EvilZone

Do not forget the "hackish" NodeJS.

It's not client side. Javascript is becoming the lingua franca for development. I am actually coding some sort of website with it, using ExpressJS.

For framework suggestions: CodeIgniter or Laravel, nothing else.

But don't jump just right now. It sucks to have a framework when you don't know all the subleties of the language, so first learn php properly.

Most vulnerabilities in web applications come thanks to bad development practices, such as those cheap YouTube tutorials where they step by step spoon feed you, but it's all chewed and you ONLY end up knowing what they EXACTLY told you. I don't think nobody has ever audited these dudes btw for webdev industry's sake, so expect the worst from them. (Not to prejudice you, but that's what I've seen).

Stick to PHP.NET, and make no mistake: this is a security forum, so you'd be wise to also stick with OWASP learning programs or similar. Oh yeah, and a tenet of security: whatever you do, should be secure from the ground-up (from its architecture, design, whatever you call it), anything that has "an external plugin for security" will be most likely flawed. Not necessarily flawed, but most likely. Cheerio!

EDIT: My engrish suked.

Okay @namespace7, you're not a criminal, you don't do bad things... perhaps some day they'll put cameras in bathroom to watch for people who have been traveling in drugs inside their bodies... you don't carry drugs but you prefer your anus to not be watched.

I support the position of @Axon, it is never enough to be paranoid. We live in a half-good and half-evil planet. Surveillance will always exist, but... let's not leave it exceed.

EDIT: Check out this post. It explains it better than I could.

http://www.wired.com/opinion/2013/06/why-i-have-nothing-to-hide-is-the-wrong-way-to-think-about-surveillance/

Totally agree with @proxx. It's worth it. And if you don't want to partition your disk, and install a linux distro that could potentially break things at your bootloader... just get Virtualbox and install Ubuntu Server in the virtual machine, that way you can run both linux and windows at the same time, whilst developing in a near real-world environment. Upload whatever you are developing to the virtual machine and you're set.

Count with me man, I've this code:

• Copy to USB itself.
• Very basic client server architecture, just needs commands programmed.
• Very basic HTTPd. (For pushing exploits).

I'm developing more "snippets" when time allows me (I have a real life too!), all of those in Delphi, willing to contribute for this project. Just pm me, let's organize a group of some kind. Those that have anything to contribute, are invited to join, I guess. 

Yeah, a dropper is a good idea, a dropper that determines if it's a honeypot of some sort before pulling the real deal.

Something like a silent VNC? btw, starting a back-connection to the mothership has the problem of revealing where it all goes to. Unless you manage so "open the VNC" only when needed and use a pwned box for that purpose. Oh yeah, you can open ports on home routers on-the-fly with UPnP (in case you didn't know). 

Nice ideas have been posted here!

Yeah, I'd block or somehow redirect social networking sites, I'd inject a small banner "Social networking kills your brain" and marquee it constantly.

@Kulverstukas: Why image manipulation?

@Fur: You mean an interpreter? Something like adding new functionality/modules on the fly? without pulling a new executable to infect again.

The Tuxissa idea is not bad at all, I think it could get far undetected given it never infects subliminal messages experts. It is a strange idea, though.

It could use a polymorphic engine like some malware around had. Cloud polymorphism, the executable downloaded a "new entire body" during propagation, processed in cloud.

I also did my task finding ideas on my own, I read somewhere that Koobface used solved CAPTCHAs grabbed from infected people, in order to maintain its propagation routine. Not that is clever, but it's self-sustainable and that's a detail I like. 

Sure, just do a loop, like "for (i=0; i=random(from,to); i++):"

The random in that place should find the last execution of the loop, and then execute the loop that quantity of times.

I don't know the actual implementation because I have not learned Python yet, but that's the basic structure of what you want to do... I guess...

Off-topic: Sorry for the bad english, still not fully awaken.