Hacking Gmail using the GX cookie Loophole and Its Solution

Hey Guys as a Ethical hacker I am always curious to Find the New Loopholes in Existing websites ,softwares and other things... Today over the Internet I found a Very Dangerous Loophole in the Gmail (Best Mailing Services In the World) and I am Going to Share that With You Guys. I have Tried this from my college Network so there Will be Some Assumptions and Tools Needed for that... So Read On...

NOTE: THIS TUTORIAL IS FOR EDUCATIONAL PURPOSES ONLY ! 

 ASSUMPTIONS:

1- You are in Local Area Network (LAN) in a switched / wireless environment : example : office , cyber café, Mall etc.
2- You know basic networking information.

Tool used for this attack:
1- Cain & Abel or Any Ethernet Capturing Tool
2- Network Miner
3- Firefox web browser with Cookie Editor add-ons (anEC Cookie Editor)
(ALL THE TOOLS MENTIONED HERE ARE AVAILABLE FOR FREE DOWNLOADS YOU JUST HAVE TO GOOGLE THEM)

Attack in detail:

We assume you are connected to LAN/Wireless network. Our main goal is to capture Gmail GX cookie from the network. We can only capture cookie when someone is actually using his gmail. I’ve noticed normally in free Classes in College when people normally check their emails. If you are in cyber café or in Mall then there are more chances of catching people using Gmail.

We will go step by step, If you are using Wireless network then you can skip this Step A.

A.) Using Cain to do ARP poisoning and routing:

Switch allows unicast traffic mainly to pass through its ports. When X and Y are communicating eachother in switch network then Z will not come to know what X & Y are communicating, so inorder to sniff that communication you would have to poison ARP table of switch for X & Y. In Wireless you don’t have to do poisoning because Wireless Access points act like HUB which forwards any communication to all its ports (recipients).

-> Start Cain from Start > Program > Cain > Cain
-> Click on Start/Stop Snigger tool icon from the tool bar, we will first scan the network to see what all IPs are used in the network and this list will also help us to launch an attack on the victim.
-> Then click on Sniffer Tab then Host Tab below. Right click within that spreadsheet and click on Scan Mac Addresses, from the Target section select

All hosts in my subnet and then press Ok. This will list all host connected in your network. You will notice you won’t see your Physical IP of your machine in that list. How to check your physical IP ?

-> Click on start > Run type cmd and press enter,
-> In the command prompt type Ipconfig and enter. This should show your IP address assign to your PC.

It will have following outputs:

-> Ethernet adapter Local Area Connection:
-> Connection-specific DNS Suffix . : xyz.com

IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1

Main thing to know here is your IP address and your Default Gateway.
FOR AMU Its : 10.10.50.1
FOR BSNL Its : 192.168.1.1

Make a note of your IP Address & default gateway. From Cain you will see list of IP addresses, here you have to choose any free IP address which is not used anywhere. We assume IP 192.168.1.10 is not used anywhere in the network.

-> Click on Configure > APR > Use Spoof ed IP and MAC Address > IP

Type in 192.168.1.10 and from the poisoning section click on “Use ARP request Packets” and click on OK.

-> Within the Sniffer Tab , below click on APR Tab, from the left hand side click on APR and now click on the right hand top spreadsheet then click on plus sign tool from top. The moment you click that it will show you list of IP address on left hand side. Here we will target the victim IP address and the default gateway.

The purpose is to do ARP poisoning between victim and the default gateway and route the victim traffic via your machine. From the left side click on Victim IP address, we assume victim is using 192.168.1.15. The moment you click on victim IP you will see remaining list on the right hand side here you have to select default gateway IP address i.e. 192.168.1.1 then click on OK.

Finally, Click on Start/Stop Sniffer tool menu once again and next click on Start/Stop APR. This will start poisoning victim and default gateway.

B.) Using Network Miner to capture cookie in plain text

We are using Network miner to capture cookie, but Network miner can be used for manythings from capturing text , image, HTTP parameters, files. Network Miner is normally used in Passive reconnaissance to collect IP, domain and OS finger print of the connected device to your machine. If you don’t have Network miner you can use any other sniffer available like Wireshark, Iris network scanner, NetWitness etc.

We are using This tool because of its ease to use.

-> Open Network Miner by clicking its exe (pls note it requires .Net framework to work).
-> From the “---Select network adaptor in the list---“ click on down arrow and select your adaptor If you are using Ethernet wired network then your adaptor would have Ethernet name and IP address of your machine and if you are using wireless then adaptor name would contain wireless and your IP address. Select the one which you are using and click on start.

Important thing before you start this make sure you are not browsing any websites, or using any Instant Mesaging and you have cleared all cookies from firefox.

-> Click on Credential Tab above. This tab will capture all HTTP cookies , pay a close look on “Host” column you should see somewhere mail.google.com. If you could locate mail.google.com entry then in the same entry right click at Username column and click on “copy username” then open notepad and paste the copied content there.
-> Remove word wrap from notepad and search for GX in the line. Cookie which you have captured will contain many cookies from gmail each would be separated by semicolon ( GX cookie will start with GX= and will end with semicolon you would have to copy everything between = and semicolon

Example : GX= axcvb1mzdwkfefv ; ßcopy only axcvb1mzdwkfefv

Now we have captured GX cookie its time now to use this cookie and replay the attack and log in to victim email id, for this we will use firefox and cookie editor add-ons.

C.) Using Firefox & cookie Editor to replay attack.

-> Open Firefox and log in your gmail email account.
-> From firefox click on Tools > cookie Editor.
-> In the filter box type .google.com and Press Filter and from below list search for cookiename GX. If you locate GX then double click on that GX cookie and then from content box delete everything and paste your captured GX cookie from stepB.4 and click on save and then close.
-> From the Address bar of Firefox type mail.google.com and press enter, this should replay victim GX cookie to Gmail server and you would get logged in to victim Gmail email account.
-> Sorry! You can’t change password with cookie attack.(LIMITATION OF ATTACK)

SOLUTION: HOW TO PROTECT URSELF FROM THIS HACK

Google has provided a way out for this attack where you can use secure cookie instead of unsecure cookie. You can enable secure cookie option to always use https from Gmail settings.
Settings > Browser connection > Always use https .

I Hope You Have Enjoyed This ... Any Queries ?? Please Comment

How To Trace an Email Address And Original Sender?

Hello Guys Nowadays spamming is the Most common .. Out of the 5 emails you receive 2 are spams... And Out of 5 spam Mails 1 contains Virus or Botnet.. Its hard to believe but its truth... So Today I am Going to share with you HOW TO TRACE THE EMAIL ADDRESS AND ORIGINAL SENDER?? .. So guys Read On..

TRACING AN EMAIL ADDRESS

The purpose of this guide is to show the process involved in tracing an email. The first step required to tracing an email is finding out the headers of the email. What are headers? Email headers are lines added at the top of an email message that are used by servers as the email goes on route to get delivered. Generally email clients only show the standard To, From, and Subject headers, but there are more.


1) Enabling Email Headers

Enabling Email Headers For Gmail
Step 1:Once Logged into your Gmail Account open the Email whose headers you want to view. Click on the “More Options” link in the message next to the date of the email.

Step 2: Now click the “Show Original” link.

Step 3: This link will popup a new window the headers and the body of the message.

Enabling Email Headers For Hotmail

Step 1:Once logged in, click on the "Options" link in the upper navigation bar.

Step 2: Now click on the "Mail Display Settings" link.

Step 3: Change the "Message Headers" option to "Full" and click ok.

Step 4: Go to your inbox and open any one of your email. You emails show now contain additional headers.

Enabling Email Headers For Yahoo

Step 1:Once logged in, click on the "Options" link in the upper navigation bar.

Step 2: Now click on the "General Preferences" link.

Step 3: In the paragraph titled Messages and locate the "Headers" heading and select "All".

Step 4: Go to your inbox and open any one of your email. You emails show now contain additional headers.

2) Understanding Email Headers

In this example the “Sender” located at sender@exampleuniversity.edu want to send an email to “Receiver” located at receiver@exampleisp.com. The sender composes his email at his workstation in the university’s computer lab (lab.exampleuniversity.edu). Once completed the email message is passed to the university’s mail server called mail.exampleuniversity.com. The mail server seeing that it has a message for receiver@exampleisp.com, contacts someisp.com mail server and delivers the email to it. The email is stored on someisp.com server until Receiver logs on to check his/her inbox.

In this example, four headers will be added to the email message. This first header is generated by email client on lab.exampleuniversity.edu when forwarding it to the mail server at mail.exampleuniversity.edu.

The following header is added when mail.exampleuniversity.edu transmits the message to mail.exampleisp.com.

The following header is added when mail.exampleisp.com stores the message on the server for Reciever.

The following header is added when Reciever downloads the email from home machine called reciever.local.

3) Tracking The Orginal Sender

The easiest way for finding the original sender is by looking for the X-Originating-IP header, this header is important since it tells you the IP Address of the computer that had sent the email. If you can not find the X-Originating-IP header then you will have to sift through the Received headers to find the sender's ip.

Once the email sender's ip is found go to http://www.arin.net/ to begin a search.

Now click on the "NET-24-16-0-0-1" link.

Scroll down the page untill you find the OrgAbuseEmail field.

Remember to include all the headers of the email along with an attached copy when filling a complaint.

Hack Yahoo Messenger and Google Talk to open Multiple Instances

HERE’s a simple hack for yahoo messneger and google talk through which u can create multiple instances if in case u need to..

FOR YAHOO MESSENGER

Go to Start -> Run -> Type regedit -> hit enter

Go to HKEY_CURRENT_USER->> Software ->> Yahoo ->> pager ->>Test

Right click on test -> choose new Dword value .

Rename it as Plural.

Double click it -> assign a decimal value of 1.

Close registry -> Restart yahoo messenger.

NOW you can open yahoo messenger N number of times



FOR GOOGLE TALK

Create a shortcut of Google Talk messenger on your desktop or any other location.
Right click on the Google Talk messenger icon and select properties option
Modify target location text by this
“c:\program files\google\google talk\googletalk.exe” /startmenu

to

“c:\program files\google\google talk\googletalk.exe” /nomutex

Click OK
Now you can run multiple instances of google talk .

How to Hack Hotmail Account Passwords Within 24 Hours

Some of our regular visitors ask for an article about How to Hack Hotmail Account Passwords so here is it. Hacking email passwords is not that easy. You can't do that by simply entering the email address and waiting for the software to crack passwords. Instead, you have to fool victim to give his own password without his knowledge. The main methods used to hack Email passwords are Keylogging and Phishing, but there are many other useful methods that can be used to hack email account, like Bruteforcing, Social engineering, etc. In this article i'm going to show you another method for hacking email account passwords, Reverting. Reverting means undoing the effects of one or more edits, which normally results in the page being restored to a version that existed sometime previously.

Hack MSN Hotmail Account using Reverting

1. Firstly you'll need a victim. Once you have this victim, I would recommend opening a text document with the following sections.

2. In this you'll see all the fields you'll need to fill for the revert form. You will NOT need to fill out all of these in order to revert an account. I'll note the importance of each field as we go along.


* Email:

This field should be filled in already. If you're confused to what to put here, just leave.

* Full Name:

Ok this is where the S/E(social engineering) begins. If you have the victim on Facebook, or some other social networking site, where you can acquire their details, then fill out the fields you can, and skip along to where relevant.

If you don't have a resource of their details, then visit these sites:

http://www.pipl.com/email
http://com.lullar.com
http://www.yasni.co.uk/

On these websites you can search people by various different means. In this case, we're going to use the email, as this is the only information we have at this point. So go to the email tab, type it in and hit search. If the person has signed up to websites with this email, you should get a list of sites they've signed up to, and if the site has a little padlock next to the thumbnail pic, it means the profile is locked (you will need to be friends to view).

If you still can't find it, use a little SE (Social Engeneering) try adding the victim as friend, and you will be able to see his full name. So by this point we should have covered: Email, Full name, Date Of Birth, Country, State/County, so next...

* Postcode/ZIP:

For the postcode, all you need to do is use the information you already have to your advantage. You should know which country and town they are from. So with this information, go to Google and type in the town + the words 'full postcode'. So for example, let's say the victim lived in Skopje, Macedonia. You would type 'Skopje full postcode' into the google search bar. Now in the results you should find full postcodes for that district, which should be located next to the boldly highlighted words that you searched. And as the full postcode/zip isn't as necessary, it won't matter that it isn't exactly what your victims actual postcode is. The only problem with this method is success rate may vary with country and area.

* IP & ISP:

Get them to send you an email somehow, it doesnt matter how, you can just send an email saying: "hey, how are you?" and they'll probably reply. Also don't forget to put a decent 'Subject', you want them to open it, not think it's just some junk/spam. Once they've replied, you now want to extract their IP address from the email.

Your second option is to get the person on MSN (unless you already have them), and get them to interact with you. Here you can use a little command prompt trick to see his ip address.

1. Send them a file, or get them to send you a file.

2. Before you start the transfer though, goto start > run (if you're using vista, just press the windows key) and type in cmd, and hit enter.

3. Type in the following: netstat -n (without quotations) and hit enter, it will show you a list of active connections to different IP's, like this:

4. Remember or take a screenshot of those IP's, because once you start the transfer, type in netstat again while it's transferring and check for any new IP's, that is your victims IP.


Lastly, your final option, is to visit IP Tracer Websites:

1. MyIPTest - From here all you need to do is send the victim a link, and it will log their IP once they've visited it. I won't explain how to use, as the site is pretty self explanatory. Don't forget to TunyUrl your link otherwise it will be too obvious and no-one will click it.

2. Ok so now the IP is covered, how do we get the ISP (Internet Service Provider). For this go to to IP Tracer Website. This is an IP tracer website, which can get you loads of details on a persons connection and even location, providing you know the IP.

So the page will look like this:

#1 Is where we are going to enter the IP of the victim. Then hit the ''Track IP, host or website'' button.
#2 Is where all the information on the victim will appear once the tracking is complete.

In the list of information (no.2) you should see a line for 'My ISP'. This is the Internet Service Provider the victim is running from the tracked IP.

So the only fields you should have empty now are 'Last sign in', 'Contacts', 'Mail' & 'Nickname', so let's keep it moving...

* Last Sign-In:

All you'll need to do for this, is simply go onto their Facebook, or one of the sites you found out they were signed up to earlier, and see when they were last active. If the source is unreliable, just say ''Yesterday'' for this field, because if they are an active computer-user there's a good chance they were on.

* Contacts:

To get the victims contacts for the ''Messenger contacts'' and ''Hotmail address book'' fields, all you need to do is go to their Facebook, or main social networking site, if they have one, and look at who they are most active with, i.e. who mostly leaves comments on their wall, likes their statuses etc. Good chance these are their closest friends, and therefore have them on MSN. You will need to collect the friends names and emails if possible, although this isn't of extreme importance. Just so we're clear, MSN contacts and Hotmail address book contacts are the same, if you add someone to MSN, they will go to your address book.

* Mail:

For the mail, you need to know some old mail they would have received in their hotmail inbox. All you need to do for this is visit http://www.pipl.com/ again (don't forget to search several times for more accurate results), and for all the results you get, that means they are signed up to the site, which in turn means they must have received registration emails from these websites. So take all these down and add them to your txt.

* Nickname:

And finally we get to Nickname. Nice and simple, just add them on MSN, from another account, or if you have them already that's all good. Take down their screen/display name, and add it to your txt.

Ok so we should now have a complete form ready to revert this account.

So here's a list of the fields and level of importance:

Email: Extreme Importance for obvious reasons...
Full name: Very important
D.O.B: Very important
Country: Important
County/State: Not very important
Postcode: Not very important
IP&ISP: Not important atall (though they will help your case alot)
Last sign-in: Not very important, but don't overstep your mark
Contacts: Important that you get them right
Mail: Important that you get them right
Nickname: Important that you get it right

If you don't know a field, simply say 'I DON'T KNOW' or 'I CANNOT REMEMBER'

Some fields aren't as important as others, although if you attempt a guess and get it wrong, you'll pay severely by failing this whole revert.

REMEMBER: When filling out this form, it's going to an ACTUAL PERSON, not being auto-read by some bot, so at the bottom in the ''additional info'' box, make the most of it. Let them know you're desperate for your account back for whatever reason. All this will help.

Finally, the whole point of this tutorial, here is the revert link:

Revert Link

Bookmark it, as it's not very easy to memorise

Hope this helped.

How To Hack Zynga Poker (Trick)

This method works with IE and Firefox.
Important: I'm doing it with IE but you can follow the same steps to do it with Firefox!

Here we go:

1) Open IE and go to this link :
Code:

http://toolbar.zynga.com/install/poker/

2) It's an official Zynga Game Bar. Download it and install it. (It's adware and spyware FREE!)

3) Once you are done installing you'll see this bar:

4) Now click on the 'facebook icon' on the toolbar and you'll get this:

5) Login using your account.

6) Once you login the toolbar kind of refreshed in 5-10 seconds and you see a green 'play now' button.

7) Click that. It'll take you to the Zynga App.

You'll now get $25k, click on the green 'Accept $25k' button :

9) Now close IE (just from the close button)

10) Open IE again. Now click the 'facebook icon' again and it'll again ask you for a login.

11) Now enter a different account and repeat steps 4-8.

12) You'll get 25k AGAIN!

13) You can do this with UNLIMITED accounts and then keep transferring chips to one account.

Download Free Real Hide IP v4.0.4.2

Real Hide IP v4.0.4.2 | 5 Mb

Real Hide IP is a software that allows you to anonymously surf the net. Protect your privacy online by clicking the mouse, hiding your real IP-address, to protect themselves from intrusion by hackers.

If you are using Real Hide IP, you will have the option to hide your identity on the network, showing the websites IP-address of the proxy server, which you can choose from a number of available countries. In this way, you block hackers and curious visitors wanting to know everything about you. You can easily switch between real and fake IP. As soon as you stop using Real Hide IP, configure your browser will again usually automatically. The program is compatible with browsers Internet Explorer, FireFox, Opera, Maxthon, MyIE and others.

Key Features

- Hide Your Real IP Address

- Anonymous Web Surfing

- Protect Your Identity Against Hackers

- Un-ban Yourself from Forums or Restricted Websites

- Prevent Websites from Tracking Your Online Activities


Home:
Code:
http:/www.real-hide-ip.com

Download:
Code:
Download Software Here

Guide to Proxies (Hide IP)

First we need to know what a proxy is. A proxy actually is nothing more than some sort of "middle man" between you and the server (web-page, ftp, ...) you want to visit or make access to. So if someone wants to trace you, it won't be easy for him (her) to find out who you are. So, in a way it's some sort of hiding your own IP. (=Not the same as ip-spoofing, that's a whole other area!!!)

So now we know what a proxy is, it's time to move a little bit forward. There are two (most used) sorts of proxy servers.

1) HTTP proxy
A HTTP (hyper text transfer protocol) proxy server is a proxy which allows you to connect to a remote server through its own "dataflow". Mostly http and sometimes ftp protocol.

2) SOCKS proxy
A SOCKS proxy server is a proxy which allows you to connect to a remote server. All protocols. (http, smpt, ftp, udp, tcp/ip, ...) Two types of SOCKS; - SOCKS V4 - SOCKS V5

I find it difficult to explain the difference between them. The things i understand, i will share with you;

SOCKS V4 is the oldest one (duhhh, version 4) but has two major weaknesses: the lack of strong identification and the requirement to recompile applications with SOCKSv4 client library. Due to the fact this is the oldest one, it is the most found one SOCKS proxy throughout the internet.

SOCKS V5 resolved the weaknesses in the previous version:
# Strong authentication
# Authentication method negotiation
# Address resolution proxy
# Proxy for UDP-based applications

It's all rather technical "mambo-jambo" to explain the real difference between them. So i'm not going into this issue any further. {also because of my lack of knowledge at this moment}

Just remember that a HTTP proxy is easy to use with your standard browser, and supports most of the protocols what you're using.
SOCKS have a -very- positive thing, they always have high anonymity, because this protocol is used for firewalls. (authenticated firewall traversal (AFT))
While using a SOCKS proxy server, the remote server actually thinks the SOCKS server is the client, and not you.
So figure out why you want to use a proxy, and choose a type which is most suitable for you.

How do you find proxy servers? Just use your browser to search some sites which offer several proxys. The best ones are the ones who let you filter out proxies. By this I mean, filter the HTTP, SOCKS proxys. So you know which one is which.

Then there is the "Anonymity" subject.
I suggest you use a high anonymity proxy. Here's why:
Everytime you visit a webpage, you leave some information at the server you're connected to. For example, if you visit www.whatever.com, you leave some 'footprints' behind. Those footprints can identify you. Which isp (internet service provider) you use, the browser u use, your ip, which site you last visited... Here are the three most common to trace you. The footprints are called "VALUES". The places where they are stored in are called "VARIABLES". If you use a high anonymity proxy it will only leave its own IP. The rest is not determined. (The proxy leaves those variables empty)

1) REMOTE_ADDR – Your IP (client = you)
2) HTTP_VIA – If you use a proxy not 'high anonymous', it will leave it's IP here. (proxy IP)
3) HTTP_X_FORWARDED_FOR – If you use a proxy not 'high anonymous', it will leave your IP here. (client IP)

Here's what those different types leave behind:
# Transparant Proxy
REMOTE_ADDR = proxy IP
HTTP_VIA = proxy IP
HTTP_X_FORWARDED_FOR = your IP

# Simple Anonymous Proxy
REMOTE_ADDR = proxy IP
HTTP_VIA = proxy IP
HTTP_X_FORWARDED_FOR = proxy IP

# Distorting Proxy
REMOTE_ADDR = proxy IP
HTTP_VIA = proxy IP
HTTP_X_FORWARDED_FOR = could be whatever IP

# High Anonymity Proxy
REMOTE_ADDR = proxy IP
HTTP_VIA = empty (not determined)
HTTP_X_FORWARDED_FOR = empty (not determined)

PS: Only the high anonymity proxy doesn't reveal that a proxy has been used.

A proxy looks like this (for the ones who don't know yet): xxx.xxx.xxx.xxx:yyy
The X's are the proxys adress, and the y's are the port they use.
The x's and y's don't always have to be 3-digit numbers. (look up how a ip is built)

We have a clear picture about what a proxy actually is and what it does. {(i hope..}

I can hear you asking: "how the hell do i configure my system settings to use a proxy and not use a direct connection?" Well, that's easier than you think. Just go to your browser and find the options menu. There should be tap saying
-connection settings-
or something simular to this.
See if your browser lets you choose between HTTP, SOCKS, ... . If it doesn't, you should choose a HTTP proxy, because else you need some extra software to let you use a SOCKS proxy. I know IE (M$) doesn't have this option. Firefox does.

Next all you have to do is enter the proxys adress and port number into the specific field for the manually proxy configuration.

Most sites support the feature allowing you to see if the proxy has high anonymity or not. But to make sure you can use a program called "Accessdiver" to test those proxys for speed and anonymity. But that's a whole tutorial on its own... And most free proxys don't last for long, so make sure the proxy u use is safe.

Hack Facebook/Twitter Or Any Email Account With Session Hijacking

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.

It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL.

 Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely?

Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.
Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.

After installing the extension you'll see a new sidebar. Connect to any busy open wifi network and click the big "Start Capturing" button. Then wait.

As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed:

Double-click on someone, and you're instantly logged in as them.

That's it.
Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.
Websites have a responsibility to protect the people who depend on their services. They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.
By Codebutler..