages. However, there are lots of websites who do not have an acknowledgment list on their website, so they thanked me via an email or sometimes by sending a gift T-shirt, toolkit etc etc.
linkedin.com/in/rafaybaloch

Q: PKNIC is always been targeted my site was also down for some hours. What you recommend them to increase their Security?

The threat is on their web application level, which allowed the attacker to access it’s database, I remember, i saw a screen shot on a forum where it was vulnerable to SQL Injection attack, So i would recommend them to review their security policies and validate inputs properly to prevent any kind of these attacks in the future.

Q: If you don’t mind, can you tell me what courses are essential to do to become a successful Security Researcher?

Honestly speaking i never did any courses, nor i did any certifications though i have tought courses like CEH, CPTE to lots of people, but i never did any of these certifications, However, in terms of value i believe CEH, GPEN is at the top, in terms of knowledge i think CEH is only good for beginners, it’s just a catalog of tools, In terms of knowledge i would recommend any one to go after learn security (ecPPT), OSCP (Offensive security Certified Professional), ECCS (Executive Certificate in Cyber Security) by Voice of Green Hats and SANS gpen.

Q: What are your future plans. Would go for a job or start your own Company?

I would be launching my book "Ethical hacking and penetration Testing" this year inshA ALLAH, after that i 'll work on DOM based XSS wiki and something cool related to HTML 5.

Introduction to Server Virtualization Technology and Hypervisor Types

Virtualization is the creation of a virtual (rather than actual) version of something, such as an operating system, a server, a storage device or network resources.
For those who are new to virtualization technology, this article will give you some high level fundamentals that will help you to get started on virtualization.

Three areas of Virtualization

The following are three high-level areas where virtualization could be done:

1. Network virtualization is a method of combining available resources in a network by splitting up the available bandwidth into channels, each of which is independent from the others, and each of which can be assigned (or reassigned) to a particular server or device in real time. The idea is that virtualization disguises the true complexity of the network by separating it into manageable parts, much like your partitioned hard drive makes it easier to manage your files.
2. Storage virtualization is the pooling of physical storage from multiple network storage devices into what appears to be a single storage device that is managed from a central console. Storage virtualization is commonly used in storage area networks (SANs).
3. Server virtualization is the masking of server resources (including the number and identity of individual physical servers, processors, and operating systems) from server users. The intention is to spare the user from having to understand and manage complicated details of server resources while increasing resource sharing and utilization and maintaining the capacity to expand later.

System Virtualization: Hardware and Hypervisors

System virtualization is a technology often used to consolidate systems, workloads and operating environments by using a single physical system to create multiple virtual systems. One type of system virtualization is done through hardware partitioning, which divides a single physical server into partitions — where each partition is able to run an operating system.
A Hypervisor, which is also called as Virtual Machine Monitor (VMM) or virtualization manager is another technology at the heart of system virtualization. A hypervisor provides the underpinnings for virtualization management, which includes policy-based automation, virtual hard disk, life cycle management, live migration and real-time resource allocation. It’s the software program or part of the code in firmware that manages either multiple operating systems or multiple instances of the same operating system on a single computer system. The hypervisor’s job is to manage the system’s processor, memory and other resources to allocate what each operating system requires. Hypervisors provide the means to logically divide a single, physical server or blade, allowing multiple operating systems to run securely on the same CPU and increase the CPU utilization.
Where hardware partitioning allows for hardware consolidation, hypervisors allow for flexibility in how the virtual resources are defined and managed, making it a more-often used system consolidation solution.

Two Types of Hypervisors

Type 1 Hypervisors – Native or Bare-Metal Hypervisors run directly on the host’s hardware to control the hardware and to manage guest operating systems. A guest operating-system thus runs on another level above the hypervisor. The following figure shows one physical system with a type 1 hypervisor running directly on the system hardware, and three virtual systems using virtual resources provided by the hypervisor.
An example of Type 1 Hypervisor is VMware ESXi.

Type 2 Hypervisors – Hosted  Hypervisors are those that run on a host operating system that provides virtualization services, such as I/O device support and memory management. Type 2 hypervisors are used mainly on client systems where efficiency is less critical, and are also commonly used for systems where support for a broad range of I/O devices is needed and can be provided by the host operating system. The following figure shows one physical system with a type 2 hypervisor running on a host operating system and three virtual systems using the virtual resources provided by the hypervisor.
An example of Type 2 Hypervisor is VMware workstation.

What is Server Virtualization?

Server virtualization is a technology for partitioning one physical server into multiple virtual servers. Each of these virtual servers can run its own operating system and applications, and perform as if it is an individual server. This makes it possible, for example, to complete development using various operating systems on one physical server or to consolidate servers used by multiple business divisions.

Server Virtualization Features

The following are two high-level important features of server virtualization:

1. It provides partitioning and isolation. i.e Resources of same physical server are shared by multiple VMs and are isolated from each other.
2. It provides high availability. i.e Several physical servers can form a cluster for high availability. If one server goes down, all the VMs on that server will migrate to another physical server in the cluster.

Primary Advantages of Server Virtualization

1. Reduce number of servers: Partitioning and isolation, the characteristics of server virtualization, enable simple and safe server consolidation. Through consolidating, the number of physical servers can be greatly reduced. This alone brings benefits such as reduced floor space, power consumption and air conditioning costs. However, it is essential to note that even though the number of physical servers is greatly reduced, the number of virtual servers to be managed does not change. Therefore, when virtualizing servers, installation of operation management tools for efficient server management is recommended.
2. Reduce TCO: Server consolidation with virtualization reduces costs of hardware, maintenance, power, and air conditioning. In addition, it lowers the Total Cost of Ownership (TCO) by increasing the efficiency of server resources and operational changes, as well as virtualization-specific features. As a result of today’s improved server CPU performance, a few servers have high resource-usage rates but most are often underutilized. Virtualization can eliminate such ineffective use of CPU resources, plus optimize resources throughout the server environment. Furthermore, because servers managed by each business division’s staff can be centrally managed by a single administrator, operation management costs can be greatly reduced.
3. Improve availability and business continuity: One beneficial feature of virtualized servers not available in physical server environments is live migration. With live migration, virtual servers can be migrated to another physical server for tasks such as performing maintenance on the physical servers without shutting them down. Thus there is no impact on the end user. Another great advantage of virtualization technology is that its encapsulation and hardware-independence features enhance availability and business continuity.
4. Increase efficiency for development and test environments: At system development sites, servers are often used inefficiently. When different physical servers are used by each business division’s development team, the number of servers can easily increase. Conversely, when physical servers are shared by teams, reconfiguring development and test environments can be time and labor consuming. Such issues can be resolved by using server virtualization to simultaneously run various operating system environments on one physical server, thereby enabling concurrent development and test of multiple environments. In addition, because development and test environments can be encapsulated and saved, reconfiguration is extremely simple.

Linux provides several powerful administrative tools and utilities which will help you to manage your systems effectively. If you don’t know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linux system administrator.
Get the Linux Sysadmin Course Now! 

ونڈوز 8 کی دنیا

امریکا کی مائیکرو سافٹ کارپوریشن نے اکتوبر 2012ء کے آخری ہفتے ونڈوز8 (Windows 8) جاری کر دی۔ یہ کمپیوٹرز، سمارٹ فون اورٹیبلٹس کے لیے مائیکروسافٹ کا جدید ترین آپریٹنگ سسٹم ہے۔ ماہرین سے لے کر عام لوگ تک اس پرتبصرے کر رہے ہیں۔ ہر آپریٹنگ سسٹم کی طرح اس کی بھی خوبیاں اور خامیاں سامنے آئی ہیں۔

پہلی بات تو یہ ہے کہ ونڈوز 8 ایسے کمپیوٹر پر ہی چل سکتی ہے جس میں کم از کم ایک گیگاہرٹز (Gigahertz) کا پروسیسر نصب ہو۔ نیز ۱؍گیگا بائٹ ریم (Gigabyte RAM) موجود ہو۔ مزید برآں ہارڈڈسک (Hard Disk) میں20؍گیگا بائٹس(Gigabytes) جگہ ہونی چاہیے۔ نیز کمپیوٹر میں ڈائریکٹ 9؍ گرافکس کارڈ مع ڈبلیو ڈی ڈی ایم ڈرائیور بھی لگا ہو۔

سٹارٹ مینو (Start Menu)ختم ہوا ونڈوز 8کی نمایاں ترین خصوصیت یہ ہے کہ اس میں سٹارٹ مینو موجود نہیں۔ مزید برآںسابقہ ونڈوز کی خاص نشانی، ڈیسک ٹاپ بھی عنقا ہے۔ اس کی جگہ ٹائل نما ڈبوں نے لے لی۔ انہی ٹائلوں میں تمام پروگرام نظر آتے ہیں۔ جو پروگرام کھولنا ہو اس پر کلک کیجئے، وہ کھل جائے گا۔ یوں مائیکروسافٹ نے ایک تیر سے دو شکار کیے اور سٹارٹ مینو اور ڈیسک ٹاپ کو یکجا کر دیا۔ اس طرح ’’منی مائز‘‘ اور ’’میکسی مائز‘‘ کے بٹنوں سے نجات مل گئی۔

ٹائل نما ڈیسک ٹاپ سے ہم آہنگ ہونے میں کچھ وقت لگتا ہے تاہم اسے استعمال کرنے والوں کا کہنا ہے کہ اس کو برتنا آسان ہے۔ دراصل یہ تبدیلی اس لیے کی گئی کہ سمارٹ فون اور ٹیبلٹ والے بھی اسے بآسانی استعمال کر سکیں۔گویا نئی نسل کو رِجھانا مقصود ہے جو فی الوقت اپنے سمارٹ فونز میں مختلف آپریٹنگ سسٹم مثلاً اینڈرویڈ اور آئی ایس او وغیرہ برتتی ہے۔ مگر ایکس پی یا ونڈوز7؍ استعمال کرنے والے سٹارٹ مینو یا ڈیسک ٹاپ غائب پا کر پریشان ہو سکتے ہیں۔

تیز رفتاری میں آگے ونڈوز 8 کی دوسری خصوصیت یہ ہے کہ یہ خاصی تیز ہے بلکہ برق رفتار۔ اسی طرح پروگرام بھی کلک کرتے ہی کھل جاتے ہیں۔ اسے استعمال کرنے والوں کا کہنا ہے کہ ونڈوز 7؍کھلنے اور بند ہونے میں تقریباً 30؍ سیکنڈ لگاتی ہے۔ جب کہ ونڈوز 8؍ یہی مراحل کمپیوٹر کی طاقت کے حساب سے15 تا20؍ سیکنڈ میں طے کر لیتی ہے۔

Use binder clips to Fix broken key board feet

How Remove Dirty Pics and Movies From Facbook

Google unveiled a contact lens

Google unveiled a contact lens on Thursday that monitors glucose levels in tears, a potential reprieve for millions of diabetics who have to jab their fingers to draw their own blood as many as 10 times a day. http://alj.am/1dergxw
(Google/AP)

Excel Tip : Quickly adding row under each data item.

Excel Tip : Quickly adding row under each data item.