Dreamers of Dreams are pathfinders. Dreams remain valid. I think I am marrying Python now, I have dated and cohabited several programming languages but Python proves to be the most caring, loving and romantic of all.
Ok, this seems to be basically up and running… As it is, I’m packing up my life, getting ready to leave. I’m heading out in just a couple days to Eldoret to start a week-long stint working with the Machakos County high school administrators.
I’m not an administrator but my machine can attest to this ( Crazy!!!). I believe the developers frommy team recently made a patch which should make them go paperless in there offices unlike the reasonable traditional file pilings in common administrators office. One option, then, is to try one of our products. Another option is to try getting in touch with one of our team members.
Currently am really thinking about testing ideas and getting statistics on who is resistant to change from the #1 county high school heads meeting in the famous Riftvalley this week (30th March to 2nd April).
Current product in question, A digitalSchool Management Software with the following features all under one roof.
screenshot of the application’s homepage interface from my crappy Android phone.
Students Registry and Administration
Finance Management platform
Exams Processing and Analyzing feature
Asset management System (The inventory)
Library management System
Payroll System
Bulky SMS feature (with customized name of institution and short-codes)
Geared to run on Android phones (and access your schools’s update while away from office) too as shown from the picture.
With many more features coming up as updates all under one roof with no maintenance cost nor subsequent subscriptions (it’s a one time payment.)
Gone are the days when website hacking was a sophisticated art. Today any body can access the Internet and start hacking your website. All that is needed is doing a simple search on google with keywords like “how to hack website”, “hack a website”, “Hacking a website” etc. I have been researching and trying out things over the past few days. Now that they worked as expected and perhaps more perfectly, I am providing this article to create awareness on some common website hacking methodsrather than teach you website hacking.
If you ever use the following content for malicious purposes, I'm not responsible for I have forewarned you!
Avoid rotting behind bars.
The Simple SQL Injection Hack
SQL Injection involves entering SQL code into web forms, eg. login fields, or into the browser address field, to access and manipulate the database behind the site, system or application. When you enter text in the Username and Password fields of a login screen, the data you input is typically inserted into an SQL command. This command checks the data you've entered against the relevant table in the database. If your input matches table/row data, you're granted access (in the case of a login screen). If not, you're knocked back out.
In its simplest form, this is how the SQL Injection works. It's impossible to explain this without reverting to code for just a moment. Don't worry, it will all be over soon. Suppose we enter the following string in a User name field:
' OR 1=1 The authorization SQL query that is run by the server, the command which must be satisfied to allow access, will be something along the lines of: SELECT * FROM users WHERE username = ‘ADMINNAME ' AND password = ‘PASSWORD’ …where ‘ADMINNAME' and 'PASSWORD' are what the user enters in the login fields of the web form. So entering `OR 1=1 — as your username, could result in the following actually being run: SELECT * FROM users WHERE username = ‘' OR 1=1 — 'AND password = '’ Two things you need to know about this: ['] closes the [user-name] text field. Everything after Comment is ignored. So the actual routine now becomes: SELECT * FROM users WHERE user name = '' OR 1=1 1 is always equal to 1, last time I checked. So the authorization routine is now validated, and we are ushered in the front door to wreck havoc. Let's hope you got the gist of that, and move briskly on.
If you think you gonna hack into a bank with this crappy and cheap knowledge, slow down, cowboy. This half-cooked method won't beat the systems they have in place :-) "I already said Im creating awreness not teaching how to hack..."
The process does serve to illustrate just what SQL Injection is all about — injecting code to manipulate a routine via a form, or indeed via the URL. In terms of login bypass via Injection, the hoary old ' OR 1=1 is just one option. If a hacker thinks a site is vulnerable, there are cheat-sheets all over the web for login strings which can gain access to weak systems. Here are a couple more common strings I found and experimented with which are used to dupe SQL validation routines: username field examples:
admin'—
') or ('a'='a
”) or (“a”=”a
hi” or “a”=”a
… and many more.
Cross site scripting ( XSS ):
Cross-site scripting or XSS is a threat to a website's security. It is the most common and popular hacking a website to gain access information from a user on a website. There are hackers with malicious objectives that utilize this to attack certain websites on the Internet. But mostly good(ethical) hackers do this to find security holes for websites and help them find solutions. Cross-site scripting is a security loophole on a website that is hard to detect and stop, making the site vulnerable to attacks from malicious hackers. This security threat leaves the site and its users open to identity theft, financial theft and data theft. It would be advantageous for website owners to understand how cross-site scripting works and how it can affect them and their users so they could place the necessary security systems to block cross-site scripting on their website.
Denial of service ( DDOS attack ):
A distributed denial of service attack (DOS) is an attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the resources, so that no one can access it.this is not actually hacking a website but it is used to take down a website/shutdown a website. If an attacker is unable to gain access to a machine, the attacker most probably will just crash the machine to accomplish a denial of service attack,this one of the most used method for website hacking.
Part of a screenshot from the computer (core i5)
I launched an attack from.(I had permission).
Cookie Poisoning: Well, for a starters i can begin with saying that Cookie Poisoning is alot like SQL Injection
Both have 'OR'1'='1 or maybe '1'='1'
But in cookie poisoning you begin with alerting your cookies
Javascript:alert(document.cookie)
Then you will perharps see "username=AlexWaya" and "password=pizzaandcoffee"
There is also many versions of this kind... like for example
'
'1'='1'
'OR'1'='1
'OR'1'='1'OR'
and so on...
You may have to try several things before you get it completely right... Password Cracking Hashed strings can often be deciphered through 'brute forcing'. Bad news, eh? Yes, and particularly if your encrypted passwords/usernames are floating around in an unprotected file somewhere, and some Google hacker comes across it. You might think that just because your password now looks something like XWE42GH64223JHTF6533H in one of those files, it means that it can't be cracked? Wrong. Tools are freely available which will decipher a certain proportion of hashed and similarly encoded passwords.
* If you utilize a web content management system, subscribe to the development blog. Update to new versions soon as possible. * Update all 3rd party modules as a matter of course — any modules incorporating web forms or enabling member file uploads are a potential threat. Module vulnerabilities can offer access to your full database. * Harden your Web CMS or publishing platform. * If you have an admin login page for your custom built CMS, why not call it 'butts.php' or something, instead of “AdminLogin.php” etc.? * Enter some confusing data into your login fields like the sample Injection strings shown above, and any else which you think might confuse the server. If you get an unusual error message disclosing server-generated code then this may betray vulnerability. * Do a few Google hacks on your name and your website. Just in case… PS: If you have some valuable info or queries please comment below and I will get to you as soon as possible.
Terminal of an "headless" raspberry pi running a very simple arithmetic python code I wrote to test
if it's ready for the job. It ran successfully...
One of the many projects I'm planning to run involves getting some Raspberry Pi computers and hacking around with them to horn my programming skills. I'm particularly looking forward for a new implementation of one or many or all of the ideas I have if possible.
So I’ve gotten my hands dirty on a couple of Raspberry Pis for the last few days I’ve really started hacking around with one in particular. I've currently installed Raspbian operating system in it. My short-term goal was to get an assembled and working Raspberry Pi running very simple python arithmetic program and yeeeeeeees, it's working(as demonstrated above).
It will generally be a good public service to get a Pi-ready build of some already installed solution to a real life problem out there in the world. One will probably need an 8gb sd card(class 10 and later preferred) to run it properly, though, as the binary will probably weigh in at a bit over 2gb.
As mentioned in the caption, I have managed to get the Raspberry Pi working. However, I will be adding some peripheral devices soon. Presumably, I should just pick up a cheap TV somewhere and plug into the component jack on the Raspberry Pi, and that’s certainly what I will do when I deploy the devices(for the normal human being demonstration). But in the meantime I’ve been and I will continue running headless, i.e, without a monitor or keyboard.
It was a bit complicated to get set up in the first place, but now that all is together it’s no problem. The Raspberry Pi comes with sshd pre-enabled, making it very easy to log in ‘remotely’ from across the "scene of crime" and it's environs and run all the processes one desires. The main trick was getting the raspberry pi onto the local network set up by my partner-in-crime's cheap android cell phone and figuring out which IP address it had ended up with. I did this by writing a code to dump the ifconfig info into a text file from time to time (first at regular intervals then at random intervals), then reading off the IP address from that. Luckily, the android product is pretty nice about giving out the same address on either side of a reboot.
I'm confident that now I'm ready to launch effective and successful hacks. In case you need help or some guidance please comment below and I will get to you as soon as possible.
A friend recently said: "I want to learn how to code. How and where do I start?"
I WANT TO LEARN HOW TO CODE - DO I GO TO IKEA OR GROW MY OWN TREE?
It's like woodworking. You can START by growing a tree, then chopping it down and finishing it, sanding it, before you make a table. Or you can go to Ikea. More likely you'll try something in between.
Modifying a WordPress theme is going to Ikea. Writing your own web framework is growing a tree first because you don't like the existing trees. You have to decide where on the spectrum you want to be, from being a custom furniture maker or someone who assembles prefabricated pieces made by someone else.
OK, WHERE DO I START?
Very cool. I'm always happy when folks want to learn to code. The Facebook thread continued with the usual suggestions:
Then the most interesting questions start getting to the root of the matter...you find yourself brainstorming :-)
WHAT'S THE DIFFERENCE BETWEEN A CODER, A HACKER, A PROGRAMMER, A DEVELOPER, AND A COMPUTER SCIENTIST?
These words might all mean the same thing to you. Perhaps you hear geek, nerd, and dweeb, but we all know these have very important differences. Knowing the differences also can give you a sense of how deep you want to go on your coding adventure.
Coders - Can pretty much figure out it. It'll work, but it won't be pretty.
Hackers - usually low level folks, skillful, with detailed understanding of some area deeply, often scarily deeply.
Programmer - Write code and understand algorithms. Often work alone and well.
Developer - Are the best generalists, can use lots of different systems and languages and get them to talk to each other. Are true and broad professionals, work with people, and communicate well.
Computer Scientist - Need to be able to prove how computers work, at a theoretical level. Are usually math people also.
If you are closer to one of these already you can get an idea of which direction to head.
&& WEB PROGRAMMING?
Everyone on the thread assumed some kind of web programming, which makes sense, since nearly everyone's on the web in 2016. However, just a few years ago we might have sat our friend down and made a Hello World app at the console, or perhaps loaded up Visual Basic, dragged a button, and MessageBox'ed Hello World.
Is Markup Code? Lots of people said "learn HTML and CSS," but I don't think that's coding in the classical sense. As a gateway to JavaScript and Web Services, I think it's a good place to start. The thing is, though, that while not every app is a web application that makes HTML in a browser, most applications are connected applications in some way. Apps consume data from services, send notifications, texts, emails and tweets. Nearly every application is distributed in some way, even if it's just a simple app that calls a web server for some data.
If you want to be a coder today, or, let me go further and say if you want to be an effective coder, you will want to understand the web and what really happens when you type twitter.com in your web browser. Just like you should understand how trees grow if you want to be a carpenter, how engines work if you want to be a race car driver, or where the water comes from if you want to be a plumber. Heck, you should really understand all of these things if you want to be an effective human. ;)
WHAT DO WE REALLY MEAN BY "I WANT TO LEARN TO CODE?"
What's the question under the question? Does s/he want to make websites? Design them? Does s/he want to make mobile applications and take them on the go? Does s/he want to create a gadget that will text her when s/he leaves the car door open too long? These are all very different endpoints and there's lots of great ways to get started if we dig in a little.
Interested in Web Development?
Any of the many "Learn to Code" sites mentioned above will do fine.
You can totally jump in to the web, learn a little JavaScript and start making web apps, and you should. But as with everything, if you've got deeper interest, there are a few different paths to going further. Do a little research into the breadth of possibilities available to you, and you just might try a slightly different path. I'm off for some espresso, see you next week or sooner...
Passwords being cracked by some really simple python code I wrote. Who knew ‘freedom’ was such a common root word for passwords?
(The last month and especially the last week of last year (2015), I invested much in exploring capabilities of Python only to bump into salt somewhere on the way. It wasn't anywhere near the kitchen ;-) though...
Suppose you’ve just made a hot new website from which you’ll make a million dollars a year. You get to the point of creating a database for all of your users who will be logging in and doing things like buying trains, so you put together a database table. Maybe it looks something like this:
Name
Email
Password
Alex Waya
awaya@sheena.net
passw0rd
A few weeks after launch, you have two million users, and someone breaks(cracks) into your server and steals the database. Of course, they don’t tell you that they did this; they’re much happier to keep the database, pull out a name and password, log in as someone else, and use your site to steal lots of money and undermine the basic building blocks of democracy and common decency. After sending apologies to the userbase, you decide that your database structure was flawed.
At this point you start doing some reading, and find out about password hashing. The very basic idea of password hashing is to take any password and turn it into a nonsense-looking string of characters; this is called the hash of the password. This hashed password is then what’s stored in the database. When a person tries to log in, their typed password is turned into another nonsense string of characters, and checked against the nonsense string in the database; if the nonsense matches, then they probably typed the right password, and are allowed to log in. So now your database looks like this:
Name
Email
Hashed Password
Alex Waya
awaya@sheena.net
bed128365216c019988915ed3add75fb
So how do you make a hashed password? The right answer is: Use a pre-made hashing function. There are numerous libraries for hash functions available in whatever language you’re using, php, python, whatever. You should use these instead of making your own because making a good hash function is incredibly difficult to do right. Here are some of the requirements of a good hash:
A hash is a deterministic function. If you give it the same input, it produces the same output every time.
It’s hard to go backwards. In other words, if someone finds the hash “827ccb0eea8a706c4c34a16891f84e7b” in your database, it should be hard to figure out that it came from the password “12345”. Mathematically, this says means (roughly speaking) that the hash is a one-way function.
Given a hash, it should be really hard to produce a word that gives that hash. If it were easy to do this, then a hacker could just find SOME word (maybe really long and nonsensical) that gives the hash “827ccb0eea8a706c4c34a16891f84e7b”, and not even care that your ACTUAL password was “12345”.
In particular, small changes to the input should make big changes in the hash. This makes it hard to find a password which gives something close to the right hash and then hone in on the actual hash from there.
The hash should always be the same length. This keeps anyone from knowing whether your password has one character or thirty.
The hash function should be resistant to all known means of reversing hash functions.
Finding a function that does all of these things is extremely difficult. And that’s why you should use a pre-made hash function. The good ones are designed with the notion that the hashes and the algorithm for generating the hashes are known to everyone; this means they’re designed to be incredibly hard to break.
But even so, there are good hash functions and bad hash functions; in fact, some of the hash functions that were good in the past are now bad because someone has figured out a way to break one of the six requirements above. A prime example of this is the md5 hash function, which has numerous weaknesses that have come to light over the years.
So you go ahead and use a nice, modern hash function, like SHA256. So now your table looks like this:
Now let’s imagine what happens when a hacker gets your database. They also manage to look at your source code and figure out that you’re using the SHA-256 algorithm to keep your hashes. That should be fine. But they also know a few thousand common passwords, and use this to get the passwords of some of your users.
To find out how easy this is, I downloaded a text file containing md5 hashes of passwords from eHarmony from a hack that occurred some years ago. I also downloaded a file with about 3000 common passwords. I then wrote some python code to go through the 3000 passwords, hash them with md5, and see if the hashes show up in the eHarmony list. This takes about 6.5 seconds on my cheap laptop, and turns up one password: ‘BUTTHEAD’. This clearly isn’t good enough, so I wrote another function to add digits on either side of a common password, and check each ‘new’ password. This starts turning up passwords quite quickly, thousands in fact.
Now, in fact there exists software that people have written exactly to speed this process. (Look up ‘password recovery tools’ if you’re interested.) This software includes lots and lots and lots of common ‘rules’ that people use for their passwords, like using 133t-sp34k, keyboard patterns (qeadzc13, for example), alternating numbers and letters, and so on and so forth. In one test carried out by Ars Technica, a skilled hacker broke over 80% of the passwords in a particular database.
This brings us to the topic of ‘salt’. Salt is some random characters added to each password in the database. You store the salt in the database along with the user password; when someone tries to log in, the salt is added automatically to the password and the hash is checked. Now your database looks like this:
The upshot is that now the hacker has to add the salt – which is different for each user – for every password check. Effectively, this means they need to do their whole ‘common password search’ separately for each user, vastly slowing down the operation. Hopefully enough to allow your userbase to change their passwords….
But the problem in the last few years is that people are now using fancy, high-powered graphics processors (GPU’s) for this sort of thing, and suddenly just adding some salt isn’t good enough anymore. With a setup that can check millions of passwords a minute, it actually isn’t a big deal to do the search on every password.
The response has been a new generation of password protection algorithms. These new algorithms use really complicated algorithms to produce the hash, complicated enough that it slows down the process of creating an individual hash. This means that even with the big rig full of GPU’s, the hacker can’t get through the individual users at a reasonable speed. The best-known of the new-generation hashing functions (usually called ‘key generation functions’ instead of hashes, these days) is bcrypt. Another competitor is scrypt.
So, as of this writing, these are some good tools to use in protecting your database. For now! It’s unknown whether someone will discover a vulnerability in bcrypt; there hasn’t been much research on the algorithm yet, so there’s a good chance someone will find a vulnerability eventually. And then we’ll need to move to the new best thing to keep our passwords safe!
Conclusions.
One of the things that I kind of fall in love about all of this is that, in the end, the design of the system probably matters more than the stupid password choices of individual users. This simple lesson is actually applicable in all kinds of situations: You’ll usually get more bang for your buck from designing better systems than you will from trying to change human nature. The applications to politics are obvious: instead of trying to change the nature of greedy politicians, we should instead try to get systems in place that make it impossible (or at least extremely difficult and risky) to be greedy. Of course, it’s a hard sell when the same greedy ministers have to sign off on those systems, but that’s a topic for another blog, perhaps…
A program was a TV show A cursor used profanity A keyboard was a piano!
Memory was something that you lost with age A CD was a bank account And if you had a 3-inch floppy You hoped nobody found out!
Compress was something you did to garbage Not something you did to a file And if you unzipped anything in public You'd be in jail for awhile!
Log on was adding wood to a fire Hard drive was a long trip on the road A mouse pad was where a mouse lived And a backup happened to your commode!
Cut - you did with a pocket knife Paste you did with glue A web was a spider's home And a virus was the flu!
I guess I'll stick to my pad and paper And the memory in my head I hear nobody's been killed in a computer crash But when it happens they wish they were dead!
Computer programmers spend much of their workday in front of a computer in an office setting. And whenever they move outdoors they don't leave there computers behind to avoid guys with itchy hands from messing with their ongoing projects. Again you never know when you are going to meet your next client, they may need some demonstration of your past projects. However, they got advantage, everything important that one needs to know about living a successful life, you can get from programming. I know, it's quite a nerdy thing to say—but the truth is that there's a lot of wisdom in code. Don't believe me? Keep reading.
Below are some lessons that I have learned from programming:
Reuse program modules to save time:
Any good programmer eventually learns that certain blocks of code (functions) can be reused in multiple programs. The function may include a certain number of lines of code, but why would you re-create those lines of code for every program you write, when you can just save them once as a program "module," and then insert that module into any future programs that need it? Automation is the key to success, so if you can find ways to automate tasks in your job that you do repeatedly, you can make your day much more efficient and save time.
Document everything:
Sometimes, it can be pretty tempting for a programmer to write code without documenting a single thing because at the moment you know exactly what you want the program to do and how you want to do it. This meticulous documentation can help in every area of life, from keeping track of birthdays and anniversaries, to keeping a log of daily business transactions and why you made them. It's naive and inefficient to trust only your memory to remember why you attended certain meetings or why you made certain purchases. A daily journal or log can go a long way to freeing up your mind for more important things.
Always Leave an Escape Route:
One of the most common mistakes of an amateur programmer is the infinite loop. That's a situation where the condition required to break out of the loop never actually takes place, so the program stays in that loop and never ends, this consumes 100% of the PC CPU and pretty much locks up the computer for good until you kill the process.
Free Up Memory When You're Done:
Cleaning up after you are done is another lesson. In a program, you will need to open up a stream to an output file, create a large array filled with data points, and other things that consume computer memory and resources. A clean program is one that closes those output streams or empties those arrays once the program is done with them. The idea here is to avoid a common problem with poorly written applications known as a memory leak.
It sounds like something you've probably heard from your mother, say when you were younger, right? Clean your room. Put your clothes away. Leaving things hanging around just wastes space and wastes your time when you can't find what you need later on.
Note:
These are not the only life lessons that you can learn from the art of programming, there are many more. This is why every child should learn at least one programming language in school.African Maths Initiative has been promoting this during theAnnual Maseno Maths Camp. Once you've caught on to the tricks of the trade, it becomes apparent pretty fast that you can use those same tricks throughout many other parts of your life.
