SQL Injection Presentation

SQL Injection Demo

Additionally, earlier in the year I worked with Duke’s ITSO to write up examples of good coding practices to protect against a variety of web application security issues. This referenced is linked on Duke ITSO’s site here: http://www.security.duke.edu/ITSO_Web_Application_Security_Standard_v1.pdf

To do this I used examples from here for the new File API and here for the AJAX upload. Obviously this could be expanded upon by implementing it in all three file views in Webfiles and by showing progress bars for each file. Additionally, there are some small bugs with uploading large files. However, if you are a Duke student and want to give it a try, follow the instructions below. Please note, this is a alpha version of the software, and you may run into some bugs when using it.

• Make sure you are using Firefox 3.6 Alpha – Namoroka.
• Go to our development version of Webfiles and log in.
• After you are logged in, go here to turn on the new drag and drop feature.

Please, give it a try and let me know your thoughts. Thanks.

I am on fall break now, and will be spending the weekend at home.  Hopefully I’ll do something cool while I’m home and will post if anything comes out good.

Plane Propeller Photo from iPhone 3G

Canon SD700 IS Plane Propeller Photo

Click the image to view the video

Here is the propeller appearing to stand still. This is due to the fact that the spacing of the frames is twice the period.

The graphs below show the propeller appearing to go backwards. Here we see that the frame rate is just below two periods of the propeller. The downward slope on the radian graph is a simple quick way to see the direction of the propeller rotation.

Propeller appearing to flip repeatedly:

This example shows the propeller appearing to rotate forwards. Again, the upwards slope of the points on the radian graph is an easy way to see the direction of rotation.

Last, here is the propeller appearing to stand still again. Unlike the first case of the propeller standing still, the spacing of the frames is not a multiple of the period. Rather, we see here that it is a multiple of 1/3 the period. It is only necessary that the spacing be a multiple of 1/3 the period because there are three blades and the blades are indistinguishable.

And finally, putting it all together:

The Mathematica code can be viewed here or downloaded here, and a printout of the entire Mathematica worksheet can be found here. Last, if one had a camera which could vary the frame rate just so slightly as to find two nearest frame rates to show the propeller standing still, the frequency of the propeller could be calculated as shown below.

As for the iPhone picture, a single image (and knowing the number of blades) is enough to roughly approximate the speed of the propeller as shown below.

However, just as a warning both of these are back of the envelope calculations and it is very possible I made a mistake (if so please let me know). That is all for now. Nothing ground breaking, but as the title suggests, it was a good chance for some mental masturbation, playing with Mathematica and Matlab.

Ultimately, I became addicted to these near instant updates for new blog posts that the Jetpack extension provided.  At the same time I learned to love the fact that by default I was forced to read the title for every blog post in Reader.  Where as before in Netvibes I would never scroll through the backed up posts from Gizmodo and Engadget, Reader’s chronological ordering makes me go through each post.  Recently, this is just another case where what I think I want does not match up with what actual creates a better user experience (similar to Google’s analysis of users searching more with 10 results despite asking for as many as possible or  Dan Curtis’s explanation that we are not in control of our deicions).  Also, this reminds me of Aza Raskin’s statement “Every time you make the user make a decision they don’t care about, you have failed as a designer.”  Interestingly, Google forced me to make a harder decision than I wanted to make; where before I could avoid deciding whether or not to remove the blog by just leaving it on my page and just easily clicking away new posts with “Marking all as read,” I now had to decide to either read the post titles or make the leap to get ride of the RSS feed all together.  While I was able to be lazy before, it made for a more concrete decision and user experience.

The other thing I realized was that the Jetpack extension for Reader notifications was causing my browser to hang when I had a bad internet connection.  Sadly, living in an off campus apartment with spotty Internet this happens all too often, and I decided to disable Jetpack.  However, I missed the notifications and decided to fix the Jetpack extension.  I reworked the old extension to only perform asynchronous AJAX calls, getting rid of the browser hanging issue, and modified the extension to display notifications to show new posts by blog title, thus making the notifications more informative.  The status bar display and the new Growl notifications can be seen below.  Click here to install this extension or here to view the code.  Of course, let me know your thoughts or any bugs you run into.  Thanks.

Also, as some friends like Niru, DJ, and Marc have pointed out, I have somewhat decreased my blogging but have been posting a good number of posts on Twitter.  So of course, you should follow me on Twitter here.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

#!/usr/bin/env python
# encoding: utf-8
 
import sys
import os
import urllib
import urllib2
import base64
import time
from xml.dom import minidom
 
def twitter(twitter_username, twitter_password, message):
	request = urllib2.Request('http://twitter.com/statuses/update.json')
	request.headers['Authorization'] = 'Basic %s' % ( base64.b64encode(twitter_username + ':' + twitter_password),)
	request.data = urllib.urlencode({'status': message})
	try:
		response = urllib2.urlopen(request) # The Response
	except HTTPError, e:
		print "Error posting to twitter"
		print "HTTP Error code: ", e.code
	except URLError, e:
		print "Error posting to twitter"
		print "URLError reason: ", e.reason
 
def main():
	message = ""
	last_update = "17514";
	chromium_url = "http://build.chromium.org/buildbot/snapshots/sub-rel-mac/"
	while(True):
		try:
			response = urllib2.urlopen(chromium_url + "LATEST")
		except HTTPError, e:
			print "HTTP Error code: ", e.code
		except URLError, e:
			print "URLError reason: ", e.reason
		else:
			latest = response.read()
			print "latest: ", latest
			if(latest != last_update):
				try:
					response2 = urllib2.urlopen(chromium_url + latest + "/changelog.xml")
				except HTTPError, e:
					print "HTTP Error code: ", e.code
				except URLError, e:
					print "URLError reason: ", e.reason
				else:
					html = response2.read()
					# print html
					dom = minidom.parseString(html)
					entries = dom.getElementsByTagName("logentry") #[0].childNodes
					print "entries: ", len(entries)
					for i in range(0, len(entries)):
						link = chromium_url + latest + "/ "
						msg = entries[i].getElementsByTagName("msg")[0].firstChild.nodeValue
						num = entries[i].getAttribute("revision")
						print "Revision: ", num
						twitter("USERNAME", "PASSWORD", "Chromium Revision " + num + ": " + msg)
					last_update = latest
			time.sleep((60*2))
 
 
if __name__ == '__main__':
	main()

Play with the code or follow the twitter. Also, I decided to try a new Wordpress plugin for code so let me know what you think. Thanks.

Ethical Hacking Seminar

Duke OIT gave me the opportunity to take this hacking seminar at Duke the first week of summer.  It was definitely an extremely beginner course and I was a little disappointed to see that so much of it was just “pick the right tool and run it,” but good opportunity to dig a little deeper into network protocols and learn some new things; without a doubt was worthwhile.  If anyone reading this is as much of a beginner as I am check out things like Ettercap, nmap, and Nessus.

Duke’s AFS Online Interface – Webfiles

The past year I have been working with OIT, half doing web application security and half doing programming updating Duke’s online interface for its AFS file system, Webfiles.  Essentially, it was an attempt to make the online interface more comfortable for average users and make it most similar to Windows Explorer and OS X Finder so that using it is as intuitive as possible.  The coding was anything but beautiful, but it was a good opportunity to learn more about Javascript and play with some fun things.  General changes are that it now has an icon and outline view, drag and drop, some of the typical shortcut keys, etc. Below are some screenshots and I will try to create a demo site at some point.  I am also excited to say Duke is making all my code open source so let me know if you would like to implement it yourself.  I believe Carnegie Mellon is currently looking at deploying it on their systems, which I think is exciting.

Neutrino Physics

I just started working with Professor Chris Walter and his Neutrino Physics group.  So far, just to get into the group, I have been working on creating a plug-in for ROOT to make it read and write to a specific kind of distributed file system faster.  It has been an interesting experience getting back into C++ and a little bit of Fortran, and learning about this large project out of CERN.  I’m still finishing up the plug-in but hopefully I will be able to post the code or at least write about how to easily integrate the plug-in into ROOT when I’m done.  Not sure what I will be doing after that; I am taking classes on GEANT4 and think I will be doing monte carlo simulations of some sort for the rest of the summer, but I will write about this when I know more.

Simple Flash Cards in Python

The second reason I am here for the summer is that I need to take Spanish to fulfill Duke’s foreign language requirement.  If you actually know me, you will know that I am horrible at foreign languages and have been dreading taking these classes since I got to Duke.  It has now been two years since I last took a Spanish course, so jumping back into the language has been an interesting experience.  Also, Spanish 63 is known to be a lot of work and over the summer its so jam packed together that it is actually a good amount of work each night.  Anyway, we had our first test last Friday, and I had about 100 words of vocabulary to memorize, one of my worse skills.  So, both to procrastinate from actually studying and because I thought it could be useful, I decided to make a basic command line flash card program.  I’m trying to bit by bit pick up Python, so I used it and it was fairly simple.  The program essentially takes in a plain text file with the two sides of the flash card on one line, each side separated by a colon.  It then goes through the lines, shows you the second half of the line first, waits for you to press enter and then shows you the first half.  If you press enter again it will discard the word and go to another random word in the deck; if you type ‘x’ and then press enter it will put the word back in the stack.  Fairly basic, and the code is nothing special; probably took about 15 minutes to throw together, but it was surprisingly very useful as I could run through a lot of the vocab very fast and repeatedly. I’ll probably update it to make it a little better packaged together with proper arguments, etc. so you can check back for that.  Anyway, to run it (if you have a Mac python is installed by default and in Windows you need to do it yourself) open up a terminal and make sure you are in the folder where the code and the text file with the vocab are.  Then just type:

python flashcards.py yourvocabfile.txt

The code for flashcards.py (example vocab linked here) can be seen below:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#!/usr/bin/env python
# encoding: utf-8
 
import sys
import random
import os
 
def clearscreen(numlines=100):
    if os.name == "posix":
        # Unix/Linux/MacOS/BSD/etc
        os.system('clear')
    elif os.name in ("nt", "dos", "ce"):
        # DOS/Windows
        os.system('CLS')
    else:
        print '\n' * numlines
 
def main(argv=None):
	if argv is None:
		argv = sys.argv
	allLines = []
 
	again = 'x'
	if(len(argv) > 2):
		again = argv[2]
 
	f = open(argv[1], 'r')
	for line in f:
		allLines.append(line)
 
	clearscreen()
 
	cnt = 0
	wrong = 0
	wWords = []
	while len(allLines) > 0:
		cnt += 1
		l = allLines.pop(random.randint(0, len(allLines)-1))
		parts = l.split(":")
		p = 1
		p2 = 0
		print cnt, "(", len(allLines), "). ", parts[p]
		inp = raw_input("")
		if(inp == "exit"):
			break
		print parts[p2]
		inp = raw_input("")
		if(inp == "exit"):
			break
		if(inp == again):
			allLines.append(l)
			wrong += 1
			wWords.append(l)
		clearscreen()
	clearscreen()
 
	print "Missed ", wrong, " times"
	for line in wWords :
		print line
 
if __name__ == "__main__":
	sys.exit(main())

Again, nothing special or fancy, but seemed to work well; I guess I’ll know how effective it was when I get the test back haha. Anyway that is all for now, I may make public a post I wrote a few months ago that I never published, so check for that and I’ll write of any other things I do this summer. Also check my twitter as I post more frequently there. Time to go outside.