xchg.info

Who Uploaded that image at FB?

Today was another rainy day here. And i didn’t get to go to ShmooCon as CNY is near.
I have at numerous times been asked by people on who uploaded certain images at Facebook.

So i spent 10min and developed this time wasting web application.
Basically, users just need to enter the url containing the FB image and it will return the profile id of the person who uploaded that particular image.
Hopefully this will be useful to those people.
I made use of jQuery JavaScript Library v1.4.2 to return the results.
But none-the-less, here are the source code to the web application.
FB.Image

Anyway, have Phun coding.
/Me wish i was at ShmooCon.

BR,
[ Gunther ]

Boring Application by a bored man. :(

The other day i was feeling kinda bored so i developed a simple application to fetch the rankings of the “Free” & “Paid” iPhone and iPad applications in iTunes Store.
It’s really nothing fancy but maybe someone would find it useful or further enhance it.

Basically, what i did was use Paros to sniff the traffic from iTunes to see where did it get the results.
Initially, i had a small hiccup. Then i realise it requires me to have the iTunes User Agent.

I have hereby attached the entire source code.
iTunes.Ranking

Until next time, Have Phun coding.

BR,
[ Gunther ]

Simple Virustotal Checking Tool

Hi everyone, it’s been a long time since any of us blogged about anything here. But rest assured that we are coming up with some interesting stuff for some of you if not all of you.

Maybe, today’s topic seems slightly amateur-ish but it’s part of the modules EvilCry and myself are integrating into a system that we are developing and hope it will be useful.
This is just the Alpha version of a particular module. So to put it simply, what this module does is to allow user to do a quick MD5 hash of the binary that they have on hand and do a quick check against VirusTotal. Return the results if it’s submitted to VirusTotal before.

The plans we have for this is to add in 2 more options. Firstly being, “Update”, which we allow user(s) to add in the results into an internal DB, we are using SQLite. The other option is “Offline” such that the user(s) can do a quick check in his / her internal DB instead of querying VirusTotal. It will be useful if 1 got too many files to check and not sure whether it’s trusted or not.

In the meantime, we will try to write more quality stuff.

Have Phun everyone.

BR,
[ Gunther ]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

#!/usr/bin/python
import re, hashlib
import os, sys
import urllib, urllib2
 
# Usage
def help_menu(cmd):
    print("Usage: python %s [online] [binary]\n") % (cmd)
 
# Banner
def Banner():
    print("=================================================")
    print("MD5 Virustotal Checking Tool v0.2                ")
    print("=================================================")
 
def online_check(binary_md5):
    url = "http://www.virustotal.com/search.html"
    values = { 'chain' : binary_md5 }
    data = urllib.urlencode(values)
    req = urllib2.Request(url, data)
 
    try:
        response = urllib2.urlopen(req)
    except(URLError),e:
        print e.reason
    digit1 = ""
    digit2 = ""
    perc = ""
 
    while 1:
        data = response.read(65536)
        if (len(data) > 0):
            if data.find("The item you searched for was not") > 0:
                print("[+] No malware detected")
                sys.exit(1)
 
            retup = re.findall('(color: red">)(\\d+)(<\\/span>)', data)
            if len(retup) > 0:
                for element in retup:
                    digit1 = element[1]
 
            retup = re.findall('(\\/)(\\d+)( ).*?([+-]?\\d*\\.\\d+)(?![-+0-9\\.])', data)
            if len(retup) > 0:
                for element in retup:
                    digit2 = element[1]
                    perc = element[3]
            print("[+] Malware detected! [ %s/%s ] (%s%%)" % (digit1, digit2, perc))
            print("    [*] Report:")
 
            result = data.find("<th>Result</th>")
            retup = re.findall(r"(<td)([a-zA-Z0-9\/\!\@\:\<\>\=\.\"\-\_\~\+\]\[\(\) ]*)(</td>)", data[int(result):])
 
            i = 0
            while i < len(retup) and len(retup) > 0:
                if retup[i][1][1:].find("SHA256") > 0:
                    break
                if retup[i+3][1][1:] != "-":
                    print("        %s - %s" % (retup[i][1][1:], retup[i+3][1][18:]))
                i = i + 4
            print("[+] For more information, you may visit: %s") % (response.url)
        if not len(data):
            break
 
if __name__ == '__main__':
    Banner()
    if len(sys.argv) < 2:
        help_menu(sys.argv[0])
        sys.exit(1)
    binary_md5 = sys.argv[2]
 
    if len(sys.argv) > 2:
        md5 = hashlib.md5(open(sys.argv[2],'rb').read())
        binary_md5 = md5.hexdigest()
 
    try:
        if (sys.argv[1].lower() == "online") and len(sys.argv) > 2:
            # For testing purposes you may comment out the line below (md5 of a virus)
            #binary_md5 = "2bde56d8fb2df4438192fb46cd0cc9c9"
            print("[+] Online md5 check: %s (%s)") % (sys.argv[2], binary_md5)
            try:
                online_check(binary_md5)
            except KeyboardInterrupt:
                if sys.platform == 'linux-i386' or sys.platform == 'linux2':
                    os.system("clear")
                elif sys.platform == 'win32':
                    os.system("cls")
                else:
                    os.system("cls")
                Banner()
                print("[+] Bye...")
            except Exception:
                print("[+] Error: Check your internet connection or proxy configuration")
                sys.exit(1)
        else:
            help_menu(sys.argv[0])
            sys.exit(1)
    except KeyboardInterrupt:
        if sys.platform == 'linux-i386' or sys.platform == 'linux2':
            os.system("clear")
        elif sys.platform == 'win32':
            os.system("cls")
        else:
            os.system("cls")
        Banner()
        print("[+] Bye...")

[ Concept ] Build your own Youtube Downloader

Hi everyone,

Today I’m going to write a short and simple concept post on how to “Build your own Youtube Downloader”.
The reason was that i find it amusing that some people still don’t know how to develop such a simple tool. But i won’t end it as just another simple youtube tool.
What i can do though is encourage development thru advanced code snippets or simple applications that solves someone’s problems in their real life.

One simple example would be looking at Youtube’s API.
You would have noticed that a simple GET to “http://gdata.youtube.com/feeds/api/users/” and you will get lots of information with regards to this particular user. So slowly expand from there, you can develop an application that will show information about that user in a nice GUI and you can download all the videos uploaded by that user. Other features which one can implement is adding proxy support.

And if there are network guys here, i’m sure you could developed your own Youtube downloader easily.
A normal youtube link would look like this, http://www.youtube.com/watch?v=
But if you watch the traffic, you could see this, http://www.youtube.com/v/
Further analysis would give you this results,

http://www.youtube.com/get_video_info?&video_id=uL691j65CAM&el=embedded&ps=default&eurl=&hl=en_US&hd=1

Then you can see within this file to get the link to the .MP4 and .flv file.

You can even develop in such a way that you can track down all the contacts of that particular user using this GET.

http://gdata.youtube.com/feeds/api/users//contacts?v=2

Have Phun. Come on, just try it. It’s just that simple.

BR,
[ Gunther ]