I believe in continuous learning. Not exactly as a life philosophy but so much as it makes me feel fulfilled. So as i took a walk down my memory lane but not so far long, just a year back, yes that right, just as i set this website up. As i said in my previous post, there has been quiet a lot of things going around and hence it took me a while to post this. So i ask myself a simple question, what new stuff have i learned the past year?. well the answer lies in the following,
Haskell: Optparse-applicative and Wreq library.
To say the truth, this one was more tiring as well as rewarding of all. A while ago, i started to write some personal scripts in haskell but then i ran into the trouble of parsing commandline arguments. The getopts options was fairy nice to begin with, but as my scripts got bigger so did my need for more commandline parsing options. After searching around, I found that optparse applicative library was regarded the most powerfull commandline parser option available.
The issue: As with everything haskellish, there was extensive documentation, a full detailed mathematical digression from paolo capriotti in his blog and with only 2 examples in hackage and hoogle. And therein began my month long odyssey in trying to understand the library. My usual learning process of googling, taking a few examples , modifying the same and finally after developing a feel for the library then reading the docs failed, since there isn't much example to work with. Finally when i managed to write the first parser, i even did a brief root dance, (a ritual only reserved for successful privesc,)
The second library wreq is a http client library and is eventhough far more complicated, but thanks to the extensive from the great BOS himself, the learning curve was a less steeper than it could have been. In effect, i had a coding challenge wherein it was required to make a http request and process the result and send back the processed result along with some cookie manipulation. Since the challenge also increased in a step difficult, it allowed me to slowly assimilate the wreq library information. On a personal note, I am a cat on the wall as far as the use of Lens in haskell is concerned.
HUGO
Hugo is a framework based on Go lang to built beautiful websites. Since i was working a bit more than usual with websites for some of my clients, i started an aversion to the usage of worpress and drupal for sites which are basically of static in nature. I was looking for alternate options, and after using hugo for the first website, i should confess i am impressed. In short, hugo works in the following way, you code the contents of your blog/website in markdown language and then setup a html template in the form of either single.html or with partials and use hugo to generate the static website. Since this is static in nature, there is no need for a database server or php version headaches. Just an apache server or as for that matter any simple webserver would suffice. If the website has multiple contents that has to be rendered differently, there is a option of adding categories/types and choosing different templates based on types.
Learning curve-wise, hugo is has relatively low lying learning curve. I managed to deploy my first website after a week (5 working days infact for anyone interested.). The downside, hugo being relatively new, not many tutorials are available at the moment and the docs though small is very concise. Furthermore since most of the configuration is carried out in the form of markdown and config.toml file and with hugo community being gracious to fill github with lot of templates with sample config.toml, this compensates for the lack of huge number of tutorials.
ARCHSTRIKE
Arch linux has been my preferred linux of choice, though i occasionally work with gentoo for experience and keeping up. For anyone, who is not familiar with the name Archstrike. Archstrike is a archbased distro, or rather lets say provides additional repositories filled with tools ideally needed for security assessment and pentesting. Eventhough the standard pentest distro kali is rolling release, i prefer Archstrike as a matter of choice since it is easy to convert an existing arch install to archstrike. All that needs to be done is add the relevant repos to pacman and import the arch keyring and one is set to go. For more on the details, the developers of archstrike have a nice written wiki on their project page.
Now coming to the main issue, since using aur for a long time, i was aware of pkgbuild for arch. In a simpler term, the pkgbuild is simple a bash script which installs the required package. But there are certain additional nifty technical details like pkgversion, git commits and source builds or even for the cleanup process. Finally, i decided to take a plunge and submit two package to archstrike. As the repo of archstrike extensively covers a lot of scripts and tools, it took me a while to find some scripts which were not preexisting in archstrike repos. The archstrike wiki again had additional supplementary details on setting up the archroot and making a clean build. Confession time: In spite of all those available information, i did make a few minor blunder while commiting (wrong versioning, release candidate, commits etc) but after receiving some feedbacks from the devs, i got hold of the ropes and finally did two commits.
Buffer Overflow Exploitation
This one is not something that i would add as something new that i learned, but more like, something that i improved myself in. The thanks goes to Offsec staff. Since there were a few vulnerable applications available in the offsec labs, it gave me a enhanced oppurtunity to also play around and learn the mechanics of simple buffer overflows. This inturn allowed me to challenge myself to exploit a simple buffer overflow vulnerability within an hour. By simple, i mean no complicated fuzzers or unicode etc. Obviously, the ideal option is to take what a programmer would do in such a situation and abstract the common features into a script. The nice thing about writing a script to automate some process is that it forces one to think about a common problem from a different perspective. In the end i had a python script which abstracted the nifty little repetitive pieces out of my hand and allowed me to concentrate on the beef of the exploitation part.
Rails
Laravel, Zend, Django, flask, Yesod, catalyst....there are as many frameworks as there are programming languages and infact are more of them. So in the end , I resorted to a age old DnD style and made my decision based on a roll of a dice. Which kind of came out phenomenal since along the way i also started using heroku more and more. Especially, the heroku CLI integrates well with git and deploying my testing apps became a breeze. After the end of the first two days my productivity skyrocketed. Additionally, I was fortunate to read Michael Hartl's book which placed emphasis on unit tests. This is a rarely touched subjected and even if attempted, usually ends up with a single chapter somewhere near the end. But Hartl's approach was to treat it as a simultaneous hand in hand process. Since as an aim, I was building a multilingual site, this approached also helped me to catch a few errors in the initial phases which otherwise would have ruined my day. To this extent, even if one is not a rails user or a ruby programmer, it is still beneficial to read Michael Hartl's book for his treatment on conducting tests before deploying. So to sum up, my whole learning of rails was : 20% rails, 15% heroku deploying, 15% bootstrap sass, 30% on running test and 20% of REST and MVC.
To state, the last year has been a productive year (atleast as far as learning was concerned for me).
Add new comment