For applications that are assessed at the end of every release cycle (version change), from this graph, one can visualize the trend of vulnerability detection. Here severity scale – Critical, High, Medium & Low (Info) is also displayed in the graph.

We will have a look at 2 charting APIs to achieve this – Google Charts and Highcharts

Using Google Charts

By using Google Charts API, we try to embed the following chart on our SharePoint site. Once the code is embedded, user can hover over the data points to get its value and other information.

There are various obvious reasons for choosing a chart API over a static image inserted into the site.

1. Its easy to update. Just need to change the values in the embed code.
2. Less cluttered. As you can see, values of the data points are not displayed in the chart. If anyone needs to know the value, he/she just has to hover over any column.
3. This can later be programmed to update itself from the data available in any SharePoint list.

Steps

1. Add a ‘Content Editor Web part’ by clicking ‘Add a Web Part’ option.

2. Now access the ‘Source Editor’ via ‘edit – Modify Shared Web Part’.

3. Paste the following code on to the source editor. Replace the ‘data required’ block to match with your data table.

4. You can use this google spreadsheet to convert tabular data to google charts API mark up - http://goo.gl/ALbIc.

5. Insert the data generated in column ‘H’ on to the Google Chart code.

Few Points

1. If you need to change the severity scale to something other than C, H, M, L then modify it on ‘var rowData’ and the match the number of data values appropriately.
2. Change chart dimensions, color and other properties in draw() options.

Using Highcharts

High charts is yet another popular charting solution. Unlike, Google charts, we don’t have to modify the embed code to update the graph values. In the following example, we use a feature in highcharts that extracts value from HTML table that is displayed on the same page. So we just need to update the data in the HTML table using the SharePoint Rich Text Editor and graphs are automatically updated.

Steps

First, we need to download Highcharts API and extract it to our local directory. Then upload ‘highchart.js‘ to your SharePoint site (I copied to ‘Shared Documents‘, you can upload it anywhere you want). Note the relative URL of that js file.

1. Add 2 content editor webparts. One webpart holds embed code for Chart and other for data table

2. Chart webpart – Access source code editor and paste the following code. Replace the highcharts.js URL with previously copied SharePoint URL. (It will be something like /Shared%20Documents/hc/highcharts.js)

3. Datatable webpart – Access source code editor and paste the following code.

4. Updating the data – Click on Modify Shared Web part and access the Rich Text Editor. Now, any one can modify the values from the table without messing up the embed code markup.

When the SharePoint page that contains the chart code loads, highchart.js file will be initialized and values in the HTML table below (identified by the table id – ‘datatable’) are extracted and displayed on the graph. Similar to Google charts, we can hover over any of the columns to view the value of data point.

Few Points

1. Chart dimensions can be modified by changing the attributes of ‘container‘ div in Chart Web part source.
2. Match the value of table id with the value in document.getElementById. Default is ‘datatable‘
3. Change the severity levels in datatable by deleting or adding columns on Rich text editor. Your scale might be H, M, L so delete ‘Critical’ column.
4. Change the title and other options in Highcharts code if necessary. Refer to highchart documentation

There are various other solutions which involves access to SharePoint designer or to be able to upload third-party web parts on the SharePoint server. If you want a simple front-end solution, this works the best.

Highcharts Info
App Name	Highcharts
License	free
Type	code
App URL
More Info	link

This is not made to encourage piracy/plagiarism in any case.

How To

1. Extract batch file and lib folder to C:\apk2java\ (or any folder that doesnt have space in its path)

2. Backup the target app’s apk from phone to PC via ASTRO Browser (check this post for details)

3. Keep the target apk in the root folder where batch file is present

4. Run ‘apk2java.bat target.apk’ in cmd

c:\apk2java>apk2java.bat target.apk

5. Result : java and resource files available in ‘src’

Note: This batch just automates the sequence in which various tools are initiated and does not handle any error events. You will have to go through the cmd verbose to figure out the problem.

Note 2: ‘lib’ folder contains apk-tool files (apk-tool.jar, aapt.exe), jad.exe, 7zip (7za.exe), dex2jar files (all other jars).  If required, update each of those tools by replacing it with latest copy from links mentioned below.

Requirements

• Windows (but can be ported to *NIX)
• JRE 1.6 (Java Runtime Environment)

Tools in lib

• Dex2jar – Converts Android dex format to jar (link)
• JAD – Java Decompiler CLI (link)
• 7Zip – Unarchival  (link)
• apk-tool – Extracts resources from apk (link)
• aapt – Android Asset Packaging Tool (link)
• aapt commands (link)

apk2java Info
App Name	apk2java
License	free
Type	code
App URL
More Info	link

Note: Below table will be updated regularly. If you find any addons that are not listed but might be useful while conducting pentests, please mention in comments.

Root Your G2

1. Install Terminal Emulator and a file manager (such as Astro File Manager) from the Market.
2. Extract the contents of the zip file (Download from XDA site / here) to the SD card (this will create a directory called root_files on the card). When done, make sure you unmount your SD card from your computer if you had mounted it as a storage device to transfer the files.
3. Enable Unknown Sources (under Settings->Applications) and USB Debugging (under Settings->Applications->Development).
4. Using your file manager, navigate to the root_files directory on your SD card and select “com.modaco.visionaryplus.r14.apk” to install the Visionary app.
5. Start the Visionary app and click on “Temproot now.” Leave all other settings unchecked.
6. Start the Terminal app and type the following commands (the $ and # symbols represent the command prompt and should not be typed):

Select Temproot now in Visionary

Temp Root in progress via Visionary Plus

Perm Root commands

Perm Root execution in progress

You will see multiple messages scroll by as the programs run. Once you are returned to the prompt in terminal, you will have permanent root (S-OFF), as well as subsidy unlock and SuperCID.

Steps to Backup Installed Apps + Data to SD card (using Titanium Backup)

1. Install Titanium Backup from Market (free version would do the job, though it will take only one version of backup).
2. Make sure the latest / good version of BusyBox is installed (hit the “Problems” button lower right in Titanium home screen)
3. Un-check “Auto-sync TB settings” under Preferences
4. Only Run “Backup all user apps” under ‘Batch’.
5. Titanium takes a backup of app and user data to SDCard.

Batch backup

Steps to Backup Stock ROM to SD card (Using Clockworkmod Recovery)

1. Install ROM Manager from Market (free version)
2. Open ROM Manager and select ‘Flash ClockworkMod Recovery’. Confirm the phone model and wait until flash operation is complete.
3. Now ‘Select Reboot to Recovery Option’.
4. In Recovery console, scroll to ‘backup/restore’ (Trackpad button to scroll and select, Power button to go back) and then select ‘backup’ to initiate stock ROM backup process. (It will take 5-10 mins).
5. Once the backup is complete you will be redirected back to recovery console.
6. (Optional: copy Titanium backup folder & Clockworkmod backup folder form the SDCard root folder to your PC, just in case)

Flashing Clockworkmod Recovery

Rom Manager Requesting for SuperUser access

Recovery Console

Backup in Progress

Backup Complete

Install Custom ROM – Cyanogenmod 7 based on Gingerbread

1. Download the latest Cyanogenmod ROM zip file for G2 from here.
2. Download Google Apps bundle from here. Its recommended to keep the zip on the root of SDCard.
3. Copy the zip file to Sdcard root directory. Unmount Sdcard from computer.
4. On your phone recovery console select wipe data/factory reset, wipe cache partition and Advanced > ‘Wipe Dalvik cache’. (Ensure that this step is complete before proceeding ahead).
5. Now select the option ‘install zip from sdcard’ and choose cyanogenmod 7 zip that was copied earlier.

Wipe Cache, data ans Select Cyanogen zip from sdcard

Cyanogen Boot Screen

G2 with Honeycomb Theme

Install Google Apps

1. In recovery console select ‘install zip from sdcard’ and choose the google apps zip file. Reboot the device.

Note: Now Cyanogenmod bootloader will be displayed. It might take one or two minutes to boot to the new OS. My phone started looping through the boot screen and the home screen. If that happens reboot your device once or twice.

Restore Backed-up Apps + Data via Titanium Backup

1. Install Titanium Backup from Market.
2. After opening Titanium, selectively restore apps from the “Restore all apps with data” (these will only be user apps per 3. above) by selecting this batch operation and un-checking the apps I do not want to restore via Titanium prior to running the batch operation (by default all apps will be selected). You can also select here to restore just the app, app + data, or just data.

Restore Apps and Data

Content extracted from

• xda-developers (link), g2hacks (link1, link2), addictivetips (link1, link2)

CyanogenMod 7 Info
App Name	CyanogenMod 7
License	free
Type	code
App URL
More Info	link

Adblock can be made more efficient by adding custom patterns for the elements to be filtered.. This feature of AdBlock can be extended to block not only the ads but also the malicious content those are injected in seemingly genuine sites. This is done by adding MalwareDomains subscription to our Adblock preferences. MalwareDomain contains a list of domains that are known to be used to propagate malware and spyware. Adblock verifies whether there are any cross domain content loaded from any of malicious websites present in that list and if there is, then it blocks those elements.

Note: Subscribing to this list can increase the load time of the site. Increase in security at the cost of slight reduction in performance.

Here, we illustrate the steps to add the MalwareDomain list to our Adblock addon available for Chrome and Firefox browsers.

I. Adding MalwareDomain Subscription in Chrome

Download Adblock for Chrome here.

1. Access the AdBlock Options from the Chrome Extensions page and add MalwareDomains URL (http://malwaredomains.lanik.us/malwaredomains_full.txt)

2. Entered URL will now display in the subscriptions list. Make sure that its checked.

II. Adding MalwareDomain Subscription in Firefox

Download AdBlock Plus for Firefox here.

1. Open the Adblock Plus Preferences and click on the ‘Add Filter Subscription’ from the Filters menu.

2. Click on ‘Add a different subscription’ link.

3. Add the MalwareDomains URL in the subscription entry (http://malwaredomains.lanik.us/malwaredomains_full.txt)

4. List of domains to be filtered will be displayed under the filter which we have newly subscribed. Make sure that its enabled.

Links

• MalwareDomains List
• Other AdBlock Suscriptions
• AdBlock for Chrome
• AdBlock for Firefox

MalwareDomains Subscription List Info
App Name	MalwareDomains Subscription List
License	free
Type	online
App URL
More Info	link

During this evolution, some browsers tries to standout from others by introducing a new feature which had never been available in any of their counterparts. But the other browsers instead wait for the users comments on the new feature implemented, if appreciated, they implement the same feature in theirs, may be in a better way. The browser who introduced that feature first might even loose its credit in due course. User is forced to switch from their  favorite browser for a ‘single feature’ they found useful in the ‘other’ browser. Once they completely switch and get used to the new browser, the old one brings out the same feature plus few bonus features. This cycle never ends. Firefox introduced tabs and extensions when IE did not have in them, people were attracted to it and finally switched to firefox. Then the light weight chrome came with Tab tearing, web apps, new tab page with speed dial and many other features, made few users to make chrome as their default browser. Firefox then inherited few of chromes’ features, syncing and expose like tab candy/panaroma effects. We don’t have to switch browsers just for UI features, and if at all we do, it should be seamless.

This article tries to identify best features in each of the browser and the features we expect to be part any modern browser. Here, we try to baseline few ideas, those ideas which takes browser design to the next level.

Browser Main Screen (Mockup)

MOCKUP - Main Screen - Click over image to zoom

Highlights

Main Screen

1. Menu Button

Drop down to access frequently access browser actions like preferences, print options, edit etc. To replace standard browser tool bar. (Inspired from firefox/opera)

2. Extension Button

Displays drop down that contains icons of the extensions to activate/deactivate them, or displays extensions options in sub-menus. Does not consume your address bar space as used to in firefox or previous chrome version. (Inspired from Chromium resizable bar that displays extension icons)

3. Bookmarks Button

Displays organized bookmarks in dropdown, no more bookmarks bar – (Can be created in firefox by customize options for toolbar)

4. Only Favicons in tab title

We just need favicons to know which tab is what. Most of the websites have favicon now-a-days (Inspired from faviconize tab firefox extension/pin tabs/app tabs)

5. Tabs that behaves like Dock/Taskbar icons in OSX/Win7

MOCKUP - Switch pages from same site with hover preview

One favicon displayed for one domain/website. Its like transformation from Win XP quicklauch to Win7 Taskbar. 2 pages from Facebook are to be indicated by one tab and should allow user to switch over the pages from that single Facebook icon displayed. For example, hovering over the icon should display preview of different pages open from that same site. So this keeps the number of tabs open in the browser under control. (Inspired from OSX dock/Win7 Peek).

6. Tab Sets/Groups

Tabs should be grouped to different sets and only those tabs belonging to that set should be visible on the browser window. This gives us distraction free environment. We should be able to move the tabs across the tabset by drag-n-drop (Inspired by Opera Tab Sets/Firefox Panorama)

Example -

• SOCIAL Set – Facebook, Twitter, LinkedIn etc
• WORK Set – Stackoverflow, Superuser, Dev Forums etc
• FUN Set – Youtube, Failblog etc

7. DropZone for Downloads

We don’t need a separate downloads window to keep track of our downloads.  All we need is a small icon which displays the status of our downloads and should reveal the items downloaded only when required. So idea is to click on that dropzone icon to pop up a stack which displays the downloaded items/in progress ones. Another feature we would want is to be able to drag and drop the target URLs directly to the dropzone to start the download to the default downloads folder. (Inspired from Download statusbar firefox extensions/ flashget)

Check the Mockup

8. Semi Transparent Status Bar to display full URL (Autohides)

Status bar displays only when we hover over any link (Inspired from Chrome)

9. Unload the tabs on demand/Not all tabs are loaded during browser start

Some of the websites sends Ajax request continually load the time based dynamic content every n seconds even if the page is not active. For examples gmail syncs with the server to check for new email and there might be different apps that does the same. But we might not want gmail to do so and we dont want to close the tab either. So the solution is to unload the tab and activate/load it only when required. This happens during browser start as well, we load only the last tab this significantly increase browser startup time. (Inspired from Bartab Firefox addon)

10. Mouse Gesture Support

Less keystrokes – More usable browsers will be. Built-in support for mouse gestures. (Inspired by FireGestures Firefox addon and Chrome Gestures addon in Chrome)

11. Sync ‘Everything’

Every time you do a fresh install of your favorite browser anywhere, you have to spend hours to customize it. Do it at home and you repeat all again at work, or on your new laptop. All browsers should have built-in capabilities to sync preferences, extensions, bookmarks, and everything to ensure that user doesn’t even notice any change if browses at home or at work. He should be given options to create profile and sync those at work or home. (Inspired from Firefox weave, built-in with Firefox 4 though)

New Tab/ Hidden Address Bar

MOCKUP - New Tab Popup

1. Pops-up on demand

Address bar consumes unnecessary space of our precious screen real estate. We need address bar only when we access a new page so why should it be visible all the time? Clicking on the newtab icon displays a popup that has a tiny address bar. This is like a omnibar/awesomebar which means single box to accept URL as well as search string. (Inspired from AppPanel enabled using startup switch in Chrome).

2. Search Site

Below the address bar are the favicons of the currently open tabs. Example, select the icon of twitter then enter the search term to search twitter for something. Reduces many steps this way.

3. Top Sites (Starred)

Few starred sites/frequently used sites (may be top 10) are displayed in drop down when the Star icon is clicked. So open these sites with a click (Most visited in Chrome, Top Sites in Safari)

Tab Grid

A new perspective to our usual browsing experience. This displays preview of currently opened tabs in a grid, tabs can be easily identified/switched to from here. We should be able to close the tabs with a click without switching back to the page.

MOCKUP - Tab Grid

1. New Tab from Grid

This is the best part, we can create tabs by just entering the address of the page you want to access from the grid itself. Example – create tabs for Google reader/ Gmail or any site instantaneously and let it load when you are still in the grid. So in future grid enables user to quickly create and open multiple tabs. (Inspired from IE in Win7 mobile)

2. Switch Tabsets from Grid

Click on the tabset button to preview the tabs belonging to that set. Easily drag and drop the tabs to different sets from the Grid as well. (Inspired from Firefox Panorama/OSX Expose)

• Counter on Panorama feature – This feature in Firefox will become little complex and unmanageable after opening maybe 30 tabs (or on laptop screens). We will end up in have 10 or 15 tab piles. But the method mentioned in this article lets users to manage tabs on that tab set and does not display all the tabs in all the sets.

3. Open New Page of Opened Tab

List of opened tabs displayed in the Grid, click on it to clone the site to a different page.

Conclusion

Like the term ‘Tabs’ which is now a standard in all the browser, we expect the ideas mentioned in the post to be integral part of every browser. Let the users have seamless browser switch if the opt for. So in future, users should consider the parameters like speed, stability, performance to let them decide on the chosen and not just the UI based influences.

Mockups Below For Reference

Main Screen - Click over image to zoom

Hover Preview

New Tab Popup

Tab Grid

Please mention in comments if there are any features you would want to see in all the browsers or you deny on any of the idea mentioned.

Author of this post is familiar with different web browsers like IE 4 – 8, Now Defunct Netscape Navigator, Firefox (all versions), Opera, Chrome (all versions), Safari and many others. Has been evangelizing web browsers since 90s.

1. WebDeveloper

2. Firebug Lite

3. Pendule

4. Chrome Web Developer Tools

5. Simple REST Client

6. View Selection Source

7. Domain Details

8. Chrome Sniffer

9. User-Agent Switcher

10. Unencrypted Password Warning

11. JSONView

12. Cookie Editor

View and Edit the Cookies created by the site visible in the active page

13. Light Shot

14. Note Anywhere (Bonus)

Comparison of all those are presented in a table at the end of this post.

Security Perspective: If you are an info sec guy, esp. in forensics, you can utilize the features of the these tools to identify the presence of hidden large files/archives which might possibly contain some sensitive data in it. Most of the time secret truecrypt files are hidden inside some OS folders to make it look genuine.

Note: Most of the apps mentioned here can be downloaded in a portable format. The others can be made portable using the method mentioned here

Comparison Table – here.

HDGraph

SpaceSniffer

DiskSpaceFan

WinDirStat

TreeSizeFree

SpaceMonger

OverDisk

JDiskReport

Disktective

Xinorbis

Scanner

FilePro

FolderSize

Comparison Table

[Go To Top]

Running Backtrack

BackTrack4 VM can be downloaded from the backtrack site (link at the end of the post) and to run the VM, we need the free VMWare Player.

Install the VMWare Player and open the BT VM with it. We are good to go with the default configuration unless we have more RAM to spare (Its recommended to provide 512MB of RAM if you have around 2GB).

Adjust Backtrack VM RAM

Default Credentials

Backtrack VM comes with the default login credentials (which can be changed later, ofcourse)

bt login:  root
Password:  toor
. . .
root@bt:~#  startx

We should be able to see the BackTrack OS up and running by this time. If you face any difficulties with the screen resolution, install/upgrade your VMWare tools.

BackTrack VM Up and Running

Change Default Credentials

Once the OS is loaded, access the terminal from the taskbar and use the ‘passwd’ command to change the password.

bt~#  passwd
bt~#  New Password : ******
bt~#  Re-enter Password: ******

Enable Networking to Access Internet

Many a times internet might not work at the first shot. If it doesn’t do as mentioned below.

1. First find out the IP address/Default Gateway of you the HOST PC (Assuming that it’s an Windows OS, do ‘ipconfig’ in DOS Terminal)
2. Choose any arbitrary IP address, should be in the range of the IP of the host, and ensure that its not used.
3. In the BackTrack Terminal, type the following commands

bt~#  ifconfig eth0 up
bt~#  /etc/init.d/networking start

Once you have BackTrack running and Internet enabled, you are all set to use the tools bundled with this OS.

Backtrack VM Download Info
App Name	Backtrack VM Download
License	free
Type	OS
App URL
More Info	link

VMWare Player Download (Free):

Download and extract SyntaxHighlighter scripts to your PC (Check the download link at the bottom of the post). Now access the SharePoint site and create a folder structure as shown in the below screenshot (i.e. to create ‘scripts’, ‘src’ and ‘styles’ folders inside syntax folder which is present in ‘Shared Documents’). Now upload the syntax highlighter files to appropriate folders.

Upload Scripts Folder Structure

Step 2

Access the page where you want syntax highlighter to be enabled and go the ‘Edit Mode’.  Add ‘Content Editor Web Part’ to the page. This Web Part will contain the scripts that provides reference to the syntax highlighter code uploaded in SharePoint server.

Add Content Editor Webpart

Step 3

View the Web Part options by clicking on the ‘Modify Shared Web Part’ menu. Click on the ‘Source Editor’ and enter the scripts to call syntax highlighter.

Select Source Editor

<LINK href="/sites/Shared Documents/syntax/styles/shCore.css" type=text/css rel=stylesheet>
<LINK href="/sites/Shared Documents/syntax/styles/shThemeDefault.css" type=text/css rel=stylesheet>
<SCRIPT src="/sites/Shared Documents/syntax/scripts/shCore.js" type=text/javascript></SCRIPT>
<SCRIPT src="/sites/Shared Documents/syntax/scripts/shBrushJScript.js" type=text/javascript></SCRIPT>
<SCRIPT type=text/javascript>
    SyntaxHighlighter.config.clipboardSwf = '/sites/Shared Documents/syntax/scripts/clipboard.swf';
    SyntaxHighlighter.all();
</SCRIPT>

Note: Change the paths in the script if you have uploaded the syntaxhighlighter code in a different location

Step 4

Hide this Web Part by checking the ‘Hidden’ option.

Hide Layout

Step 5

Add 2nd Content Editor Web Part. This Web Part will contain the code which you want to highlight. Use the Source Editor and paste the code there.

Step 6

Wrap your code with the syntax highlighter wrapper codes, change the language value as per your code. Click Ok to view the syntax highlighted code

<pre class="brush: js">

Syntax Highlighter Info
App Name	Syntax Highlighter
License	free
Type	code
App URL
More Info	link