Using SSI effectively

Server Side Includes (SSI) is a simple interpreted server-side scripting language. SSI is mainly used to include files inside other files, much like PHP includes.

Simple include:
File: main.html

Using variables to include files:
File: main.html

Passing variables to create dynamic includes using SSI and JavaScript:
File: main.html

File: /inc/header.inc

Apache includes can also do a number of other interesting bits and pieces.

Displaying dates:

I have always used PHP includes in my own work but since starting my new job we do not have access to such technology and therefore have been forced to use SSI. I was wondering how the performance would differ between the two methods. There was some debate on the matter but little in the way of facts and figures. I did find one interesting point which was:

“using PHP is more efficient than using SSI because SSI is still forking a separate CGI process where PHP is not, assuming PHP is integrated as a module on the web server, not run as a CGI.”

This seemed interesting but either way any differences would be negligible and it appears no body has any definitive proof to which is faster.. Never the less there is no doubt that PHP is more powerful and flexible and for this reason I would not consider changing to SSI.

Setting default monitor for Ubuntu

When using dual screen the gnome panels automatically get attached to the default monitor. If you have something like nvidia x-config you can easily change this using their software, but what if you don’t?

Open up a new terminal window and enter:

This will display which devices are currently connected, now decide which one of these is the monitor you want to set to default. Now enter:

Replacing [monitor] with the device you chose in the first step. Now your panels should magically move to your new default monitor.

Andrew Martin at ubuntuforums wrote a quick bash script to semi-automate this process. Copy the code below and save it with the file extension .sh. Now set this file as executable and away you go.

Creating JSON Objects with Android

After starting a new project utilizing Android and a server written in C++ I noticed that although Android has a built in JSON library there is little to no information about how to implement anything useful. The majority of responses online point users to using an additional library such as GSON. This is all well and good, but I only needed minimal functionality…converting JSON to HashMaps and vice versa.

Here is the first draft of my JSON class. With static methods to convert Map to JSONObject and the other way around, of any depth.

Implementing VLC support in Java

How to Add Bash Completion in Debian

Now simply add the following to /etc/profile to enable it system wide or ~/.bash_profile for a certain user.

Installing ZNC (IRC Bouncer)

A BNC (short for bouncer) is a piece of software that is used to relay traffic and connections in computer networks, much like a proxy. Using a BNC allows a user to hide the original source of the user’s connection, providing privacy as well as the ability to route traffic through a specific location. A BNC can also be used to hide the true target to which a user connects.

Use of an IRC Bouncer has many of the same advantages as using irssi and screen but with the major difference of being able to use any client. An IRC Bouncer allows registered users to connect to a server which then relays this information to the target IRC server. Thus hiding the users IP address from the server, also it means that the user can be permanently logged in and the bouncer log the conversation for when the user returns.

ZNC is a fully featured BNC written in C++ and licensed under the GNU General Public License. It has support for both SSL and IPv6. Installing ZNC is very easy, being available in the app repository of most common linux distros.

One thing to note for Debian Stablehttp://www.backports.org is recommended, even this is very simple. Add the following line to your sources.list found at /etc/apt/sources.list

then…

After it has installed correctly, we need to configure it:

Work through the questions, I installed one global module, webadmin, which allows you to control your BNC from a nice web interface. As for user modules I loaded kickrejoin and nickserv…nickserv allows the users to identify against the servers nickserv.

At the end of the instillation it would show you how to connect to your BNC:

[ ** ] To connect to this znc you need to connect to it as your irc server
[ ** ] using the port that you supplied. You have to supply your login info
[ ** ] as the irc server password like so… user:pass.
[ ** ]
[ ** ] Try something like this in your IRC client…
[ ** ] /server :

Everything should now be set up for all your IRC needs.

Using webadmin
If you have loaded webadmin, you can access your admin page at: http://example.com:8080

Change Default URL of phpMyAdmin

By default phpMyAdmin is installed at example.com/phpmyadmin. Changing this URL will make your instillation that bit more secure. To change this you need to edit the apache.conf file in the phpMyAdmin’s configuration directory. This is usually in /etc/phpmyadmin/.

At the top of this file there should be the line:

Simply change the alias path, something like:

Now simply restart your apache server and you are all done:

Automatic Website Screenshots

I wanted to make an archive of certain sites at a regular interval. But how to get a screenshot of a website automatically?
I found this http://www.debian-administration.org/articles/413 which was almost there but not really what I was looking for. I have adapted the script to closer meet my requirements.

Here is the result:

I plan on improving this script in a number of ways:

1. Make firefox open in fullscreen
2. Allow website login
3. Remove unnecessary items from the screen

Session Fixation

A major concern regarding session security is keeping the session identifier secret. Session hijacking can only really be carried out if this is not kept secret. With a valid session identifier an attacker may find it very straight forward to gain access and impersonate users.

Obtaining valid sessions can be very simple, but there are a few simple steps to help keep your website secure. First of lets establish how am attacker can get this information:

• Prediction
• Capture
• Fixation

Lets look at the first one “prediction”, this is not a practical approach and therefore you do not need to concern yourself with it to much…PHP will generate session identifiers in a VERY random way so the chance of someone simply guessing it are very thin.

Method two, “capture” this is the most common attack and I will cover this in a later post. Basically the attacker will get the victim to simply tell them there session identifier. This can be in many forms, most likely a form of XSS vulnerability , so if you are concerned look for articles on XSS and ways to combat it.

The third method is the one I am most interested in today, fixation…fixation is a way of tricking the victim into using a session identifier of your choosing. Therefore the attacker can already know the session identifier before the victim has even created it, and when they do simply and swiftly hijack their session. Example 1:

Example

• Bob visits http://example.org/ and checks which SID is returned. For example, the server may respond: Set-Cookie: SID=0D6441FEA4496C2.
• Bob is now able to send Alice an e-mail: “Check out this new cool feature on our bank, http://vulnerable/?SID=0D6441FEA4496C2.”
• Alice logs on, with fixated session identifier SID=0D6441FEA4496C2.
• Bob changes his session to 0D6441FEA4496C2, and starts impersonating Alice.

Explanation

A standard fixation attack will have 3 steps:

• Setup
• Fixation
• Entrance

First off the attacker will create a “trap-session” on the target server and obtain the session id, this will then be used as the id for the attack. This session must then be maintained (kept active) by periodically sending requests to the server using the given session. Secondly they must introduce the target to the trap-session, this will mean that when the user logs in to the target site there login will be stored in a session that the attacker knows the id of. With these steps done and the session being kept alive the attacker can come along at a later point, change his session to the trap-session and start surfing as the target.

Sorting – BubbleSort