How to Hack Google Search Commands.& Google Hacking Master list

Google search engine can be used to hack into remote servers or gather confidential or sensitive information which are not visible through common searches.

Google is the world’s most popular and powerful search engine. It has the ability to accept pre-defined commands as inputs which then produces unbelievable results.

Google’s Advanced Search Query Syntax

Discussed below are various Google’s special commands and I shall be explaining each command in brief and will show how it can be used for getting confidential data.

[ intitle: ]

The “intitle:” syntax helps Google restrict the search results to pages containing that word in the title.

intitle: login password

will return links to those pages that has the word "login" in their title, and the word "password" anywhere in the page.

Similarly, if one has to query for more than one word in the page title then in that case “allintitle:” can be used instead of “intitle” to get the list of pages containing all those words in its title.

intitle: login intitle: password

is same as

allintitle: login password

[ inurl: ]

The “inurl:” syntax restricts the search results to those URLs containing the search keyword. For example: “inurl: passwd” (without quotes) will return only links to those pages that have "passwd" in the URL.

Similarly, if one has to query for more than one word in an URL then in that case “allinurl:” can be used instead of “inurl” to get the list of URLs containing all those search keywords in it.

allinurl: etc/passwd

will look for the URLs containing “etc” and “passwd”. The slash (“/”) between the words will be ignored by Google.

[ site: ]

The “site:” syntax restricts Google to query for certain keywords in a particular site or domain.

exploits site:hackingspirits.com

will look for the keyword “exploits” in those pages present in all the links of the domain “hackingspirits.com”. There should not be any space between “site:” and the “domain name”.

[ filetype: ]

This “filetype:” syntax restricts Google search for files on internet with particular extensions (i.e. doc, pdf or ppt etc).

filetype:doc site:gov confidential

will look for files with “.doc” extension in all government domains with “.gov” extension and containing the word “confidential” either in the pages or in the “.doc” file. i.e. the result will contain the links to all confidential word document files on the government sites.

[ link: ]

“link:” syntax will list down webpages that have links to the specified webpage.

link:www.expertsforge.com

will list webpages that have links pointing to the SecurityFocus homepage. Note there can be no space between the "link:" and the web page url.

[ related: ]

The “related:” will list web pages that are "similar" to a specified

web page.

related:www.expertsforge.com

will list web pages that are similar to the Securityfocus homepage. Note there can be no space between the "related:" and the web page url.

[ cache: ]

The query “cache:” will show the version of the web page that Google

has in its cache.

cache:www.hackingspirits.com

will show Google's cache of the Google homepage. Note there can be no space between the "cache:" and the web page url.

If you include other words in the query, Google will highlight those words within the cached document.

cache:www.hackingspirits.com guest

will show the cached content with the word "guest" highlighted.

[ intext: ]

The “intext:” syntax searches for words in a particular website. It ignores links or URLs and page titles.

intext:exploits

will return only links to those web pages that has the search keyword "exploits" in its webpage.

[ phonebook: ]

“phonebook” searches for U.S. street address and phone number information.

phonebook:Lisa+CA

will list down all names of person having “Lisa” in their names and located in “California (CA)”. This can be used as a great tool for hackers incase someone want to do dig personal information for social engineering. 

Google Hacks

Well, the Google’s query syntaxes discussed above can really help people to precise their search and get what they are exactly looking for.

Now Google being so intelligent search engine, hackers don’t mind exploiting its ability to dig much confidential and secret information from the net which they are not supposed to know. Now I shall discuss those techniques in details how hackers dig information from the net using Google and how that information can be used to break into remote servers.

Index Of

Using “Index of ” syntax to find sites enabled with Index browsing

A webserver with Index browsing enabled means anyone can browse the webserver directories like ordinary local directories. The use of “index of” syntax to get a list links to webserver which has got directory browsing enabled will be discussd below. This becomes an easy source for information gathering for a hacker. Imagine if the get hold of password files or others sensitive files which are not normally visible to the internet. Below given are few examples using which one can get access to many sensitive information much easily.

Index of /admin

Index of /passwd

Index of /password

Index of /mail

"Index of /" +passwd

"Index of /" +password.txt

"Index of /" +.htaccess

"Index of /secret"

"Index of /confidential"

"Index of /root"

"Index of /cgi-bin"

"Index of /credit-card"

"Index of /logs"

"Index of /config"

Looking for vulnerable sites or servers using “inurl:” or “allinurl:”

a. Using “allinurl:winnt/system32/” (without quotes) will list down all the links to the server which gives access to restricted directories like “system32” through web. If you are lucky enough then you might get access to the cmd.exe in the “system32” directory. Once you have the access to “cmd.exe” and is able to execute it.

b. Using “allinurl:wwwboard/passwd.txt”(without quotes) in the Google search will list down all the links to the server which are vulnerable to “WWWBoard Password vulnerability”. To know more about this vulnerability you can have a look at the following link:

http://www.securiteam.com/exploits/2BUQ4S0SAW.html

c. Using “inurl:.bash_history” (without quotes) will list down all the links to the server which gives access to “.bash_history” file through web. This is a command history file. This file includes the list of command executed by the administrator, and sometimes includes sensitive information such as password typed in by the administrator. If this file is compromised and if contains the encrypted unix (or *nix) password then it can be easily cracked using “John The Ripper”.

d. Using “inurl:config.txt” (without quotes) will list down all the links to the servers which gives access to “config.txt” file through web. This file contains sensitive information, including the hash value of the administrative password and database authentication credentials.

For Example: Ingenium Learning Management System is a Web-based application for Windows based systems developed by Click2learn, Inc. Ingenium Learning Management System versions 5.1 and 6.1 stores sensitive information insecurely in the config.txt file. For more information refer the following

links: http://www.securiteam.com/securitynews/6M00H2K5PG.html

Other similar search using “inurl:” or “allinurl:” combined with other syntax

inurl:admin filetype:txt

inurl:admin filetype:db

inurl:admin filetype:cfg

inurl:mysql filetype:cfg

inurl:passwd filetype:txt

inurl:iisadmin

inurl:auth_user_file.txt

inurl:orders.txt

inurl:"wwwroot/*."

inurl:adpassword.txt

inurl:webeditor.php

inurl:file_upload.php

inurl:gov filetype:xls "restricted"

index of ftp +.mdb allinurl:/cgi-bin/ +mailto

Looking for vulnerable sites or servers using “intitle:” or “allintitle:”

a. Using [allintitle: "index of /root”] (without brackets) will list down the links to the web server which gives access to restricted directories like “root” through web. This directory sometimes contains sensitive information which can be easily retrieved through simple web requests.

b. Using [allintitle: "index of /admin”] (without brackets) will list down the links to the websites which has got index browsing enabled for restricted directories like “admin” through web. Most of the web application sometimes uses names like “admin” to store admin credentials in it. This directory sometimes contains sensitive information which can be easily retrieved through simple web requests.

Other similar search using “intitle:” or “allintitle:” combined with other syntax

intitle:"Index of" .sh_history

intitle:"Index of" .bash_history

intitle:"index of" passwd

intitle:"index of" people.lst

intitle:"index of" pwd.db

intitle:"index of" etc/shadow

intitle:"index of" spwd

intitle:"index of" master.passwd

intitle:"index of" htpasswd

intitle:"index of" members OR accounts

intitle:"index of" user_carts OR user_cart

allintitle: sensitive filetype:doc

allintitle: restricted filetype :mail

allintitle: restricted filetype:doc site:gov

Other interesting Search Queries

· To search for sites vulnerable to Cross-Sites Scripting (XSS) attacks:

allinurl:/scripts/cart32.exe

allinurl:/CuteNews/show_archives.php

allinurl:/phpinfo.php

· To search for sites vulnerable to SQL Injection attacks:

allinurl:/privmsg.php

allinurl:/privmsg.php

How to get Google Map API

To use the Google Maps Directions API, you must register your app project on the Google API Console and get a Google API key which you can add to your app or website.

Step 1: Get an API Key from the Google API Console

Click the button below, which guides you through the process of registering a project in the Google API Console, activates the Google Maps Directions API automatically, and generates a generic, unrestricted API key.

Step 2: Add the API key to your application

When loading the Google Maps Directions API, substitute YOUR_API_KEY in the code below with the API key you got from the previous step.

https://maps.googleapis.com/maps/api/directions/json?origin=Toronto&destination=Montreal&key=YOUR_API_KEY

Detailed guide for users of the standard Google Maps Directions API

Follow these steps to get an API key:

Go to the Google API Console.

Create or select a project.

Click Continue to enable the API.

On the Credentials page, get an API key. 

Note: If you have an existing unrestricted API key, or a key with server restrictions, you may use that key.

From the dialog displaying the API key, select Restrict key to set a server restriction on the API key.

In the Key restriction section, select 'IP addresses (web servers, cron jobs, etc.), follow the on-screen instructions to add server IP addresses, then click Save. Read more about restricting API keys.

(Optional) Enable billing. See Usage Limits for more information.

Choosing an authentication method for your application

The section below provides a summary of the various tools and reports that are available to Premium Plan customers, based on the method you choose to authenticate your application.

Authentication using an API key

By using an API key to authenticate your applications, you can:

Manage all of your APIs in the Google API Console.

Access real-time usage data and 30 days of historical usage data for your application in the Google API Console.

View usage reports with more than 30 days of data in the Google Cloud Support Portal.

Authentication using a client ID and digital signature

By using your client ID and digital signature (instead of an API key) to authenticate your application, you can:

Add the channel parameter to requests so you can view more detailed usage reports.

View usage reports with more than 30 days of data in the Google Cloud Support Portal.

Use Maps Analytics tools for the Maps JavaScript API.

Authenticating your application using a client ID and digital signature

Upon purchasing your Google Maps APIs Premium Plan license, you will receive a welcome email from Google that contains your client ID and your private cryptographic key.

Read more about the cryptographic key which you can use to generate a unique digital signature.

You must use both the client ID and unique digital signature to authenticate the Directions API.

The code example below shows you the client and signature parameters to which you must pass your client ID and unique digital signature.

    https://maps.googleapis.com/maps/api/directions/json

      ?origin=Toronto

      &destination=Montreal

      &client=gme-YOUR_CLIENT_ID

      &signature=YOUR_URL_SIGNATURE

Substitute gme-YOUR_CLIENT_ID with the client ID you got in your welcome email. All client IDs begin with a gme- prefix.

Substitute YOUR_URL_SIGNATURE with your unique digital signature. Read about how you can generate a digital signature using your cryptographic key.

Generating a digital signature

Requests to the Directions API by Google Maps APIs Premium Plan customers require a digital signature that you can generate using the private cryptographic key provided to you in your welcome email.

Follow the steps below to generate a digital signature for your request.

Construct the request URL without the signature, making sure to include your client parameter. Note that any non-standard characters will need to be URL-encoded:

https://maps.googleapis.com/maps/api/directions/json?origin=Toronto&destination=Montreal&client=clientID

Note: All Google services require UTF-8 character encoding (which implicitly includes ASCII). If your applications operate using other character sets, make sure they construct URLs using UTF-8 and properly URL-encode them.

Strip off the domain portion of the request, leaving only the path and the query:

/maps/api/directions/json?origin=Toronto&destination=Montreal&client=clientID

Retrieve your private key, which is encoded in a modified Base64 for URLs, and sign the URL above using the HMAC-SHA1 algorithm. You may need to decode this key into its original binary format. Note that in most cryptographic libraries, the resulting signature will be in binary format.

Note: Modified Base64 for URLs replaces the + and / characters of standard Base64 with - and _ respectively, so that these Base64 signatures no longer need to be URL-encoded.

Encode the resulting binary signature using the modified Base64 for URLs to convert this signature into something that can be passed within a URL.

Attach this signature to the URL within a signature parameter:

https://maps.googleapis.com/maps/api/directions/json?origin=Toronto&destination=Montreal&client=clientID&signature=base64signature

Restricting an API key

Google Maps APIs are available via HTTP web services, for web browsers, and Android or iOS apps. APIs in any platform can use a generic (unrestricted) API key. You can optionally add a restriction (for example, IP addresses) to the API key. Once restricted, a key will only work on platforms that support that type of restriction.

To add server restrictions to an existing, generic API key, do the following:

1. Go to the Credentials page of the Google API Console.

2. Select the project that contains the API key you want to edit.

3. On the Credentials page, from the list of API keys, select the name of the API key to edit           the details of the key.

4. In the Key restriction section of the page, select IP addresses (web servers, cron jobs, etc.),       follow the on-screen instructions to add server IP addresses, then click Save.

Troubleshooting authentication issues

If your request is malformed or supplies an invalid signature, the Google Maps Directions API returns an HTTP 403 (Forbidden) error.

To troubleshoot individual URLs, you can use the URL Signing Debugger. It allows you to quickly validate a URL and signature generated by your application.

Alternatively, Google Maps APIs Premium Plan customers can troubleshoot individual URLs by logging in to the Google Cloud Support Portal and selecting Resources > Google Maps APIs Premium Plan online tools > URL Signing Debugger for Web Service and Image APIs.

Top Android Mobile Phones

Google’s Android operating system accounts for a vast majority in today’s smartphone market. In recent times, many Android phones come with 4GB of DDR4 RAM, equivalent to the RAM available on a normal laptop. Alongside, while you may still be using a Full HD television at home, the screen resolution on latest Android phones have been moved to 2K, and in some cases, even 4K. The camera quality has also improved massively, and is steadily progressing with each latest Android mobile. With all of these in mind, there are a lot of options to go through. Here, we give you a list of the best Android mobiles to buy in India this month. These Android phones offer the right mix of performance and features. Click on each of the recommended top 10 smartphones to read their detailed reviews, and get more information on the best smartphones in India.

Google Pixel XL

After partnering with multiple phone makers over the years, Google has finally produced a smartphone which is made by Google through and through. Right from the software of the phone to the design, everything is done by Google. The Qualcomm Snapdragon 821 powered device is easily the best Android smartphone you can buy today. It offers a very familiar design and a superb 2K display. Google has also incorporated a brilliant camera on the phone which can easily stand against the likes of Samsung Galaxy S7 Edge and even the iPhone 7. If 5.5-inch is too large for you to handle, you can settle for the 5-inch Google Pixel. Specs: Display: 5.5-inch, 1440p SoC: Qualcomm Snapdragon 821 RAM: 4GB Storage: 32/128GB Camera: 12.3MP, 8MP Battery: 3450mAh OS: Android 7.1.

Samsung Galaxy S7 Edge

Samsung was the first company to bring its 2016 flagship smartphone to India. Samsung's latest Android phone offers an updated specification sheet, and refines the whole glass and metal design introduced with the Galaxy S6 range of Android phones in 2016. It is waterproof, and supports microSD cards of up to 200GB. Samsung has used an all new Exynos 8890 SoC on the new Galaxy S7 Edge, and there is 4GB of RAM along with 32GB of internal storage. It features an AMOLED display with 2560x1440-pixel resolution, but the screen size has been increased from 5.1 inches to 5.5 inches. This has allowed Samsung to increase the battery size from 2600mAh to 3600mAh, which allows it to offer better battery life. The biggest change in the phone, though, is the new 12MP Dual Pixel camera, which shoots amazing photographs even in low light. All of these combine to make the Samsung Galaxy S7 Edge the best Android phone to buy in India today. Specs: Display: 5.5-inch, 1440p SoC: Exynos 8890 RAM: 4GB Storage: 32GB Camera: 12MP, 5MP Battery: 3600mAh OS: Android 6.0

OnePlus 3T

The OnePlus 3T has grabbed the third position on our ‘best phones to buy’ with ease. This Android phone is an all-rounder, and offers the best performance-to-price ratio among the latest flagship Android phones. This is the first time that OnePlus made an all-metal smartphone, and while the phone is reminiscent of the HTC One M9, it is still a good design. The device is powered by Qualcomm Snapdragon 821 SoC and has 6GB of RAM. The 16MP camera on the back does not disappoint either and offers PDAF as well as OIS. Like most latest Android phones, battery life is not that great, but still manages to go on for a whole day on a single charge. Specs: Display: 5.5-inch, 1080p SoC: Qualcomm Snapdragon 821 RAM: 6GB Storage: 64/128GB Camera: 16MP, 16MP Battery: 3400mAh OS: Android 6.0.1

LG G5

LG's flagship smartphone, LG G5, is also the world’s first modular smartphone. This Android phone from LG offers a metal build and fingerprint sensor. It has the best specifications currently available on latest Android mobiles. The LG G5 is powered by a Qualcomm Snapdragon 820 SoC. There is 4GB of RAM and 32GB of native storage, along with microSD card support of up to 200GB. The smaller, 5.3-inch display is a delight to look at, and offers 2560x1440-pixel screen resolution. The colours of the display are among the most well-balanced of the latest Android phones. The removable battery is small, but lasts for a day. LG will also be selling various accessories under its Friends ecosystem for the LG G5, including a camera grip with extra battery, an external amplifier and more. Specs: Display: 5.3-inch, 1440p SoC: Qualcomm Snapdragon 820 RAM: 4GB Storage: 32GB Camera: 16MP + 8MP, 8MP Battery: 2800mAh OS: Android 6.0.1

HTC 10

The HTC 10 is another great Android phone to look for in the flagship smartphone range. The HTC 10 flaunts the suave HTC design, with latest generation hardware to boot. Powered by the Qualcomm Snapdragon 820 SoC, the HTC 10 offers great multi-tasking abilities. The OIS-assisted 12MP UltraPixel rear camera is great to shoot with, and you also get OIS on the front camera. HTC has also mastered the 2K display, and the 5.2-inch LCD5 2K resolution panel looks beautiful from all angles. However, the best part is the audio quality, which gives the best music quality you can get on any Android mobile available for purchase today. Specs: Display: 5.2-inch, 1440p SoC: Qualcomm Snapdragon 820 RAM: 4GB Storage: 32GB Camera: 12MP, 5MP Battery: 3000mAh OS: Android 6.0.1

Xiaomi Mi5

Xiaomi’s two-year-long wait for the Mi 5 translated into a massive upgrade over its previous flagship smartphone in India, the Mi 4. Xiaomi has given this Android phone a complete makeover, fusing an incredibly ergonomic body with a glass-and-metal chassis. It has a 5.15-inch display that offers a well-balanced colour gamut and Full HD screen resolution. The device is powered by the Qualcomm Snapdragon 820 SoC, like most other flagship Android phones in India. Only the 3GB RAM-32GB storage variant has been launched in India, but this itself offers fluent performance. The 16MP primary camera has 4-axis OIS, and is very fast. Also, the 3000mAh battery should last you through the entire work day, comfortably. Specs: Display: 5.15-inch, 1080p SoC: Qualcomm Snapdragon 820 RAM: 3GB Storage: 32GB Camera: 16MP, 4MP Battery: 3000mAh OS: Android 6.0

Huawei P9

The Huawei P9 is a flagship Android phone, and features all the hardware you can expect from a phone in this league, including a brilliant camera. It offers a two-camera setup with Leica-certified SUMMARIT lenses, which facilitates shooting the best ‘bokeh’ effects available on a latest Android phone. The device is powered by a Kirin 955 SoC, which is not as powerful as the competing Qualcomm Snapdragon 820, but still manages to deliver decent multi-tasking and gaming performance. The Huawei P9 also offers one the best designs and build quality among the latest Android phones. Specs: Display: 5.2-inch, 1080p SoC: HiSilicon Kirin 955 RAM: 4GB Storage: 32GB Camera: 12MP + 12MP, 8MP Battery: 3000mAh OS: Android 6.0

LeEco Le Max 2

The Le Max 2 might be a slightly larger phone but it is one of most affordable device to offer a flagship class Qualcomm Snapdragon 820 SoC. This LeEco flagship features a bright 2K display with good viewing angles. It can take upon all kinds of tasks and is very well built. To sweeten the deal, LeEco bundles a free subscription of Le Live and Le Vidi apps offering live TV and movie content. Further, the 21MP rear camera does a good job as well, although the battery life could have been better. Specs: Display: 5.7-inch, 1440p SoC: Qualcomm Snapdragon 820 RAM: 3GB Storage: 32GB Camera: 21MP, 8MP Battery: 3100mAh OS: Android 6.0

Samsung Galaxy Note 5

The Samsung Galaxy Note 5 is another great Android phone, particularly when productivity is concerned. Last year’s Samsung flagship is still one of the fastest Android phones to buy in India. It features a bright, 5.7-inch AMOLED display with 2K screen resolution, offering good viewing angles and S-Pen compatibility. Powered by Samsung’s previous generation Exynos 7420 SoC, the Galaxy Note 5 is still one of the fastest Android phones in the market. The larger footprint allows for a larger battery, and this phone can easily last you for a day, even if you are a power user. The 16MP rear camera is good too, and even offers 4K video recording. Specs: Display: 5.7-inch, 1440p SoC: Exynos 7420 RAM: 4GB Storage: 32GB Camera: 16MP, 5MP Battery: 3000mAh OS: Android 6.0.1

Samsung Galaxy S6

The Samsung Galaxy S6 is a year old now, but still beats a lot of other Android phones to be on this list. It houses an excellent 16MP camera with OIS, and is powered by the Exynos 7420 SoC. The combination of these two factors makes it an excellent overall device. The Galaxy S6 features an excellent 5.1-inch AMOLED display with 2560x1440-pixel resolution. The glass-and-metal construction on this Android phone laid foundation for Samsung’s resurgence on the design front. The Galaxy S6 is available in 32GB and 64GB variants, and 3GB of RAM on board handles all kinds of heavy multitasking, making it rank among the best Android phones to buy in India today. Specs: Display: 5.1-inch, 1440p SoC: Exynos 7420 RAM: 3GB Storage: 32GB Camera: 16MP, 5MP Battery: 2550mAh OS: Android 6.0.1

Best Hollywood Movies of 2016

The movie year is just about over, and a review of the past twelve months makes clear that cinephiles have been spoiled with sterling movies, from blockbuster superhero sagas and low-budget horror thrillers to bizarre dystopian comedies and politically oriented foreign imports. With our late-year binge-watching now complete, our final assessment—which still only scratches the surface of everything worth watching—proves that, whether at the multiplex or the art house, filmgoers were blessed with a bounty of great offerings in 2016.

10. Moonlight

Moonlight is a coming-of-age tale about a homosexual African-American boy living in Florida. That basic plot description, however, does little to convey the incisive poetry of Barry Jenkins' film, whose narrative is divided between three stages in the life of its protagonist, Chiron (aka "Little" as an adolescent, and "Black" as an adult). From its astounding opening shot on a street corner circling around a drug dealer (Mahershala Ali) who'll come to be young Chiron's surrogate father figure—since his mother (Naomie Harris) is a junkie—this evocative drama captures an overwhelming sense of both place and character. As Chiron grows up, enjoying fleeting moments of euphoria amidst routine abuse and neglect, Jenkins charts thorny individual and interpersonal dynamics in which both salvation and damnation seem to stem from the same (or, at least, similar) source. Sensitive, subtle, intense and complex, it's a triumph of both expressive direction and—courtesy of Alex Hibbert, Ashton Sanders, and Trevante Rhodes as Chiron, as well as André Holland and Janelle Monáe—nuanced, heart-rending performance.

9. Jackie

Pablo Larrain's cinema is one rooted in the knotty relationship between influential historical leaders and the people over whom they govern (or rule with an iron fist). That's true of both his superb 2016 releases, although in the final tally, his Neruda falls just shy of the piercing majesty of Jackie, an unconventional, hauntingly lyrical snapshot of Jackie Kennedy (played by an astounding Natalie Portman) in the week immediately following the November 23, 1963 assassination of her husband, President John F. Kennedy. Framed by an interview between Jackie and a reporter (Billy Crudup), Larrain's masterful drama uses incessant close-ups to dig deeply into the conflicted interior condition of his subject, who finds herself both battling with grief and struggling to immediately lay the groundwork for her husband's legacy. Graceful and gripping, it's a period piece character study that cannily speaks to the way in which words—and, tellingly, also visual images—are the tools by which we shape history.

8. The Fits

No 2016 debut has been as striking as Anna Rose Holmer's The Fits, an immaculately conceived and executed small-scale indie about a young African-American girl named Toni (superb newcomer Royalty Hightower) who, while living in Cincinnati's West End, spends her time working out at a local boxing gym with her brother, even as she increasingly finds herself drawn to the championship-winning dance team that practices in the same facility. Holmer's precise aesthetics echo her protagonist's detachment from both the pugilistic and dance cliques from which she seeks acceptance, and her slow-motion sequences of the troupe's rhythmic routines have an overpowering, hypnotic grace and splendor. Fixated on Hightower's subtly expressive countenance and her spatial (and emotional) relationship to her peers, the film is more than just a coming-of-age saga; it's an expressionistic snapshot of a young girl trying to transcend her estrangement, define her identity, and find a place for herself in the world.

7. Arrival

Denis Villeneuve's follow-up to last year's Sicario boasts the same brand of gorgeously portentous widescreen imagery as well as a female protagonist thrust into head-spinning territory. In this case, however, the subject isn't Mexican drug cartels but aliens, who mysteriously arrive across the globe in giant ships, and who don't communicate in anything like a decipherable human language. Enter Amy Adams' linguist, who—paired with Jeremy Renner's mathematician—is tasked by the U.S. government with finding a way to communicate with these extraterrestrials, known as "heptapods" because of their seven-limbed physical form. What endues is a thrilling "first contact" drama that also splits its focus to concentrate on Adams' protagonist's grief over the loss of her daughter—twin narrative threads that eventually dovetail into a poignant portrait of the circular nature of life, and the way in which written and spoken language help connect us all to our pasts, present, and future.

6. Elle

"Shame isn't a strong enough emotion to stop us doing anything at all," says Isabelle Huppert's French video game mogul Michèle to her best friend late in Elle, and that sentiment certainly pertains to every one of the twisted characters found in Robocop and Basic Instinct auteur Paul Verhoeven's stirring examination of intersecting passions. Beginning with Michèle's rape by a masked intruder, his story proceeds to confound expectations at every knotty turn, eschewing for long stretches any resemblance to a revenge fantasy as it investigates Michèle's relationship with numerous relatives and acquaintances—mostly male—who are, in some form or another, sexually intertwined with her. That Michèle has a deep dark daddy issue only further mires the material in deranged and deviant (semi-masochistic) desire, although Verhoeven's composed and chilly direction proves as adept at eliciting laughs as it is at generating suspense. Even after its rapist "villain" has been identified, it proves to be an exhilaratingly mysterious thriller-by-way-of-character-study about power, eroticism and need—a one-of-a-kind work energized by a lead Huppert turn of such rich psychological complexity (and contradictions!), it leaves just about every other 2016 performance in its wake.

5. Hell or High Water

David Mackenzie's outlaws-on-the-run saga concerns two brothers (Chris Pine and Ben Foster) who embark on a bank-robbing spree in order to raise enough money to save their family farm from foreclosure—a conceit that lends the film a piercing timeliness. Nonetheless, the true power of this rugged genre effort comes from its stars and its attention to both atmosphere and character detail. As yin-yang siblings compelled to embark upon their mission by need, fury, and inherent recklessness, Pine and Foster share a compelling chemistry. And they're complemented (and, in fact, surpassed) in the charisma department by the always great Jeff Bridges. As the just-about-to-retire sheriff hot on their trail, Bridges delivers one of his finest performances, radiating both wit and regret as an old-school relic who—like the criminals he's pursuing, and the beaten-down land that he roams with his Native American-Mexican partner Alberto (Gil Birmingham)—is on the precipice of transforming into a ghost from a bygone era.

4. Gleason

Steve Gleason was a sturdy New Orleans Saints safety who became immortalized in team history when, during the squad's first game back in the Superdome following Hurricane Katrina, he blocked a punt against the Atlanta Falcons—a play that came to symbolize the city's indefatigable comeback spirit. Tragically, at the too-young age of 34, and on the eve of his first child's birth, Gleason was diagnosed with ALS (aka "Lou Gehrig's Disease"). Using copious footage shot by the former athlete himself (some of it addressed to his unborn kid), J. Clay Tweel's documentary details Gleason and his wife Michel's struggle with that incurable condition. To say Gleason is heartbreaking is a vast understatement, but amidst its tears-inducing horrors, it conveys a genuinely uplifting sense of its subject's refusal to quit, especially once he endeavors to use his fame to help others with ALS. The story of a man, and family, torn asunder by disease, and yet unwilling to just accept defeat, it's the non-fiction film of the year.

3. Green Room

The most hardcore thriller in years, Jeremy Saulnier's follow-up to 2013's critically acclaimed Blue Ruin is another exercise in extreme, nail-biting suspense, this time about a just-scraping-by punk band (comprised of the late Anton Yelchin, Alia Shawkat, Joe Cole, and Callum Turner) that unwisely decides to accept a gig at a rural neo-Nazi music club. When they happen to witness the aftermath of a murder, they become captives of the resident skinheads and their leader (a terrifying Patrick Stewart), leading to a prolonged showdown which Saulnier stages as a series of quiet, panic-stricken moments and bursts of brutal violence—a storytelling rhythm in tune with the sludgy punk and metal thundering through the venue's speakers. A relentless assault on one's nerves that pummels viewers with the same all-out viciousness exhibited by the racists slam-dancing around the venue's grimy, beer-soaked floors, Green Room (which we dubbed "mosh-pit cinema") leaves a lasting mark.

2. The Lobster

Greek director Yorgos Lanthimos' The Lobster is one of the strangest movies in recent memory—and one of the most hilariously (and surprisingly profound) ones as well. In this pitch-black future-society saga, a single man (Colin Farrell) checks into a hotel where, by law, he must find a mate within 45 days or be transformed into the animal of his choice. (His preference? A lobster.) In that wacko locale, Farrell's lonely loser pals around with other equally strange sorts, and tries to forge a romance with a female counterpart, before eventually fleeing for the woods where anti-monogamy rebels are stationed. A deadpan dystopian comedy that also functions as a bizarro-world examination of love, relationships, marriage, and the basic human desire for connection, Lanthimos' film is that rare thing in today's cinema: an unqualified original.

1. O.J.: Made in America

There will be those who argue that O.J.: Made in America—a documentary that runs seven hours and 47 minutes, and is divided into self-contained chapters—is in fact a long-form TV documentary. Nonetheless, thanks to a limited theatrical run in May, Ezra Edelman's non-fiction opus is eligible for 2016 movie awards, and even in a year overflowing with gems, it stands head and shoulders about the rest. A titanic work of socio-cultural commentary that plumbs issues of ambition, race, fame, ego and denial, Edelman's masterpiece spends its first three immersive hours conveying the magnetic personality and triumphant athletic (and advertising) career of O.J. Simpson, as well as providing background on the contentious historic relationship between Los Angeles' police force and African-American community. That engrossing material is the appetizer for its subsequent in-depth look at the "Trail of the Century" and Simpson's eventual conviction on armed robbery charges, all of which is examined from myriad enthralling, incisive angles. Illuminating, infuriating and heartbreaking in equal measure, O.J.: Made in America paints a vividly ugly portrait of its notorious celebrity—and, in the process, gets to the rotten center of the culture that begat him.

Set Static Port SQL Server 2012

How to assign a static port to a SQL Server named instance

While Books Online clearly mentions the steps to Configure a Server to Listen on a Specific TCP Port we still see people missing out on one small but important detail in these steps: they forget to delete the entry (0 or some random port) for dynamic port. This firstly results in confusion and occasionally can result in connectivity problems as well. Let me explain how using an example from one of our lab setups.

As a first step, let’s see what the ‘administrator’ (in this case, yours truly Smile) had done:

As you can see, they have added the static port for ‘IPAll’ with a value of 1450. That part is fine. The problem though is they forgot to remove the entries for the dynamic ports (0 or some random port). That means that when they restarted SQL, the dynamic port setting is still valid. In fact if we query sys.tcp_endpoints, you will still see the engine thinks it is listening on dynamic port:

SELECT        name, protocol_desc, type_desc, state_desc, is_admin_endpoint, port,        is_dynamic_port, ip_address 
FROM            sys.tcp_endpoints

The important observation is that the engine reports that it is still using a dynamic port. It does not report the static port number 1450 which we selected in Configuration Manager. Let’s double-check in the errorlog to see if indeed the static port is being picked up at all. And lo and behold:

Server is listening on [ ‘any’ 1450]. 
Server is listening on [ ‘any’ 1450]. 
Server is listening on [ ‘any’ 49626]. 
Server is listening on [ ‘any’ 49626].

In our case, sqlservr.exe has a PID of 1240. Using the command netstat –ano, we can see what it is listening on.

  Proto  Local Address       Foreign Address                State                  PID 
  TCP      0.0.0.0:1450                0.0.0.0:0                           LISTENING             1240 
  TCP      0.0.0.0:49626             0.0.0.0:0                           LISTENING             1240 
  TCP      127.0.0.1:49627          0.0.0.0:0                           LISTENING             1240 
  TCP      192.168.1.101:1450    192.168.1.200:49386      ESTABLISHED       1240 
  TCP      192.168.1.101:1450    192.168.1.200:49396      ESTABLISHED       1240 
  TCP      [::]:1450                      [::]:0                                   LISTENING             1240 
  TCP      [::]:49626                   [::]:0                                   LISTENING             1240 
  TCP      [::1]:49627                  [::]:0                                   LISTENING            1240

So it is not only listening on the static port, but also on the dynamic port 49626. The DAC is listening on TCP port 49627. The values with a local address of [::] are the IPv6 ‘All’ address.

So depending on what got cached earlier in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\SNI11.0\LastConnect on the client (you can find some detail about the LastConnect registry key and the caching mechanism in this KB article), the client might attempt to connect to the previous dynamic port (which is still valid based on our observation above.)

FYI, if we run NetMon, we can see that the SSRP response from the SQL Browser correctly gives back 1450 as the port for this named instance:

For clarity I’ve reproduced the response from SQL Browser (using the SSRP protocol) back to my client (SQLCMD.exe):

.^.ServerName;SOMESERVER;InstanceName;SOMEINSTANCE;IsClustered;No;Version;11.0.2100.60;tcp;1450;;

From the above it is clear that SQL Browser is correctly sending the static port assignment. But if you are like me, I feel uneasy till I fix the root cause, which is to delete the dynamic port assignment!

To summarize here is what we saw in this walkthrough:

The official steps (captured in Books Online) to assign a static port for a named instance involve also deleting the value (0 or some random port) for the dynamic port.

Failure to delete the dynamic port value in SQL Configuration Manager will cause SQL to listen on both the static as well as the dynamic ports.

This means that clients will succeed to connect to the erstwhile dynamic port if they had that cached in the LastConnect client side registry key.

For clients which do not have cached connection details, SQL Browser seems to pickup the static port and sends that back to the client.

So follow the steps in the BOL article to the T and delete the dynamic port value right after you type in the static port value, and in any case before you restart the instance.

FYI the steps to fix a static port for the Dedicated Admin Connection (DAC) are in the KB article How to configure SQL Server to listen on a specific port under the section ‘Configuring an instance of SQL Server to use a static port’.