Linux & Web Development Geek - Tips & Tricks

Best Linux Security Tools 2016

2016-05-12T05:45:00.002+05:00

Always trying for a more robust tool to assist you in your work?

If there's one web site UN agency is aware of what's happening within the field of security tools, it is ToolsWatch. The site covers new tools, and promotes existing projects once they unharness a brand new version.

Here is the list of Best Security Auditing Tools so far:

01 – OWASP ZAP – Zed Attack Proxy Project (+5↑)
02 – BeEF – The Browser Exploitation Framework (+7↑)
03 – IDA Pro (NEW)
04 – Faraday (NEW)
05 –Lynis (+4↑)
06 – Burp Suite (NEW)
07 – PeStudio (-1↓)
08 – Nmap (+6↑)
09 – Haka (NEW)
10 – OWASP Offensive (Web) Testing Framework (-2↓)
11– NESSUS Vulnerbility Scanner (+10↓)
12– METASploit Framework (Best so Far) (+12↓)

Got some more? Drop comments! Also let me know which tools you want me to write tutorials about, i will be writing detail tutorials on those tools :)

Best

How to Check if a URL is UP?

2012-10-11T15:18:00.000+05:00

So in this small quick tutorial i am going to tell you a very short way to determine weather a website is up or not? We will be using the PHP's cURL library in order to determine so.

So lets start:

function urlUP($url){
  //Validate the URL first!
  if(filter_var($url,FILTER_VALIDATE_URL)){
$handle = curl_init(urldecode($url));
curl_setopt($handle,  CURLOPT_RETURNTRANSFER, TRUE);
$response = curl_exec($handle);
$httpCode = curl_getinfo($handle, CURLINFO_HTTP_CODE);
if($httpCode >= 200 && $httpCode < 400){
return true;
}else{
return false;
}
curl_close($handle);
}

  }

This is the function we will be actually using, Lets break it down!

We validate the URL through filter_var().
Open the cURL handle for our URL.
Set option in cURL to receive the incoming.
Execute the handle.
Get the HTTP code response for the executed handle.
If HTTP Response code is greater than or equal to 200 (200 stands for Ok) or its shorter than 400, this means website is up, return true.
Else return false,so that means the website is down.
Close the cURL handle!

To use the function you have to do the following:

if urlUP("http://geeks-wiki.blogspot.com"){
echo "The website is currently UP!";
}else{
echo "The website is Down!";
}

Use the code freely and leave comments, additionally you can tweak the code as well, or you can also get the HTTP Codes, match them with an array of HTTP Codes and get the specific response as well!

♥ Happy Coding! ♥

Source: https://www.stackflair.com/curl-error0-in-php/

Best way to Avoid MySQL injection in PHP

2012-10-06T23:38:00.001+05:00

SQL Injection, a commonly method used by majority of hackers and which is the cause for about 70% of the hack's all over the cyber warfare. Mostly hacker uses this (mysql injection) vulnerability to exploit the website and gain access to the server thus through Admin panel or obtain the sensitive information including Credit Cards etc as well.

SQL Injections are Common nowadays!

So here i am going to explain you the best practices you should do while writing code!
First of all keep it in mind, never ever trust a user's input, you are on to your own! So it is the very first thing to keep in mind that whatever a user sends, intentionally or unintentionally, if it is not properly sanitized and exploits a vulnerability which could be possibly a MySQL injection or even a XSS attack, could let hackers give a way to intrude.

Bullet Points:

When you are going to embed strings in HTML for example when you "print" or when you "echo" you should default to escape the string using htmlspecialchars(); .
Never trust user's input, always sanitize the user input by first sanitizing it properly and before performing any SQL query, this can be achieved by mysql_real_escape_string($parameter).Where $parameter is the input you are about to filter.
Disable Magic Quotes.
Use prepared statements and parameterized queries, always filter the user inputs properly,thoroughly and strictly.
Don't through mysql_error() to the user,don't even let them know something happened out there,most of the people use it like, die(mysql_error()); . Instead of just throwing this error straight away to the user you can write your custom messages, prepare some log files or even create a mail() function so you get notified whenever someone tries to pull something off the routine.
Log,Log,Log, always log the errors and warning messages, turn off error reporting on live websites and enable only when debugging or during development process or testing phases.
Be Self-Aware, never give up, always try up-to-date security precautions, create difficult random passwords for database, encrypt all the user's information in the database and set a value of 666 to the files which contains configuration for mySQL access.
Keep your server patched and updated, use only latest software's, if you are on a shared hosting server, and find something which is not fine, notify the Administrator.
If you are using some software's like WordPress,Joomla,Drupal or any other free and open-source or even other software's,keep them updates, most of these products have built-in update notifiers in the Admin panel's and most of the time they update themselves with a single click.

Best way to Avoid MySQL Injections.

You basically have two options to achieve this:

Using PDO:

$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');

$stmt->execute(array(':name' => $name));
foreach ($stmt as $row) {
    // do something with $row
}

Using mysqli:

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name);

$stmt->execute();

$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // do something with $row
}

PDO

Note that when using PDO to access a MySQL database real prepared statements are not used by default. To fix this you have to disable the emulation of prepared statements. An example of creating a connection using PDO is:

$dbConnection = new PDO('mysql:dbname=dbtest;host=127.0.0.1;charset=utf8', 'user', 'pass');

$dbConnection->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$dbConnection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

In the above example the error mode isn't strictly necessary, but it is advised to add it. This way the script will not stop with a Fatal Error when something goes wrong. And gives the developer the chance to catch any error(s) (which are throwed as PDOExceptions.

What is mandatory however is the setAttribute() line, which tells PDO to disable emulated prepared statements and use real prepared statements. This makes sure the statement and the values aren't parsed by PHP before sending it the the MySQL server (giving a possible attacker no chance to inject malicious SQL).

Although you can set the charset in the options of the constructor it's important to note that 'older' versions of PHP (< 5.3.6) silently ignored the charset parameter in the DSN.

Explanation

What happens is that the SQL statement you pass to prepare is parsed and compiled by the database server. By specifying parameters (either a ? or a named parameter like :name in the example above) you tell the database engine where you want to filter on. Then when you call execute the prepared statement is combined with the parameter values you specify.

The important thing here is that the parameter values are combined with the compiled statement, not a SQL string. SQL injection works by tricking the script into including malicious strings when it creates SQL to send to the database. So by sending the actual SQL separately from the parameters you limit the risk of ending up with something you didn't intend. Any parameters you send when using a prepared statement will just be treated as strings (although the database engine may do some optimization so parameters may end up as numbers too, of course). In the example above, if the $name variable contains 'Sarah'; DELETE * FROM employees the result would simply be a search for the string "'Sarah'; DELETE * FROM employees", and you will not end up with an empty table.

Another benefit with using prepared statements is that if you execute the same statement many times in the same session it will only be parsed and compiled once, giving you some speed gains.

Oh, and since you asked about how to do it for an insert, here's an example (using PDO):

$preparedStatement = $db->prepare('INSERT INTO table (column) VALUES (:column)');

$preparedStatement->execute(array(':column' => $unsafeValue));

Any comments are welcome :) Share your practices with me as well.

♥ Happy Coding ♥

How to Validate a URL in PHP? [Easy]

2012-10-06T19:41:00.001+05:00

Starting from PHP 5.2 we have bunch of built-in functions which makes it easier for programmers to perform small functions without writing up code for them,one of such function is filter_var(); , using filter_var().

We can validate emails and URL's easily with just a few steps or you can say only 4-5 lines of code, so lets say you want to validate a URL using filter_var() you can do it as follow:

function checkurl($url)
return filter_var($url, FILTER_VALIDATE_URL);
}

To use this function simply use the following code :

  if(checkurl("http://www.google.com")) {
  echo 'URL is correct';
  //continue....
  }else{
  echo 'URL is incorrect';
  //through an error!
  }

Simple isn't? And if you don't want to use the complete function,you can simply use the filter_var("Your URL here!", FILTER_VALIDATE_URL); .

Comments are welcome, and once more you must have PHP >= 5.2.

♥ Happy Coding.! ♥

PHP Get time difference in Hour,Minutes or Seconds.

2012-10-06T19:08:00.002+05:00

Starting from PHP 5.3,it has became so much easy for the programmers to code less and get more because of the in-built classes that came with it.One of from those classes is the DateTime() class which made it lot more easier for using it in many different ways,one of the most required technique from this class is getting the difference of time in Years,months,days,hours or even seconds :).

So lets start, we have a scenario that we want to actually get the difference between a past date,suppose a past date you want to compare it with the current date, initiate the class:

$today = new DateTime(date('y-m-d h:m:s'));

First we need to get the today's time, Year-Month-Date Hour:Minute:Seconds , so in this way we can totally compare the past time and get the actual difference in every possible way :). Next,

$pastDate = $today->diff(new DateTime('2012-09-11 10:25:00'));

Next we are going to compare the past time with the current, so using the DateTime()'s method diff() , since $pastDate is a DateInterval object.

Now you can get the years,months,days,hours or minutes and vice versa, by the following method:

echo $pastDate->y; //return the difference in Year(s).
echo $pastDate->m; //return the difference in Month(s).
echo $pastDate->d; //return the difference in Day(s).
echo $pastDate->h; //return the difference in Hour(s).
echo $pastDate->i; //return the difference in Minute(s)
echo $pastDate->s; //return the difference in Second(s).

So, now you can actually get the total difference in anyway you want,even in seconds.
Comments are welcome, hope you have learnt these small tricks,and in a way they are allot more helpful!

♥ Happy Coding! ♥

PHP Get Process Creation Time.

2012-10-04T23:55:00.001+05:00

So, this is a very quick and dirty method that i am going to tell you today, actually whenever on windows platform if you need to get the time of when is a certain process is created, actually nobody needs it that much only but if you are creating system layered applications with PHP and are going deep inside digging through the WinCOM Objects.
Anyway, i won't recommend this method but may be any of you finds it useful in any scenarios,so here we go:

First of all you need to know, what actually are you trying to achieve,the process in Windows can be accessed using two ways, either by using the PID (Process Identifier) or the name (Image Name). So i will tell you the both ways you can actually get to that by how, here is the code :

$pid = "9252";$wmi = new COM('winmgmts://'); $process = $wmi->ExecQuery("SELECT * FROM Win32_Process WHERE ProcessId ='".$pid."'"); $pDate = floor($process->CreationDate); $formatDate = date_parse($pDate);$time = $formatDate['hour'].':'.$formatDate['minute'].':'.$formatDate['second'];print $time;

So, what is actually happening above, its quite simple, i am using COM objects with PHP, even though you should use them with great precautions because they can be huge security risk if exploited so you should have to be really careful playing around with these.

Just change the $pid = "9252"; to any PID you like,and if you want to know the process creation time using its name,than it is quite simple as well, just change the ProcessId with ProcessName in $wmi->ExecQuery("SELECT * FROM Win32_Process WHERE ProcessId ='".$pid."'"); and you are good to go.

There could be many more methods out but i used this one for my own usage and it quite helped me. But as before i would recommend you to thoroughly tighten the security if you are using COM objects on Enterprise level.

Happy Coding!

Fix PHP FATAL Memory Error, Allowed Maximum Size of X bytes Exhausted... [Solution]

2012-10-03T12:52:00.001+05:00

Today while processing PNG images in one of my script, i came across this error:

Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 7680 bytes) in image.php on line 33.

So, i thought may be i need to set the memory to somehow really high, as i am using a fairly decent laptop as my development environment with 8 GB of RAM backed by Core i5 SandyBridge processor, so i didn't wasted another second and added the following line to the top of my script :

ini_set("memory_limit" , "1024M");

I know this could be insane,but i was a bit in the flow of coding so i didn't care, amazingly this DIDN'T SOLVED THE PROBLEM. I was totally blank, and i was like, how could this be possible? I mean i know i am processing fairly big enough PNG images which are direct from DSLR but that shouldn't matter, the same images which are same in resolution but in JPEG are working fine. I thought may be this limit isn't working through the script, so i corrected the limit in php.ini. Amazingly, this either didn't solved the problem itself.

After allot of struggle with this, i just tried to relax myself, and said to myself " I need to do something really tricky here!".

So finally i ended up with following line:

ini_set("memory_limit" , "-1");

To my surprise, this solved the issue instantaneously and my script worked even better, so i thought it may have some draw back issues on my CPU usage, but i monitored the CPU and RAM usage and it didn't went that up as i expected. But who cares for these things when you actually achieve your goal.

So, what does this actually do? This actually tells PHP to override all the memory limits and use as much memory as possible, this won't eat that much memory but it will if you use fairly large images, i was actually processing 8MP.

Keep in mind that huge memory limits can crush your server, and those scripts which run frequently and poorly coded can be a serious pain in rear for daily uses as they may be slow/sluggish and can even cause server crash as well, so use this with caution, as i am on development platform so i didn't care about this, but if you are going to use this trick on other platform other than that of development,this might cause you severe problems as well. So code neat, be clear to yourself, avoid unnecessary code blocks and be simple and straight forward for it.

At last i would say that, everything you go onto, just give it a try,actually you learn only when you take risks, so its better to try many things, "Practice makes a man perfect.".
Keep this motto in your mind, be positive for yourself and don't worry about what might other think about your coding standards because everyone lives for themselves, so do your code. Comments are welcome, let me know your solutions about this.

This isn't just for image processing but you can use it though at any stage, but first try to allocate the similar sizes of memory like , 32M , 64M, 96M to 256M or even 512M. But make sure to debug your script and know at which stage is it consuming the most of the memory, so you can actually know what is causing it to hog.

♥ Happy Coding ♥

PHP - a Billionaire's Choice.

2012-10-01T15:16:00.001+05:00

PHP which came into existence 17 years ago, in 1995 when Rasmus Lerdorf created a script from Perl known as ''Personal Homepage Tools'' was not the first to the ground for dynamic scripting.

The programming language took height when PHP 4 was initially released in 2000 and than became a star when PHP 5 was introduced in 2004 followed by the powerful Zend Engine.PHP became the choice for programmers rapidly due to its flexibility in coding and speed of parsing and the choice of extensions which totally boosted PHP's ground market and somehow defeating the major Competitors, ASP- Active Server Pages, which was the some-how similar to PHP or you can say PHP was similar to ASP but PHP was developed by using a mixture of different tastes of many languages, like Perl and Python to the C.

Many popular companies choose'd PHP, the major example is Facebook and Yahoo!. Just because of its flexibility and freedom to code.PHP became popular because it was open-source so you can download the source, tweak it according to your needs, remove any bloat stuff, keep the necessary things within and so on.

The cross-platform independent language became so popular that now-a-days its first of the choice by any newbie web designer / developer / programmer, just because its so fun and easy to learn through its every step.

This giant scripting language has the footholds on any operating system,no matter if it is *inx/Windows/Mac , you have the choice, choose Mac and get the PHP-Packages, install it , choose your favorite code editor program and start coding.

Learning PHP is so simple, you have allot of tutors out there who can teach you for free, i mean seriously, every time you face a problem or you need to know "What is this stuff for?" you have a complete bible written over there at www.php.net with full manuals and most of all the comments below every manual helps you understand the basics and advanced techniques as well.

When i first started to learn PHP, i didn't knew HTML properly, seriously, I don't! But wait, i went through www.w3schools.com , it was back in 2005. I learned PHP and at that time i was totally new to coding, and i feel no shame in saying so that i am still in a process of learning,but while in the process of learning i came to know allot of things, the most of all is the Linux's Terminal, Yeah... you read it right, the Linux's Terminal, i learned allot of commands for it while compiling the PHP's source under ubuntu and than fedora.

Anyway, i just created this Blog to share everything i have learnt so far, and i hope so that you guys, if any read this, will surely comment about all this :)

Best.