SQL Injection Presentation

SQL Injection Demo

Additionally, earlier in the year I worked with Duke’s ITSO to write up examples of good coding practices to protect against a variety of web application security issues. This referenced is linked on Duke ITSO’s site here: http://www.security.duke.edu/ITSO_Web_Application_Security_Standard_v1.pdf

To do this I used examples from here for the new File API and here for the AJAX upload. Obviously this could be expanded upon by implementing it in all three file views in Webfiles and by showing progress bars for each file. Additionally, there are some small bugs with uploading large files. However, if you are a Duke student and want to give it a try, follow the instructions below. Please note, this is a alpha version of the software, and you may run into some bugs when using it.

• Make sure you are using Firefox 3.6 Alpha – Namoroka.
• Go to our development version of Webfiles and log in.
• After you are logged in, go here to turn on the new drag and drop feature.

Please, give it a try and let me know your thoughts. Thanks.

Ethical Hacking Seminar

Duke OIT gave me the opportunity to take this hacking seminar at Duke the first week of summer.  It was definitely an extremely beginner course and I was a little disappointed to see that so much of it was just “pick the right tool and run it,” but good opportunity to dig a little deeper into network protocols and learn some new things; without a doubt was worthwhile.  If anyone reading this is as much of a beginner as I am check out things like Ettercap, nmap, and Nessus.

Duke’s AFS Online Interface – Webfiles

The past year I have been working with OIT, half doing web application security and half doing programming updating Duke’s online interface for its AFS file system, Webfiles.  Essentially, it was an attempt to make the online interface more comfortable for average users and make it most similar to Windows Explorer and OS X Finder so that using it is as intuitive as possible.  The coding was anything but beautiful, but it was a good opportunity to learn more about Javascript and play with some fun things.  General changes are that it now has an icon and outline view, drag and drop, some of the typical shortcut keys, etc. Below are some screenshots and I will try to create a demo site at some point.  I am also excited to say Duke is making all my code open source so let me know if you would like to implement it yourself.  I believe Carnegie Mellon is currently looking at deploying it on their systems, which I think is exciting.

Neutrino Physics

I just started working with Professor Chris Walter and his Neutrino Physics group.  So far, just to get into the group, I have been working on creating a plug-in for ROOT to make it read and write to a specific kind of distributed file system faster.  It has been an interesting experience getting back into C++ and a little bit of Fortran, and learning about this large project out of CERN.  I’m still finishing up the plug-in but hopefully I will be able to post the code or at least write about how to easily integrate the plug-in into ROOT when I’m done.  Not sure what I will be doing after that; I am taking classes on GEANT4 and think I will be doing monte carlo simulations of some sort for the rest of the summer, but I will write about this when I know more.

Simple Flash Cards in Python

The second reason I am here for the summer is that I need to take Spanish to fulfill Duke’s foreign language requirement.  If you actually know me, you will know that I am horrible at foreign languages and have been dreading taking these classes since I got to Duke.  It has now been two years since I last took a Spanish course, so jumping back into the language has been an interesting experience.  Also, Spanish 63 is known to be a lot of work and over the summer its so jam packed together that it is actually a good amount of work each night.  Anyway, we had our first test last Friday, and I had about 100 words of vocabulary to memorize, one of my worse skills.  So, both to procrastinate from actually studying and because I thought it could be useful, I decided to make a basic command line flash card program.  I’m trying to bit by bit pick up Python, so I used it and it was fairly simple.  The program essentially takes in a plain text file with the two sides of the flash card on one line, each side separated by a colon.  It then goes through the lines, shows you the second half of the line first, waits for you to press enter and then shows you the first half.  If you press enter again it will discard the word and go to another random word in the deck; if you type ‘x’ and then press enter it will put the word back in the stack.  Fairly basic, and the code is nothing special; probably took about 15 minutes to throw together, but it was surprisingly very useful as I could run through a lot of the vocab very fast and repeatedly. I’ll probably update it to make it a little better packaged together with proper arguments, etc. so you can check back for that.  Anyway, to run it (if you have a Mac python is installed by default and in Windows you need to do it yourself) open up a terminal and make sure you are in the folder where the code and the text file with the vocab are.  Then just type:

python flashcards.py yourvocabfile.txt

The code for flashcards.py (example vocab linked here) can be seen below:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#!/usr/bin/env python
# encoding: utf-8
 
import sys
import random
import os
 
def clearscreen(numlines=100):
    if os.name == "posix":
        # Unix/Linux/MacOS/BSD/etc
        os.system('clear')
    elif os.name in ("nt", "dos", "ce"):
        # DOS/Windows
        os.system('CLS')
    else:
        print '\n' * numlines
 
def main(argv=None):
	if argv is None:
		argv = sys.argv
	allLines = []
 
	again = 'x'
	if(len(argv) > 2):
		again = argv[2]
 
	f = open(argv[1], 'r')
	for line in f:
		allLines.append(line)
 
	clearscreen()
 
	cnt = 0
	wrong = 0
	wWords = []
	while len(allLines) > 0:
		cnt += 1
		l = allLines.pop(random.randint(0, len(allLines)-1))
		parts = l.split(":")
		p = 1
		p2 = 0
		print cnt, "(", len(allLines), "). ", parts[p]
		inp = raw_input("")
		if(inp == "exit"):
			break
		print parts[p2]
		inp = raw_input("")
		if(inp == "exit"):
			break
		if(inp == again):
			allLines.append(l)
			wrong += 1
			wWords.append(l)
		clearscreen()
	clearscreen()
 
	print "Missed ", wrong, " times"
	for line in wWords :
		print line
 
if __name__ == "__main__":
	sys.exit(main())

Again, nothing special or fancy, but seemed to work well; I guess I’ll know how effective it was when I get the test back haha. Anyway that is all for now, I may make public a post I wrote a few months ago that I never published, so check for that and I’ll write of any other things I do this summer. Also check my twitter as I post more frequently there. Time to go outside.

Above we see to simply first reference the name of the folder on your local machine to back up and then username@server address colon folder on server to back up to. And that's it. Simple and very effective. Thanks Mozy.

The second recent hacked together script I made was a basic way of batch printing. Duke has a system called E-Print, which runs basically by Line Printer Daemon (LPD) to a specific address. Any network printer set up like this. The other key requirement is that I have set my short name on my Mac to my NetID because this short name is the username that is sent through to LPD. If you have this, I create a simple AppleScript application that takes either all selected items or all files in a folder and prints them separately and in duplex with the lpr command. This script is below.

Or you can download the application here. Place this inside your applications directory, and then in Leopard you can drag it to the toolbar of Finder. I believe you also need to make sure you have the LPD printer set to your default printer. The, you can always easily batch print.

Note: You can also in command line use lp but this will combine all of the documents printed into one item on the print queue, which has its disadvantages in the Duke e-Print system. Also, I need to thank Henrik Nyh whose "Open in Textmate" script I use and worked off of for this.

As I have done before, I would like to ask Duke to push the envelope on this project. The administrators have on their hands literally hundreds of students who clearly care about this system, viewing the site within the first 24 hours of it being released and posting their opinion eagerly on their Facebook status, creating the Facebook group, and e-mailing the registrar. Both I and a rising Junior independently created webpages to build a graphical schedule despite the old system being lost, and another one of my friends told me that he was planning on doing the same thing, and now planning on helping me out to enhance mine.  Without a doubt students and teachers, want things to change and apparently are willing to put at least some thought and time into it. However here is the killer, there are too many hurdles. In the three days that the link to my schedule generator has been posted on Facebook there have been 125 visits and 160 pageviews, but only 56 graphical schedules actually generated. Why? It is a simple flaw of my site, it is pain, god knows how many clicks, to actually download the iCal file and upload it to my site as compared to the simple old system of refreshing a single page. So here is what I would like from Duke - LET us help out, just do the one thing we can't, take down the barriers. Make a system for us to easily access a logged in user's data and customize the way its displayed, let us take all of the data for all of the classes and create our own systems of searching and testing out schedules - neither of these tasks seem to be much of a privacy concern.  My friend Nick Bottenus created a system for testing out different schedules, but again it could have been far more effective if it had better site integration.  Hell, even allow students to choose other interfaces for registering for classes; take some of that load off of your servers that manage to nearly be brought down to a halt each semester on those splendid 7 AM morning rushes, always nearly as chaotic and clearly effective as the free Homecoming t-shirt give away this year.   Use the internet to its strengths, and likewise the students, and prove that Duke is a place of innovation, action, and on the forefront even in class registration.  Having a development platform for class registration, now there is something different I didn't here on a college tour.  Administrators, you have it easy, an open opportunity.  There are willing and able students who want to help, all you have to do is let us.

Update: Nick Bottenus and I have created a new version of the schedulator, enjoy: http://dukesched.ambmediadesign.com/.

Update: New version of the Schedulator and a new address: http://www.dukeSchedulator.com