Displaying an HTML table from MySQL data

July 23rd, 2008

Here’s one from the 2003 archives:

Did you know that PHP could interface with a MySQL database? Well it can, and here’s how! The code below illustrates just how easy it is to produce a nice table with headers populated with data culled from a database. One little trick I like to use (and have used for a very long time) when displaying table data is to alternate the background color. This makes it a bit easier to read the data (at least it does for me) Notice that when the table is initialized (<table><tr bgcolor=\”#afafaf\”>), I define the background color. Later as the code iterates through the lines of data, I test to see what the current backgound color is, and then reverse it. Not rocket science, but it spruces things up just a bit. I have been using a heavily modified version of this code in several places, whether it is for displaying log files or pulling intrusion reports from a Snort database and it has worked quite well. Any comments or improvements are always welcome!

<?php
$link = mysql_connect("database_host", "user", "password");

mysql_select_db("database_name", $link);

$qry = mysql_query("SELECT * FROM table_name", $link);
echo <table><tr bgcolor=\"#afafaf\">;
if (mysql_num_rows($qry) > 0) {

for ($i = 0; $i<mysql_num_fields($qry); $i++) {

echo "<td><b>" . mysql_field_name($qry, $i) . "</b></td>";

}

}else{

echo "<td>No entries found in the database</td>";

}
echo "</tr>\n";
if (mysql_num_rows($qry) > 0) {

for ($j = 0; $j<mysql_num_rows($qry); $j++) {

if ($bgcolor == "#ffffff"){

$bgcolor="#cccccc";

}else{

$bgcolor="#ffffff";

}

echo "<tr bgcolor=\"$bgcolor\">";

for ($k = 0; $k<mysql_num_fields($qry); $k++) {

echo "<td>" . mysql_result($qry,$j, $k) . "</td>";

}

echo "</tr>\n";

}

echo "</table>";

}
?>

Gmail IMAP missing

April 16th, 2008

UPDATE:  Looks like it’s been re-enabled.  Hopefully for good.  Maybe they were upgrading the service.

Looks like Google may be having some issues w/their IMAP services.  I noticed earlier that my palm pilot couldn’t access my gmail account via IMAP, producing a connection error.  When I log into my gmail settings, the IMAP section from the ‘Forwarding and Pop’ tab is now missing:

No IMAP settings in gmail



Using VMWare Fusion on OSX

April 8th, 2008

I’ve been using VMWare’s Fusion product on my 1st gen Apple Macbook (2.0Ghz, 2GB ram, 160GB hard drive upgrade) sporadically now for about six months. I originally purchased the 1.0 version and was pleased when just a few weeks ago I found out that there was a free upgrade to 1.1 which included a few bug fixes. The original install and subsequent upgrade were as smooth and uneventful as one tends to expect from Mac software versions. Insert the installation cd, drag the icon to your Applications folder and you’re done. After that, you’re ready to run Fusion for the first time. Of course, you will need to configure or install your first virtual machine the first time you run it. And wouldn’t you know it, there are hundreds of ready-made virtual machines for you to download at VMWare’s appliance marketplace.

Perhaps a brief explanation of virtualization (of the software variety) might be in order here. Normally your operating system (be it OSX, a Linux-variant, or WindowsXP) runs on top of the hardware platform that you’ve chosen. The operating system needs to have various drivers that allow it to connect to and control the myriad little pieces of the system. From network connections to video cards, they all need corresponding software for the operating system to be able to utilize them. So imagine that you have a program that runs on top of your operating system that intercepts and mimics all of the system calls and abstracts and isolates them from the real hardware you are running on. This software creates a separate ‘virtual’ computer on top of your existing system. You can then install a new operating system along with various programs into this ‘virtual’ computer and you then have a computer system running inside of (or on top of, depending on your viewpoint) your original system.

But that’s silly you say. Why in the world would I want to run two operating systems, one inside the other? Surely that can’t be very efficient! Actually there are several benefits to running a virtual system. First and foremost is the ability to create distinctly separate environments in which to work. For example: My primary laptop is as I’ve mentioned previously a wonderful little Apple Macbook running the latest OSX Leopard operating system. There are times when it would be beneficial to have access to various WindowsXP programs, such as Internet Explorer when I am trying to work out some cross-browser html/css hack. Or I need access to certain security tools that are only available for Windows (read: Cain & Abel ~ caution: this site is not safe for work environments) or perhaps I’m working on a particular Solaris 10 issue. Wouldn’t it be handy if I could just fire up the operating system of my choice from within my macbook?

And that’s exactly what I do with VMWare Fusion! Not only do I have two full WindowsXP installs, I also have the latest Ubuntu Stable version (7.10 as of this writing) and a full version of OpenSolaris 10 (Indiana) all available to me with just a click!

Another advantage comes from the ability to consolidate server hardware.  Suppose that you have a web server that is used primarily during business hours and a secure ftp server that has its peak activity during the middle of the night.  Instead of maintaining two separate servers, you could consolidate them onto a single server by migrating them into a VMWare instance running on a single server.   With some of VMWare’s other tools you could even load balance both the web server and the ftp server across multiple machines.

So you get the ability to access multiple operating systems from a single desktop, giving you the ability to create an on-the-fly virtual lab.  From a server perspective you can consolidate hardware resources (reducing power, heat and physical space consumption) or leverage your existing hardware better by taking advantage of VMWare’s Virtual Infrastructure.

One particularly useful benefit of VMWare’s Fusion product is its ‘Unity’ feature that allows you to run applications from a virtual machine along side your mac software.  Instead of a single window dedicated to your virtual machine and all of the programs that run inside of it, you get a drop down menu that allows you to run the individual applications in their own window!  Pretty slick and a fun trick to show your co-workers that you can run the latest Internet Explorer on your Mac (useful for testing those browser html/css hacks mentioned earlier!)

See some initial Fusion screenshots after the cut.

Read the rest of this entry »


# emerge osx-epic-fail

April 3rd, 2008

Gentoo Prefix Bootstrap Process for Mac OS X has a lengthy walkthrough on getting Gentoo’s emerge package management system installed onto a Mac OSX system.  Naturally I had to give it a shot!  I’ve never worked with Gentoo before so I really had no idea what to expect from emerge.

From a few conversations with a collegue I learned that I could very easily tailor the build process to my specific environment by customizing the make.conf file for emerge.  Unlike some package management systems that either grab a generic binary for your platform, emerge will pull down the latest source code and compile it directly for your specific machine.  If I recall correctly, the FreeBSD ports collection also works this way, as does Debian’s apt (although I’m not sure of the ability to modify machine-specific compile time flags with either system)

The install detailed in the walkthrough (see link above) is a bit sparse on background information such as why call emerge with the oneshot option. (still not sure about that myself, from the emerge man page: “Emerge as normal, but do not add the packages to the world profile for later updating”)  Each of the build steps took a rather long time on the aging Mac G4 box and I unfortunately kept running into compile errors about 3/4ths of the way through the process.  The process failed trying to compile Autom4te (an M4 replacement for autoconf) due to various reasons (one of which might be a missing perl library)

After stepping through the various stages of the install a couple of times and only getting marginal success, I decided the easiest route would be to script the install process so that I could re-run it at my leisure.  I just grabbed the commands listed in the walkthrough and stuck them in a shell script (no error-checking or anything fancy) which would allow me to set a couple of variables and then re-run the script as often as needed.   The script (and the author’s walkthrough) relies on another script called ‘bootstrap-prefix.sh’ (also available from the walkthrough site) so I created a directory called ‘emerge’ and therein placed both the ‘bootstrap-prefix.sh’ script and my own ’setup_gentoo_bootstrap_env.sh’ script.

I set my ‘EPREFIX’ variable to /usr/local/gentoo, so everytime the process would fail, I could just ‘rm -rf /usr/local/gentoo’ and start over.   Since part of the process includes pulling down all the latest sources I figured that if I just waited a week, maybe someone would have found the issue and fixed it.  But alas, as of this morning the process still fails in the same spot.  So I’ll send a note to the maintainer and see what happens.  Until that time I have to conclude that emerge on OSX constitutes the ‘epic-fail’ tag.

After all of this, I finally just grabbed the latest macports and within minutes I installed several standard software packages.  Both macports and fink provide very easy access for OSX to most readily available linux software.  However it does appear at the moment that macports has been getting more attention and is more supported (at least by comparing the verbage on each of their websites) and even though I’ve been a big fan of fink in the past, I went with macports if for no better reason other than its the one that I haven’t utilized before.

Code for setup_gentoo_bootstrap_env.sh located after the cut.

Read the rest of this entry »


Updated to Wordpress 2.5

April 3rd, 2008

Well I didn’t exactly update the site per se.  I moved Intuition & Elbow Grease to a new server and in the process upgraded to the latest version of Wordpress.   I created a new database and installed the code fresh (i.e. I performed a ‘new’ install) and then restored my posts from an exported xml file from the old site.  The theme and plugins I simply tarred up from the contents of a  full backup I made from the old site and then uploaded to the new server.  So far the only code I’ve needed to regenerate was the adsense code that I use.  If you notice any weirdness with the site, please let me know!


The all macintosh network… almost

March 13th, 2008

It’s probably no secret that I’ve turned into a huge mac fanatic… The recent acquisition of a mac mini puts the household total to four machines actively in use. It also means that my low-end machine, a Power Mac G4 PCI (Yikes!) is just sitting there, looking all forlorn and wanting to be put back into service.

It occurred to me that the old box could serve quite nicely as a replacement for my aging content/proxy server. Currently I’m running Dan’s Guardian and Squid on top of Ubuntu Linux on an old Compaq PentiumII. While it does work rather well, the hard drive has suffered a couple of soft failures in the last few weeks (fixable, but annoying) so the thought occurred to me that I could swap out the old box for the G4, utilizing the BSD underpinnings of OSX to run the proxy and content software.

As I began to think about it, I imagined that I could also throw in a nice second ethernet card and then use the IPFW firewall software (that is already installed by default) to act as my primary firewall. The addition of an ethernet nic and I could also use the box as a wifi hotspot (complete w/captive portal via nocatauth) and provide a robust wifi connection to the entire house. Of course, being somewhat security minded ::grin:: I am an advocate of using WPA2 to assist in securing the wireless connection.

So I set out by installing OSX Tiger 10.4.11 (the latest version that is supported on the G4 PCI ) along with the requisite hardware. Squid and Dan’s Guardian installed quickly and effortlessly (although I’m still trying to understand the whole ‘OSX init script’ landscape to get the services to start at boot time) and went to configure the wifi nic as a hotspot. In ‘System Preferences’ is a choice labeled ‘Sharing’ that allows you to set up internet sharing and choose the interfaces. You can then set the options for your wifi connections via the ‘AirPort Options…’ button. Lo and behold, clicking on it allows you to set up WEP (a very poor security option as it can be cracked almost effortlessly nowadays) and no choice for either WPA or the more robust WPA2!

This is really a show-stopper for me at the moment. I’ll still continue to plod along and replace the proxy/content server with this G4, but how dissappointing that Apple won’t provide reasonable security for sharing out the AirPort connection, but I guess the ‘Steve’ wants me to shell out even more money for an Airport Extreme (which just isn’t going to happen since I’m saving up for the next gen iPhone!)


Counter-Hacking in New Jersery….

November 19th, 2007

I have finally returned home after spending the last seven days sequestered in a lavish hotel about ten miles south of Red Bank, NJ (home of Kevin Smith and his comic book store) I was there to attend training called “Hacker Techniques, Exploits & Incident Handling” for my GCIH (GIAC Certified Incident Handler) certification. What an amazing week!

From Sun Tzu’s ‘The Art of War’ (Translation and commentary by Lionel Giles, Sourced from Project Gutenberg):

“If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat.”
-Sun Tzu, Art of War

We started with the an overview of the basics of incident handling and quickly moved into “Knowing the enemy…” by studying all sorts of really amazing (and sometimes ridiculously simple) attack vectors and ways to exploit them. Network attacks, various Unix/Linux attacks, Windows attacks… you name it, we probably covered it. From simple smurf attacks to buffer overflows to kernel level rootkits and even hints of escaping virtual machines! (pretty scary stuff) The class started at 9:00am sharp every morning, continuing on until 8:00 or 8:30pm nearly every night (we took a night off on Wednesday, and class ended Saturday afternoon).

The culmination of the training was a ‘Capture the Flag’ style game where we were allowed to flex our new skills against a series of windows (2k and 2k3 servers) and linux servers in an attempt to attack each server, gain access and find a file that contained clues to our final objective. Several of the participants played as three to six man teams, while others hacked alone. I started out with a couple of very able cohorts, but we each became quickly immersed in the process and became defacto ‘lone gunmen’. We were allowed to begin our attacks at 9:30am with the first flags found within twenty minutes. The second flags fell much later (near 11:30a).

I was poking and prodding each machine, furiously trying many different attack vectors while others around me seemed to be surging ahead, locked into combat with a particular exploit or two that were certain to win them the game. I managed to quickly get the first flag a little bit after everyone else (not a good sign), next I captured the fourth flag around 11:00a. I managed to get the third flag (the hardest one of the four by far) and finally captured the second flag at about 12:50p. With all of the flags captured, I managed to assemble each of the clues provided by the flags, which pointed to a file with a password protected, steganographically embedded message. I analyzed the file and was able to extract the hidden phrase, and lo and behold yours truly won the game just after 1:00pm.

About twenty minutes later a team of six people managed to snag second place, and after another twenty minutes, third and fourth place was claimed.

The point of all this was to embody the teaching of Sun Tzu and “know the enemy and know yourself” so that we can all better defend our networks and servers by “Counterhacking” if you will. My instructor literally wrote the definitive book on the subject:

Now comes the hard part… I will spend the next week and a half (possibly more) studying all of the material in-depth to prepare for the two 90 minute tests in order to earn the certification.

I can’t recommend this training highly enough to those whose job is to serve as systems administrators, network administrators or security administrators. The skills learned will be of immense value in assessing and securing our corporate infrastructures.