Me n My Perspectives

Idea:

Understand and explain the OWASP compiled most critical security risk to web applications in a series of posts.

What is OWASP?

OWASP - Open Web Application Security Project, an online community working to contribute in the field of web application security. OWASP releases standard awareness documentation containing information about most critical security risk for developers and web application security.

Background:

I am a web developer by profession. Security is always a critical aspect to consider when developing any application, specially web-based application.

OWASP - Open Web Application Security Project is a go to place for web application security. I have always thought of going through the concepts thoroughly, but never got a chance to. I am taking this idea of something-awesome as an opportunity to go through the OWASP in details myself, do some research, and explain the concept in simpler terms with relevant examples where necessary.

This way I will involve myself in cyber security literacy, and build my security engineering skills, at the same time sharing with others in simpler language will help others learn without being overwhelmed.

Action Plan:

I will host a series of posts on “web application security 101″. This will act as security stepping stones for web-application development.

Every week I will be posting the concept, its implementations along with relevant examples where necessary.

Criteria

* Pass: At least a post on security topic from OWASP every week.

* Distinction : All OWASP Top 10 explained along with example where relevant.

Contingency Plan:

wget is a network downloader,  so we can use it to download files from internet. Using wget, you can download webpages, download multiple files, download large files, you can also save offline copy of the webpages and many more. Here, I have covered simple usage and commands of wget which introduces you to wget.

You can download and save any particular webpage / file:

wget DESIRED/URL/PATH

This downloads the file pointed by the location 'DESIRED/URL/PATH'.

If 'DESIRED/URL/PATH' is webpage, it downloads and saves the page

& if 'DESIRED/URL/PATH' is a file, it downloads the file and saves it.

You can give a new name to the file you are downloading:

wget -O newfilename.tar.gz DESIRED/URL/PATH/TO/FILE

When you are downloading the file, without renaming, it will take the default name (FILE) from the DESIRED/URL/PATH/TO/FILE, and you might not get the proper file name or extension of the downloaded file. So, you can rename the file to be downloaded with proper filename and extension.

You can specify bandwidth limit to the file being downloaded.

wget --limit-speed=100k newfilename.tar.gz DESIRED/URL/PATH/TO/FILE

This limits the speed of download or bandwidth for downloading the file to 100kb/s. (Helpful to download large file.)

You can also resume your old, interrupted / incomplete download with -c option.

wget -c --limit-speed=100k newfilename.tar.gz DESIRED/URL/PATH/TO/FILE

No worries if your download got interrupted and leave you with incomplete file. This will help you resume your old download. But make sure that you typed the same filename and are in the same path. (Helpful to download large file.)

You can also download multiple files using wget. All you need to do is write the list of path in a file and specify the file as follows.

wget -i my_download_list.txt

Make a file my_download_list.txt with the list of URLs separated into different lines. And it will download each of the files mentioned in the list. Make sure, each URLs are in a different line (Helpful to download multiple file.)

You can also download webpages and save for offline views.

wget --mirror --convert-links DESIRED/URL/PATH

This converts the dynamic contents of the website to static and saves a local copy for offline view.

Finally, you can run the downloads in background with -b option:

wget -b DESIRED/URL/PATH

This will run the downloads in background, and the progress is updated in a log file wget-log. So, you can monitor the progress with the following command.

tail -f wget-log

This will automatically update and show you the progress.

Following is the easiest way to install pip or start using virtual environment, straightaway without installing virtualenv.

It is a good idea to install pip to a virtual environment which is different from the system and doesn't directly install python packages to the system python, so is a good choice if you work on multiple projects and are installing different python packages or different versions of python packages for different projects. You can refer to what-is-virtual-environment-why-is-it-needed for basic understanding about what is virtual environment and why is it needed, what is virtualenv, what is virtualenvwrapper.

To use pip, it is not mandatory that you need to install pip in the system directly. You can create a virtual environment and use it through virtualenv. What you can do is follow these steps:

download virtualenv tar.gz file from [https://pypi.python.org/pypi/virtualenv][1]

unzip it with 7zip or some other tools

We normally need to install python packages for one particular project. So, now create a project folder, lets say myproject.

COPY **virtualenv.py** file from decompressed folder of virtualenv, and PASTE inside **myproject** folder

Now Create Virtual Environment, lets say **myvirtualenv** as follows, inside **myproject** folder:

python virtualenv.py myvirtualenv

It will show you:

New python executable in myvirtualenv\Scripts\python.exe Installing setuptools....................................done. Installing pip.........................done.

Now your virtual environment **myvirtualenv** is created inside your project folder. You might notice, pip is now installed inside you virtual environment. All you need to do is activate the virtual environment with following command.         (for windows)

myvirtualenv\Scripts\activate

        (for ubuntu)

source myvirtualenv/bin/activate

You will see following in the command prompt:

(myvirtualenv) PATH\TO\YOUR\PROJECT\FOLDER>pip install package_name

Virtual Environment is an environment decoupled from the main system or the physical machinery and delivers computing resources separately within the environment.

In python programming, we use different python packages created from different sources for different projects we work on. What we normally do is install all the packages to the system python. But, not all packages are required by all projects and different projects might need different versions of same python packages. Also, some requirements can be only specific to a single project. And, as the projects and requirements grow, the site-packages installed in system grows clumsier. One clean way to avoid this issue is the concept of virtual environment.

With Virtual Environment in python, what you can do is separate out a different environment where using the same system python, (i.e. you link the system python, and) you can install project specific packages into it. So the packages you install to each virtualenv are independent and decoupled from the packages installed in the system and independent to other virtualenv's. You can create multiple virtual environments, may be one for each project or reuse same virtual environment for multiple projects.

For example, you can create a virtualenv for project1 where you use django1.3 and project2 - django 1.4, or project3 - django1.5 or any other packages with different versions independently for individual projects and work independently in each of the projects at the same time. Finally you will get:

project1 - runs django1.3 and other packages

project2 - runs django1.4 and other packages

project3 - runs django1.5 and other packages

and each are independent to one another.

What you get with virtual environment is an isolated working copy of python along with the packages to be installed for one particular project, and you can make multiple of such isolated copies which work independent and does not affect the other.

  Why is virtual environment is needed in software development?

There are multiple cases where virtual environment comes handy

If you are working on a share host where you are not allowed to mesh with the system, you can still install the python packages in your own environment.

If all packages are installed in the system python, everything gets messed up. Though the project is running smoothly, any changes in the library packages, will result in inconsistent state of the system/project you are working on.

  What is virtualenv and virtualenvwrapper?

virtualenv is a builder for virtual python environment that helps you create virtual environment independent to the system python and separates out the libraries, site-packages from system or other virtual environment.

You can download virtualenv from https://pypi.python.org/pypi/virtualenv.

virtualenvwrapper is a wrapper built around virtualenv so as to provide easy interface and easy command line utilities that provides convenience (offering new, helpful commands) in working with python virtualenv.

You can install Dropbox to Ubuntu via terminal in easy steps.

Go To Terminal [Ctrl+Alt+T]

Paste the following Command to add repository key of Dropbox:

sudo apt-key adv --keyserver pgp.mit.edu --recv-keys 5044912E

Paste the following Command to add repository of Dropbox

    (for 12.10-Quantal and 12.04 Precise)

sudo add-apt-repository "deb http://linux.dropbox.com/ubuntu precise main"

    (for other Ubuntu versions, you can also write generic code)

sudo add-apt-repository "deb http://linux.dropbox.com/ubuntu $(lsb_release -sc) main"

Paste the following Command to update your repository and install dropbox:

sudo apt-get update && sudo apt-get install nautilus-dropbox

After installation complete the dropbox settings & restart the nautilus (i.e. the file manager) Dropbox for other Linux Versions You can also install the Dropbox via dropbox daemon for all 32/64 bit linux servers as follows:   (for 32-bit)

cd ~ && wget -O - "https://www.dropbox.com/download?plat=lnx.x86" | tar xzf -

  (for 64-bit)

cd ~ && wget -O - "https://www.dropbox.com/download?plat=lnx.x86_64" | tar xzf -

This downloads and extracts the dropbox daemon for linux.   Now, you need to run the Dropbox daemon as follows:

~/.dropbox-dist/dropboxd

RSA keys (public-private key pair) are required to authenticate your computer in order to access some resource via ssh. It helps you to avoid entering password each time you are trying to access the resources. Following is the quick way you can generate RSA keys and used it when required.

Check for already available SSH Key

        Go to Terminal (for Linux) / git bash (for windows)

cd ~/.ssh

        You can also check in the default location for windows i.e. 'C:\Users\<username>\.ssh\' folder

Generate RSA Key / SSH Key

ssh-keygen -t rsa -C "your@email_id.com"

        Gives following output:

Generating public/private rsa key pair. Enter file in which to save the key (/home/<username>/.ssh/id_rsa):

        Press Enter for default location. Then, it gives following output:

Created directory '/home/<username>/.ssh'. Enter passphrase (empty for no passphrase):

        Press Enter for no passphrase. (Passphrase is used for extra security purpose, if you enter a passphrase, you either need to re-enter you passphrase everytime ssh authentication is made or, use 'ssh-agent', a tool to manage the passphrase.)

Enter same passphrase again:

        Again, Press Enter. You will have following output.

Your identification has been saved in /home/<username>/.ssh/id_rsa. Your public key has been saved in /home/<username>/.ssh/id_rsa.pub. The key fingerprint is: bla:bla:bla:bla your@email_id.com

Congratulations! your RSA key is not successfully generated and stored in home folder.

Add Public RSA Key / SSH Key to your Account

Now, you need to copy 'public key' from RSA key pair (contents of 'id_rsa.pub' file) and paste it into your online account or server. All you need to do is:

cat ~/.ssh/id_rsa.pub

and copy the content displayed up to your email_id, then paste it where you need to. Now you are DONE.

For the first time, ssh authentication is made, the following message can be seen, go ahead and type yes and enter, then that host will be recorded in a file: known_host in ~/.ssh/ folder for later reference

The authenticity of host 'blablabla.com' can't be established. RSA key fingerprint is bla:bla:bla:.... Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'blablabla.com' (RSA) to the list of known hosts.

Why is SSH keys / RSA keys required? How does it work? Lets see, what happens and clear out the concept of ssh authentication using RSA keys...

You generate unique RSA keys pairs i.e. public key and private keys, both are by default store in separate files in .ssh folder inside home i.e. (/home/<username>/.ssh/) 'id_rsa' is private key whereas 'id_rsa.pub' is the public key. You need to copy-paste the content of id_rsa.pub (the public key) to external resources wherever required whereas keep the private key secret. Now every time you perform ssh request, ssh authentication runs during which, the public key you had pasted in external resource makes a match against the private key stored in you computer. If the authentication is successful it allows further access via ssh. Enjoy! If not, recheck you keys in 'id_rsa.pub' and paste it to the external resource.

For further details on How Public Key Cryptography Works? Go to 'Introduction' and then straight to 'how it works?' and 'Description' Section.

To install Google Chrome or Chromium Browser in Ubuntu 12.10, Ubuntu 12.04, Ubuntu 11.10, or Ubuntu11.04, you can follow the instructions below:

Installing Google Chrome

For Google Chrome,

Go To Terminal [Ctrl+Alt+T]

Paste following (to download debian package):

        (for 32-bit)

wget https://dl.google.com/linux/direct/google-chrome-stable_current_i386.deb

        (for 64-bit)

wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb

        To find Ubuntu 64-bit / 32-bit, look in another section below.

Paste following (to install the debian pacakge):

sudo dpkg -i <google-chrome-package-name.deb>

[Replace <google-chrome-package-name.deb> with package downloaded.]

If anything goes wrong with installation, Paste following (to force the installation):

sudo apt-get install -f

  How to find out 64-bit or 32-bit Ubuntu?

Goto Terminal ( [Ctrl+Alt+T]) and Type the following command

uname -i

        x86_64 means 64-bit ubuntu

        i386 means 32-bit ubuntu

  Use Chromium Browser instead of Google Chrome

You can also install open source Chromium Browser instead of Google Chrome. They are basically same and support common the extensions. For Chromium Browser,

  GoTo Terminal [Ctrl+Alt+T]

  Paste following:

sudo apt-get install chromium-browser

Late night sleep had some hangover when I woke up. I didn't get out of the bed until I felt it was late. Then, I rushed to the room 101, where our team had agreed to meet before splitting up last night. Reaching the room 10 minutes late, I still found that the room had nobody other than a single guy who slept there, Subodh. In a while the team was back. Then we tried to wrap up our discussion points as soon as possible still managing to discuss some more. We were preparing in our own way, making up the points for ourselves. Since there was a risk that the facilitator could pick anybody from within the member to express the conclusion of the discussion, we shared our views on, which points not to be missed.

Finally, it was time for breakfast. I could see people flooding into the hall in hurry. I was exactly on time. We sat for around five minutes discussing on some new ideas that arouse our mind which could support proper expression of our ideas. Then, brought our breakfast. We were all set for concluding remarks, with our breakfast plate in front of us. The tables and chairs in the dining hall had an conference arrangement. Our team got the last chance to present our understanding. And the name of probably the youngest member in the whole Arthalaya was called out. Though, he presented better than I had expected. I'm happy about that. He is Prakash. But, the way we completed our overall explanation was not that effective. The session already extended five minutes beyond its schedule. We were then informed of 2 minutes time to reach conference hall. I had asked for 5 minutes,  and reached the hall at exact 5 minutes time, but later realize that my request was not audible enough for facilitator to notice. So since I was found 3 minutes late, I was fined with Rs. 30 @ NRs. 10/min (Thank god, we had only set the charge @ 10).

That session was 'The Story of an Entrepreneur', it was really nice where a real life entrepreneur was sharing his experience about how he has become what he is right now. His beginning days, struggling periods, achievements and extensions, how he stayed focused and patient were some major points the session highlighted. He mainly presented all of his stories which were somehow comparable to the characteristics of the entrepreneurs.

We enjoyed the session a lot. Right after that we had short refreshment followed by Possibilities for a Prosperous Nepal by Robin Sitaula, a creative resource person and also the CEO of Samriddhi, The Prosperity Foundation. He brainstormed and overwhelmingly flooded us with prospects of business in present Nepali context. At the moment we are blaming the situation, but there are lots of opportunities all around us because of this situation, all we need to change is our perspectives. Thinking out of the box was important. He encouraged us to look problem as an opportunity, and that every enterprise has to be created around the PAIN (realized need was what it actually referred to). And that can only serve the real need of people. One has to put some efforts to add some value to the product chain to become a part of the chain and ultimately successful and satisfied. The session was fully enthusiastic, we were being offered a lot wrapped in a small package. By the end of the session we were really exhausted trying to catch up with his rapid fire ideas, and our situation was well accompanied by hunger. A stream of participant headed straight to the dinning hall then had lunch there. The stream made me realize that I was not only the one feeling that way.

After an hour break, we gathered to continue with the next session which was 'What motivates People?' Something refreshing could be our answer, if we were asked. There was the answer, not really the answer we had expected, but not bad, for everybody loved it. Curious about the answer, alright, 'Chocolates' was actually the answer. After the session, we had a tea break. Then, we had refreshment with a team building game. It was naming and passing game. Details of game in the later post. The next session was on Economic Freedom. The session was information and research based, so was pretty much informative. Right after the session we had a long free time, something that we were desperately craving for in Arthalaya. We used this free time to broaden our business.

Some friends had organized documentary, which seem to be a grand success. Pani puri and head massage seemed second most promising business on day2. Of course, our game, Ping Pang Pong also could accompany large number of participants and yeah that means good collection of money from business perspectives.

Woke up later than usual, had watched a movie last night celebrating my brother's birthday. Rushed to complete all the daily works soon. Had left my phone on the bed. Found 2 missed calls and a caring message. Replied it with a call. Had done nothing in preparation for Arthalaya, 5-6 day long workshop. Need to reach the office of Samriddhi @ 12 sharp. After the meal, I started packing and getting ready. Somehow, I managed to reach the office on time. There I met, lots of people, some of whom I had known earlier during the group discussion. I noticed that besides one, all of the members of our group discussion were selected for Arthalaya. We waited for about an hour, then headed to Dhulikhel where we were to stay for next 5 days. In the bus, we enjoyed interacting and joking with new friends and knowing more about one another. I helped put everybody's luggage and get them off the bus from its top.

Before we noticed, we were there at Dhulikhel Village Resort. The Arthalaya had begun. As we entered the conference room, we had a short introduction on what we were going to do that day. Then we were allotted the room to be shared among a group of 3. We had just 15 minutes time to reach back to the conference hall, and we needed to put our stuffs to the allocated room, have tea and snacks within the allocated time. We realized, our hasty schedule had begun.

We  rushed to the hall, then the formal session began with the introduction (introduction game) - enjoyed it, rule setting - setting trap for self, brainstorming and setting up business firm, (which had to be registered right after the dinner). The business was the actual simulation of how business is done by a company in the real world. The concept was awesome. Shall describe the company and business simulation further, later. Everything here was new to me, beginning from location, food, and environment, reaching to concepts, things to be done as well, and almost everything was just so different and yes, that includes participants who were unique, too.

We had some talks in search of team members to get together to register a company, team selection, discussion about the firm to establish, which had to be decided right after the dinner. A group of four was formed, however, the idea of business was absolutely new, so we were not much clear about what to register for. The decision point was approaching nearer, meanwhile the time for our dinner was coming to an end. We had our dinner under pressure, and finally, concluded somehow to get a "One Stop Solution", company registered, trying to make our business scope as flexible as possible, having to deal with both product and services. After the dinner, the company was registered. The session of that day was coming to an end. All of us seemed so happy for there was only half an hour more to go after a tiresome day, to let our body meet the bed as per its request.

Absolutely tired after the travel and the days session, before we could take a long sigh of comfort, we were again assigned with the article reading and group discussion assignment. We needed to get our newly prepared team ready for the summary presentation task tomorrow during breakfast. Right after the announcement of end of the sessions for the day, we a team of 6 came to a friends room and started to read, as my room was locked from inside and the key we were provided with was not working on the door. Finally, somehow we discussed a little and managed to escape the first day of torture. Back to my room, we 3 of us, got ready to sleep. As per my words, I turned on my laptop to start typing my experience of first day in Arthalaya, to keep the records.

The internet connection was not working, so I started to type my diary, a friend of mine was not asleep, so we started talking. He was a small guy, seem to be serious and quiet till then, but was concealing his fun filled and friendly nature. To my surprise, he had returned back to Nepal just 3 months back, after his 4 to 5 years stay in Australia.

We had a talk about the life in Australia, how much he missed, how he dealt with different situations he faced, some of them included his happy and masti in life and some of them were of course his tough times in the foreign land. I found him very friendly. According to him, while in Australia, he used to helped other new comers from his homeland to the new land in the way that he would have been really grateful of if somebody had done for him during his beginning days. And I do believe him. He told that he earned money and spent extravagantly at times, and sometimes, was also completely broke, even to cover his daily meals. Though, people earned huge sum, the definition of happiness in there was actually really confusing. He was not so sure if he was happy or others living in there were, specially concerning about the foreign students.

Met Alok, my friend, at KIST Talk Show which was co-organized by Samriddhi, The Prosperity Foundation and organized by KIST Bank. He told me if I would apply for Arthalaya, today was the extended deadline. I looked at the registration charge, Rs. 5000/- was highlighted. I exclaimed, five thousand... and instantly it was out of my thought. He mentioned that scholarship was also available. I looked at the form, it had 50-70%, 30-50% and 0-30% scholarships. Ok not bad, if you can get me 70% scholarship, I told. Both of us laughed. After I entered the hall, I had a talk with an Arthalaya graduate, who had attended the program @ 700 NRs. He told it was worth 5000. Alok had also explained how were they covering the event with low charges and that the price might increase in coming up batches and the recommended me to participate telling that it was a very good program for person like me. During the talk show, I got the form and started filling in. Later I realized that I need to write an essay in 500 words about 'How Nepal could be Prosperous.' I stopped filling the form. After the program I met Alok and told him if I could complete the form online and the essay before midnight, then I shall certainly apply for it, since there was loadshedding problem. We got separated and was back home in the evening. I talked to my brother, a previous Arthalaya graduate and my sponsor, about participating and the charge. I found him positive and challenged if I could complete it by the deadline which was few hours from then. I started typing the form entries. Thank god, there was power supply late in the evening. I completed my essay, downloaded the form and filled the entry finally applied for Arthalaya. It was about 11:40 pm. And I was happy and waiting for selection.

On Saturday, I received a call telling that I was selected for the group discussion and interview, which were scheduled for Sunday, 10:30am and I needed to reach Samriddhi, The Prosperity Foundation office.

Unlike my usual habit of getting late, I reached earlier this time, introduced to the people sitting around the library table and reading newspaper. Something interesting happened during introduction. Shall talk about it later. The temperature was normal but I was feeling extra cold and shivery. I was completely unknown what made me feel that cold, but definitely not the weather, it was warmer than previous days. So I decided not to take my bags off so as to keep myself warm. After a while, Sandeep entered the room handing us the sheet to mark our attendence, there I realized that some of the friend who were supposed to be in my group, Group A, had still not arrived, I took a breathe of relief, some people are later than me.

I was calm and composed for the group discussion. We were called above, seated around the conference table, with 3 evaluaters from Samriddhi. The discussion was like a role play, in which we were given the topic and 6different stakeholders to represent and we were supposed to express our views from respective viewpoint on the topic. After a brief introduction of one another, we were presented with the topic 'Private Schooling System'. Though it started calm, in a while we were reprimanding one anothers view. As the discussion was getting, we were informed of 2 or 3 remaining minutes. Then, soon we managed to avoid rambling recrimination and organized the discussion to the conclusion. We picked points to be included as a summary, and took turns expressing our view. There was a boy, whom I had noticed trying to say somthing time and again but had not gotten a proper chance, since others voice ...SUPERIMPOSE..or..OVERRODE.. that of his. And again this time during our concluding points, he was trying to express his point, but he was stopped as we were taking proper turns, anticlockwise, and it happened that he was the last person to have his say. You can easliy guess that he didnt get a chance to conclude his point, as everybody had a lot to say in limited time trying to strengthen their roles and points. The time was over. I felt a bit bad about that he didnt get a chance, since I was a bit dominant during the discussion. Now it was time to give the concluding remarks within a minute time. Again, as I had drafted the points, I asked others and stood up and this time I think, I finished it on time and asked the guy to put his points, if anything I didnt covered. The boy was Prasanna. And I felt happy that I gave him a chance.

As we came out of the group discussion, Mochan hinted me of my dominance, which I had already realized (Ok, that was Mochan who made the introduction a bit interesting. I was introducing to everyone around the table, and now I was shaking hands with him. I spoke, "Hello, Im Gauraw.". He was mute. Then smiled a bit and with eyes looking at me in a familiar manner, he kept quiet and started thinking, I guess. I paused and waited for reaction. He told, "Gauraw, right.". I told yes, there was no point in getting my name correct as I had already told it several times. Then he smiled again and acted in a manner that he had something to say, and that thing was just not coming through, may be blocked in the throat then finally added, "Gauraw Dhakal !!!". Totally wrong. I told, "Im sorry, Im Gauraw Rijal.". He repeated, "Oh yeah Gauraw Rijal.". By this time, I found him, from his facial expressions-as if he knows me well and mistakes he made in recognizing me, pretty humurous character. Though I controlled myself and told, "Eh ok, do you know me, ...?". "Mochan.", he replied and added, Rotaract Club of Dillibazar. Ok, he had a point. Yes, we had met earlier also. I thanked my memory for that.). He also told me that my points might decrease in leadership as I didnt listen to others properly.  I thought he was right. But agian, to some extent, I dont feel it as my fault because, I had a lot to say and the way others presented was passive and they didnt seem to be that enthusiastic and exciting. After that we were called for interview. I was in hurry so I left the office immediately after the interview.

It was Monday afternoon, I was waiting for a call from Samriddhi office but the phone was with my dad, my phone rang. But as he was getting it to me, the call ended and I missed the call. :( I looked at the number it was unknown number. May be it was from Samriddhi, I was completely confused about what to do, call them back or not. Also that I was not so sure that if it was Samriddhi. While I was not being able to decide what to do, the same number blinked on my mobile screen again. I instantly picked it up, I found the sound from the other side so soothing, as it selected me and requested me to complete the registration by Tuesday 5:30pm.