Random Web Development Topics

Account Lockout DDoS

2011-11-11T11:22:00.000-08:00

Webmail with no CAPTCHA + authentication based on Active Directory + strict account lockout policy + publicly available organization email addresses = recipe for a fairly brutal DDoS attack on an organization.

The account lockout denial of service attack is not a new concept. There already exists several white papers describing the dangers of these attacks and possible solutions. But unfortunately the solutions are a bit shortsighted. They describe ways to prevent an "attacker" (read singular) often by blocking her IP address from attempting to log in as a user. They miss the fact that putting together a vicious DDoS attack, using innocent computers as slaves over the web (using multiple IP addresses of the innocent), is but a trivial matter.

All one needs to do to put together such an attack is place an iframe or several iframes on a popular webpage on any server that points to the target organization's webmail form processor script with a valid user account placed in the user field, with a bad password, and use javascript to submit the form. Every time an innocent person visits the "popular webpage" they are inadvertently submitting the form with a real organization user and bad password (purposely). Because the webpage has high traffic, this in effect will cause the user account to lock out based on the organization's lockout policy (sometimes only after 3 missed attempts within an hour). Now imagine placing 100 iframes on that page all pointing to unique users of that target organization. That would be 100 locked out accounts almost instantly, depending on how many people visit that webpage with the dangerous code placed within.

Additionally, after the IT department goes in and unlocks the account so the user can work at their desk or check their email, it happens all over again, because the code is still on the webpage working to lock the same user accounts.

More research should be conducted on how to mitigate this form of attack, especially because it's so easy to pull off. A couple ways to help prevent the problem now would be to prevent publishing organization email addresses that those within organizations would use to log in to their webmail accounts, create aliases that users could log into their account with when their regular account becomes locked out, and possibly the best solution would be to use a good CAPTCHA on their webmail login pages so that this form of automated attack could not easily be accomplished.

Pet euthanasia down from the 70's because of spaying and neutering

2011-07-15T13:31:00.000-07:00

Pet euthanasia down from the 70's because of spaying and neutering

Excel Concatenation and Auto Fill

2011-02-25T09:59:00.000-08:00

Often times data that you have to use in your applications comes in Excel sheets but it's not always formatted the way you like it. For example, you might have a column of user ids in your sheet that you need to populate an array in your code, but your array code requires the ids to be quote contained to signify that they are Strings. Concatenation function to the rescue.

Go to an empty column and create your function in the first row. Something like this should do assuming A is your id column: ="'"&A1&"',". What this will do is create an id that looks like this: '454', if 454 is the id in A1. Next, autofill all the rows by placing your mouse in the bottom right corner of the field you just created and when the cross hash appears as your mouse pointer, pull down to auto fill all of your rows. You should notice the fields update automatically. Next, highlight the entire new column, right click on the column and copy to clipboard. Paste your quote encapsulated, comma separated data into a text editor, preferably one like the free Text Wrangler. Why Text Wrangler, well because you will likely need to remove line breaks in the file to work with your array code. Text wrangler has a function to remove all line breaks, in addition it supports regular expressions! Paste your line break free array pieces into your code and enjoy the rest of your day. Gotta love automation!

Obscure your email address from harvesters with Javascript

2011-01-27T14:51:00.001-08:00

Every string is an array in javascript:
var chars="@abcdefghijklmnopqrstuvwxyz.";
email = "peter"+chars[23]+"schlamp"+chars[0]+"gmail"+chars[27]+"com";
alert(email);

Using Javascript to disable the browser back button

2010-12-15T11:41:00.000-08:00

With the rise of Ajax in web development, a lot of talk has been going on about how to deal with page state-persistence and search engine indexing of Ajax sites. Largely because Google somewhat recently released a white paper on how to create state-persistence and better Ajax indexing, a new procedure for dealing with this has emerged: dynamic URL hashing via Javascript. Facebook and Twitter are a couple of the big boys whom are already using this. It goes a little something like this: upon an Ajax request, a page should use javascript's location.hash property to dynamically change a hash in the page's URL so that the address reflects the new state of the page. For example, if one has a page that dynamically, through Ajax, shows 2 separate views of imagery and another of calendar events, the view that shows imagery should have a hash with the word imagery, while the other view a hash with the word calendar (#calendar). This way, one's Ajax page and Google will "know" the difference between the 2 URLS and correctly represent what needs to be represented.

I didn't know about the location.hash property until Google's white paper, mostly because I had little reason to use it before Ajax. Besides being useful for Ajax, it can also be used as a browser hack for effectively killing the browser back button. All one needs to do is set this property within a loop, run through it about a hundred times and no more back button (see code below). So far, I've only tested it on Firefox but I'm sure a good portion of the other browsers are affected by this.

Shake, Rattle, and Roll in Firefox

2010-12-06T15:39:00.000-08:00

Firefox's moveBy function in a loop can create some havoc.
Test the above code out in Firefox and see what happens. Alternatively you can drag this link to your bookmark bar or just click it: Shake It!

Web development in public spaces - Otis College's lobby displays show work from students and ongoing events around campus.

2010-10-14T09:24:00.000-07:00

The web page's place has moved beyond its origins. What once used to only exist on our home and work computer monitors, now can be found on mobile devices and on public space displays.

Why use a canned software solution when it's so easy to use HTML to brand your own interface? The hardest part for us in developing this was keeping the data fresh. Otis events are added through the website's content management system, so we needed a way for the lobby display's web interface to access the site's back end database where the event information was held.

A little Ajax and PHP solves this. The PHP returns a javascript array of event ids from the database that the interface uses to call in information from Otis event URLs. After the system loops through all of the ids in the array, the main interface makes a new Ajax call accessing a replacement array of "fresh" ids thereby keeping the events fresh and alleviating the need for us to "refresh" the page on the display, which would be impossibly cumbersome.

What's Nearby. Web app for your mobile.

2010-10-03T16:33:00.001-07:00

Test this on your mobile. Nearby

Long URL Bookmarklet

2010-09-09T14:53:00.000-07:00

Long URL Bookmarklet expands those short URLs so that you can see where you're really headed when clicking on those links

Drag this link to your Firefox toolbar: Long URL

Speed up processing your code with Word's marquee function

2010-07-22T10:54:00.000-07:00

Marquee parts of text lines with MS Word On a Mac, Command+Option allows you to select a portion of multiple lines. Say you need to just grab the variable names from this list, well all you would need to do is press command+option, highlight the left side of the code where the variable names are, then copy to clipboard. This drastically speeds up code processing by alleviating the need to type the variables or to backspace each line.

Table To Chart

2010-05-15T07:09:00.000-07:00

Create a HTML table and get a Google Chart.

I really like the Interactive Charts API that Google offers http://code.google.com/apis/charttools/ but I wanted to devise a way of creating these charts simply by creating a HTML table for those less inclined to using complex JavaScript. An example of the main function call is drawChart('columnchart','chartme','chart_div','Things I Do',600,400); It works with these charts for now: as first function parameter-"linechart","piechart","areachart","columnchart","barchart","gauge". 2nd parameter is the table id, 3rd is the element id that you would like your chart to appear, 4th parameter is the title of your chart, 5th and 6th are width and height respectively. All are necessary for the chart to function properly. You can download tabletochart.js here.

Dependencies: You must include Google's JSAPI library http://www.google.com/jsapi , Jquery - if you don't have it on your site, all you have to do is uncomment the line that reads "google.load("jquery", "1.4.1");" and it will add it for you. Of course, you will need tabletochart.js available for download above. Also when creating your HTML table, you must have TH tags in your first row. The code that runs behind the scenes will use the data within these tags in your chart. In addition to TH tags you should wrap all rows within your table inside of TBODY tags.

Feel free to use drawchart.js in your code, I just ask that you don't hotlink directly to it from your site. Let me know if you've got questions.

View the source on this page: http://peterschlamp.com/js/drawcharttest.html

2010-03-05T08:53:00.000-08:00

Ever wish you had instant access to a XML feed, but in JSON format? Well wish no longer. I wrote a web service for that. Example usage: http://www.peterschlamp.com/php/xmltojson.php?xml=http://peterwschlamp.blogspot.com/feeds/posts/default?alt=rss

Just add any XML file on the net to the xml parameter in the above URL and you'll get an on the fly JSON formatted file for you to use via Javascript. This works great with syndications like Atom or RSS, which may not have a related JSON format. Here's an example I'm using for the RSS feed of my blog: http://www.peterschlamp.com/php/testjson.html. I used Jquery's getjson function to parse the RSS feed into it's titles and related links. Give it a try yourself.

Security: Cross-site request forgery

2010-03-04T13:09:00.000-08:00

If I was a hacker, one of my favorite forms of web applications hacking would be through cross-site request forgery. CSRF is a form of web site exploitation in which unauthorized commands are transmitted from a user that the website trusts. It's easy to do and gives a hacker all the privileges of the trusted user whom he's acting as.

One very simple example would be a known but very innocuous exploit on Gmail's log out function. Log me out of Gmail Clicking this link would log you out of Gmail from my blog, which shouldn't be allowed by Google but is. The above is simple because it's in the form of a link, which uses GET variables as it's parameters. Actually Gmail's logout function is so simple that it doesn't even use parameters in it's link. Many developers mistakenly believe that as long as their forms use POST that they don't have a problem with CSRF.

A more complex example but still very easy exploit would be to place a copy and pasted bank's POST form that would be hidden through some simple CSS on the hacker's site. The hacker would have to trick a bank user who is logged in to the bank's website to navigate their browser over to the hacker's malicious page with the hidden form, at which point some javascript would click submit on the form, which could transfer money from the victim's account over to the hacker's. The hacker would copy and paste the form onto his site and place whatever data he wanted into the inputs of the form before it's submitted by the javascript. This is possible because the hacker is acting as the trusted user of the bank's website. Of course most if not all banks have long ago safeguarded themselves from this form of attack, but I know for a fact that many other sites have not.

The best form of prevention is to use tokens in hidden inputs of your forms. The token should be a randomly generated number made specifically for that user. This way the hacker would have to know what the user's token is, which is pretty much impossible. Any form when submitted as that user must have that exact token value as one of the variables with each request. An easy solution to a very common problem.

Luke Wroblewski and the importance of quality web forms.

2010-03-02T15:09:00.000-08:00

Probably the most important element of web development in this day of e-commerce and information exchange is good Web Form design. And Luke Wroblewski has likely studied it more than anyone else.

Luke discusses layout design, validation methods and emphasizes gradual engagement. This 74 min video is definitely worth watching for anyone seeking better user navigability and higher conversion rates: http://www.lukew.com/presos/preso.asp?8

Using PHP's List construct makes referencing database variables much faster

2009-04-28T11:40:00.000-07:00

PHP's list language construct basically assigns a number of variables to the pieces of an array all in one line of code. This helps speed up a lot of things but particularly assigning variables to your database return.

From PHP.net:

$result = mysql_query("SELECT id, name, salary FROM employees", $conn);
while (list($id, $name, $salary) = mysql_fetch_row($result)) {
echo " \n" .
" $name\n" .
" $salary\n" .
" \n";
}

?>

Notice that the code assigns $id, $name, and $salary to the individual pieces of the $result array that is returned by the mysql_fetch_row function. In this case you would be turning 3 extra lines of code into 1. Yes small fries here, but often times, you would be returning at least 10 fields from your DB.

Security: Public Computer Bait Phishing for user credentials

2009-04-20T10:37:00.000-07:00

Here is a vector of attack that one can use to obtain the username and password of an individual at many organizations on a public computer.

Say you're an evil hacker on a public computer in a university library or something and want to get access to a student's login credentials. A hacker might want the credentials to gain access to the protected WiFi access of the college or worse. He can do so with local javascript injection and a server script that will receive the info.

Here's example code that alerts out yahoo email credentials:
javascript:document.getElementsByName('login_form')[0].onsubmit=function(){alert(document.getElementById('username').value + " " + document.getElementById('passwd').value);return false;};void(0);
Just go to the Yahoo mail page place above code in address and hit enter, then fill in your login/password, finally submit form. Notice alert box with credentials will show.

Let's pretend here that yahoo mail is really the webmail page for the university that you are trying to hack credentials for. By navigating on the public computer to Yahoo's email login page, injecting this particular javascript into it, and clearing out the address so it doesn't look suspicious one can gain access to a user's credentials.

What one would do is 1st - the above steps. But instead of using an alert box (used only as proof of concept) one would send those values to an external server (his server), preferably to his database for safe keeping. As mentioned before, be sure to clear out the address of the suspicious javascript. Replace it with, in this case, "http://mail.yahoo.com/", then walk away from said public computer leaving the injected page on the screen as bait for our victim. The best way to do this would be to create with javascript a hidden IFrame to do all the dirty work in the background and allow the form to submit afterward so that the user doesn't notice anything wrong.

I don't endorse this, but am merely documenting this as a vector of attack. Administrators should take note of this and use any form of prevention possible.

Polymorphism in PHP 5+

2008-03-25T13:14:00.001-07:00

Click the above code image to see it larger. In the code, the Animal parameter is an interface for both the Dog and Cat classes. Dog and Cat both return woof and meow respectively.

The "magic" of polymorphism is found in the function. It accepts a class of type Animal. It then attempts to figure out which type of Animal it is, just to be sure it exists. Finally, it outputs what's returned by the Dog and Cat's makeSound functions.

The ternary operator instead of basic if-then statements for quicker more efficient coding

2008-02-15T11:12:00.001-08:00

As you can see, the ternary operator greatly reduces the amount of code in your file.

The second php block shows that you can turn 5 lines of code into 1. With the ternary operator, the if keyword is implied with just the use of parentheses. The question mark is used for the keyword then (or } in php) and the colon is used for the "else".

Here, the code will echo out either hello world or this is some other page depending on what the server variable is holding.

AJAX - A simple demonstratin with code

2008-02-12T14:53:00.000-08:00

http://petmarkdowns.com/AJAXclassTester.htm

Friendly URLs with Apache and .htaccess Files

2008-02-12T14:22:00.000-08:00

Want to change those ugly parameter-filled PHP URLs to more user and search engine-friendly links.

Give it a try. Alternatively one could use mod_rewrite but this way is much easier especially for those who host on servers that give little access rights.

More fun with opacity: Opaque over black and white photos

2008-01-25T12:50:00.000-08:00

I love how an opaque foreground looks when it overlays a black and white photo. Check out how mine looks: http://www.geocities.com/peterwschlamp/blackwhiteopaquetest.html

It's so easy to do too! All it takes is some CSS. Feel free to check out the source while you're there to see how it's done.

Make your own CSS Javascript menu!

2008-01-25T11:32:00.001-08:00

Making your own Javascript menus isn't as hard as you may think. Look at how simple the code can be. Basic CSS sets up the color and font of the actual menu and some simple inline Javascript either hides or shows the menu depending on where the mouse's location is on the screen.

Use PHP and Javascript together for easier PHP debugging

2008-01-24T10:27:00.001-08:00

A nice way to test for LOGICAL bug positions (obviously not syntactical) in your PHP scripts is to place a Javascript alert box in those questionable places. Because PHP has no built in alert box method, Javascript can really come in handy for this.

Here's the code:

You would apply this incrementally into your code until it doesn't any longer appear. If your Javascript alert box pops up but things don't function properly after the alert then you know that your bug resides somewhere after your placement (usually very close) of this line of code.

Obviously, you can use your alert box for other things too. Have fun with it.

Make Your Own Javascript Firefox Bookmark that Works with Almost All the Websites that You Visit

2008-01-21T09:16:00.000-08:00

I like to watch movies and other videos on the internet. Like Youtube, these videos typically stream over a flash or quicktime player. What I find annoying sometimes is that there is usually a blinding white background page behind the player that usually takes away from the movie-watching experience.

Well, now you can control the color of your background on pretty much any website with a little javascript experience.

In order to create a clickable bookmark in firefox you have to first create a javascript link and then drag that link up to your firefox toolbar.

Here is the javascript link that I created to use for darkening white backgrounds for my movies:

Just slap that code in a link and after the link is on a page, simply drag that link up onto your firefox toolbar and wala! Now evertime you click that bookmark, you will see the background color of the site you're on turn to black.

Try tweeking the code to your own needs.

Example of my link. Just drag this link to your Firefox toolbar and try clicking it: Darken This Background

Want to do an extremely simple opaque div overlay?

2008-01-19T18:43:00.000-08:00

Check out how simple the code can be. It starts out as invisible then if the link is clicked, the div shows up taking up the whole screen in all its opaque glory. If the div's clicked, it will disappear leaving you with your link again.

Getting those Select-Option HTML Form Inputs to have defaults depending on form submission with PHP

2008-01-18T21:04:00.000-08:00

Wow, what a horrible title. Anyway, I wanted to add this post for those of you who are interested in adding defaults to select option form inputs depending on what the user originally set in the form.

For example, Joe goes over to your form and selects 'male' for his gender in your form and after he submits it, you want to show him what exactly he chose for gender on the next page within another select option form input.

Well with HTML you have to use the 'selected' attribute within the particular 'male' option as opposed to female in Joe's case. The selected attribute adds a couple degrees of complexity over that of a basic text box that you would simply add to the value attribute.

Check out the code above for a similar example this time using yes/no as values as opposed to gender. If you have even a little PHP experience, it should be a breeze to understand.

Thanks to Matthew Ballard for this one.