Categories
Feeds Français

Exploiter une injection SQL les doigts dans le nez

Si au petit-déj, vous aimez manger des injections SQL, voici un petit outil qui va vous permettre de tester votre site afin de voir si celui-ci est vulnérable.

Cet outil, c’est The Mole. C’est tout en ligne de commande pour les barbus et ça permet simplement à partir d’une URL contenant une chaine de caractère valide, de voir s’il est possible d’y injecter du SQL.

Mole3 Exploiter une injection SQL les doigts dans le nez

C’est pratique, car tout automatique et ça gère aussi bien MySQL, SQL Server, Postgres et Oracle.

The Mole est téléchargeable ici et pour apprendre à vous en servir, il y a un très bon tuto ici.

A utiliser sur votre propre machine, car sur les machines des autres, c’est illégal.

flattr this!

Categories
English Feeds

Francois Marier: Optimising PNG files

I have written about using lossless optimisations techniques to reduce the size of images before, but I recently learned of a few other tools to further reduce the size of PNG images.

Basic optimisation

While you could use Smush.it to manually optimise your images, if you want a single Open Source tool you can use in your scripts, optipng is the most effective one:

optipng -o9 image.png

Removing unnecessary chunks

While not as effective as optipng in its basic optimisation mode, pngcrush can be used remove unnecessary chunks from PNG files:

pngcrush -q -rem gAMA -rem alla -rem text image.png image.crushed.png

Depending on the software used to produce the original PNG file, this can yield significant savings so I usually start with this.

Reducing the colour palette

When optimising images uploaded by users, it’s not possible to know whether or not the palette size can be reduced without too much quality degradation. On the other hand, if you are optimising your own images, it might be worth trying this lossy optimisation technique.

For example, this image went from 7.2 kB to 5.2 kB after running it through pngnq:

pngnq -f -n 32 -s 3 image.png

Re-compressing final image

Most PNG writers use zlib to compress the final output but it turns out that there are better algorithms to do this.

Using AdvanceCOMP I was able to bring the same image as above from 5.1kB to 4.6kB:

advpng -z -4 image.png

When the source image is an SVG

Another thing I noticed while optimising PNG files is that rendering a PNG of the right size straight from an SVG file produces a smaller result than exporting a large PNG from that same SVG and then resizing the PNG to smaller sizes.

Here’s how you can use Inkscape to generate an 80×80 PNG:

inkscape --without-gui --export-width=80 --export-height=80 --export-png=80.png image.svg
Categories
English Feeds

CodeSOD: The Anti-SQL Coalition

"There is a small coalition of developers at the office who are vehemently anti-database," writes Bob, "naturally, this faction also doesn’t value 'experience' — mostly, because they have none. At least, not outside their university studies. They'll often liken a database server to a file system, and suggest that it's just a convenient way to store blobs of data — but everything else is inelegant bloat."

"Of course, since this coalition doesn't have any actual decision making power, their strong opinions remain just that, and we stick with a standard tech of technology. Of course, their attitude often leaks into the code, as in this example of a simple search query that was used to search for an employee by name. The trick is we have employees with accented characters in our directory but, if a user search for the name without the accented char (e instead of é), it needs to return the result anyway."

SELECT *
  FROM Persons
 WHERE /* HACK! Being SQL, there's no concept of 
          RegEx, so we have to this horrible hack  */
       Replace(Replace(Replace(Replace(
       Replace(Replace(Replace(Replace(
       Replace(Replace(Replace(Replace(
       Replace(Replace(Replace(Replace(name, ' ',''),
         'É','E'),'È','E'),'Ê','E'),'Ë','E'),
	 'À','A'),'Â','A'),'Ä','A'),
	 'Ï','I'),'Î','I'),
	 'Ç','C'),
	 'Ô','O'),'Ö','O'),
	 'Ü','U'),'Ù','U'),'Û','U') 
       LIKE @name AND 
       /* HACK AGAIN! Oh yeah, no cod reuse.
          Why are we doing this in SQL!? */
       Replace(Replace(Replace(Replace(
       Replace(Replace(Replace(Replace(
       Replace(Replace(Replace(Replace(
       Replace(Replace(Replace(Replace(surname, ' ',''),
       'É','E'),'È','E'),'Ê','E'),'Ë','E'),
       'À','A'),'Â','A'),'Ä','A'),
       'Ï','I'),'Î','I'),
       'Ç','C'),
       'Ô','O'),'Ö','O'),
       'Ü','U'),'Ù','U'),'Û','U') 
       LIKE @surname 
 ORDER BY name, surname

Bob added, "like most of their code, I was able to replace it with a much simpler block."

SELECT * 
  FROM Persons 
 WHERE name collate Latin1_General_CI_AI LIKE @name 
   AND surname collate Latin1_General_CI_AI LIKE @surname 
 ORDER BY name, surname

Categories
English Feeds

Money

There, I showed you it.

Categories
English Feeds

Rescan SCSI bus on Linux

In order to rescan your SCSI bus on a Linux server, simply run the following command:

echo '- - -' > /sys/class/scsi_host/host0/scan

NOTE: Your scsi target could be different than host0.

Running ‘dmesg‘ should show you a SCSI rescan as the last output.

Categories
English Feeds

$25, Credit Card Size PC Runs Debian, Fedora & Arch; No Ubuntu

UK-based Raspberry Pi Foundation is working on a credit card size, $25 PC which will redefine computing. The tiny computer runs on Linux. It supports Debian, Fedora and Arch Linux. Initially Ubuntu, as its based on Debian, was supported but it doesn’t at the moment. Read more here

Categories
English

Glances v1.3.7 released – System monitoring tool for Linux

System statistics at a glance: Official site.

From

Glances v1.3.7 released – System monitoring tool for Linux | The Hacker News THN.

Categories
English Feeds

Julien Danjou: Using GTK+ stock icons with pynotify

It took me a while to find this, so I’m just blogging it so other people
will be able to find it.

I wanted to send a desktop
notification
using
pynotify, but using a GTK+ stock
icons
.

With the following snippet, I managed to do it.

import pynotify
pynotify.init("myapp")
import gtk
n = pynotify.Notification(summary="Summary", message="Message!")
n.set_icon_from_pixbuf(gtk.Label().render_icon(gtk.STOCK_HARDDISK, gtk.ICON_SIZE_LARGE_TOOLBAR))
n.show()

Note that the use of a Label is just to have a widget instanciated to use
the render_icon() method. It could be any widget type as far as I
understand.

Categories
English Feeds

Living: Being bad CAN be good

According to the bods at MSN, who have come up wth the below list, being bad can be good for you (though we are certain that this should be approached with a pinch of salt

Swearing
At best, swearing can make men seem inarticulate. At worst, it can make them seem angry or aggressive. Nobody likes to hear loud swearing in a public place.

But on occasion, a well-chosen profanity doesn’t just feel like the only word up to the task – it can even be good for you.

Researchers at Keele University’s School of Psychology found that volunteers who repeated a swear word throughout the ordeal were able to keep their hands in ice cold water longer than participants who repeated a non-swear word. It adds to previous evidence that swearing, on occasion (when you stub your toe, for example), can be an effective form of pain control.

But the Keele researchers warned that swearing works best when it’s done in moderation.

"People who don't swear very much in daily life can keep their hand in roughly double the amount of time when they swear compared to when they don't swear," said Keele's Dr Richard Stephens. But the research found that swearing is less effective as a painkiller in people who swear regularly at other times.

Drinking
Excessive drinking ups your risk of various cancers, obesity, heart disease and a host of other unpleasant ailments. But alcohol doesn’t have to lead to ill health. It can be good for you.

There’s actually quite a lot of evidence that moderate drinking is healthy. Most recently, a study from researchers at Calgary University found that people who drank moderately were 14% to 25% less likely to develop cardiovascular disease than people who didn’t drink at all.

That chimes with a ten-year study on Irish and French men, which found that regular, moderate drinkers had a lower risk of heart disease than both non-drinkers and binge drinkers.

Bear that last line in mind, though. Only modest drinking – four units a day for men at most, up to a maximum of 21 a week – seems to confer health benefits. Heavy drinking is always bad for you.

Fighting
Brawling on the street or in the pub is never a good idea. You could get seriously hurt. You could get arrested. You could get shunned by everyone you know.

But studies show that training to fight in a controlled environment actually makes people less violent.

The research has largely been done with martial arts, but it may be true of boxing too. When you fight in a structured environment, you release aggression safely, connect with others socially, and give yourself something to do on boring nights when you might otherwise be out looking for trouble (if you’re that way inclined).

In other words, structured training in martial arts helps boys develop a better attitude to violence and aggression. Fighting – in the right way – was good for them.

Gambling
Gambling is undoubtedly bad for you if you become addicted to it or if you need to gamble to try and pay the rent. But moderate gambling, like your monthly poker night with friends, can be healthy in all sorts of ways.

In fact, research published in the American Journal of Psychiatry found that, among older people, gambling is a positive boon. It found that between 80 and 90% of all recreational gamblers over 65 claimed to enjoy excellent health, compared with just 62% of non-gamblers.

You may not be over 65, but the reasons the researchers found for this positive effect are relevant at any age. Gamblers were more stimulated (they enjoyed it – a lot) and sociable than non-gamblers.

So there it is. ‘Proof’ that being bad means you’re golden. Except when you either swear at work – get the sack, drink at work – get the sack, fight at work – get the sack, gamble your wages, end up stealing from work – get the sack. Or drink to much (leading to gambling), lose winning pot (leading to swearing at someone), end up in a rucus get punched (leading to fighting). Fighting leads to being charged with affray.

Moderation is the key.

Forward by email

Categories
Feeds Français

Connaissance du 17/12/2011

Le véritable prénom de Mr. Alzheimer était Alois.