My learning source is my EC Council training and internet. So, I will take you on a tour by covering the below modules.

Off late, I am using ‘Microsoft Communicator’ to a great extent and I just can’t imagine how my life would be without it. Let me list out the features that I like here.

1) Group Chat – It’s there in other messengers too

2) Sharing Desktop and taking control – Since I work remotely, this is an indispensable feature. I use this to show demos, assign tasks to developers and in debugging.

3) Tag Contact – A trivia but yet so nice. I can keep a tab on a person to know his availability.

4) Its integrated with outlook..

I guess GTalk , Yahoo and MSN might offer some of the above features. But overall, I like Communicator the best.

“Celia, forget about security. Once you put your application on the web, no matter what you do, it is always vulnerable.”

Another one said, “Gosh! Remember that we are from the service industry. Lets not overdo on that security aspect. The client will take care of it when he deploys it. Also, remember, we can do only what they ask for.. “

As I pondered about this, I was wondering how I could strike a balance between these two people. Agreed, security is an ongoing thing. It seems like a race between the hackers and the crackers.. Today, we find a vulnerability and fix it. Tomorrow, there comes another issue.

Likewise, clients come in all flavors. There are some who really know a lot about what they want. These people are a delight to work with as their requirements are very clear. Also, they are quick to understand and know that building efficient security applications do take some royal effort. And there are some who think that application development shouldn’t take more than a week. There was this manager who once asked me, “After all, its just adding, editing, deleting and viewing. You are not doing rocket science. Why is it taking more time?”.

Yeah.. I agree to it. It would just take me one single query on the database to let an administrator login to a system. But it would take me atleast 10 other policy checks to prevent other users from manipulating this query. Wouldn’t this take some solid effort?

I hope people are atleast nodding a little now. Let me say one thing now. Even popular websites like gmail, facebook, youtube and msn have vulnerabilities. So, its not just because of a poor programmer’s pathetic code. Even experienced experts find it difficult to take care of all vulnerability issues when all their attention is focused on business logic.

In this case, what can be done? First thing:

Client: Client has to know that building secure web application takes some time. And some real effort.

Developer: The programmer needs to know how to secure their code and need to follow some security standard.

PM: The one who takes the real pressure. Needs to coordinate between the above two.

Security Consultant: The one who tells us what we already know .. well, jokes apart.. This is the person who makes our lives simpler. Who tells us what needs to be done to make our code secure and who reviews it before the app gets deployed in the production environment.

Now, just like how we have a separate team for application design, BI development and testing, we do need a separate group of security experts who concentrate just on the security aspect of the application. How a security expert will add value to the application, will be discussed in PART 2 of this article…

To Start with, let me tell you the standard that has been adopted by the security world.

The standards available are

1) OWASP top ten security vulnerabilities

2) CWE/SANS Top 25 software vulnerabilities

Since OWASP broadly covers the most of the aspects, I will be taking this as my verification standard.

For all the vulnerabilities covered, example code will be that of php language.

Lets dive in..

1) To call the executable c code from php using function calls like system or ~~.

2) To compile the c code and make it into a php extension. This way, he can call methods in the code and use its objects.

We found one tool which is helpful in developing these extensions. That is SWIG. SWIG is a compiler that takes C declarations and turns them into the “glue” needed to access them from common scripting languages including Perl, Python, and Tcl. SWIG usually requires no modifications to existing C code and can often be used to build a working interface in a matter of minutes.

http://www.swig.org/Doc1.1/HTML/Introduction.html#n1

Though this seems quite an interesting option, he was a little hesitant because he was not sure whether the c++ code would have been written in such a way to act as a stand alone library.

3) To turn over to python. I have heard that in python, one can include c++ code and get down to the nuts and grits of any API.

Though this was a mundane 5 minute conversation, I found that it offered enough scope to look into one weak-area of PHP. Does anyone have any expertise in such a area? Like accessing native API code from scripting languages?

Any thoughts, inputs are welcome.

But sadly, it doesn’t work for GMAIL smtp server, the reason being that GMAIL requires TLS or SSL to send mails.

I found a way to fix this problem.

Fix:

1) Just prefix your smtp hostname with a ssl://
In this case, your hostname will be ssl://smtp.gmail.com

$this->phpMail->Host = "ssl://smtp.gmail.com";
$this->phpMail->Port=465;

2) Comment out the following lines of code in class.phpmailer.php
/* if(strstr($hosts[$index], ":"))
list($host, $port) = explode(":", $hosts[$index]);
else */

I guess that would be from Line No: 537 – 539

Save the file and test it out.

I have followed a terminology here.
CMD – means command mode.
INS – means insert mode.
VIS – means visual mode.
LOC – means to be entered in .vimrc file

However, if there is some text contained in the textarea, IE positions the cursor at the end whereas safari positions the cursor at the beginning. After some frantic google searching, I found the below javascript would fix this discrepancy.

replybox=document.myform.reply;
replybox.focus(0);
if (replybox.setSelectionRange )
{
replybox.setSelectionRange(0,0);
}

This works fine in all the browsers. Let me know if this helped you.

1) I don’t have this, would the software work for me?
2) Would it work without the libraries?
3) Would it work on a Windows 2003 server with S123456789 service pack with PHP 5.12345 version and Mysql 5.98765 version?
4) I host with Godaddy and they say that they can’t provide that option. Would it work without the option?
5) I host with Comemommy and they don’t want to install it, would it work without installing?

and just every other question they can come up with except the right question!! and what do I usually say? Should I say, “ Give me some time, let me replicate the exact condition here and then I would tell you whether it works or not!! “.. No, as a good worker, I always end up saying.. “Yeah!! This would!!”, “No, This wouldn’t. But if I can buy some of your time, it definitely would!”.

Wouldn’t it be better if I tell just tell, “Well this mostly depends on your machine. Testing it is usually the quickest way to find out.” So, do test it out while having your coffee and lemme know if it worked or not!!

Wouldn’t this be easy? These people are a real lot clever!!

So, if your scripting language is PHP, and uses mail() function to send mails, read on.

# Agent 1:

Incorrect TO: address. Please check whether your recipient email address is correctly entered.

# Agent 2:

Incorrect FROM address. Yeah. These days, it is indeed possible to send a mail to any tom, dick and harry from email addresses like bush@whitehouse.com or pamela@anderson.com. But not every server likes that. SPAM protection is in and hence servers try to check the validity of the entered FROM address. If your FROM address is in an incorrect format or is some non-existant address, chances are that your mail() function would not work.

# Agent 3:

So, The TO: address and the FROM: address are correct. Mail() still does not work. If you have access to the function call in the php script that says

mail($to,$subject,$message,$from);

Try assigning the returned value to a variable and display it. Also, you could turn on error_reporting and see whether the mail() function throws up any error.

Chances are that, PHP.INI file wasn’t configured to contain the PATH to the sendmail binary or SMTP address. If you are not sure about this, do a phpinfo on the server to find out the configuration details. If the configuration is correct, check whether your sendmail allows relaying.

# Agent 4:

The PHP software is configured to contact the SMTP server or the SENDMAIL binary. Sendmail allows relaying. But still, mails don’t go out. What do we do now?

Check the sendmail error log. See whether you get a message like “Deferred”. This could probably mean that your sendmail is listening only to its localip. If this is the case, then you would be able to send mails only to and from localhost.

Open the /etc/mail/sendmail.mc file and search for the text ‘DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA’)’.

If this text is not commented out (comment character is dnl here), add a ‘dnl’ to the beginning. Then, execute the following commands.

# cd /etc/mail
# m4 sendmail.mc > sendmail.cf
# /sbin/service sendmail restart

Make sure you are logged in as root user to do the above. Once this is done, your mails should work!! If it still doesn’t, …….. well, I haven’t found a similar case. Lemme know if it doesn’t.