Absolute Bits & Beats

Read in 2014

Waleed Abdelwahab Ali — Fri, 02 Jan 2015 01:08:00 +0000

1. The Fastlane – MJ DeMaro – 4-star
2. One up on wall-street – Peter Lynch – 3-star
3. OS internals and design principles – William Stallings – 3-star
4. Rich Dad Poor Dad – Robert Kiyosaki – 4-star
5. The Startup Playbook – David Kidder and Reid Hoffman – 3-star
6. Getting Real – 37 Signals – 4-star
7. Running Lean – Ash Maurya – 5-star
8. Algorithms in a Nutshell – George H., Gray P. and Stanley S. – 4-star
9. Delivering Happiness – Tony Hsieh – 4-star
10. A bug Hunter’s Diary – Tobias Klein – 4-star
11. The Art of Software Security Assessment – Mark Dowd, John McDonald and Justin Schuh – 2-star
12. Yes! – Noah Goldstein, Steve Martin, Robert Cialdini – 3-Star
13. Never Eat Alone – Keith Ferrazzi, Thal Raz – 4-Star
14. Basic Economics – Thomas Sowell – 3-Star
15. Functional JavaScript – Michael Fogus – 3-Star
16. Data Smart – John W. Foreman – 4-Star

Ratings: 5-Star: Must read; 1-Star: Don’t waste your time

This was the list of books I was fortunate to read last year, I hope you find them inspiring and useful.

Happy New Year!

Node.js Web Applications Security Risks – CRSF

Waleed Abdelwahab Ali — Wed, 16 Jul 2014 02:12:12 +0000

As more node.js web applications are deployed into production, the high performance gains should never come at the expense of security, it’s crucial to validate your app against the common web application vulnerabilities like the top 10 risks defined by OWASP and know how they manifest in the node.js environment.

Injection
Broken authentication and session management
Cross-site scripting (XSS)
Insecure direct object references
Security misconfiguration
Sensitive data exposure
Missing function level access
Cross-site request forgery (CRSF)
Using components with known vulnerabilities
Unvalidated redirects and forwards

In this post I will cover the node.js specific mitigation and prevention techniques against the cross-site request forgery (CRSF). A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

Before I get to the mitigation techniques used for node.js and express, let’s take a look at how to exploit a CRSF vulnerability. In this example I will use the node goat application as our target.

Assuming the victim is already logged in and the session cookie is available, an attacker that previously learned about the behavior of the authenticated areas in this application could take advantage of the victim’s session information to send a request using a forged form or using an image embedded in a linked HTML page.

For example, in this vulnerable application the victim has a form where the payroll contributions percent can be changed.

The attacker can change the victims contributions by hosting a forged form like the below. once the victim’s submits this form, a request with the user’s session information will be sent to the vulnerable application and lead to an unintended change to the victims contributions.


 
 
  
   You are about to win a brand new iPad!

   Click on the win button to claim it...

When this form is submitted, the vulnerable application will handle it as a legitimate request since it has no validation for the source of the request and it will update the victim’s contributions to the submitted values.

How to prevent this attack in Node.js web apps?

There are two easy approaches, one is using csrf middleware that’s provided with the Express (version 2 or 3) and the second is to using csurf directly as an external middleware from.

Add the CSRF module to the express app configuration, Then create a custom middleware to generate new token using req.csrfToken(); and exposes it to view by setting it in res.locals. The CSRF middleware depends on session support to save the CSRF token on the server so it has to be initialized after the session module.

app.configure(function(){
 app.set('port', process.env.PORT || 3000);
 app.set('views', __dirname + '/views');
 app.set('view engine', 'jade');
 app.use(express.favicon());
 app.use(express.logger('dev'));
 app.use(express.bodyParser());
 app.use(express.methodOverride());
 app.use(express.cookieParser('your secret here'));
 app.use(express.session());

// enable csrf protection
app.use(express.csrf());

app.use(function(req, res, next){
 res.locals.token = req.session._csrf;
 next();
});

 app.use(app.router);
 app.use(express.static(path.join(__dirname, 'public')));
});

once this is complete, a variable will be available to the templates to set a hidden form field in the your view as below:

An example for the hidden field in a form in a jade template:

form(action='/form',method='post')
 input(type='hidden', name='_csrf', value=token)
 label(for='color') Color:
 input(type='text',name='color',size='50')
 button(type='submit') Save

After we start the application and view the source of this basic form in the browser, we should see our request’s unique csrf value.


 
 Color:

The CSRF middleware will look for the CSRF token in three locations. First, it will check for a _csrf property in the request body (req.body._csrf), next it will check for it on the query string (req.query._csrf), and finally, it will check the request headers (req.headers[‘x-csrf-token’]). If any other request type is made and this csrf value is missing, the middleware will reject the request with an 403 – Forbidden status.

Express CSRF middleware ignores verifying tokens on HTTP GET, OPTIONS, and HEAD requests (which is correct) however there’s a caveat.

GET / HTTP/1.1
[..]
_method=POST

As a result, it is possible to bypass the security control by sending a GET request with a POST MethodOverride header or parameter like in the above code.

app.use(csrf()) // #1
app.use(methodOverride()) // #2
// vulnerable code!

If the methodoverride module was configured after the csrf module like above, it would lead to this vulnerability since the csrf module needs to know the method of the request first. The workaround is clearly to disable methodOverride or make sure that it takes precedence over other middleware declarations.

References:

Cross Site Request Forgery (CSRF) Tutorial

Always check CSRF token if request has body

Improves your security testing with fuzzdb

CSRF with NODEJS and EXPRESS 3

Using CSRF protection with Express and AngularJS

OWASP top ten web application risks

OWASP Node Goat Project

Top overlooked security threats to Node.js web applications

Read in 2013

Waleed Abdelwahab Ali — Tue, 31 Dec 2013 00:29:46 +0000

1. Advanced Programming in the UNIX Environment SE – Richard Stevens and Stephen Rago – 5-Star
2. API Design for C++ – Martin Reddy – 5-Star
3. Founders at work – Jessica Livingston – 4-Star
4. Version Management with CVS – Per Cederqvist – 3-Star
5. The C Programming Language – Brian Kernighan, Dennis Ritchie – 5-Star
6. The power of habit – Charles Duhigg – 3-Star
7. Permission Marketing – Seth Godin – 3-Star
8. Built to Sell – John Warrilow – 5-Star
9. The sun also rises – Ernest Hemingway – 3-Star
10. Computer Security principles and practice – Stallings – 4-Star
11. Cryptography Engineering – Ferguson, Schneier, Kohno – 3-Star
12. Counter Hack Reloaded – Skoudis, Liston – 5-Star
13. HTML5 Game Development – Jesse Freemen – 3-Star
14. Moonwalking with Einstein – Joshua Foer – 4-Star
15. JQuery Mobile up and running – Maximiliano Firtman – 5-Star
16. The $100 Starup – Chris Guillebeau – 5-Star
17. Lean Startup – Eric Ries – 4-Star
18. 4-Star – الفيل الأزرق – أحمد مراد

Ratings: 5-Star: Must read; 1-Star: Don’t waste your time

I hope you find them inspiring and useful. I have the books available if anyone wants any of them.

Happy New Year!

Built to Sell

Waleed Abdelwahab Ali — Tue, 26 Feb 2013 01:56:50 +0000

It’s been awhile since I was into a book that much. It’s not amazingly written but its story has kept me engaged from the beginning to end, every night after work, listening to its audio book on my commutes, and dedicate a full weekend for it – the weekend is priceless for a software engineer as you all might know. I highly recommend this book for all the value creators.

The book is a fictional story about Alex Stapleton, an advertising agency owner, and his struggle to convert his business into a sellable one. With the help of his friend Ted, he converts the business from a struggling one that relies too heavily upon him and a single, overly demanding client, to a highly-focused one that thrives without his constant low-level involvement.
If you’ve read many business books on the subject of entrepreneurship and management, these concepts will seem very familiar, but set in a slightly different context. Throughout the book, I felt that the content borrowed heavily from the E-Myth – who the author credits in the appendix. The important variation from E-Myth is that the owner is preparing to sell the business. Everything he does in terms of automating and streamlining the operations is done within the framework of the question: "How will this help me sell this company?"

After the story concludes, the author summarizes the key points, which seems a little redundant but helpful, along with some personal experiences. The greatest flaw of this book is that it never addresses the problems you might have at different points along this process. Again, I highly recommend this book and I hope I get the time to read again next year.

Aldostour party App, PhoneGap in action

Waleed Abdelwahab Ali — Sat, 16 Feb 2013 14:59:17 +0000

Two months ago I was invited to a meeting with the Egyptian activists and Aldostour party supporters Sherif Mansour, Zaid Salah, and Amgad Abdelhafez at one of the Egyptian cafes at the Arabic Steinway in Astoria. We were discussing our local plan, projects and activities for the upcoming months. Among other projects we agreed on initiating an effort to build a mobile app for the party and help provide another means of communication for a growing mobile user community.

The technical goals for the app development can simply be summarized in:

1. Cross platform mobile development: One codebase – easier development, testing and maintenance. The app should be Installed as a native app for as many devices as possible, this includes iOS, Android, Windows Phone, Blackberry, etc.

2. Wide contributor base: building a web-based app in a native wrapper would let us use existing expertise. Almost everyone can help with JavaScript, and web technologies. It would make it very easy for the tech volunteers to join the app dev team, add new features and help with bug fixing.

The existence of many frameworks like RhoMobile, PhoneGap, Appcelerator, Mosync, Corona, etc. – more info here – made it a little hard to pick one in the limited time we had. Based on the online reviews and recommendations, I have narrowed this down to PhoneGap and Appcelerator.

Both have a good wide range of APIs – accelerometer, GPS/location, camera, sound, etc. PhoneGap was ready for almost all available platforms with an easy and smooth cloud-based build engine, where Appcelerator was ready to support iOS and Android with a promise to support others in the future. PhoneGap looked a lot simpler for this project as it takes the HTML/CSS/JavaScript as is into a web container, however the Appcelerator analyzes and compiles it into the representative symbols of the native code and the UI is built by using the phone’s native resources which might eventually lead to writing specific code for each platform.

The App is still a work-in-progress. We are planning to release a beta version by the end of March. Please contact me @waleedeg if you would like to join the development team or know more.

Read in 2011

Waleed Abdelwahab Ali — Sat, 31 Dec 2011 23:14:31 +0000

Voyage through time – Ahmed Zeweil – 3-Star
Developer’s Workshop to COM and ATL 3.0 – Andrew W. Troelsen – 3-Star
Advanced Windows Debugging – Hewardt and Pravat – 4-Star
The Data Warehouse ToolKit – Margy Ross – 4-Star
The Google Resume – Gayle McDowell – 5-Star
Inside the Microsoft Build Engine – Sayed Hashimi – 4-Star
Learning Perl (the llama book) – Randal Schwartz – 4-Star
Large Scale C++ Software Design – John Lakos – 3-Star
Exceptional C++ – Herb Sutter – 4-Star
Into the wild – Jon Krakauer – 3-Star
The big 5-oh – Sandra D. Bricker – 2-Star
Be your own best publicist – Jessica Kleiman and Meryl Cooper – 3-Star
Automating System Administration with Perl – David Blank-Edelman – 1-Star
Windows Internals 5^th edition – Mark Russinovish – 3-Star
Emotional Intelligence 2.0 – Travis Bradberry and Jean Greaves – 2-Star
Windows via C/C++ – Jeffrey M. Richter, Christophe Nasarre – 5-Star
More Exceptional C++ – Herb Sutter – 3-Star
Programming Windows Azure – Sriram Krishnan – 4-Star
Azure in Action – Chris Hay and Brain Prince – 1-Star
Introducing HTML5 – Bruce Lawson and Remy Sharp – 3-Star
Outliers – Malcolm GladWell – 4-Star

Ratings: 5-Star: Must read; 1-Star: Don’t waste your time

This was the list of books I was fortunate to read last year, I hope you find them inspiring and useful, and maybe share yours too. I’ve the books available if you want any of them for free.

Happy New Year!

Shell extensions in c++, step by step

Waleed Abdelwahab Ali — Mon, 05 Sep 2011 08:49:04 +0000

Writing shell extensions is one of those programming tasks in which C++ (with the help of a library like ATL) excels – an MSFT explained here why it is better to avoid .NET for writing shell extensions.

Michael Dunn (a former Visual C++ MVP) wrote a very interesting series of tutorials on CodeProject on developing shell extensions, they are worth listing and sharing:

SharePoint List Web-Services, delete all items

Waleed Abdelwahab Ali — Fri, 10 Jun 2011 17:25:42 +0000

I’ve been looking for an efficient way to delete all items in a list using the SharePoint list webservice, a few friends have helped me with some good references to get it done by using CAML (@AhmedIG) or by using CSOM (Haytham), you can check them out and see if they solve the problem under your constrains, the challenging part of the problem is you usually don’t produce the item IDs for a list and just allow the SP to do the job for you, you also might discard maintaining the item IDs in your newly created or loaded items in your items collection.

In order to create the below XML batch we will need to build the delete method tags using the existing items’ IDs, so additional IDs retrieval would be required to create a single delete batch (using the GetListItems web service method, as long as we are using the SP list web-service only in our context)

   1: <Batch>

   2:   <Method ID='1' Cmd='Delete'>

   3:     <Field Name='ID'> TheMissingID Field>

   4:   Method>

   5: Batch>

The solution starts here, a method returns an ArrayList of item IDs, to be used by the batch delete method. The GetListIDs method uses the GetListItems web service method to retrieve one field only – the Item ID – of all the items in the list.

   1: public static ArrayList GetListIDs(String ListName)

   2: {

   3:     WS_TopDealLists.Lists listService = new WS_TopDealLists.Lists();

   4:     listService.Credentials =

   5:         new NetworkCredential("username", "PASS****", "domain");

   6:     listService.Url =

   7:     "http://SPServer/sites/SiteCollection/sandbox/_vti_bin/Lists.asmx";

8:

   9:     XmlDocument xmlDoc = new System.Xml.XmlDocument();

10:

  11:     XmlNode ndViewFields =

  12:         xmlDoc.CreateNode(XmlNodeType.Element, "ViewFields", "");

  13:     ndViewFields.InnerXml = "";

14:

  15:     XmlNode ndListItems =

  16:         listService.GetListItems(ListName, null, null,

  17:         ndViewFields, null, null, null);

18:

  19:     //convert String to XMLReader

  20:     XmlReaderSettings settings = new XmlReaderSettings();

  21:     settings.ConformanceLevel = ConformanceLevel.Fragment;

  22:     settings.IgnoreWhitespace = true;

  23:     settings.IgnoreComments = true;

  24:     XmlReader xmlReader =

  25:     XmlReader.Create(new StringReader(ndListItems.OuterXml), settings);

26:

  27:     ArrayList IDsList = new ArrayList();

28:

  29:     while (xmlReader.Read())

  30:     {

  31:         if (xmlReader.Name == "z:row")

  32:             IDsList.Add(xmlReader.GetAttribute("ows_ID").ToString());

  33:     }

34:

  35:     return IDsList;

  36: }

And here’s the Delete method which already takes the IDs ArrayList returned by the GetListIDs method then constructs one delete XML batch, and we’re done, all items are deleted in one shot.

   1: public static void DeleteItems(String ListName, ArrayList IDs)

   2: {

   3:     if (IDs.Count == 0)

   4:         return;

5:

   6:     WS_TopDealLists.Lists listService = new WS_TopDealLists.Lists();

   7:     listService.Credentials =

   8:     new NetworkCredential("username", "PASS****", "domain");

   9:     listService.Url =

  10:     "http://SPServer/sites/SiteCollection/sandbox/_vti_bin/Lists.asmx";

11:

  12:     string strBatch = "";

13:

  14:     foreach (String ID in IDs)

  15:     {

  16:         strBatch += "" +

  17:             "" + ID + "";

  18:     }

19:

  20:     XmlDocument xmlDoc = new System.Xml.XmlDocument();

  21:     XmlElement elBatch = xmlDoc.CreateElement("Batch");

22:

  23:     elBatch.InnerXml = strBatch;

24:

  25:     listService.UpdateListItems(ListName, elBatch);

  26: }

Technorati Tags: SharePoint,SharePoint WebServices,SharePoint Development

SharePoint List Web-Services, list item insertion

Waleed Abdelwahab Ali — Tue, 07 Jun 2011 20:12:34 +0000

A simple task as adding an item to a SharePoint list has a lot of good-to-know stuff attached to it, the first problem-solving track I toke was using the Windows SharePoint Services classes to construct objects like the SPSite, and SPWeb and for the good reasons this wouldn’t work as I’m doing some data integration processing on a remote integration service (pulling data from different sources, do some processing, and then inserting them into a SharePoint list), as the other objects will allow you to construct them if and only if the script will run on the SP host machine so there’s no other way except using the SharePoint Web-Services to access site-collection lists remotely. after digging here and there for the best way to do it, I finally created the following chuck of code on my pilot project – the code has some tips that would save you a few hours of debugging..

   1: WS_TopDealLists.Lists lists = new WS_TopDealLists.Lists();

2:

   3: // Impersonating the context to use a user with a contribute access on the list

   4: lists.Credentials = new NetworkCredential("username","PASS****","domain");

5:

   6: // This line must be included – the webservice reference already has it I know,

   7: // otherwise the GetList method will throw Exception

   8: // of type 'Microsoft.SharePoint.SoapServer.SoapServerException'.

   9: lists.Url = "http://SPServer/sites/SiteCollection/sandbox/TopDeals/_vti_bin/Lists.asmx";

10:

  11: // Use these two lines to learn about the actual static names of the list fields

  12: //XmlNode xmlNode = lists.GetList("LIST_NAME");

  13: //System.IO.File.WriteAllText("Top10.xml", xmlNode.OuterXml);

14:

  15: string strBatch = "" +

  16:     "WaleedsTitle" +

  17:     "1,000,000" +

  18:     "Technical Win" +

  19:     "TJ" +

  20:     "WaleedTMC" +

  21:     "support from the presales" +

  22:     "Running in Staging";

23:

  24: XmlDocument xmlDoc = new System.Xml.XmlDocument();

  25: XmlElement elBatch = xmlDoc.CreateElement("Batch");

26:

  27: elBatch.InnerXml = strBatch;

28:

  29: lists.UpdateListItems("LIST_NAME", elBatch);

Some helpful resources:

http://stackoverflow.com/questions/85392/sharepoint-how-do-insert-new-items-using-the-list-web-service

http://msdn.microsoft.com/en-us/library/lists.lists.updatelistitems(v=office.12).aspx

http://msdn.microsoft.com/en-us/library/lists.lists.getlist(v=office.12).aspx

http://social.msdn.microsoft.com/Forums/en/sharepointdevelopment/thread/777310c3-009f-4efd-8006-783480dd1ee8

Technorati Tags: SharePoint SharePoint WebServices SharePoint Development

Functors, Function Pointers, and Templates

Waleed Abdelwahab Ali — Mon, 25 Apr 2011 14:33:38 +0000

When it comes to writing a code library and you wish to write a function that takes both function pointers and functors then it’s the right time for you to use templates. The templated function will deduce the proper type for the functor or function pointer, and both functors and function pointers are used in the exact same way – they both look like function calls – so the code in the function will compile fine.

For example, let’s say you had this simple little find_matching_numbers function that takes a vector and returns a vector of all numbers for which a given function returns true.

   1: std::vector<int> find_matching_numbers

   2: (std::vector<int> vec, bool (*pred)(int))

   3: {

   4:     std::vector<int> ret_vec;

   5:     std::vector<int>::iterator itr = vec.begin(),

   6:     end = vec.end();

   7:     while ( itr != end )

   8:     {

   9:         if ( pred( *itr ) )

  10:         {

  11:             ret_vec.push_back( *itr );

  12:         }

  13:         ++itr;

  14:     }

  15: }

We could convert this function to allow either functors or function pointers by templating on the type of the second argument:

   1: template <typename FuncType>

   2: std::vector<int> find_matching_numbers

   3: ( std::vector<int> vec, FuncType pred )

   4: {

   5:     std::vector<int> ret_vec;

   6:     std::vector<int>::iterator itr = vec.begin(),

   7:     end = vec.end();

   8:     while ( itr != end )

   9:     {

  10:         if ( pred( *itr ) )

  11:         {

  12:             ret_vec.push_back( *itr );

  13:         }

  14:         ++itr;

  15:     }

  16: }

17: