Check perl syntax from command line

When we run your PERL scripts in browser, we may get “500 Internal Server Error” when something goes wrong.
There would be many reasons for this but Out of many check one thing which we can do very quickly is to check if your PERL script contains errors.

To do it login to server where PERL script running and execute command:
To check syntax
/path/to/perl -wc /path/to/script.cgi

To runtime script
/path/to/perl -w /path/to/script.cgi

Web Application Security

Web application layers

1. Data :Original data: Text, images, files
2. Database : Access, SQL Server, MySQL, ORACLE
3. Code : Perl, php, servelet, jsp, asp
4. Webserver : Apache, IIS, Websphere, Weblogic, Netscape Enterprise
5. User interface Code : Html, Forms, Javascript, Coldfusion
6. Browser
7. Input

Any layer is potentially open to attack!

Top 10 Reason :

• – Unvalidated input
• – Broken access control
• – Broken authentication and session management
• – Cross site scripting
• – Buffer overflows
• – Injection flaws
• – Improper error handling
• – Insecure storage
• – Denial of service
• – Insecure configuration management

Unvalidated input:
– Never trust input from a user
– Malicious user can tamper with anything and try to:

• Cause errors to occur and give up info
• Buffer overflow
• Modify parameters

– Common attacks:

• Modifying URL
• SQL Injection
• Cross Site Scripting
• Session hijacking with cookie modification

Broken access control
Types of attacks:
– Insecure ID (guess IDs)
– Forced browsing past access control checks

• “/client” is checked for access control
• “/client/client1/data” is not
• If someone guesses the full URL….

– Path traversal (../../../)
– File permissions (OS permission + web server permission)
– Client side caching

Authentication and Session Management
– Two main issues, credential management and session hijacking
– Flawed credential management functions:

• Password changes (expiry, etc)
• Forgot my password

– All account management functions should require authentication first

Web applications need to keep track of users
HTTP does not offer session management
Web application must take care of this by session IDs stored in either:

• – Cookies
• – Embedded in the URL
• – Embedded in dynamic web page

Authentication and Session Management: “Session Hijacking”
How is your session ID being generated?
– Time based?
– Sequential?
How do you protect it?
– Integrity with hash?
– Encryption?
– Encode it with easily reversible scheme?
– Timeouts for length of session ID?

Buffer overflows
– Corrupt execution stack of web application
– Cause application to execute arbitrary code
– Very common problem
– Keep your apps and OS patched!

Improper error handling
– Debug messages that can help attacker gain information that can be leveraged into a compromise
– Turn your debug off!
– Personalize error messages to ensure no information is given

Insecure configuration management
– 90%* of breakins can be stopped by properly configuring your web server!
– Don’t do default installations!

Insecure configuration management: Default directories
Dot dot sequence (../../) directory traversal:
– /../../winnt/system32/cmd.exe?/c dir +
Unicode directory traversal
– /..%5c..%5cwinnt/system32/cmd.exe?/c dir +
– /cgi-bin/..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c +dir
Unicode %5c..%5c=\..\
Unicode %c1%c1..%c1%c1=\..\


How to stop Web application attacks

• – Error message customization
• – Restricted access to sensitive information
• – Patch Web servers
• – Remove the sensitive page from Google
• – Regularly perform application test
• – Deploy a web application firewall
• – Deploy IPS that will analyze application level

How to install MySQL on Windows

Option 1: Use All-in-One distributions packages

There are some distributions packages available that contain Apache, PHP, MySQL and other applications in a single installation file, e.g. XAMPP, WampServer etc.

These packages are good for beginner as well as for Quick setup.

If need custom/ advance configuration use manually installing MySQL, it will help you learn more about the system and give you more control.

Option 2: Manual Installation

Manual Installation

Step 1: Download MySQL

Download MySQL from dev.mysql.com/downloads/. download the “Without installer” version.

Step 2: Extract the files

Extract the ZIP to your C: drive and rename the folder from “mysql-x.x.xx-win32″ to “mysql”.

MySQL can be installed anywhere on your system. If you want a lightweight installation, you can remove every sub-folder except for bin, data, scripts and share.

Step 3: Move the data folder (optional)

I recommend placing the data folder on another drive or partition to make backups and re-installation easier. For the purposes of this example, we will create a folder called D:\MySQLdata and move the contents of C:\mysql\data into it.

You should now have two folders, D:\MySQLdata\mysql and D:\MySQLdata\test. The original C:\mysql\data folder can be removed.

Step 4: Create a configuration file

MySQL provides several configuration methods but, in general, it is easiest to to create a my.ini file in the mysql folder. There are hundreds of options to tweak MySQL to your exact requirements, but the simplest my.ini file is:

[mysqld]

# installation directory

basedir="C:/mysql/"

# data directory

datadir="D:/MySQLdata/"

Step 5: Test your installation

The MySQL server is started by running C:\mysql\bin\mysqld.exe. Open a command box (Start > Run > cmd) and enter the following commands:

cd \mysql\bin

mysqld

This will start the MySQL server which listens for requests on localhost port 3306. You can now start the MySQL command line tool and connect to the database.

Open another command box and enter:

cd \mysql\bin

mysql -u root

This will show a welcome message and the mysql> prompt. Enter “show databases;” to view a list of the pre-defined databases.

Step 6: change the root password

The MySQL root user is an all-powerful account that can create and destroy databases. If you are on a shared network, it is advisable to change the default (blank) password. From the mysql> prompt, enter:

UPDATE mysql.user SET password=PASSWORD("my-new-password") WHERE User='root';

FLUSH PRIVILEGES;

You will be prompted for the password the next time you start the MySQL command line.

Enter “exit” at the mysql> prompt to stop the command line client. You should now shut down MySQL with the following command:

mysqladmin.exe -u root shutdown

Step 7: Install MySQL as a Windows service

From a command prompt, enter:

cd \mysql\bin

mysqld --install

Open the Control Panel, Administrative Tools, and then Services and double-click MySQL.

Set the Startup type to “Automatic” to ensure MySQL starts every time you boot your PC.

Alternatively, set the Startup type to “Manual” and launch MySQL whenever you choose using the command “net start mysql”.

The Windows service can be removed using:

cd \mysql\bin

mysqld --remove

Install Lampp In ubuntu

Step to follow:
1. Download file to Desktop.
2. Type in terminal :
sudo tar xvfz Desktop/xampp-linux-1.6.4.tar.gz -C /opt
3. put to startup (Auto run ) : sudo gedit /etc/init.d/rc.local
When the text editor opens, paste the following just below the “#! /bin/sh” line:
/opt/lampp/lampp start

Reference:
http://alanedwardes.com/posts/installing-and-configuring-lampp-the-simple-guide/

Smart HTTP and HTTPS RewriteRule Redirects

This is a really cool idea I had to make my Apache .htaccess mod_rewrite code much shorter and easier to manage multiple Redirections when using sites with both HTTP and HTTPS. Basically instead of having to check for HTTPS using a RewriteCond for every redirect that can be HTTP or HTTPS, I found out I can set an environment variable 1 time to determine if HTTP or HTTPS is being used for that request, and by giving the variable a value of “https” for HTTPS or “http” for HTTP I can remove all duplicate rewriterule blocks. This is sweet I’m telling you!

Setting HTTP/HTTPS Environment Variable

Old method for HTTP to HTTPS Redirection

This is the old way I would have to use to redirect /index.html to / and urls with // to /.


RewriteCond %{HTTPS} !=on
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)index\.html\ HTTP/ [NC]
RewriteRule ^.*$ http://%{SERVER_NAME}/%1 [R=301,L]

RewriteCond %{HTTPS} =on
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)index\.html\ HTTP/ [NC]
RewriteRule ^.*$ https://%{SERVER_NAME}/%1 [R=301,L]

RewriteCond %{HTTPS} !=on
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)//(.*)\ HTTP/ [NC]
RewriteRule ^.*$ http://%{SERVER_NAME}/%1/%2 [R=301,L]

RewriteCond %{HTTPS} =on
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)//(.*)\ HTTP/ [NC]
RewriteRule ^.*$ https://%{SERVER_NAME}/%1/%2 [R=301,L]


New HTTPS to HTTP Redirection

First I set the environment variable ps to have the value “http” for HTTP requests, or “https” for HTTPS requests. Once that is accomplished, I can use %{ENV:ps} in all of my rewriterules and it will result in https for SSL requests and http for non-ssl requests!


RewriteCond %{HTTPS} =on
RewriteRule ^(.+)$ - [env=ps:https]
RewriteCond %{HTTPS} !=on
RewriteRule ^(.+)$ - [env=ps:http]

# redirect urls with index.html to folder
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)index\.html\ HTTP/ [NC]
RewriteRule ^.*$ %{ENV:ps}://%{SERVER_NAME}/%1 [R=301,L]

# change // to /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)//(.*)\ HTTP/ [NC]
RewriteRule ^.*$ %{ENV:ps}://%{SERVER_NAME}/%1/%2 [R=301,L]


Even Newer HTTP/HTTPS Rewrite Code

The top guru I have ever seen in my lengthy .htaccess related web travels is a moderator on the WebmasterWorld.com Apache Forum, jdMorgan. Upon seeing the above solution that I came up with, jdMorgan instantly provided an improvement, resulting in being able to set the environment variable in 1 rewrite block instead of 2. This is truly Sweet.


RewriteCond %{SERVER_PORT}s ^(443(s)|[0-9]+s)$
RewriteRule ^(.+)$ - [env=askapache:%2]

# redirect urls with index.html to folder
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+/)*index\.html\ HTTP/
RewriteRule ^(([^/]+/)*)index\.html$ http%{ENV:askapache}://%{HTTP_HOST}/$1 [R=301,L]

# change // to /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)//(.*)\ HTTP/ [NC]
RewriteRule ^.*$ http%{ENV:askapache}://%{HTTP_HOST}/%1/%2 [R=301,L]