SQL Injection at Duke TechExpo 2009

Alex — Mon, 12 Oct 2009 19:56:07 +0000

I gave my first public talk today at Duke’s TechExpo 2009. I along with my coworker Artem Kazantsev discussed the risks of SQL Injection. The presentation gives a good overview of the capabilities of SQL injection along with how to prevent such vulnerabilities. I also gave a demo of performing a SQL injection attack on a vulnerable site during the talk. For any web programmers who aren’t familiar with SQL injection, take a look at the code for the demo to see exactly how and why it is vulnerable, along with how to fix these vulnerabilities.

SQL Injection Presentation

SQL Injection Demo

Additionally, earlier in the year I worked with Duke’s ITSO to write up examples of good coding practices to protect against a variety of web application security issues. This referenced is linked on Duke ITSO’s site here: http://www.security.duke.edu/ITSO_Web_Application_Security_Standard_v1.pdf

PHP and Acrobat.com

Alex — Fri, 06 Jun 2008 01:36:46 +0000

A good while ago I heard about Adobe acquiring Buzzword, which was quite exciting since it definitely seemed like the most clean of the up and coming online document editing software. Finally, just last week Adobe released a public beta of a suite of Buzzword, Share, and other online editing tools to go along with their release of Adobe Acrobat 9. So, of course, I signed up, played around a bit before going to work in the morning and took a quick peek at the Share API. Well to jump to the point, I am excited at the possibilities but disappointed in Adobe. For a company that is usually solid in their product releases, this is very beta. As I read in another blog post, there is no continuity to the suite. As a matter of fact, why is it even a suite? The multiple features available at Acrobat.com should be implemented together. And, rather than worrying so much about their value, open the features up more. 5 PDFs per month? Really? Anybody that can use Google can find infinite other ways to convert their documents to PDF. My final complaint is that the flash viewer used to share the documents is atrocious. It is impossible to actually read any documents with it. Adobe has beautiful flash paper and again by trying to retain value will just kill itself off in the face of newer compartively open formats like Scribd’s iPaper (just a hack of Flashpaper but at least more accessible conversion).

Anyway, regardless of the poor GUI congruity, I would like to discuss the API. The site has a few public libraries at first appearance, and I must hand it to Adobe that their Java library looks extremely clean and easy to use. But the Python library – not even a library, although probably the easiest reading of all of their online documentation. The writer of the blog even states that he has given up and decided to use the Java library - encouraging. Anyway, disappointed in not even an attempt at a PHP implementation, I decided to give it a shot. I essentially went as far as the writer of the Python blog post: authenticate, get sessionid, and get a list of files you have on your account. (Note this requires PEAR’s HTTP_Request package.) Also, I know this is very ugly code and I’m possitive could and should be done much cleaner. However, it works if your just trying to take the first steps and get some output. If anyone wants to clean it up or continue on with a PHP implementation, feel free and let me know how it goes. However, until they open up the platform to worthwhile features, it is sadly not worth my time. Hopefully Adobe soon realizes the mistake of being so possessive and thinks a little more creatively about how to monetize their technology. Anyway, here is the code; enjoy:

^?View Code PHP

< ?php
$acrobat_api_key = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
$acrobat_shared_secret = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
$acrobat_base_url = "https://api.share.acrobat.com/webservices/api/v1/";
$acrobat_username = "your_username@somecompany.com";
$acrobat_password = "your_acrobat.com_password";
 
function getAuthToken()
{
	global $acrobat_api_key, $acrobat_shared_secret, $acrobat_base_url, $acrobat_password, $acrobat_username;
	$a = new HTTP_Request();
	$a->setURL($acrobat_base_url."auth/");
	$a->setMethod("POST");
	$time = time();
	$data = "POST https://api.share.acrobat.com/webservices/api/v1/auth/ ".$time;
	$md5 = md5($data.$acrobat_shared_secret);
	$auth = "AdobeAuth apikey=\"".$acrobat_api_key."\",data=\"".$data."\",sig=\"".$md5."\"";
	$request_body = "\n".$acrobat_username."\n".$acrobat_password."\n";
	$a->addHeader("Authorization", $auth);
	$a->setBody($request_body);
	$a->sendRequest();
	$xml = $a->getResponseBody();
	$regex = "[a-zA-Z0-9]+";
	$i = ereg($regex, $xml, $matches);
	$p = xml_parser_create();
	$i = xml_parse_into_struct($p, $matches[0], $vals, $index);
	$j = xml_parser_free($p);
	return $vals[0]['value'];
}
function getSession($auth_token)
{
	global $acrobat_api_key, $acrobat_shared_secret, $acrobat_base_url;
	$a = new HTTP_Request();
	$a->setURL($acrobat_base_url."sessions/");
	$a->setMethod("POST");
	$time = time();
	$data = "POST https://api.share.acrobat.com/webservices/api/v1/sessions/ ".$time;
	$md5 = md5($data.$acrobat_shared_secret);
	$auth = "AdobeAuth apikey=\"".$acrobat_api_key."\",data=\"".$data."\",sig=\"".$md5."\"";
	$request_body = "\n".$auth_token."\n";
	$a->addHeader("Authorization", $auth);
	$a->setBody($request_body);
	$a->sendRequest();
	$xml = $a->getResponseBody();
 
	$regex = "[a-zA-Z0-9]+";
	$i = ereg($regex, $xml, $matches);
	$p = xml_parser_create();
	$i = xml_parse_into_struct($p, $matches[0], $vals, $index);
	$j = xml_parser_free($p);
 
	$regex = "[a-zA-Z0-9]+";
	$i = ereg($regex, $xml, $matches2);
	$p = xml_parser_create();
	$i = xml_parse_into_struct($p, $matches2[0], $vals2, $index);
	$j = xml_parser_free($p);
 
	$response[0] = $vals[0]['value'];
	$response[1] = $vals2[0]['value'];
 
	return  $response;
}
function getList($session, $secret)
{
	global $acrobat_api_key, $acrobat_shared_secret, $acrobat_base_url;
	$a = new HTTP_Request();
	$a->setMethod("GET");
	$time = time();
	$data = "GET /webservices/api/v1/dc/ apikey=".$acrobat_api_key." calltime=".$time." sessionid=".$session;
	$md5 = md5($data.$secret);
	$url = $acrobat_base_url."dc/?apikey=".$acrobat_api_key."&calltime=".$time."&sessionid=".$session."&sig=".$md5;
	$a->setURL($url);
	$a->sendRequest();
	$xml = $a->getResponseBody();
	return $xml;
}
$auth = getAuthToken();
$response = getSession($auth);
$session = $response[0];
$secret = $response[1];
echo getList($session, $secret);
?>

Mental Masturbation, Musings, and Methods » PHP

SQL Injection at Duke TechExpo 2009

PHP and Acrobat.com