MAC Address spoofing

by Law Metzler 26. February 2010 04:48

While travelling and visiting a family members home recently, I ran into an issue with their modem not allowing me to connect with my laptop.  Turns out that their provider had MAC filtering on their system.

A MAC Address is a unique number (hexadecimal) that most every network adapter has.  When you plug in a cable to a router and then to your computer, the first communication that occurs is the two devices declaring who they are by stating their MAC address (Ok, this is a big simplification, but no need to digress to far).  MAC addresses are intended to be globally unique, and as such are divided into two: The manufacturer ID and a manufacturer assigned ID.  This  helps guarantee that all MAC addresses are unique.

MAC filtering is a security measure some routers or ISPs use to limit access to the network. By stating that only computers with a certain MAC address are allowed onto the network, you can add an additional layer of security.  Most wireless routers have this feature (a good idea if you're paranoid and already set up a password on your wireless network [WHICH EVERYONE SHOULD DO]). Many non-wireless routers have this feature also.  And occasionally, ISP's enable this feature on their networks.

This is a problem that I rarely (actually, only once before) have run into.  It used to be simple for me to overcome, as I used to take a wireless router with me also, and that would easily allow for overriding of the MAC address though a configuration screen.  However, with the proliferation of wireless routers I stopped bringing my own and instead just jump on the local network.

Luckily, there is a way to spoof your MAC address.

There's a couple programs out there to do it for you (google will help, but I haven't tried any of them so can't recommend them) but I prefer to get my hands dirty, so with no further ado, how to spoof your MAC address:

Windows Vista:

NOTE: This requires modifying your registry.  If you do NOT know what you are doing, DO NOT DO THIS.  If you mess up your registry, your computer may not boot at all.  

First, you'll need to know the adapter you are changing your mac address for.  The easiest way to make sure you have the correct one is to open a command prompt and type:

net config rdr

 

You'll see a line that says "NetBT_Tcpip_{XXXXXXX....}.  This is the GUID of your adapter (A GUID is a Globally Uniqued IDentifier).  Copy this number, (between the curly brackets)  In this example, the GUID is 6F3A69A0-81B8-42B4-A38D-06ECC66485CC

Next you'll need to edit the registry.  In the command prompt, type:

REGEDIT

Once in the registry editor, navigate to the key:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

Underneath this key are lots of sub keys.  To find the one you want (with that key selected) press Ctrl+F and search for the GUID.  You should find it as a value for a key named NetCfgInstanceId.  Inside this key, add a new string value with a name of NetworkAddress and set the value to the MAC Address you want (no dashes).

Once that is done, you can reboot or disable/re-enable  the network device in Device manager.

To revert back, simple delete the key you added (NetworkAddress).

 

Hope that helps

Tags: , , ,

Tutorial

Create your own Foxfire extensions

by Law Metzler 11. September 2009 16:29

There are multitude amount of Firefox extensions downloadable over the internet right now targeting day to day website visitors and developers as their primary audience. ….. This being said, have you ever wondered what would it take to make such amazing software tools?  Let me walk you through the fundamental steps in making a very basic Firefox extension.

Let's begin by creating a folder that would contain your extension definition.  For illustration purposes we will name this “demo@bambitinc.com”.  Inside the demo@bambitinc.com folder create another folder named content.  Inside the content folder create an empty javascript file named bambit.js.  On the same level as the bambit.js file create an empty XML User Interface Language file named bambit.xul.  Now lets step back to the previous directory and create another two empty files named chrome.manifest and install.rdf.  You should end up with a directory structure like this:


        demo@bambitinc.com/
            content/
                bambit.js
                bambit.xul
            chrome.manifest
            install.rdf



Using your favorite text editor, open up the bambit.xul.  Inside we would want to add an overlay.  In general, Firefox's interface is written in XUL defined at http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul and javascript.  The XUL document defines the widgets such as the buttons, toolbars, etc.  While the javascript handles the user actions.  For us to extend the browser, we partially modify the browser UI by inserting, removing, or modifying the widgets defined in the master XUL.  This can be accomplished using overlays.  XUL overlay is a way of attaching UI widget to the XUL document at runtime.

First we would import the bambit.js that will handle user actions and modify a merge point.  In this case the browser's status bar.



<?xml version="1.0"?>
<overlay id="bambit:" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
    <script type="application/x-javascript" src="chrome://bambit/content/bambit.js" />
     <statusbar id="status-bar">
        <statusbarpanel id="bambit"
            label="Bambit"
            insertbefore="statusbar-display"
            onclick="bambit();"
        />
    </statusbar>
</overlay>



We import the javascript file just as a child of the overlay.  Take note that the path of the file is not called by the file URI nor was it a fixed path.  It is invoked using the chrome URI.  This is a bundled package that defines scheme, package name, type of data, and finally the file to load.

Next we defined a new child of statusbar named statusbarpanel.  Statusbar serves as the merge point where the modifications would take place.  The child statusbarpanel creates a new panel on the left of  the statusbar-display with a text “Bambit”.  The next attribute “onclick” defines the javascript function to be used when user clicked on that panel.  This will be defined on the bambit.js file.

After saving open up the bambit.js file and make the function “bambit”.  As a proof on concept we will only redirect the whole window to the bambit website.


function bambit(){
    window.location = “http://www.bambitinc.com”;
}




Now we need to create the manifest that will be used on the chrome package.  Inside the chrome.manifest file we'll define the type of material, name of the chrome package, and the location of the files.  Also we need to merge our overlay with the browser during runtime.  All these can be accomplished by this code.


content bambit content/

overlay chrome://browser/content/browser.xul chrome://bambit/content/bambit.xul



Finally, open up the install.rdf  file.  Inside place the following code.



<?xml version="1.0"?>
<RDF
    xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
         xmlns:bambit="http://www.mozilla.org/2004/em-rdf#">

      <Description about="urn:mozilla:install-manifest">
            <bambit:id>hello-world@bambitinc.com</bambit:id>
            <bambit:name>Bambit Hello World</bambit:name>
        <bambit:version>1.0</bambit:version>
        <bambit:type>2</bambit:type>
           <bambit:targetApplication>
              <Description>
                <bambit:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</bambit:id>
                <bambit:minVersion>1.5</bambit:minVersion>
                <bambit:maxVersion>3.0.*</bambit:maxVersion>
              </Description>
            </bambit:targetApplication>
           
      </Description>      
</RDF>


These are the minimum elements required in the installation manifest. For the complete list of the install properties click here: (https://developer.mozilla.org/en/Install_Manifests)
- id:    This is the id that makes your extension unique.  On Firefox versions prior to 1.5 this can only be in a GUID format and nothing else.  For 1.5 onwards it can accept GUID and email address format though it is not necessary to be a valid email address.
- name: This is the name your resource will be known universally.
- version: This represents the version of your resource.
- type: This indicate what kind of resource you are installing.  Since we will install an extension that value would be 2.  If we would like it to be a theme or a locale we should use 4 and 8 respectively.
- targetApplication: This defines the application you're resource is applicable to. Since we are making an extension for Firefox the id should be equal to the Firefox application id (ec8030f7-c20a-464f-9b0e-13a3a9e97384). If you notice that the mini-version is set to 1.5, that is because I used something that is not applicable to earlier versions, specifically the id of the application.  Earlier versions only support GUID.  For the max-version we set it to 3.0.x to ensure that the resource is compatible with Firefox's security and stability updates.
(Link to compressed file)
Test
We are now ready to test our extension.  First, we need to setup a development environment.  We don't want to ruin the Firefox version we are currently working on even though it is easily repairable.  We do this by creating another Firefox profile.  For this example “dev” is the name of the new profile.
On linux:


/usr/local/bin/firefox -no-remote -P dev


On MAC:


/Applications/Firefox.app/Contents/MacOS/firefox-bin -no-remote -P dev &


On Windows:


start "" "%ProgramFiles%\Mozilla Firefox\firefox.exe" -no-remote -P dev


The first time you run the command it will display the profile list screen.  There create the new profile named “dev”.
Now we our environment ready.  What we'll do is copy the entire demo@bambitinc.com folder within the Firefox's (dev profile) extensions folder.  In Vista you can go to <% Users %>\AppData\Roaming\Mozilla\Firefox\Profiles and browse through the extensions folder and paste the entire folder there.  Open an instance of the development profile.  You are supposed to see that a new extension named Bambit Demo is installed and you'll notice the text “Bambit” at the lower left of your status bar.  Click on it and it will take the whole window to the Bambit website.
Package
Now that we got the extension working on our environment we'll need a way to publish it.  Firefox's extensions are packaged as XPI files.  In essence XPI files are just zipped files that have an extension of XPI.  Using your favorite archive tool zipped the contents (not the folder) of the demo@bambitinc.com folder.  Now delete the demo@bambitinc.com folder inside the extensions folder of your development environment.  Close all instance of your Firefox development profile.  You'll notice that the Bambit is no longer installed.  Now using Firefox, open the XPI file you created earlier.  This will go through the installation process.  Viola! Your Firefox extension is made!!!

 

 

 

Tags: , , ,

Implementing the Xml-Rpc Spec in C#: Part 2

by Law Metzler 11. September 2009 16:29

Sorry for the long span between posts, but things have been pretty busy here.

In the first part of this series, we reviews the Xml-Rpc specifications and used the XSD tool to generate our starting point.  Now, we'll tackle some of the basic changes we've done to those generated files.

Standards and Compliance

The first thing we need to do is to move the classes into a form that that is compliant with the software development standards for Bambit.  This is, for the most part, rather trivial, if not just tedious.  It includes:

  1. Putting each class into it's separate file
  2. Changing properties that simply expose private data variables to auto-properties
  3. Create proper casing for classes, properties and methods

As I said, simple, but (somewhat) tedious.

Class Implementation Changes

MethodCall Class

In the MethodCall class, the xsd file had originally created a special class called methodCallParams, which itself simply wrapped an array of parameter objects.  This was overly redundant to me, so I eliminated the methodCallParams class entirely, and changed the property


[System.Xml.Serialization.XmlElementAttribute("param")]
public parameter[] param {
get {
return this.paramField;
}
set {
this.paramField = value;
}
}

 to

[XmlArray("params")]
[XmlArrayItem("param")]
public List<Parameter> Parameters { get; set; }

This was a lot cleaner.  First, the naming  convention follows our guidelines. Second, we eliminated a class entirely.  Third, we changed from a non-expandable array data type, to a List<>.  This allows us to add to the list at any point in time, so calling code can keep adding parameters, instead of having to assign all parameters at once.

In doing this, we need to create a default ctor to initialize the List<>.  If we don't do this, De-serializing will explode on us, due to the fact that, when de-serializing to a List object, the Framework assumes that the object is valid and simply calls Add instead of putting the entire list on at once, so it will try to call Add on a null object.

Value Class

This class was given a lot of additions to, all having to do with casting.

Since the specifications state that a value can be a whole host of things, it must be stored as an object (outside of customizing the serialization and keeping a whole slew of different type variables).  However, an object is much too vague to be of real use in most situations.  So what we did was to store the actual object as an object, but add cast operators to the Value class itself.  To be effective, we made casts both ways, so that casting from a double, int or any other valid type to a Value would be allowed, as would casting from a Value to any other type (as long as the Value WAS of that type).

To do this, casting from a Double (or any other valid type) to a Value would be an implicit conversion, while converting from a Value back would be an explicit.  The reason for this is that, in an implicit casting, you should NEVER thrown an exception, while explicit conversions allow for an exception to be thrown. Since the Value object can be any other type at any time, it is allowed to be implicitly cast.  However, if the Value already contains an RpcStruct object and we try to cast it to a double, we will blow up.

We then entered every cast possible, in the following form:

public static explicit operator <TYPE>(Value value) { return (<TYPE>)value.Item;}

public static implicit operator Value(<TYPE> item)

{

  return new Value { Item=item, ItemType = <APPROPRIATE ITEM TYPE> } ;
}

 

For instance, the conversion casting for a double was:

public static explicit operator double(Value value) { return (double)value.Item;}
public static implicit operator Value(double item) 

{

   return new Value { Item=item, ItemType = ItemChoiceType .Value } ;
}

 

As you can see, our implicit conversion will never fail, as assigning the "Item" (which is an object) anything is completely legal.  Our explicit will fail only if the framework does not know how to do the conversion itself.  We could have done some checking on ItemChoiceType ourselves, but this would have been a bad idea.  First, it's extra work on our end that is redundant.  Second, if we try to cast to a double and it's an integer, we would fail (unless we actually check all the different types that can be cast to/from), when it is a perfectly legal cast.  As such, it's much better just to let the Framework do the work for us.

 

Well, that covers a few of the design decisions.  In the next installment, I'll go over changes to the RpcStruct and MethodResponse classes.


NOTE:

We've released this project under the LGPL and you can download it at codeplex, BXmlRpc.  The current generated documentation can be found at http://bxmlrpc.bambitinc.com/Documentation/

Tags: , , , , ,

Implementing the Xml-Rpc Spec in C#: Part 2

by Law Metzler 26. August 2009 16:27

Sorry for the long span between posts, but things have been pretty busy here.

In the first part of this series, we reviews the Xml-Rpc specifications and used the XSD tool to generate our starting point.  Now, we'll tackle some of the basic changes we've done to those generated files.

Standards and Compliance

The first thing we need to do is to move the classes into a form that that is compliant with the software development standards for Bambit.  This is, for the most part, rather trivial, if not just tedious.  It includes:

  1. Putting each class into it's separate file
  2. Changing properties that simply expose private data variables to auto-properties
  3. Create proper casing for classes, properties and methods

As I said, simple, but (somewhat) tedious.

Class Implementation Changes

MethodCall Class

In the MethodCall class, the xsd file had originally created a special class called methodCallParams, which itself simply wrapped an array of parameter objects.  This was overly redundant to me, so I eliminated the methodCallParams class entirely, and changed the property


[System.Xml.Serialization.XmlElementAttribute("param")]
public parameter[] param {
get {
return this.paramField;
}
set {
this.paramField = value;
}
}

 to

[XmlArray("params")]
[XmlArrayItem("param")]
public List<Parameter> Parameters { get; set; }

This was a lot cleaner.  First, the naming  convention follows our guidelines. Second, we eliminated a class entirely.  Third, we changed from a non-expandable array data type, to a List<>.  This allows us to add to the list at any point in time, so calling code can keep adding parameters, instead of having to assign all parameters at once.

In doing this, we need to create a default ctor to initialize the List<>.  If we don't do this, De-serializing will explode on us, due to the fact that, when de-serializing to a List object, the Framework assumes that the object is valid and simply calls Add instead of putting the entire list on at once, so it will try to call Add on a null object.

Value Class

This class was given a lot of additions to, all having to do with casting.

Since the specifications state that a value can be a whole host of things, it must be stored as an object (outside of customizing the serialization and keeping a whole slew of different type variables).  However, an object is much too vague to be of real use in most situations.  So what we did was to store the actual object as an object, but add cast operators to the Value class itself.  To be effective, we made casts both ways, so that casting from a double, int or any other valid type to a Value would be allowed, as would casting from a Value to any other type (as long as the Value WAS of that type).

To do this, casting from a Double (or any other valid type) to a Value would be an implicit conversion, while converting from a Value back would be an explicit.  The reason for this is that, in an implicit casting, you should NEVER thrown an exception, while explicit conversions allow for an exception to be thrown. Since the Value object can be any other type at any time, it is allowed to be implicitly cast.  However, if the Value already contains an RpcStruct object and we try to cast it to a double, we will blow up.

We then entered every cast possible, in the following form:

public static explicit operator <TYPE>(Value value) { return (<TYPE>)value.Item;}

public static implicit operator Value(<TYPE> item)

{

  return new Value { Item=item, ItemType = <APPROPRIATE ITEM TYPE> } ;
}

 

For instance, the conversion casting for a double was:

public static explicit operator double(Value value) { return (double)value.Item;}
public static implicit operator Value(double item) 

{

   return new Value { Item=item, ItemType = ItemChoiceType .Value } ;
}

 

As you can see, our implicit conversion will never fail, as assigning the "Item" (which is an object) anything is completely legal.  Our explicit will fail only if the framework does not know how to do the conversion itself.  We could have done some checking on ItemChoiceType ourselves, but this would have been a bad idea.  First, it's extra work on our end that is redundant.  Second, if we try to cast to a double and it's an integer, we would fail (unless we actually check all the different types that can be cast to/from), when it is a perfectly legal cast.  As such, it's much better just to let the Framework do the work for us.

 

Well, that covers a few of the design decisions.  In the next installment, I'll go over changes to the RpcStruct and MethodResponse classes.


NOTE:

We've released this project under the LGPL and you can download it at codeplex, BXmlRpc.  The current generated documentation can be found at http://bxmlrpc.bambitinc.com/Documentation/

Tags: , , , , ,

Implementing the Xml-Rpc Spec in C#: Part 1

by Law Metzler 21. July 2009 15:58

When we fist decided to implement a blog on our site, we figured it would be quick and easy to roll our own, and for the most part it was.  After all, a blog is only composed of a handful of tables, each with a spattering of columns.  You have the blog itself, then you have comments.  That's the long and short of blogging.

At least at first glance.

After you get the blogs up, you certainly want to implement trackbacks and pingbacks.  If you don't know what these are, they are simply a way of interlinking sites, so that if I comment on a blog at foobar.com, they can add a link back to my site, saying comments were made there.

Trackbacks are relatively straight forward as they are simply HTTP calls made in a REST fashion (spec can be found here)

Pingbacks are only slightly more involved.

Enter the XmlRpc Spec

Pingbacks are entriely built arond the Xml-Rpc specificaion, which is exactly what it sounds like, remote procedure calls via Xml, a simpler version of SOAP if you will (I'll leave the Xml-Rpc vs SOAP vs REST argument for another day).  I'll be the first to admit, somehow up to this point in my programming experience, I had somehow avoided interfacing with Xml-Rpc directly. So I did what I always do when confronted with a new spec, I read the manual.

This is a point that I want to stress.  I know a lot of developers who can churn out code to email someone without having read one single RFC concerning SMTP, MIME or any other similiar technology.  This is a sure way to limit your usefullness as a programmer.  Along with learning a language a year, coders should also strive to understand the undelying concepts of the systems they are working with.

But I digress.  To return to point, I went and read the spec, which on the surface seemed pretty simple.  Since I didn't know how to implement it myself and it seemed rather simple, I decided to take a crack at implementing my own library.

In the beginning, there's the XML

Since Xml-Rpc utilizes HTTP for the request/response, and since the HttpWebRequest method is built into the .Net libraries already, I decided to start with the xml.  The spec site gives a very verbal breakdown of how the xml is structured, but it is missing a schema definition file, so that's where I began.  This can be found here.

Once I have the xsd defined, I used XSD.exe tool that comes with Visual Studio to create the first version of the classes to serialize the documents.  The XSD.exe tool is an extremely valuable tool, but, generally, we only use it to get a base to work from.  You can find the results of this generation here.

 

In the next part, I'll go over the changes to the Xml

 

NOTE:

We've released this project under the LGPL and you can download it at codeplex, BXmlRpc.  The current generated documentation can be found at http://bxmlrpc.bambitinc.com/Documentation/

Tags: , , , ,

Tutorial

Powered by BlogEngine.NET 1.5.0.7
Theme by Mads Kristensen