SQL Injection Presentation

SQL Injection Demo

Additionally, earlier in the year I worked with Duke’s ITSO to write up examples of good coding practices to protect against a variety of web application security issues. This referenced is linked on Duke ITSO’s site here: http://www.security.duke.edu/ITSO_Web_Application_Security_Standard_v1.pdf

To do this I used examples from here for the new File API and here for the AJAX upload. Obviously this could be expanded upon by implementing it in all three file views in Webfiles and by showing progress bars for each file. Additionally, there are some small bugs with uploading large files. However, if you are a Duke student and want to give it a try, follow the instructions below. Please note, this is a alpha version of the software, and you may run into some bugs when using it.

• Make sure you are using Firefox 3.6 Alpha – Namoroka.
• Go to our development version of Webfiles and log in.
• After you are logged in, go here to turn on the new drag and drop feature.

Please, give it a try and let me know your thoughts. Thanks.

Ultimately, I became addicted to these near instant updates for new blog posts that the Jetpack extension provided.  At the same time I learned to love the fact that by default I was forced to read the title for every blog post in Reader.  Where as before in Netvibes I would never scroll through the backed up posts from Gizmodo and Engadget, Reader’s chronological ordering makes me go through each post.  Recently, this is just another case where what I think I want does not match up with what actual creates a better user experience (similar to Google’s analysis of users searching more with 10 results despite asking for as many as possible or  Dan Curtis’s explanation that we are not in control of our deicions).  Also, this reminds me of Aza Raskin‘s statement “Every time you make the user make a decision they don’t care about, you have failed as a designer.”  Interestingly, Google forced me to make a harder decision than I wanted to make; where before I could avoid deciding whether or not to remove the blog by just leaving it on my page and just easily clicking away new posts with “Marking all as read,” I now had to decide to either read the post titles or make the leap to get ride of the RSS feed all together.  While I was able to be lazy before, it made for a more concrete decision and user experience.

The other thing I realized was that the Jetpack extension for Reader notifications was causing my browser to hang when I had a bad internet connection.  Sadly, living in an off campus apartment with spotty Internet this happens all too often, and I decided to disable Jetpack.  However, I missed the notifications and decided to fix the Jetpack extension.  I reworked the old extension to only perform asynchronous AJAX calls, getting rid of the browser hanging issue, and modified the extension to display notifications to show new posts by blog title, thus making the notifications more informative.  The status bar display and the new Growl notifications can be seen below.  Click here to install this extension or here to view the code.  Of course, let me know your thoughts or any bugs you run into.  Thanks.

Also, as some friends like Niru, DJ, and Marc have pointed out, I have somewhat decreased my blogging but have been posting a good number of posts on Twitter.  So of course, you should follow me on Twitter here.

Ethical Hacking Seminar

Duke OIT gave me the opportunity to take this hacking seminar at Duke the first week of summer.  It was definitely an extremely beginner course and I was a little disappointed to see that so much of it was just “pick the right tool and run it,” but good opportunity to dig a little deeper into network protocols and learn some new things; without a doubt was worthwhile.  If anyone reading this is as much of a beginner as I am check out things like Ettercap, nmap, and Nessus.

Duke’s AFS Online Interface – Webfiles

The past year I have been working with OIT, half doing web application security and half doing programming updating Duke’s online interface for its AFS file system, Webfiles.  Essentially, it was an attempt to make the online interface more comfortable for average users and make it most similar to Windows Explorer and OS X Finder so that using it is as intuitive as possible.  The coding was anything but beautiful, but it was a good opportunity to learn more about Javascript and play with some fun things.  General changes are that it now has an icon and outline view, drag and drop, some of the typical shortcut keys, etc. Below are some screenshots and I will try to create a demo site at some point.  I am also excited to say Duke is making all my code open source so let me know if you would like to implement it yourself.  I believe Carnegie Mellon is currently looking at deploying it on their systems, which I think is exciting.

Neutrino Physics

I just started working with Professor Chris Walter and his Neutrino Physics group.  So far, just to get into the group, I have been working on creating a plug-in for ROOT to make it read and write to a specific kind of distributed file system faster.  It has been an interesting experience getting back into C++ and a little bit of Fortran, and learning about this large project out of CERN.  I’m still finishing up the plug-in but hopefully I will be able to post the code or at least write about how to easily integrate the plug-in into ROOT when I’m done.  Not sure what I will be doing after that; I am taking classes on GEANT4 and think I will be doing monte carlo simulations of some sort for the rest of the summer, but I will write about this when I know more.

Simple Flash Cards in Python

The second reason I am here for the summer is that I need to take Spanish to fulfill Duke’s foreign language requirement.  If you actually know me, you will know that I am horrible at foreign languages and have been dreading taking these classes since I got to Duke.  It has now been two years since I last took a Spanish course, so jumping back into the language has been an interesting experience.  Also, Spanish 63 is known to be a lot of work and over the summer its so jam packed together that it is actually a good amount of work each night.  Anyway, we had our first test last Friday, and I had about 100 words of vocabulary to memorize, one of my worse skills.  So, both to procrastinate from actually studying and because I thought it could be useful, I decided to make a basic command line flash card program.  I’m trying to bit by bit pick up Python, so I used it and it was fairly simple.  The program essentially takes in a plain text file with the two sides of the flash card on one line, each side separated by a colon.  It then goes through the lines, shows you the second half of the line first, waits for you to press enter and then shows you the first half.  If you press enter again it will discard the word and go to another random word in the deck; if you type ‘x’ and then press enter it will put the word back in the stack.  Fairly basic, and the code is nothing special; probably took about 15 minutes to throw together, but it was surprisingly very useful as I could run through a lot of the vocab very fast and repeatedly. I’ll probably update it to make it a little better packaged together with proper arguments, etc. so you can check back for that.  Anyway, to run it (if you have a Mac python is installed by default and in Windows you need to do it yourself) open up a terminal and make sure you are in the folder where the code and the text file with the vocab are.  Then just type:

python flashcards.py yourvocabfile.txt

The code for flashcards.py (example vocab linked here) can be seen below:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#!/usr/bin/env python
# encoding: utf-8
 
import sys
import random
import os
 
def clearscreen(numlines=100):
    if os.name == "posix":
        # Unix/Linux/MacOS/BSD/etc
        os.system('clear')
    elif os.name in ("nt", "dos", "ce"):
        # DOS/Windows
        os.system('CLS')
    else:
        print '\n' * numlines
 
def main(argv=None):
	if argv is None:
		argv = sys.argv
	allLines = []
 
	again = 'x'
	if(len(argv) > 2):
		again = argv[2]
 
	f = open(argv[1], 'r')
	for line in f:
		allLines.append(line)
 
	clearscreen()
 
	cnt = 0
	wrong = 0
	wWords = []
	while len(allLines) > 0:
		cnt += 1
		l = allLines.pop(random.randint(0, len(allLines)-1))
		parts = l.split(":")
		p = 1
		p2 = 0
		print cnt, "(", len(allLines), "). ", parts[p]
		inp = raw_input("")
		if(inp == "exit"):
			break
		print parts[p2]
		inp = raw_input("")
		if(inp == "exit"):
			break
		if(inp == again):
			allLines.append(l)
			wrong += 1
			wWords.append(l)
		clearscreen()
	clearscreen()
 
	print "Missed ", wrong, " times"
	for line in wWords :
		print line
 
if __name__ == "__main__":
	sys.exit(main())

Again, nothing special or fancy, but seemed to work well; I guess I’ll know how effective it was when I get the test back haha. Anyway that is all for now, I may make public a post I wrote a few months ago that I never published, so check for that and I’ll write of any other things I do this summer. Also check my twitter as I post more frequently there. Time to go outside.

Unlike most of the posts from last November, I am not enraged at some sort of loss of privacy, not even annoyed that is on my Facebook Mini-Feed; it’s kind of cool actually in light of the new commenting features.  However, I am still at a loss of how Fandango was able to do this.  As far as I’ve seen in the standard Facebook API, to at all interact with Facebook at least requires the user’s approval of the application or website before the data is sent.   Also, Facebook Connect is not out yet (unless that was Beta testing).  And, although Facebook Beacon can still be found on the developer’s website, there is no way to use it other than send Facebook an e-mail and hope for a response (which I did a few months ago to no avail).  So, I am still a bit at a loss as to how Fandango has this privileged access into Facebook and more importantly – when can everyone else use it?

On a side note since I am posting this a day late – Wanted was awesome.

Anyway, regardless of the poor GUI congruity, I would like to discuss the API.  The site has a few public libraries at first appearance, and I must hand it to Adobe that their Java library looks extremely clean and easy to use.  But the Python library – not even a library, although probably the easiest reading of all of their online documentation.  The writer of the blog even states that he has given up and decided to use the Java library -  encouraging.  Anyway, disappointed in not even an attempt at a PHP implementation, I decided to give it a shot.  I essentially went as far as the writer of the Python blog post: authenticate, get sessionid, and get a list of files you have on your account.  (Note this requires PEAR’s HTTP_Request package.) Also, I know this is very ugly code and I’m possitive could and should be done much cleaner.  However, it works if your just trying to take the first steps and get some output.  If anyone wants to clean it up or continue on with a PHP implementation, feel free and let me know how it goes.  However, until they open up the platform to worthwhile features, it is sadly not worth my time.  Hopefully Adobe soon realizes the mistake of being so possessive and thinks a little more creatively about how to monetize their technology.  Anyway, here is the code; enjoy:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

< ?php
$acrobat_api_key = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
$acrobat_shared_secret = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
$acrobat_base_url = "https://api.share.acrobat.com/webservices/api/v1/";
$acrobat_username = "your_username@somecompany.com";
$acrobat_password = "your_acrobat.com_password";
 
function getAuthToken()
{
	global $acrobat_api_key, $acrobat_shared_secret, $acrobat_base_url, $acrobat_password, $acrobat_username;
	$a = new HTTP_Request();
	$a->setURL($acrobat_base_url."auth/");
	$a->setMethod("POST");
	$time = time();
	$data = "POST https://api.share.acrobat.com/webservices/api/v1/auth/ ".$time;
	$md5 = md5($data.$acrobat_shared_secret);
	$auth = "AdobeAuth apikey=\"".$acrobat_api_key."\",data=\"".$data."\",sig=\"".$md5."\"";
	$request_body = "<request>\n<username>".$acrobat_username."</username>\n<password>".$acrobat_password."</password>\n</request>";
	$a->addHeader("Authorization", $auth);
	$a->setBody($request_body);
	$a->sendRequest();
	$xml = $a->getResponseBody();
	$regex = "<authtoken>[a-zA-Z0-9]+</authtoken>";
	$i = ereg($regex, $xml, $matches);
	$p = xml_parser_create();
	$i = xml_parse_into_struct($p, $matches[0], $vals, $index);
	$j = xml_parser_free($p);
	return $vals[0]['value'];
}
function getSession($auth_token)
{
	global $acrobat_api_key, $acrobat_shared_secret, $acrobat_base_url;
	$a = new HTTP_Request();
	$a->setURL($acrobat_base_url."sessions/");
	$a->setMethod("POST");
	$time = time();
	$data = "POST https://api.share.acrobat.com/webservices/api/v1/sessions/ ".$time;
	$md5 = md5($data.$acrobat_shared_secret);
	$auth = "AdobeAuth apikey=\"".$acrobat_api_key."\",data=\"".$data."\",sig=\"".$md5."\"";
	$request_body = "<request>\n<authtoken>".$auth_token."</authtoken>\n</request>";
	$a->addHeader("Authorization", $auth);
	$a->setBody($request_body);
	$a->sendRequest();
	$xml = $a->getResponseBody();
 
	$regex = "<sessionid>[a-zA-Z0-9]+</sessionid>";
	$i = ereg($regex, $xml, $matches);
	$p = xml_parser_create();
	$i = xml_parse_into_struct($p, $matches[0], $vals, $index);
	$j = xml_parser_free($p);
 
	$regex = "<secret>[a-zA-Z0-9]+</secret>";
	$i = ereg($regex, $xml, $matches2);
	$p = xml_parser_create();
	$i = xml_parse_into_struct($p, $matches2[0], $vals2, $index);
	$j = xml_parser_free($p);
 
	$response[0] = $vals[0]['value'];
	$response[1] = $vals2[0]['value'];
 
	return  $response;
}
function getList($session, $secret)
{
	global $acrobat_api_key, $acrobat_shared_secret, $acrobat_base_url;
	$a = new HTTP_Request();
	$a->setMethod("GET");
	$time = time();
	$data = "GET /webservices/api/v1/dc/ apikey=".$acrobat_api_key." calltime=".$time." sessionid=".$session;
	$md5 = md5($data.$secret);
	$url = $acrobat_base_url."dc/?apikey=".$acrobat_api_key."&calltime=".$time."&sessionid=".$session."&sig=".$md5;
	$a->setURL($url);
	$a->sendRequest();
	$xml = $a->getResponseBody();
	return $xml;
}
$auth = getAuthToken();
$response = getSession($auth);
$session = $response[0];
$secret = $response[1];
echo getList($session, $secret);
?>