Learning SQLMap

SQLMap - Automatic SQL injection and database takeover tool. The tool is easy to use and execute tests. This post SQLMAP TUTORIAL FOR WINDOW 7 provided test sites to run tests using SQLMap

Steps are 

1. Python already installed (On my Win7 had python already installed)

2. Execute the tests against the test site provided (DB tables, results will be listed)

3. Listing DB's

4. Listing Tables

Many thanks for darkassassinscybercrew for sharing the test sites.

More Read - GUI for SQLMAP is available in link
Automated Security Testing of web applications using OWASP Zed Attack Proxy

Database protection Techniques : a different prespective
Introduction To SQLmap And Firewall Bypassing
Website Hacking - SQL Injections - Sqlmap Introduction

Happy Learning!!!

java de-compiler

Yet another short post from today's learning from Ambuj. Java Decompiler

1. Download Java Decompiler from link
2. Extract and run the exe
3. Drag and Drop the class file to see the source code

Actually, This article (Is Amazon hacking our apps? Or doing us all a security favour?) prompted to try out java decompiler. Working with Ambuj made it easier to learn in few steps.

More Reads - JProfiler (Similar to SQL profiler capture events running in your JVM)
JProfiler - Good Demo

Happy Learning!!

QA Free tools - Bug Tracking / Password Management

Redmine - Bug / Issues Tracking

This post is about using redmine for bugs / issues tracking. I was introduced to this tool by my colleague Ambuj. It was pretty easy working with the tool. This tool was pretty useful in terms of logging bugs / issues / reports / bug updates / notifications.

Verdict - Try it, Very Useful.

Password management tool - Password Dragon. This will be a good option for DBAs / SysAdmins to store password safely.

More Free Tools
Top 15 Free Tools Which Make Tester’s Life Easier
Jagger is a free application suite for continuous performance testing

More Reads

• Installing Redmine on windows
• Comparison of web-based bug tracking tools
• What functionality does JIRA provide which is not available in Bugzilla?
• Top 10 Open Source Bug Tracking System
• Spoonium Online Selenium Grid

Happy Learning!!!

Security Testing - Learning Resources

Next reading list for Security Testing

• Pentesterlab bootcamp tutorials
• Game Over: Damn Vulnerable Web Application
• SQL Injection - Mozilla Security Learning Center
• Virtual Security Lab Setup - OWASP Broken Web Apps, Webgoat, & ZAP
• SQL Injection
• Databases—Vulnerabilities, Costs of Data Breaches and Countermeasures

Apps to perform live security Tests

• Damn Vulnerable Web Application
• OWASP Broken Web Applications Project
• Pentesterlab exercises
• OWASP Broken Web Applications VM Video Walkthru

More Reads

• Deep End Research
• .NET Penetration Testing Cheat Sheet
• Bruteforce vs Denial of Service
• Stackexchange Security is good start for security related questions
• Video: Building Custom Android Malware for Penetration Testing
• Intercepting SSL traffic using WebScarab

Happy Learning!!!

Test Automation Framework Series

[Previous Post - Test Automation Framework Using Selenium - Part IV]

This is in continuation with Test Automation Framework Series. After 3 years I found step-by-step framework examples. As you see this reflects my stack overflow answer (Build first, Iterate and Improve). Rest of cleartrip test series / code improvements are covered in ClearTrip Tests (Very Good Walk through)

Project 1 - Selenium examples
Project 2 - ClearTrip Test. Downloaded and compiled the project. This list of 13 tests are great examples

I had also posted cleartrip automation assignment  earlier. (My incremental learning series :))

Another interesting post in similar lines - Evolution of Software Engineer. In the similar fashion Automation Framework Exercise evolves based on continuous feedback

Very Interesting slide from presentation in link. Similar to my learning path :)

Github Test Automation projects
Test Automation Framework (TAF)
Git Code

Selenium Test Framework
Selenium Test Framework

Happy Learning!!!

Free Tool - Managing System, Environment Variables using Rapid Environment Editor

While managing servers / different environments we keep upgrading environmental variables, custom paths. Rapid Environment Editor tool is very useful for managing this job. It highlights invalid paths to quickly fix them.

While setting up eclipse, this environment issues pop up, this editor was useful to fix issues.

Happy Learning!!!

Interview Question - Maximum Palindrome Substring in given String

Some candidates write logic, working code, impressive ideas. This question 'Maximum Palindrome Substring in given String' I got a good answer during one of interview discussions.

I tried the same in codepad link. This is C++ code. The solution code is

int main()

{

    char inputname[50] = "aaabbaa";

    char match[50];

    char temp[50];

    char revtemp[50];

    int length = 0;

    int currentpalindromelength = 0;

    int maxpalindromelength = 0;

    int palstart=0, palend=0;

    int i,j;

    for(i = 0;inputname[i] !='\0'; i++)

    {

        length++;

    }

    printf("length is %d\n", length);

    for(int ipos = 0; ipos  < length; ipos++)

    {

        for(j = ipos+1; j < length; j++)

        {

            int startpos=0;

            for(int k = ipos; k < j; k++)

            {

                temp[startpos++] = inputname[k];

            }

            temp[startpos] = '\0';

            printf("string to compare %s \n", temp);

            startpos=0;

            for(int z = j-1; z >=0; z--)

            {

                revtemp[startpos++] = inputname[z];

            }

            revtemp[startpos] = '\0';

            printf("reverse string to compare %s\n", revtemp);

            int result = strcmp(temp, revtemp);

            if (result == 0)

            {

                    printf("Both strings are equal \n");

                    currentpalindromelength = 0;

                    for(int iCur = 0;temp[iCur] !='\0'; iCur++)

                    {

                        currentpalindromelength ++;

                    }

                    if(currentpalindromelength > maxpalindromelength)

                    {

                        maxpalindromelength = currentpalindromelength;

                        palstart = ipos;

                        palend =j;

                    }

            }

            else

            {

                  printf("\nBoth strings are not equal \n");

           }

        }

    }

    printf("max palindrome length is %d",maxpalindromelength);

    printf("start pos is %d\n",palstart);

    printf("end pos is %d\n",palend);

    for(int k = palstart; k < palend; k++)

    {

         printf("%c",inputname[k]);

    }

    printf("\n");

    return 0;

}

This worked for multiple cases. codepad is very good!.

Happy Coding!!!

Frequently Used Scripts & Notes

TSQL Reusable scripts - bookmarking the same

Tip #1. What is the command to truncate a SQL Server log file?

Tip #2. Settings to Capture Deadlock Trace in SQL Server Logs
DBCC TRACEON (1204, -1)
DBCC TRACEON (1222, -1)

Tip #3. Checking SQL Server Version

select SERVERPROPERTY('productversion'),SERVERPROPERTY('productlevel'),SERVERPROPERTY('edition')

Tip #4. Creating a custom firefox template

Step 1. Windows -> Run specify below command
firefox.exe -ProfileManager -no-remote

Step 2. Create custom profile

Step 3. Command to run selenium using template
Example:  java -jar selenium-server.jar -firefoxProfileTemplate “<Selenium Profile Directory>”

Usage:  java -jar selenium-server.jar -firefoxProfileTemplate C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\sd88nd1n.FRProfile

Step 4. With Logs captured below is modified steps

Usage: java -jar C:\\SeleniumServer\\selenium-server-standalone-2.25.0.jar -port 5555 > C:\\ReportLogs\\\SeleniumServerStatus.txt 2>&1 -firefoxProfileTemplate "C:\\Users\\Administrator\\AppData\Roaming\\Mozilla\\Firefox\\Profiles\\ku6gbc8j.FRProfile"

References Link1


Happy Learning!!!

mTail - Windows Real time Log Monitoring Tool, Log Searching - Free Tools

This post is for mTail - Log monitoring tool on windows. I have used it it is very good. The benefits are

• Monitor multiple Servers with multiple instances of this tool concurrently
• Simple and easy to use
• Start / Stop option to stop in case you have viewed error

Free tools for File Search / Exception Checking in logs

• Agent Ransack
• Textpad (Find in Files Feature)
• Notepad++

Happy Learning!!

Interesting Bug

Sharing one Unique Interesting bug identified during testing

Case #1 - Property_Id values mismatch was the primary issue. Two tables were defined in two databases. The scenario is Property_Id on Database A is based on master tables defined , example Master A. Issue was## mapping of MasterA was used in DatabaseB instead of MasterB. It was difficult to identify as Property_Id values were always overlapping for a smaller set of input data

Database A

MasterA

Property_Id Value

1    A

2    B

3    C

.......

10    D

TableA

Property_Id  Local_Id (Identity Column) Value

1 1

2 2

3 3

1 4

2 5

2 6

Database B

MasterB

Property_Id Value

10    A

20    B

30    C

TableB (Expected)

Property_Id          Local_Id (Identity Column) Value

10 1

20 2

30 3

10 4

20 5

20 6

TableB (Actual)

Property_Id           Local_Id (Identity Column) Value

1 1

2 2

3 3

10 4

2 5

2 6

The bug was not easily identified as Property values in MasterA and MasterB overlapped.  The values were matching in most cases for a smaller dataset.

Happy Learning!!!