nion's blog - hacks & code

noos

blog@ngolde.de (Nico Golde) — Thu, 28 Dec 2006 20:48:13 +0100

In the last 2 days Ak and me did a lot of coding stuff on noos at 23c3.

noos is a text mode RSS feed reader which has all the features missing from snownews and is not as slow as and has a different usability concept than raggle.

We found lots of bugs and implemented new features so the last 2 days were very productive.
At the moment noos depends on STFL for the UI, libmrss, libidn, libnxml and sqlite.

Installing noos is a bit tricky at the moment because of the dependencies. STFL is pretty easy to install, also sqlite.
What sucks is that mrss depends to nxml which wont compile in the latest version

So be sure to install and compile version 0.14 of libmrss and 0.15 of libnxml to make it work.
Dont forget to add /usr/local/lib to your /etc/ls.so.conf and run ldconfig afterwards.

You can get an svn snapshot of noos on:
http://nion.modprobe.de/noos-061228.tar.gz.

At the moment noos is able to:
- import and export OPML
- refresh feed content in the background (snownews can't, using pthread)
- read RSS 0.91, 0.92, 1.0, 2.0
- show only feeds with new content (like l in slrn)
- jump to next unread feed item
- save feed content to files
- open feed in browser (defined in ~/.noos/config -> browser lynx)
- mark feeds as read without actually reading them...
- nice rendering of the xml (see links and images.. like in second screenshot)
- many more things i forgot to mention

But noos still has some problems which can be tracked back to libmrss and libnxml.
For example some feed content can not be displayed correctly because libmrss doesnt
handle contend:encoded tag correctly (to workaround this use RSS 1.0 instead of RSS 2.0 feed if available) or an XML file like http://nion.modprobe.de/index.rss2 would crash because of an invalid pointer in free() in libmrss. Maybe they will be replaced by an own implementation or a better library.

There is still alot of stuff on the noos TODO list but its really usable yet and its definitely worth following the development.

If you use debian you can use the stfl package I made:
http://nion.modprobe.de/debian/stfl/libstfl-dev_0.7-1_i386.deb

P.S. some people asked me about 23c3, to make it short, I think it's not as good as in the last years (including the lectures) and the price of course is horrible

Detecting TOR users

blog@ngolde.de (Nico Golde) — Thu, 21 Dec 2006 17:04:38 +0100

Today I saw that there is a very simple but cool method to detect users of http://tor.eff.org/.
Of course Tor doesnt claim to be undetectable but encrypted an anonymous access to the web.

I hope noone uses this as a chance to deny access to web sites for anonymous users.
The test is pretty easy and is done via CSS and JS.

Test yourself: http://ha.ckers.org/weird/privoxy-test.html

[via ha.ckers.org]

Spaghetti Carbonara

blog@ngolde.de (Nico Golde) — Wed, 29 Nov 2006 18:47:09 +0100

I just asked a friend for a formula for "Spaghetti Carbonara" and thats what I got:

import Topf;
import Becher;
import Pfanne;
import Sieb;
public class SpagettiAlLaCarbonara {
private G spagetti;
private EL butter;
private G speck;
private G sahne;
private Stueck ei;
private Bissel salz;
private Bissel muskat;
private Bissel pfeffer;
private BisselMehr parmesan;
public SpagettiAlLaCarbonara(int besucher){
if (besucher<2) {
System.out.println("Alleine Gegessen wird nich!!!");
throw SingleUserException;
}
this.spagetti = besucher*500/4;
this.butter = besucher*1/4;
this.speck = besucher*150/4;
this.sahne = besucher*200/4;
this.ei = besucher*2/4;
this.salz = true;
this.muskat = true;
this.pfeffer = true;
this.parmesan = true;
}
public Essen kochen (){
Topf meinTopf = new Topf(new Wasser());
do {
meinTopf.erwaermen();
while (!meinTopf.getInhalt().kocht());
meinTopf.add(salz);
meinTopf.add(spagetti);
do {
meinTopf.erwaermen();
while (!spagetti.getInhalt().getZutatAt(2).istaldente());
Sieb meinSieb = meinTopf.getInhalt().abtropfen(new Sieb());
meinTopf.clean();
Pfanne meinePfanne = butter.auslassen(new Pfanne());
meinePfanne.add(speck);
do {
meinePfanne.erwaermen();
} while (Spck.gebraten());
G fooSahne = sahne*2/3,barSahne = sahne*1/3;
meinePfanne.add(fooSahne);
meinePfanne.add(muskat);
meinePfanne.add(pfeffer);
do {
meinePfanne.erwaermen();
} while (!meinePfanne.getInhalt().kocht());
meinTopf.add(meinSieb.getInhalt());
meinTopf.add(meinePfanne.getInhalt());
Becher meinBecher = new Becher();
meinBecher.add(barSahne);
meinBecher.add(ei.getEiGelb());
meinBecher.verruehren();
meinTopf.add(meinBecher.getInhalt());
double start = System.currentTimeMillis();
do meinTopf.erwaermen();
while ( meinTopf.getInhalt().nichtkocht() && (System.currentTimeMillis() -start)/1000<180 ); // Es darf nicht kochen !!!!
return meinTopf.getInhalt();
}

I just thought I dont like the Java coding conventions and some other "minor" glitches in the java programming
language but thats really too much. Damn Java. Thats what Java and university forms out of a harmless student.

w3bfukk0r 0.2

blog@ngolde.de (Nico Golde) — Sat, 21 Oct 2006 00:24:19 +0200

was just released a new w3bfukk0r version.

w3bfukk0r is a forced browsing tool, it basically scans webservers (HTTP/HTTPS) for a directory by using HTTP HEAD command and brute force mechanism based on a word list. Features:
HTTP/HTTPS(SSL) support
Banner grabbing
User-Agent faking
Proxy support (HTTP/S)
Reports found and non-existend directories

Note: Not all webservers are handling HTTP status codes correctly, so if the webserver doesn't care about RFCs the report generated by w3bfukk0r may include false positives. Maybe we'll find a good method to detect those false positives.

http://www.ngolde.de/download/w3bfukk0r-0.2.tar.gz

List of changes (CHANGELOG):

* w3bfukk0r 0.2 21.10.2006
- HTTP and HTTPS proxy support
- bug fixes
- it's now possible to specify more than just one URL to be scanned
- the man page has been rewritten
- a Doxyfile and doxygen source comments have been included
- support for the -p command line option has been dropped, use : instead

Google code search

blog@ngolde.de (Nico Golde) — Sun, 08 Oct 2006 13:21:29 +0200

BigBrother^WGoogle has released another cool search "plugin".
The Google code search is really cool. It has some nice features Koders doesn't have like searching with regexp.

It's just a bit more flexible and of course it has a way more search results.
Compare this and this.

But what really surprised me that Google also seems to extract files from tarballs. I didn't release the files of w3bfukk0r in a directory on a webserver and I think noone else did but the ubermighty Google will find it anyway:
http://www.google.com/codesearch?hl=en&lr=&q=w3bfukk0r&btnG=Search.

And they find even more, look at the following web interface:
http://www.google.com/codesearch?q=show:0GFmqDPt0Xo:JfoqLfp9gKo:pE69hVzivsU&sa=N&ct=rd&cs_p=http://www.ngolde.de/download/w3bfukk0r-0.1.tar.gz&cs_f=w3bfukk0r-0.1/list.c.

forced browsing with w3bfukk0r

blog@ngolde.de (Nico Golde) — Sat, 16 Sep 2006 17:15:37 +0200

We all tried to find a random directory on a webserver before in which we suspected interesting data without knowing if it exists (/tmp, /img, /data, /foo) and
index.html or whatever prevents them to be seen.
I had the idea that a tool which does this automatically would be cool and someone told me that this is a common technique called Forced Browsing.

However, I didn't find any tools which already implemented this.
The idea is simple, use a word list as brute force source and determine the presence of a directory by using the HEAD command implemented in HTTP.

I talked to AK and asked him if such a tool would interest him and he said yes so
we took a few days and wrote it.

The result is w3bfukk0r which implements it
for HTTP, HTTPS, does banner grabbing and is able to fake the user-agent string.

Download it on http://www.ngolde.de/download/w3bfukk0r-0.1.tar.gz

For nion.modprobe.de a scan would look as the following:

w3bfukk0r http://nion.modprobe.de
Starting w3bfukk0r 0.1
Scanning http://nion.modprobe.de/ with 76 words from words.txt

Found http://nion.modprobe.de/tmp/ (HTTP 200)
Found http://nion.modprobe.de/blog/ (HTTP 200)
Found http://nion.modprobe.de/img/ (HTTP 200)
Found http://nion.modprobe.de/setup/ (HTTP 200)

Found 4 directories.
Server runs: Apache/2.0.54 (Debian GNU/Linux) PHP/5.1.4-0.1~bpo2

Scan finished (5 seconds).

Ah we ship an example word list file.

AK found http://events.ccc.de/i/ using w3bfukk0r, someone from C3 has got a great humour

swebd project finished

blog@ngolde.de (Nico Golde) — Sun, 16 Jul 2006 18:46:07 +0200

It seems to be cool to write webservers at the moment AK is writing one and also fiveinch (fellow student) and me finished swebd which was the last homework of the UNIX course at university.

Swebd is a simple webserver written in C which supports compression of the content (zlib) and a simple administration interface.
http://ni.cs.tu-berlin.de/lehre/unix/ss06/swebd.html is the description of the task (in german).

Since we are learning for written tests at the moment the code could be a bit better (especially the authentification and the linked-list handling).

Check out the source at: http://user.cs.tu-berlin.de/~nion/swebd or use
wget --mirror --no-parent --convert-links http://user.cs.tu-berlin.de/~nion/swebd/

We developed it under Solaris, to make it compile under Linux remove -lsocket from the makefile.

XSS vulnerability in Google

blog@ngolde.de (Nico Golde) — Wed, 05 Jul 2006 20:48:56 +0200

The posting about an XSS vulnerability in googles personalized search leaves me only more lauging since my last post of the MemoryLeak #4 comic strip.

See a Proof of Concept by clicking here.

[via ha.ckers]

UPDATE: google fixed the vulnerability

Microsoft France got pwned

blog@ngolde.de (Nico Golde) — Sun, 18 Jun 2006 19:53:38 +0200

A Microsoft France website was defaced:

(click me)

http://experts.microsoft.fr/default.aspx

Thanks flosch for the hint.

STFL - Structured Terminal Forms Language/Library

blog@ngolde.de (Nico Golde) — Sat, 17 Jun 2006 22:01:27 +0200

Clifford Wolf implemented another cool thing:
STFL is a library which implements a curses-based widget set for text terminals. The STFL API can be used from C, SPL, Python, Perl and Ruby. Since the API is only 14 simple function calls big and there are already generic SWIG bindings it is very easy to port STFL to additional scripting languages.

A special language (the Structured Terminal Forms Language) is used to describe STFL GUIs. The language is designed to be easy and fast to write so an application programmer does not need to spend ages fiddling around with the GUI and can concentrate on the more interesting programming tasks.

The STFL documentation can be found here.

I havent tried it yet but it definetly seems to be worth a try.

Managing bookmarks with files and windowmanager #2

blog@ngolde.de (Nico Golde) — Tue, 16 May 2006 19:37:44 +0200

Here I talked about my idea to use a textfile to handle bookmarks and the wmiiplumb (now wmiipsel tool) to write them to a file.
Julias Plenz did some modifications and now I adapted the script to wmii-current (aka wmii-3 in a few days).

Download the new bookmark script on:
http://nion.modprobe.de/bookmark.sh

So far so good, now I took over garbeams idea to use it with wmiimenu to display them and its really a pleasure.
wmiimenu is a generic, highly customizable, and efficient menu for the X Window System, originally designed for wmii(1). It supports arbitrary, user defined menu contents.
The cool thing is that I call a keybinding in my WM now and I can type parts of the URL or TITLE to get the link and press ENTER. Then opera opens it in a new tab.
Show me one bookmark handler in a browser which offers you soo much comfort
This simple thing is done with:

#!/bin/sh

TEMP=`cat $HOME/bookmarks.txt | wmiimenu | sed -e 's/.\+\ :$.\+$$/\1/g'`
/usr/bin/opera -newpage "$TEMP"

Managing bookmarks with files and windowmanager

blog@ngolde.de (Nico Golde) — Thu, 23 Feb 2006 22:30:13 +0100

I hate the bookmark option of firefox & opera. With some thousand bookmarks they are difficult to maintain and
the browser becomes slow if you want to open them. I want to have all bookmarks in a single file on which
I can operate with grep and other UNIX-tools.

For this I wrote a little shell script, get it on:
http://nion.modprobe.de/bookmark.sh

Mark an URL in your browser and then execute the script. The script uses the URL, downloads it, parses title
and writes the page title and URL into a file. It gets the URL using wmiiplumb from the
window manager wmii.

wmiiplumb only prints selected strings in X to the standard output and can be
used with every window manger, it only depends on the Xlibs.
For those who have no wmii installation get a copy of wmiiplumb on:
http://nion.modprobe.de/wmiiplumb.c

and compile it with:
gcc -L/usr/X11R6/lib -L/usr/include/lib -lX11 wmiiplumb.c

If you use wmii you can modify your ~/.wmii-$version/wmiirc
and for example add a line like:
kbind normal $MODKEY-b 'extern /home/nion/bin/bookmark.sh'

Now if you press ALT+b and an URL is selected it will grab the title and write it with URL to ~/bookmarks.txt
As a matter of course this can be used with other window mangers too.

Easy way to attach files in mutt/ng

blog@ngolde.de (Nico Golde) — Thu, 26 Jan 2006 18:20:39 +0100

My hero of the day is sec.

I guess all mutt/ng users know the problem that they forget to attach files to a mail because they don't think of it after writing it.

map __a_start :imap <C-V><CR> <C-O>__a_cmd\|imap <C-V><ESC> <C-V><ESC>__a_end\|imap <C-V><C-V><C-V><C-I> <C-V><C-N>\|imap <C-V><C-N> <C-V><C-X><C-V><C-F><CR>
noremap __a_end :iunmap <C-V><CR>\|iunmap <C-V><ESC>\|iunmap <C-V><C-V><C-V><C-I>\|iunmap <C-V><C-V><C-V><C-N><CR>dd`a:"ended.<CR>
noremap __a_cmd oAttach:<Space>
noremap __a_scmd 1G/^$/<CR>:noh<CR>OAttach:<Space>
map ,A ma__a_start__a_scmd

This vim mapping auto-inserts the pseudo "Attach:" header to your mail which has a file as argument. You can also use to do file and path completion.
Be sure the the edit_headers option is set in your mutt/ngrc. You use the mapping with ,A and mark the end of it with .

Sec used ,a for this, I am using ,A because I am already using the great

map <LEADER>a G/^* /e+1<CR>ye1G}oHallo <c-r>",<cr><ESC>

mapping to greet the other.

Ipod doom/half life in action

blog@ngolde.de (Nico Golde) — Wed, 18 Jan 2006 17:48:13 +0100

In the past I talked about doom on an ipod.
Today I got a link of a video with an ipod on which doom is installed the the Half Life game files are used.

See this pretty impressing video on:
http://www.2loop.com/videos/halflifenano.shtml

vim for programmers

blog@ngolde.de (Nico Golde) — Thu, 15 Sep 2005 15:09:58 +0200

Today I told ak about some nice vim functions which are usefull for programmers (especially C) and it seems that not
everyone knows about them.

The first thing I would like to mention is % which jumps from an open brace to its matching close brace. It does work for for #ifdef #endif too (Of course they are considered as bad coding style).

gd is most usefull for me. I need it very often. It jumps to the declaration of the variable which is currently under the cursor. For example if your cursor is on ch=getch(); and you press ESC gd it will jump to char ch; and you will see that ch is a character.

* and # are very nice too cause they do a search for the word under the cursor, forward and backward.
gf can be used if you want to open a header file which is included without opening a new screen window or to go to the vim command line. It opens the file under the cursor so pressing it if you are on #include "foobar.h" will open foobar.h if it
is in the same directory.

Hope this helps, they are a must use for C programers