Feb 3

     Security attacks arise in many forms. Attacking a name server is one of them. If you are a name-server operator, the test on vulnerable recursive service from http://recursive.iana.org/ would be a good guide for further investigation on your system.

     The discovery of a highly-effective cache poisoning attack that can affect name servers providing recursive name service has made it important that such servers be patched to mitigate against the problem. Furthermore, the risk of cache poisoning for servers that share recursive and authoritative functions can cross-pollinate the authoritative function with incorrect data. This tool is designed to assess the authorities for a given domain and determine whether they provide vulnerable recursive service.

Well, let’s perform a test on my domain name!

Oh, not bad, right ;)

 

If you were me, which server would you think of next?
- SIIT, Thamasart University (the name server of my institute)

you can also test on tu.ac.th - that will give a similar result.

 

Let’s see neighbor institutes:
- Chulalongkorn University

- Mahidol University

     Now, your turn! check if your server is reliable on its security. If you are a name server operator and you have found such a loophole, it’s high time for you to fix/report the problem.


d0m3z

Jul 15

     When I was young, Pirch98 is one of the most popular chat programs through IRC system. For me, it was not just a chat program - it was where I started to systematically write my first large piece of Pascal script. It was so because the youths like us made use of IRC’s feathers to make wars! Yes wars, if you can remember, operators (people with @ preceding their name) could kick you out of the room. Among operaters, one could also kick out another; therefore, he or she needed protection (or sometimes revenge) by an automatic script which was commonly available those days.

     How nice if you could write you own script to fight with your friends. It was such a fun game that I had to recode my script over and over and join the wars almost everynight. Nonetheless, such the wars were strongly prohibited in any IRC system because of too many contigeous commands needed - this would get the sever to work heavily. That’s why we were chased by IRCops (moderators who have a privilege to use OperServ commands). If you luckily got caught, your IP address would be banned for days and the room would be suspended for months.

     I quitted chatting on IRC system when I was in highschool - I didn’t actually mean to quit it but I just couldn’t have access to the IRC server. My dream of getting back to the game had been rethought many many times, and finally I just forgot it (lol, why not?). But at present, things have been changed. The last time I entered the IRC system, I hardly remembered which commands to use, and also almost all the policies had been changed as well - this made me totally lose appreciation with it. 

     Two or three yeard ago, I accidentally heard a game named Robocode. Robocode is a programmable tank game that each player has to write his own code in Java to fight each other. Yeah, this was supposed to be a game of wars, I thought. Don’t misunderstand me, I’m not war-crazy. I also found that the tank war is more challenging than the IRC war in many aspects, like you need to know fundamental Physics, Maths and much more. I then became very fond of this game.  While most of the IRC war techniques are mostly fixed in pattern, the robocode war techniques can vary from programmers to programmers - some techniques are even in researches!

     I am not an expert in robocode, say, I’m very new at it; I’m just fascinated by it. I have created a few robots, and still they are not so competitive. As SIIT held a robocode competition, I had participated in and won the second prize. The figure above shows a one-on-one fighting between my robot (Galois) and my frined’s robot (BlowinInTheWind) -  the one that beated mine one the competition. If you love programming, thinking and wars, this game can be a very good choice for you.

programming, thinking and WARs!
so d0m3z

Apr 14

     The first part of this topic has explained what prototypes are and how they are used. Recall that, JS chooses rather to link the prototype to the blank object than to duplicate it. This results in the share of property code and method code - the more they share, the less memory they require. Carefully read that they share the code, not the memory space. Looking at the following example:

function X() {
}
X.prototype = {
     x: 0,
     getX: function(){
          return this.x;
     },
     setX: function(new_x){
          this.x = new_x;
     }
}
myNum = new X();
yourNum = new X();
myNum.setX(8);
document.write(yourNum.getX());   // print "0"

     After the 2 objects are created,  they contain nothing. The call setX() on “myNum”, which is available upon its prototype chain, sets “this.x” to the specified number. The “this” keyword in this context references to the object “myNum”, not the prototype. It does not change the “x” in the prototype. You might check it out by yourself. The next line calling getX(), is also found in its prototype chain. The reference to “this.x” does not directly mean the “x” in the prototype, but it is indirectly referenced because the property “x” is not in the object itself. That is, “this.x” is later found in its prototype chain.
     The art of JS language design, as you see, is extremely fascinating. The memory used is minimized as less as possible. However, the following code can cause a logical error that is unknown to most programers.

function X(){
}
X.prototype = new function(){
     var x;
     this.getX =  function(){
          return x;
     }
     this.setX = function(new_x){
          x = new_x;
     }
}
myNum = new X();
yourNum = new X();
myNum.setX(8);
document.write(yourNum.getX());   // print "8"

     Differently coded, the sematic is almost the same except that “x” is set local or private. You might think that the above is better. However, unlike local variables in the constructor that are saved as separate closures for separate objects, “x” is shared among objects that link it as their prototype. The reason is that, the prototype is an object that has been instantiated long before. The save of the closure was done only once by the time the prototype was instantiated. As a result, there is only one closure shared among objects. So, be very careful if you wish to use private variables, which is not supported directly by JS.
     Prototypes are not only used for object instantiation, but also for primitive types. Surprising? Remember that, reference types and corresponding primitive types are differentiated only by the presence of the “new” keyword. But, they do share the same constructor. The “new” keyword simply gives you a blank object linked to its prototype. Without “new” keyword, a memory is also allocated to that primitive value and linked to the prototype as well. The “this” keyword refer to the primitive data instead of object. That is a reason why we have a wonderful code work nicely.

Number.prototype.isOdd = function(){
     return (this%2)? true : false;
}
var a = 7;
if(a.isOdd())
     document.write("Is it really odd?");

JS Prototypes

     By now, I assume that you are familiar with prototypes. The following referencing is meant to check your understanding. It can confuse you more if you do not really understand. Think of what they are before execute it. The weird syntax is used by mean to guide you to the answer. There is a saying that thousands words cannot better explain than a picture. Looking up this picture will also guide you to the answer. I got it from MollyPages.org

var Foo = Function("", "this.x = 6;");
var myObj = new Foo();
var myList = [
     myObj.__proto__,
     myObj.__proto__.constructor,
     Foo.prototype,
     Foo.__proto__,
     Foo.__proto__.constructor,
     Object.prototype.__proto__,
     myObj.__proto__.constructor.__proto__.constructor,
]
for(index in myList){
     document.write("<li>" + myList[index] + "</li>");
}

Onion_sure

กุบ้าได้ที่แล้ว หึหึ . . .
so d0m3z

« Previous Entries