Thursday, July 6, 2017

Python & Java


Tools to Code:

Python online interpreter

https://realpython.com/blog/python/setting-up-sublime-text-3-for-full-stack-python-development/

https://sourceforge.net/projects/pyscripter/


Java file executing and JVM

.java file (source code file) is compiled in to bytecode(.class file). Bytecode is platform independent, it can you distributed to any OS.   

JVM is platform dependent, its depends on Operating system, Processor. JVM comes with different version for different operating system.

The .Class file will be converted into Machine code by Windows JVM or Linux JVM depends on operating system.  The machine code will be used by processor and the program will execute. 

Monday, May 22, 2017

Web Security Testing

Security:  22May2017

Application security
End point security
Network security: Authentication
Content security

One factor authentication
Two factor authentication : Ex: ATM card & Pin

Content Security: 
Public data: Username
Private data: Password

Confidentiality: Encryption

Encryption + Decryption = Cryptography

Integrity: Hash code for checking the completeness of the data received from the sender

Security Trio:
All the below three cannot be obtained, if the application is more secure, ease of use will be difficult.

1 Security
2 Functionality
3 Ease of Use

Security Terminology:
1 Asset: 
 Tangible asset: Physical assets
 Intangible asset: Software and Licenses


2. Threat: Change to asset from intruder

3. Vulnerably: Weakness in the application

4 Attack: 

5. Exploit: Stealing the data and intruder benefit

6. Payload: Attacker write query and get data

7. Zero-Day: Attack with no solution 
                      Initially SQL injection had no solution

8. Risk


Security Control:
OWAS: Open Web App

Attack Surface:
Attack surface is the sum total of all the vulnerability’s in an application
E: User Input. Protocol, Interfaces

Elements of Security:
1. Confidentiality
2. Integrity
3. Availability:  Negative factor is Denial of Service

Authorization: Access Control
Authentication: Identification of valid user of not


Non-Repudiation:

Digital Certificate:

SHA: Secure has algorithm
MD5- Message Digest

RSA

Kinds of Attack:

Injection
  Command            Code     SQL injection

SQL injection: 
Numerical SQL Injection
String SQL Injection


Web scarab tool for editing the request and response

Blind SQL Injection

To know the database, tables and contents of the website, Kali 2016 OS with SQLMAP tool can be used.
There are several command where we can get all the details, whenever there is an error in the page.

ex: sqlmap - h     (for help)
sqlmap -u "websiteurl" -dbs      ( for getting database name)


Cross -Site Scripting:
1. Store / Persistence
2. Reflected / Temporary


Cross-Site Request Forgery: (in .Net its also called as view state one click attack)
(CSRF/XSRF)



Thursday, April 20, 2017

PSTools - Executing Windows Command Prompt in Remote System



https://technet.microsoft.com/en-in/sysinternals/bb897553.aspx


Sample Code:

static void Main(string[] args)
        {
            Process ProcessA = new Process();
            ProcessA.StartInfo.UseShellExecute = false;
            ProcessA.StartInfo.CreateNoWindow = true;
            ProcessA.StartInfo.RedirectStandardOutput = true;
            ProcessA.StartInfo.FileName = @"C:\PSTools\PsExec.exe";
            ProcessA.StartInfo.Arguments = @"\\serverName_xx -u doamin_xx\userName_xx -p password_xx cmd /c (xcopy sourceLocation_xx destinationLocation_xx /S /Y)";          
            ProcessA.Start();
            string outputA = ProcessA.StandardOutput.ReadToEnd();
            ProcessA.WaitForExit();

            Thread.Sleep(20000);

            Process ProcessCopyB = new Process();
            ProcessCopyB.StartInfo.UseShellExecute = false;
            ProcessCopyB.StartInfo.RedirectStandardOutput = true;
            ProcessCopyB.StartInfo.FileName = @"C:\PSTools\PsExec.exe";
            ProcessCopyB.StartInfo.Arguments = @"\\serverName_xx -u userName_xx -p password_xx cmd /c (xcopy sourceLocation_xx destinationLocation_xx /S /Y)";
         
            ProcessCopyB.Start();
            string outputB = ProcessCopyB.StandardOutput.ReadToEnd();
            ProcessCopyB.WaitForExit();
            Thread.Sleep(10000);
        }


Friday, April 14, 2017

MSTest Tool for executing test cases using dll with only Visual Studio Agents Installed



Download and Install Visual studio agents from following location:

vs 2012:
https://www.microsoft.com/en-in/download/details.aspx?id=38186

vs 2013:
https://www.microsoft.com/en-in/download/details.aspx?id=40750


vs 2014:
https://www.microsoft.com/en-us/download/details.aspx?id=48152


After downloading extract the folder, you can find the following files:


Open TestAgent and install it.

After installing TestAgent, we can find the following folder and file.

C:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\MSTest.exe



Visual studio Solution & code:

Solution Explorer

Layout of MSTest Tool:

  1. MSTestRun.cs File
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Windows.Forms;

namespace MSTestRun
{
   public partial class Form1 : Form
   {
       public Form1()
       {
           InitializeComponent();
       }

       private void SelectDLL_Click(object sender, EventArgs e)
       {           
           Stream myStream = null;
           OpenFileDialog openFileDialog = new OpenFileDialog();

           //openFileDialog.InitialDirectory = "c:\\";
           openFileDialog.InitialDirectory = @"c:\";
           openFileDialog.Filter = "DLL's (*.dll)|*.dll";
           openFileDialog.FilterIndex = 2;
           openFileDialog.RestoreDirectory = true;

           string dllLocation = "";
                                  
           if (openFileDialog.ShowDialog() == DialogResult.OK)
           {
               try
               {
                   if ((myStream = openFileDialog.OpenFile()) != null)
                   {
                       dllLocation = openFileDialog.FileName;
                       dllPath.Text = dllLocation;

                       TestListInAssembly clas = new TestListInAssembly();
                       List<string> testCases = clas.GetTests(dllLocation);

                       dataGridView1.DataSource = testCases.Select(x => new { Value = x }).ToList();
                       dataGridView1.Rows[0].Cells[0].Selected = false;
                      
                   }
               }
               catch (Exception ex)
               {
                   MessageBox.Show("Error: Could not read file from disk. Original error: " + ex.Message);
               }
           }
       }

       private void ExecuteTest_Click(object sender, EventArgs e)
       {
           try
           {              
               if (dataGridView1.SelectedCells.Count == 0)
               {
                   MessageBox.Show("No test selected", "Error", MessageBoxButtons.OK);
                   return;
               }
              
               string testName = dataGridView1.SelectedCells[0].Value.ToString();
               string batpath = Path.Combine(System.IO.Path.GetTempPath(), "mstestscript.bat");
               var command = Environment.GetEnvironmentVariable("ComSpec");
               command = @"" + command + @"";

               string vsVersion = VsVersionSelected();

               string VisualStudioCmdPrompt = string.Format("cd \"C:\\Program Files (x86)\\Microsoft Visual Studio {0}.0\\Common7\\IDE\"", vsVersion);

               string vsMstestPath = string.Format("C:\\Program Files (x86)\\Microsoft Visual Studio {0}.0\\Common7\\IDE\\MSTest.exe", vsVersion);

               if (!File.Exists(vsMstestPath))
               {
                   MessageBox.Show("Path Not found : " + vsMstestPath, "Path Not found", MessageBoxButtons.OK);
                   return;
               }

               CreateBatFile(batpath);

               string mstestScript = string.Format("mstest /testcontainer:\"{0}\" /test:{1}", dllPath.Text, testName);
               using (StreamWriter sw = new StreamWriter(batpath))
               {
                   sw.WriteLine(VisualStudioCmdPrompt);
                   sw.WriteLine(mstestScript);
                   sw.WriteLine("pause");
               }

               //Executing in Admin mode
               ProcessStartInfo info = new ProcessStartInfo(batpath);
               info.UseShellExecute = true;
               info.Verb = "runas";
               Process.Start(info);
               //System.Diagnostics.Process.Start(batpath);
           }
           catch (Exception ex)
           {
               MessageBox.Show("Unknown Exception, Contact Developer", "Error", MessageBoxButtons.OK);
           }
       }

       public string VsVersionSelected()
       {
           if (VS2012.Checked)
           {
              return "11";
           }
           else if (VS2013.Checked)
           {
               return "12";
           }

           else if (VS2015.Checked)
           {
               return "14";
           }
           else
           {
               return "";
           }
       }

       public void CreateBatFile(string batpath)
       {
           if (File.Exists(batpath))
           {
               File.Delete(batpath);
           }

           using (FileStream fs = File.Create(batpath))
           {
               fs.Close();
           }
       }
   }
}

2. TestListInAssembly.cs
using Microsoft.VisualStudio.TestTools.UnitTesting;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;

namespace MSTestRun
{
   public class TestListInAssembly
   {        
       public List<string> GetTests(string dllLocation)
       {            
           List<string> testcasesList = new List<string>();
           Assembly assembly = Assembly.LoadFile(dllLocation);

           /* This code is used to specfically check the test cases in the Particular Namespace and Class           
           string Namespace_ClassName = ConfigurationManager.AppSettings.Get("Namespace.ClassName");
           Type type = assembly.GetType("Namespace.ClassName");
           Type type = assembly.GetType("testsuite.CaligoTest");*/

           Type[] types = assembly.GetTypes();
          
           foreach (Type type in types)
           {
               MethodInfo[] mi = type.GetMethods();

               foreach (MethodInfo method in mi)
               {
                   string memeber = method.MemberType.ToString();
                   object attribute = method.GetCustomAttributes(typeof(TestMethodAttribute)).FirstOrDefault();

                   if (attribute != null)
                   {
                       testcasesList.Add(method.Name);
                   }
               }
           }
          
           return testcasesList;
       }
   }
}

















JMeter Simple Controller

  Simple Controller is just a  container  for user request.