CROPVIEW stands for Comprehensive Resources for Observing Plants in a Visual Interactive Enhanced Window. As part of the Teaching and Learning Technology Grants program at Purdue, this project was developed in conjunction with Dr. Lori Snyder and TLT student developers Kevin Mohr, David Auble, Jillian Traycoff, and Brian Snyder. The application engages learners through computerized modules that use an interactive gaming method to gain knowledge of the plants that feed our world. Cropview was developed using PHP, Javascript, Flash, MySQL, and uses Google Earth to provide geographical data.

This web-based application can be utilized within K-12 courses as well as higher education around the world to increase awareness of Crop Science (the science of producing food, feed and fiber for mankind).  The program has a feature that allows administrators to add new seed and plant information/images to the database for extend geographical learning. For more information about Cropview, contact Dr. Lori Snyder at Purdue University.

Related links:

• Purdue University TLT Instructional Technology Grants Program
• Grants Showcase

To improve my information application I decided to change the user interface from a swing-GUI to a web-based system.

Here are the most important web links that helped to realize OSGi web application development:

Hello, OSGi, Part 3: Take it to the server side

Immediately after starting, you will need  the HttpService. Because I use the Felix implementation of OSGi, I needed the Apache Felix Http Service, as well as a Jetty bundle.

After installing all required bundles and configuring the OSGi environment as well as Jetty, a quick start-off with Java Servlet Programming does not hurt.

Java Servlet Programming O’Reilly

For the busy once, a Story of a Servlet: An Instant Tutorial, will be quicker.

A hands-on, refreshing your mind example servlet is given here or a short course from Sun.

To elaborate the basic skills, the “Developing Scalable, Reliable, Business Applications with Servlets” article can help.

Tutorial on Web App Development with OSGi: http://www.eclipsezone.com/eclipse/forums/t64085.html

Esta es una interesante serie de artículos, tanto para los que ya han desarrollado como a los que estan aprendiendo, muestra realmente paso a paso como desarrollar una aplicación web y ademas en forma bastante ordenada.

http://css-tricks.com/app-from-scratch-1-design/



Je vous ai parlé dans un précédent billet sur le Développement pour iPhone sous Windows, figurez vous qu’un logiciel plus simple a vu le jour et qui se nomme Sentenza

En effet, Sentenza est un nouvel outil, très simple, permettant de compiler des pages html/css (webapp) en fichier .ipa exécutable directement sur iTunes.

Quel type d’applications vais-je pouvoir compileravec Sentenza ?
Avec Sentenza vous pouvez compiler ce qu’on appelle des webApp, ou “web applications”. Il s’agit d’applications utilisant le format HTML comme contenu.
Les kits comme iWebKit sont entièrement compatibles.

Sur quelles plate-formes est compatible Sentenza ?
Sentenza est compatible PC Microsoft Windows (XP, Vista, 7).

Le language HTML “modern” est-il supporté ?
Le language HTML supporté par Sentenza est très récent.
Vous pouvez donc utiliser les fichiers CSS, les images (PNG, JPG, GIF, …), des médias Quicktime, le JavaScript, …

Puis-je coupler Sentenza à mon projet XCode actuel ?
Non, pour plusieurs raisons. La première étant que Sentenza est un programme indépendant de tout autre, et ne peut donc pas être lier à un autre logiciel de développement.
La seconde raison est l’incompatibilité de Sentenza sur une plateforme Mac OS X.

Puis-je distribuer mes applications compilées avec Sentenza ?
Oui, Sentenza compile votre projet en un fichier IPA indépendant, qu’il suffit ensuite de glisser dans iTunes et de synchroniser avec votre iPhone ou votre iPod Touch.Quand est-il des certificats ?
Sentenza compile votre projet sans vous demander de certificat. Ainsi, vos applications sont considérées comme gratuites et ne peuvent être soumisent sur l’AppStore.

Les applications compilées avec Sentenza contiennent-elles de la publicité ?
Non, les applications sont totalement transparentes.
C’est à dire qu’une fois compilées en fichier IPA et installées sur votre appareil, il est impossible de les distinguer d’une application développée sous XCode.

Tous les appareils sont-ils compatibles ?
D’après nos test, oui. Cependant il est arrivé que sur certains appareils non jaibreakés ayant le firmware 2.2.1, l’application n’apparaissait pas sur l’écran.

Le programme est disponible ici http://www.sentenzaforiphone.com pour 15€ en version complète, et il existee en version d’essai (limité au nom et  au copyright de l’application compilée).

Way back in July this year, Google announced the Chrome OS operating system. It promises to be a fast, lightweight web-app based operating system optimized at first for netbooks.

Features

• A fast bootup time (under ten seconds)
• Lightweight and quick operation
• Simple
• Secure
• Open Source
• Linux based
• Web-app oriented

Fast Boot-up time

Google value your time, and they also value netbook battery life. That’s why they are designing ChromeOS to boot up in under ten seconds. The alpha demonstration booted up in 7 seconds, and Google say they are working to improve that for the final release.

Lightweight, Simple and Secure

“Speed, simplicity and security are the key aspects of Google Chrome OS. We’re designing the OS to be fast and lightweight, to start up and get you onto the web in a few seconds. The user interface is minimal to stay out of your way, and most of the user experience takes place on the web. And as we did for the Google Chrome browser, we are going back to the basics and completely redesigning the underlying security architecture of the OS so that users don’t have to deal with viruses, malware and security updates. It should just work.”

Open Source

Google have released the source code for ChromeOS to the linux community, which is an excellent step in the right direction. Google know that with the help of the community, they’ll be able to produce a feature-packed, well polished operating system. They’ve specifically thanked the Ubuntu community for helping out with testing – and they’ve done most of their testing in virtual systems run on Ubuntu.

Web-app oriented

Here’s the most interesting idea for the operating system. Instead of having your programs and applications installed locally on your machine, they will all be server-side held with Google, along with all of your settings and details. This new approach for netbooks helps give you more space on your hard drive, and promises to give excellent quality control as apps are all maintained by Google. The downside is that many apps will not function unless you have an internet connection. Google said you will still be able to play locally stored songs and view files that you’ve got on your hard drive, etc. The user interface takes a minimalist approach, resembling that of the Chrome web browser. Because the browser will be the only application residing on the device, Google Chrome OS is aimed at users who spend most of their computer time on the Internet. Unfortunately not much of the world has a blazingly fast internet connection, so whether this orientation will work remains to be seen.

The other issue is trust. I trust Google enough to store all my emails with them, but would you trust them with your banking details, credit card details and much much more? That’s inevitably up to the user to decide.

Indeed 2010 is proving to be an interesting year for Linux, with many major names starting to cotton on to the benefits of Linux. Google are finally releasing a stable version of the Chrome browser for Linux, and of course ChromeOS should make a beta debut sometime in the first quarter of next year. Ubuntu 10.04 Lucid Lynx Long Term Support release is released in April, so that’s something else to look forward to. Keep checking back here for news on Lucid and ChromeOS – I’ll try to step up my news reporting on these two in the coming months. Subscribe, it’s just there =)

Read-only root filesystem

Yes, that’s right, for the time being, Google Chrome OS has a read-only mounted root filesystem – which means that users cannot install third party software.

- Benjamin Humphrey

Sources:

Official Google Blog

ChromeOS wikipedia page

And of course check out OMG! UBUNTU!’s awesome coverage of ChromeOS

Do you know the Big5 Lite app for iPhone or iPod?

I love this tiny app, because I can develop webapps with native features (e.g. camera) without jailbreaking my device. Big5 Lite provides a javascript based API. You can download it for free from Apple iTunes AppStore.

Now I started a project to autoinstall Big5 Lite from AppStore. All webapps could be listed and hosted at Googles cloud AppEngine or your website. I also want to integrate a gateway for foreign like Twitter, Facebook, Ebay and so one. Any developer out there who want to help me?

Anwendungen, die im Web-Browser laufen,…

… begegnen uns meist eher unbewusst, und dennoch sind sie ein Indiz eines revolutionären Konzepts. Webmail, Facebook, Google Docs und ähnliche erfordern keine Installation auf dem eigenen PC. Man startet einfach Firefox, Safari u.ä., gibt den jeweiligen URL ein und schon steht einem nach dem Login die gewünschte Anwendung zur Verfügung. In Kombination mit Technologien wie Google Gears, kann diese diese oft auch ohne aktive Verbindung zum Internet verwendet werden.

Die Vorteile sind offensichtlich: WebApps erfordern keine Installation, keine lästigen Updates, sie sind auf jedem Gerät mit Web-Browser verfügbar, und… die Daten (Dokumente, E-Mails, Fotos, etc.) sind auch immer dabei. Ganz ohne USB-Stick.

Datenschutz…

So stellen sich einige erschreckenden Fragen: Wo liegen denn die Daten? In der großen Wolke des Internets, der “Cloud”? Wer kann und wer darf darauf zugreifen? Oder besser: “gehören” die Daten überhaupt noch mir (allein)?

Die Antworten finden sich in den Nutzungs- und Datenschutzbedingungen des jeweiligen Dienst-Anbieters. Ein kalter Schauder läuft mir bei dem Gedanken über den Rücken. Aufgrund von unpräzisen oder gar falschen Übersetzungen ins Deutsche, hat sich beispielsweise Google mittels seines Dienstes Docs zeitweise Nutzungsrechte von privaten Dokumenten angeeignet. Obwohl der Fehler korrigiert wurde, zeigt es sich, dass man bei der Nutzung von WebApps gut überlegen sollte, wem man seine Daten anvertraut. Datenschutz-Bedingungen zu lesen und zu verstehen ist zwar ein guter Punkt, ob man diesen vertraut, ein anderer. Auf die Datenschutz-Problematik gehe ich aber ein anderes Mal näher ein.

WebApps aus dem Browser lösen

Diese Möglichkeit schafft es aktuell mich zu begeistern. Unter MacOSX gelingt das mit Hilfe eines kleinen Programms namens Fluid <http://fluidapp.com>. Den Artikel schreibe ich beispielsweise in wordpress.com, das als Fluid-App läuft. Technisch gesehen ist es äußerst praktisch, dass jede Anwendung unabhängig vom Browser als eigener Prozess läuft und die verwendete App bei einem etwaigen Crash des Browsers nicht mitgerissen wird. Der Anwendungscharakter wird dadurch betont, dass sich wie bei konventionellen Programmen die jeweiligen Icons ins Startmenü legen lassen und man das Erscheinungsbild (Fensterfarbe, Adress- und Tableiste,…) individuell anpassen kann. Durch das Ausblenden der Leisten (die Bookmark-Leiste fehlt zur Gänze) gewinnt man unglaublich viel Platz am Bildschirm! Die gewonnene Übersicht kann jedoch leicht wieder verloren gehen, wenn man für jede Seite eine eigene App verwendet. So empfiehlt es sich sparsam umzugehen. Für mich liegt die optimale Variante in einem konkurrenzfreien Miteinander von WebApp- und Tabbed-Browsing-Konzept.

Windows-Nutzer…

… müssen nicht traurig sein, denn auch für sie existiert eine aus meiner Sicht schöne Lösung: Was braucht man dafür und wie kann man vorgehen?

• Iron (zum Download): basierend auf Googles Browser Chrome, allerdings ohne datenschutzmäßig fragwürdige Google-Browser-ID – am besten als “Portable Version” für unterwegs. In diesem Fall jedoch aufs Kennwort speichern verzichten!
• Funktion: Anwendung herauslösen
• Verknüpfung am Desktop/im Startmenü, etc. erstellen
• Anwendung starten
• Optimale Fenstergröße wählen (merkt sich die App für den nächsten Start)
• Fertig.

Welche Anwendungen sind prädestiniert für WebApps?

• Facebook
• WordPress
• derstandard.at (in der express-Version, aktuell beta)
• Fahrpläne von ÖBB, VOR, besonders: itip (Wr. Linien), wenn man die Abfahrten von einer bestimmten Haltestelle im Auge behalten will
• Radio Live-Streams: z.B. fm4.orf.at
• vermutlich auch: GMail, Google Docs (nicht getestet)
• Wikipedia
• u.v.m. (einfach kreativ sein!)

Andere Formen von WebApps…

… zeigen sich als Anwendungen für mobile Geräte, wie das iPhone bzw. den iPod touch oder den Palm Pre. Das Konzept ist, ein für das jeweilige Gerät optimiertes User-Interface bereitzustellen. Und schon lässt sich von unterwegs bequem twittern und bloggen.

Auch bei Widgets oder Gadgets kommt dieser Trick recht wirkungsvoll zum Einsatz. Mittels unscheinbarer Minianwendungen in der Windows-Sidebar oder im Dashboard unter MacOSX, sowie innerhalb von Programmen wie Lotus Notes greift man direkt auf die erwähnten Web-Dienste zu und integriert sie in einer jeweils ansprechenden Form.

Der Browser als Betriebssystem

Einen weiteren Vorstoß leistet sich – welch Überraschung – Google. So wurde diese Woche ein Betriebssystem – Chrome OS – vorgestellt, das sich auf Netbooks (kleine Notebooks) konzentriert und ohne lokal installierter Software auskommen soll. Es positioniert sich neben dem bereits am Markt befindlichen Android, das als System für Smartphones fungiert. Mittelfristig erwartet man auch von Google-Seite, dass die beiden Systeme zu einer Plattform verschmelzen werden. Netbooks, die im Vergleich zu aktuellen Notebooks und Desktop-PCs eine geringere Performance aufweisen, sind für das Client-Server-Konzept gut geeignet, da die Rechenleistung dabei vorwiegend serverseitig erbracht wird.

Bekanntes Konzept, nun für den Massenmarkt

Server/Client-Konzepte fand man bereits in der Zeit vor dem Aufkommen von PCs (Stichwort: Großrechner/Terminal), heute ist es vielen auf aktuellen PC-Arbeitsplätzen in Unternehmen in der Form von Terminal-Services mittels Citrix oder Remote Desktop Connections vertraut.

Anwendungen übers Internet bereitzustellen wird schon seit etlichen Jahren versucht. Die Firma Sun Microsystems war mit Java-basierten Anwendungen, sogenannten Applets wesentlich beteiligt. Die fehlende Existenz bzw. Verbreitung von Breitband-Internetzugängen führte zu meist unangenehm langen Wartezeiten beim Laden der Applets. Auch das äußere Erscheinungsbild könnte man als mäßig attraktiv einstufen.

Kurzer Ausblick.

Nun scheinen die Vorzeichen für WebApps bedeutend besser zu stehen. Technologisch gesehen, passen die Rahmenbedingungen. Organisatorisch sind noch Kleinigkeiten wie Datenschutz zu klären, um das mulmige Gefühl zu eliminieren, das sich beim Schreiben eines Dokuments in einer von wem auch immer bereitgestellten WebApp und das Speichern in der Cloud breit macht.

Mit dem data: Schema können offlinefähige Anwendungen für das iPhone bzw. den iPod erstellt werden, die normal als Bookmark gespeichert werden können. Hier ein paar Demos:

Demo1
Demo Dev
Demo Skype

Kleines Bookmarklet zum offline konvertieren von Webseiten (nach dem Bookmarken “about:” löschen):
javascript:x=new XMLHttpRequest();x.onreadystatechange=function(){if(x.readyState==4)location=’data:text/html;charset=utf-8;base64,’+btoa(x.responseText)};x.open(‘GET’,location);x.send(”);

Hier wird die Methode BtoA ~ base64_encode der Gecko Engine verwendet. Das Gegenteil AtoB ~ base64_decode. Weitere WebKit-Methoden sind (siehe bindings/js/JSDOMWindowCustom.cpp – nicht getestet):

window.setLocation, window.postMessage, window.setTimeoutOrInterval, window.addEventListener, window.removeEventListener

Gisterenavond heb ik een aantal demo’s bekeken van de nieuwste versie van Exchange, nl Exchange 2010. Ik ga hier geen uitgebreid verslag maken van hetgeen ik allemaal gezien heb. Ik moet wel toegeven dat hetgeen ik gezien heb, mij heel erg aansprak.

In deze post ga ik even dieper in op de nieuwe versie van webmail van Exchange, Outlook WebApp. Het is duidelijk dat Microsoft probeert om iedereen toegang te geven tot Exchange, zonder hiervoor een versie van Outlook te hebben. De functionaliteit van Outlook WebApp is ontzettend uitgebreid. Je hebt echt de touch-and-feel van bij een gewone Outlook.

Na het zien van de demo’s is één ding wel zeker geworden, emailen en communiceren met elkaar gaat totaal veranderen. Niet dat we niet meer zullen communiceren, maar de manier waarop we de communicatie gaan verwerken zal veranderen.

In Outlook WebApp 2010 heb je de mogelijkheid om voor een standaard layout te kiezen, maar je kan ook je mails laten sorteren volgens onderwerp. Akkoord, dat was nu ook mogelijk. Maar in 2010 worden alle berichten zodanig verwerkt dat alles heel overzichtelijk wordt.

Je krijgt in Outlook WebApps nu ook de mogelijkheid om met je collega’s een chat-sessie op te starten van zodra je merkt dat hij/zij online is. Vroeger kon je vanuit je OWA niet chatten met collega’s omdat je niet altijd met Communicator aan het werk was.

Het delen van Agenda’s is ook in Outlook WebApp heel gemakkelijk gemaakt. Alle functionaliteit die je in Outlook had, die heb je nu ook in Outlook WebApp. Je kan tot 8 agenda’s naast elkaar leggen. Het is zelf mogelijk om je agenda met externe firma’s te delen. Hiervoor moet je uiteraard op serverniveau de nodige security instellen en sleutels tussen de servers laten uitdelen.

Het is nu ook voor het eerst dat je met FireFox en met Safari (enkel op Apple) dezelfde functionaliteiten krijgt als met Internet Explorer. Enkel ActiveX-elementen (bijv. voice-messages) worden enkel door Internet Explorer ondersteund.

Kortom, Microsoft heeft serieus werk gemaakt van een goed werkende webmail-applicatie. Het is ook duidelijk dat Microsoft minder blijft vasthangen aan haar lokale applicaties zoals Outlook. Deze versie van Outlook WebApp toont aan dat het mogelijk is om ook online dezelfde functionaliteiten te krijgen als met Outlook.

Often I come across lists of free learning tools and those you have to pay for. However, they always produce a lot of retweets on Twitter. So here is a list of lists that refer to learning tools and in addition blogs that I came across:

• Directory of over 3.000 Learning Tools by the Centre for Learning & Performance Technologies (C4LPT). The center was founded by Jane Hart, a Social Learning Consultant.
• Multiple Top 10 Tools Lists of Learning Professionals 2009 by the Centre for Learning & Performance Technologie (C4LPT). The center was founded by Jane Hart, a Social Learning Consultant.
• Top 10 Tools for a Free Online Education by lifehacker
• Not a Top list but one that lists Web2.0 Tolls and Applications by category. Here are the ones listed under the tag #e-learning.
• Top 100 education Blogs by Online Education Database (OEDb)
• Top 47 eLearning & Workplace Learning Blogs by The Upside Learning Solutions Blog
• Back to School with the Class of Web 2.0 – has been compiled in 2006 and is not a top list per se but a great starting point when it comes to tools useful in school settings. This is also part 1 and there are 2 more available.
• Websites For Students: 10 Online Learning Tools listed by subject. Make sure to check out the comments at the bottom of this page and you find more suggestions (more and less useful).
• 50 of the Most Dependable Web Resources for University Students splits up into 25 research resources and 25 free Web Apps.
• Searching the Internet is a common activity to inquire or learn something about a certain subject. Choose the Best Search for Your Information Need is a list of sites helping you to find what you are looking for.
• Tim Stahmer’s top 101 web sites for teachers. To put it in his own words: “Not the whole web… just the best for teaching and learning“.
• And last but not least a list of 12 Screencasting Tools For Creating Video Tutorials from Mashable

Feel free to add to this list in the comment box below. Additions are always welcome

I tried using the Signal Patterns Personality Test, and it works, and it’s really cool. Those traits in the images are mine, and they all apply to me very well.

To get to this point, you have to take a (about) 30 question page with questions like:

“You are always like to win and aren’t satisfied by ‘getting along’”

You answer the question based on how much this is like yourself, ranging from “Opposite of Me” to “This is Me”

Try it, and see what you turn up with!

Signal Patterns Personality Test

There is a common mistake which almost most of us made when we  created a new web site with Visual Studio 2005. The earlier version of Visual Studio 2005 does not include a template for web application. In other words, it was only possible to create website.

So why do you have to convert from website to web app first of all? Well there are quite a few reasons to list out:

After reading the above difference website option may look evil; but that’s not the case. There are cases when website may come in to rescue. In fact we have been using web site for our application for a long time. And deployment was not a problem, we used NANT to compile the application (batch-mode) and used INSTALLSHIELD to deploy the application.

So when to use website or webapp project? There is an excellent article from MSDN:

But after an over all comparison, Web Application looks more structured and gives us more control over the project.

How to convert a web site to web application?

ScotGu has given an excellent step-by-step approach to convert a web site to web application. (In fact the Microsoft consultant who came to audit our project also gave the same printout as guidance). This is an excellent resource to start with.

While I did the conversion I took notice of some points that are worth mentioning in addition to Scottgu’s list.

Pre-Requisites:

1. Visual Studio 2005 does not have an option for web application project. The web application project template was later added to the visual studio in Visual Studio 2005 SP1.Please read here for What is new in Visual Studio 2005 SP1? Web application projects is one among them.
2. If you are installing VS 2005 SP1 on Windows 2003 server you may get a weird error "The installation source for this product is not available". You must install a hotfix to fix this.
3. So install the hot fix (point 2), restart the machine and then install VS 2005 SP1.

Also see ScottGu’s suggestions on installing the service pack.

Steps in conversion:

1. Create a web application project.
2. Add reference to all of your dlls.
3. Copy the files to the folder except web.config file
4. Remember there is no App_Code in web application. So any classes in the app_code will not be visible to other classes in the project. This will break the build. To avoid this as a quick and effective fix, add a namespace to your classes in App_Code. And replace this class name with the fully qualified class name (with the newly added namespace) through out the project. (Of course not in the original class file in app_code). Renamed the app_code folder to something like Shared_Classes or something; this would avoid confusion.
5. Change the Build Action to <compile> for all the classes in App_Code.
6. Convert to Web Application.
7. 
8. When the convert to web application is being done the conversion may fail for some aspx files that use user controls that reside in the same directory and the same user control is also registered in the web.config file. Actually the creation of designer file may fail because of this error: tag has already been registered. To avoid this: register the user control in the problematic ascx page but choose a different TagPrefix (different from the one you have already registered in web.config file). For example:

These are few additional things I noticed while converting the project from web application to web site. Hope this helps!

On November 12th, I will be giving a talk at the annual OWASP AppSec conference titled “Synergy! A world where the tools communicate”. I am really excited to give this talk since I have been working on the content for almost 2 years. If you have attended any of my talks in the past like BlackHat/DefCon, ShmooCon and/or InfoSec World you already know that I will bring tons of fresh code! I can’t wait for OWASP AppSec 09.

Brace yourself. We are gonna raise the bar on the industry.

-Jabra

Onyaka: Online tool that allows you to set your staff roster intelligently based on their skill set

ClockingIT: Online task/pm tool with task timers.

The Big Picture: Simple Task Management Tool

I received two bug reports today about Sslscan::Parser and Dirbuster::Parser. The bug reports said that I forgot to include Test::Class as a dependency for each of the modules. Therefore, I have updated both modules to version 0.02 to fix the issue.

The updated versions can be found here:

• Sslscan::Parser 0.02
• Dirbuster::Parser 0.02

If anyone has any comments or suggestions of any of the modules I have released recently please let me know. I’m happy to fix any bugs and improve the quality of the modules.

Regards,
Jabra

Recently, I released several new security modules on CPAN. One of the modules is Nikto::Parser. It provides a module for extracting information from nikto so that users can build powerful web application testing tools. Nikto::Parser can be found here.

Here is an example of performing a nikto scan and then parsing the results with Nikto::Parser:


my $npx = new Nikto::Parser;
my @ips;
push(@ips,"127.0.0.1");
my $parser = $npx->parse_scan("/pentest/svn/nikto/", "", @ips);
foreach my $h ( $parser->get_all_hosts() ) {
    print "ip: " . $h->ip . "\n";
    foreach my $p ( $h->get_all_ports() ) {
        print "port: " . $p->port . "\n";
        print "banner: " . $p->banner . "\n";
        foreach my $i ( $p->get_all_items ) {
             print "Description:\n" . $i->description . "\n";
        }
    }
    print "---\n";
}

Just to get everyone excited for my talk, “Synergy! A world where the tools communicate” at OWASP NYC today, I decided to release Burpsuite::Parser 0.01 a little early.

Here is an example of using the module:


my $bpx = new Burpsuite::Parser;
my $parser = $bpx->parse_file('burpsuite.xml');
#a Burpsuite::Parser Object
my @results = $parser->get_all_issues();
#an Array of Burpsuite::Parser::Issue Objects
foreach my $h ( @results ) {
     print "Severity: " . $h->severity . "\n";
     print "Host: " . $h->host . "\n";
     print "Name: " . $h->name . "\n";
     print "Path: " . $h->path . "\n";
     print "Proof of Concept:\n " . $h->issue_detail . "\n";
}


Version 0.01 of the module can be found at http://search.cpan.org/~jabra/Burpsuite-Parser-0.01/lib/Burpsuite/Parser.pod

One good thing to note, all of the request/responses are automatically included in the XML. To reduce the size of the XML, it may be helpful to generate an XML file without them. This will make parsing faster.

Enjoy!
Jabra

For those know don’t already know… Portswigger released XML support for Burpsuite last week! Once I heard about this, I started working on a Perl XML parsing module. After the long weekend I have a version that is ready to be considered alpha quality. I plan to release the beta version on October 15th at during my presentation at OWASP NYC. Here is an example script demonstrating how easy it is to use Burpsuite::Parser:
#!/usr/bin/perl -w
use strict;
use Burpsuite::Parser;
my $bparser = new Burpsuite::Parser;
my $file;
if ( $ARGV[0] ) {
    $file = $ARGV[0];
}
else {
    print "usage: $0 [file.xml]\n";
    exit;
}
my $parser = $bparser->parse_file("$file");
foreach my $h ( $parser->get_all_issues() ) {
    print "Type: " . $h->type . "\n";
    print "Serial: " . $h->serial_number . "\n";
    print "Severity: " . $h->severity . "\n";
    print "Host: " . $h->host . "\n";
    print "Name: " . $h->name . "\n";
    print "Location: " . $h->location . "\n";
    print "Path: " . $h->path . "\n";
    print "Issue Background: " . $h->issue_background . "\n";
    print "Remediation Background: " . $h->remediation_background . "\n";
    print "Issue Detail: " . $h->issue_detail . "\n";
}

DM me on twitter(jabra), if you would like to help test the module.

Regards,
Jabra

I will be giving a talk at OWASP NYC/NJ this coming Thursday(October 15, 2009). The talk is heavily focused on improving the penetration testing process. It is important for the tools that are used during a penetration assessment to communicate because it will allow for the assessment to streamline much of the tasks that have been manual in the past. The goal of this presentation is to discuss the need for communication between security tools and to demonstrate several examples in which integration can provide the ability to reduce the amount of time spent manually correlating information. This will improve the penetration testing process! If you were to perform an assessment manually (ie without any tools communicating) and compare the results to an assessment in-which all the tools were communicating, the results would clearly demonstrate that communication between tools leads to a better assessment. Therefore, all security assessments need to move in this direction.

For this presentation, I will be demonstrating several modules that I have been working on to provide communication abilities to many of the most popular security testing tools for pentesting and web application security assessments. This presentation will be filled with tons of new tools and modules that I will be releasing for the first time. Many of these tools will make pentesting easier and help to automate much of the tedious tasks of security testing.

I look forward to hanging out with people after the talk and getting their feedback on ways to improve the functionality that I have built.

-Jabra

With Tapestry 5, we can use the Output component to output a Java collection as a string where the elements are separated with, for example, a comma or a dash character. The result looks something like this:

The Output component requires a parameter format of type java.text.Format which is applied to the object being rendered by the Output component. The format responsible for formatting a collection of elements as a string:

public class SeparatedFormat extends Format {

    private String separator;

    public SeparatedFormat(String separator) {
        this.separator = separator;
    }

    @Override
    public StringBuffer format(Object obj, StringBuffer toAppendTo,
            FieldPosition pos) {
        List<?> elements = (List<?>) obj;
        if (elements == null || elements.size() == 0) {
            return toAppendTo.append("-");
        } else {
            int i = 0;
            for (Iterator<?> it = ((Collection<?>) obj).iterator(); it
                    .hasNext(); i++) {
                if (i > 0) {
                    toAppendTo.append(separator);
                }
                toAppendTo.append(formatElement(it.next(), toAppendTo));
            }
        }
        return toAppendTo;
    }

    protected String formatElement(Object element, StringBuffer toAppendTo) {
        return element.toString();
    }

    @Override
    public Object parseObject(String source, ParsePosition pos) {
        throw new UnsupportedOperationException();
    }

}

The page class (BookmarksPage) renders a table which contains an overview of bookmarks (captured in the Bookmark class). Each bookmarks has a list of tags (captured in the Tag class) that describe the bookmark. This is the most relevant part of the page class:

public class BookmarksPage {

    @Property(write = false)
    private List<Bookmark> bookmarks;

    @Property
    private Bookmark bookmark;

    public Format getTagListFormat() {
        return new SeparatedFormat(", ");
    }

    ...

}

The getTagListMethod returns an instance of SeparatedFormat, which uses a comma to separate the items in the list. The list we want to output is a list of tags for a bookmark.

The template for the BookmarksPage uses a Grid component to display the table of bookmarks. The list of tags per bookmark is written in the ‘Tags’ cell:

<t:grid source="bookmarks" row="bookmark" add="tags" exclude="name">
  <p:tagsCell>
    <t:output value="bookmark.tags" format="tagListFormat" />
  </p:tagsCell>
  <p:empty>
    <p>There are no bookmarks to display.</p>
  </p:empty>
</t:grid>

That’s all there is to it. With some imagination the SeparatedFormat can be easily reused for other types of formatting a collection of objects.

I finally did it !!!!!!!!!!!!

I manage to configure a Maven webapp to run on a Tomcat Server to test the JSPs on Eclipse.

.: To Complete :.

1. Create a library for Tomcat JARs
Window > Preferences > Java > Build Path > User Libraries

2. Add this library to classpath with maven-eclipse-plugin
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-eclipse-plugin</artifactId>
<version>2.3</version>
<configuration>
<classpathContainers>
<classpathContainer>org.eclipse.jdt.USER_LIBRARY/Tomcat-6.0.20</classpathContainer>
</classpathContainers>
…

</plugin>

A big thank to that site

http://www.devx.com/Java/Article/36785/1763/page/3

Let’s code then