x-frame-options old notes

Taken from old mozsecworld.org page on x-frame-options

What to do

Add in this line to your HTTP Response Headers: X-Frame-Options: deny

How to check

Firefox's Firebug or Chrome's "Inspect Elements": Go to "Net" option, refresh page, and click on the link that shows up, select "Headers" and you should see "X-Frame-Options: DENY" under "Response Headers"

Terminal: >telnet [insert IP-address of your site] 8000 Press enter and put in GET /en-US/msw/ HTTP/1.1 Press enter twice, and scroll to the very top of the output, should see "x-frame-options: DENY".

What I did

Playdoh automatically sets the "X-Frame-Options" to "deny". But if you want to set it automatically in Django, use response['x-frame-options'] = 'DENY'

In views.py:

# X-Frame-Options
def xfo_deny(request):
    html = " ... my html stuff ... "
    response = HttpResponse(html)
    response['x-frame-options'] = 'DENY'
    return response

---

Notes on how Django does x-frame-options

In vendor/src/commonware/commonware/response/middleware.py:

from django.conf import settings

class FrameOptionsHeader(object):
    """
    Set an X-Frame-Options header. Default to DENY. Set
    response['x-frame-options'] = 'SAMEORIGIN'
    to override.
    """

    def process_response(self, request, response):
        if hasattr(response, 'no_frame_options'):
            return response

        if not 'x-frame-options' in response:
            response['x-frame-options'] = 'DENY'
        

In vendor/src/commonware/commonware/response/decorators.py:

from functools import wraps

from django.utils.decorators import available_attrs


def xframe_sameorigin(view_fn):
    @wraps(view_fn, assigned=available_attrs(view_fn))
    def _wrapped_view(request, *args, **kwargs):
        response = view_fn(request, *args, **kwargs)
        response['x-frame-options'] = 'SAMEORIGIN'
        return response
    return _wrapped_view


def xframe_allow(view_fn):
    @wraps(view_fn, assigned=available_attrs(view_fn))
    def _wrapped_view(request, *args, **kwargs):
        response = view_fn(request, *args, **kwargs)
        response.no_frame_options = True
        return response
    return _wrapped_view


def xframe_deny(view_fn):
    @wraps(view_fn, assigned=available_attrs(view_fn))
    def _wrapped_view(request, *args, **kwargs):
        response = view_fn(request, *args, **kwargs)
        response['x-frame-options'] = 'DENY'
        return response
    return _wrapped_view
        

Wildcard in CSP

For certain rules, you can set "*" to allow all. When you do so, be sure to delete any other statements, or else they would narrow down the search, making "*" ineffective.

More details

How adopted-kitsune Django upload works.

0. forms.py

class ImageAttachmentUploadForm(forms.Form):

    """Image upload form."""

    print "############################in form"

    image = forms.ImageField(error_messages={'required': MSG_IMAGE_REQUIRED,

                                             'max_length': MSG_IMAGE_LONG},

                             max_length=settings.MAX_FILENAME_LENGTH)

1. views.py

for fileupload page if request.method == 'POST':
    form = forms.ImageAttachmentUploadForm(request.POST, request.FILES)
    if form.is_valid()

2. playdoh/vendor/src/django/django/forms/fields.py

class ImageField(FileField):
    def to_python(self, data):

        """
        Checks that the file-upload field data contains a valid image (GIF, JPG,
        PNG, possibly others -- whatever the Python Imaging Library supports).
        """

Where to see CSP Policy

x-content-security-policy... policy-uri /path/to/policy

and then go to www.domain.name/path/to/poloice

SQL Query for Top 500 Passwords

It's actually 499 because "0" was repeated. Source.

insert into table_name (password_column) values ("123456"),("porsche"),("firebird"),("prince"),("rosebud"),("password"),("guitar"),("butter"),("beach"),("jaguar"),("12345678"),("chelsea"),("united"),("amateur"),("great"),("1234"),("black"),("turtle"),("7777777"),("cool"),("pussy"),("diamond"),("steelers"),("muffin"),("cooper"),("12345"),("nascar"),("tiffany"),("redsox"),("1313"),("dragon"),("jackson"),("zxcvbn"),("star"),("scorpio"),("qwerty"),("cameron"),("tomcat"),("testing"),("mountain"),("696969"),("654321"),("golf"),("shannon"),("madison"),("mustang"),("computer"),("bond007"),("murphy"),("987654"),("letmein"),("amanda"),("bear"),("frank"),("brazil"),("baseball"),("wizard"),("tiger"),("hannah"),("lauren"),("master"),("xxxxxxxx"),("doctor"),("dave"),("japan"),("michael"),("money"),("gateway"),("eagle1"),("naked"),("football"),("phoenix"),("gators"),("11111"),("squirt"),("shadow"),("mickey"),("angel"),("mother"),("stars"),("monkey"),("bailey"),("junior"),("nathan"),("apple"),("abc123"),("knight"),("thx1138"),("raiders"),("alexis"),("pass"),("iceman"),("porno"),("steve"),("aaaa"),("fuckme"),("tigers"),("badboy"),("forever"),("bonnie"),("6969"),("purple"),("debbie"),("angela"),("peaches"),("jordan"),("andrea"),("spider"),("viper"),("jasmine"),("harley"),("horny"),("melissa"),("ou812"),("kevin"),("ranger"),("dakota"),("booger"),("jake"),("matt"),("iwantu"),("aaaaaa"),("1212"),("lovers"),("qwertyui"),("jennifer"),("player"),("flyers"),("suckit"),("danielle"),("hunter"),("sunshine"),("fish"),("gregory"),("beaver"),("fuck"),("morgan"),("porn"),("buddy"),("4321"),("2000"),("starwars"),("matrix"),("whatever"),("4128"),("test"),("boomer"),("teens"),("young"),("runner"),("batman"),("cowboys"),("scooby"),("nicholas"),("swimming"),("trustno1"),("edward"),("jason"),("lucky"),("dolphin"),("thomas"),("charles"),("walter"),("helpme"),("gordon"),("tigger"),("girls"),("cumshot"),("jackie"),("casper"),("robert"),("booboo"),("boston"),("monica"),("stupid"),("access"),("coffee"),("braves"),("midnight"),("shit"),("love"),("xxxxxx"),("yankee"),("college"),("saturn"),("buster"),("bulldog"),("lover"),("baby"),("gemini"),("1234567"),("ncc1701"),("barney"),("cunt"),("apples"),("soccer"),("rabbit"),("victor"),("brian"),("august"),("hockey"),("peanut"),("tucker"),("mark"),("3333"),("killer"),("john"),("princess"),("startrek"),("canada"),("george"),("johnny"),("mercedes"),("sierra"),("blazer"),("sexy"),("gandalf"),("5150"),("leather"),("cumming"),("andrew"),("spanky"),("doggie"),("232323"),("hunting"),("charlie"),("winter"),("zzzzzz"),("4444"),("kitty"),("superman"),("brandy"),("gunner"),("beavis"),("rainbow"),("asshole"),("compaq"),("horney"),("bigcock"),("112233"),("fuckyou"),("carlos"),("bubba"),("happy"),("arthur"),("dallas"),("tennis"),("2112"),("sophie"),("cream"),("jessica"),("james"),("fred"),("ladies"),("calvin"),("panties"),("mike"),("johnson"),("naughty"),("shaved"),("pepper"),("brandon"),("xxxxx"),("giants"),("surfer"),("1111"),("fender"),("tits"),("booty"),("samson"),("austin"),("anthony"),("member"),("blonde"),("kelly"),("william"),("blowme"),("boobs"),("fucked"),("paul"),("daniel"),("ferrari"),("donald"),("golden"),("mine"),("golfer"),("cookie"),("bigdaddy"),("king"),("summer"),("chicken"),("bronco"),("fire"),("racing"),("heather"),("maverick"),("penis"),("sandra"),("5555"),("hammer"),("chicago"),("voyager"),("pookie"),("eagle"),("yankees"),("joseph"),("rangers"),("packers"),("hentai"),("joshua"),("diablo"),("birdie"),("einstein"),("newyork"),("maggie"),("sexsex"),("trouble"),("dolphins"),("little"),("biteme"),("hardcore"),("white"),("0"),("redwings"),("enter"),("666666"),("topgun"),("chevy"),("smith"),("ashley"),("willie"),("bigtits"),("winston"),("sticky"),("thunder"),("welcome"),("bitches"),("warrior"),("cocacola"),("cowboy"),("chris"),("green"),("sammy"),("animal"),("silver"),("panther"),("super"),("slut"),("broncos"),("richard"),("yamaha"),("qazwsx"),("8675309"),("private"),("fucker"),("justin"),("magic"),("zxcvbnm"),("skippy"),("orange"),("banana"),("lakers"),("nipples"),("marvin"),("merlin"),("driver"),("rachel"),("power"),("blondes"),("michelle"),("marine"),("slayer"),("victoria"),("enjoy"),("corvette"),("angels"),("scott"),("asdfgh"),("girl"),("bigdog"),("fishing"),("2222"),("vagina"),("apollo"),("cheese"),("david"),("asdf"),("toyota"),("parker"),("matthew"),("maddog"),("video"),("travis"),("qwert"),("121212"),("hooters"),("london"),("hotdog"),("time"),("patrick"),("wilson"),("7777"),("paris"),("sydney"),("martin"),("butthead"),("marlboro"),("rock"),("women"),("freedom"),("dennis"),("srinivas"),("xxxx"),("voodoo"),("ginger"),("fucking"),("internet"),("extreme"),("magnum"),("blowjob"),("captain"),("action"),("redskins"),("juice"),("nicole"),("bigdick"),("carter"),("erotic"),("abgrtyu"),("sparky"),("chester"),("jasper"),("dirty"),("777777"),("yellow"),("smokey"),("monster"),("ford"),("dreams"),("camaro"),("xavier"),("teresa"),("freddy"),("maxwell"),("secret"),("steven"),("jeremy"),("arsenal"),("music"),("dick"),("viking"),("11111111"),("access14"),("rush2112"),("falcon"),("snoopy"),("bill"),("wolf"),("russia"),("taylor"),("blue"),("crystal"),("nipple"),("scorpion"),("111111"),("eagles"),("peter"),("iloveyou"),("rebecca"),("131313"),("winner"),("pussies"),("alex"),("tester"),("123123"),("samantha"),("cock"),("florida"),("mistress"),("bitch"),("house"),("beer"),("eric"),("phantom"),("hello"),("miller"),("rocket"),("legend"),("billy"),("scooter"),("flower"),("theman"),("movie"),("6666"),("please"),("jack"),("oliver"),("success"),("albert");

Rate limiting login resourecs

Limit by IP:
- Simple one that limits 20 clicks per IP. I had it running on my xvm.

WebGoat Training

 http://yehg.net/lab/pr0js/training/webgoat.php

Getting SSL Certificate Checking to work

Workon playdoh
In directory CheckSSLCert

1. Install Twisted

1.1- svn co svn://svn.twistedmatrix.com/svn/Twisted/trunk
1.2- cd trunk
1.3- python setup.py install

check on chunk of code-

2. Install pyOpenSSL: pip install pyopenssl
2.1- Download the tar.gz http://launchpad.net/pyopenssl/main/0.11/+download/pyOpenSSL-0.11.tar.gz to directory
2.2a- ./Configure darwin64-x86_64-cc
- make

"_ENGINE_load_gost", referenced from:
_ENGINE_load_builtin_engines in libcrypto.a(eng_all.o)
ld: symbol(s) not found
collect2: ld returned 1 exit status
make[2]: *** [link_app.] Error 1
make[1]: *** [openssl] Error 2
make: *** [build_apps] Error 1

2.2b- ./Configure darwin64-x86_64-cc zlib no-asm no-krb5 shared
- make

ld: duplicate symbol _OPENSSL_cleanse in libcrypto.a(mem_clr.o) and libcrypto.a(x86_64cpuid.o)
collect2: ld returned 1 exit status
make[4]: *** [link_a.darwin] Error 1
make[3]: *** [do_darwin-shared] Error 2
make[2]: *** [libcrypto.1.0.0.dylib] Error 2
make[1]: *** [shared] Error 2
make: *** [build_crypto] Error 1

- ld: in ../libcrypto.a(XT), archive member 'XT' with length 0 is not mach-o or bitcode
collect2: ld returned 1 exit status
make[2]: *** [link_app.] Error 1
make[1]: *** [openssl] Error 2
make: *** [build_apps] Error 1
2.2c - Try again: ./Configure darwin64-x86_64-cc - make



3. Install PyCrypto tar.gz
- python setup.py install


Check that things got installed properly in Python shell
- import twisted, OpenSSL, Crypto

Google Safe Browsing API

1. Chose to use the simpler "Safe Browsing Lookup API" instead of the more complicated "Safe Browsing API v2". Comparison between the two.
    - Found a Python library to look up Google's Safe Browsing API, with Django as well, but it has not been updated for over a year and it does not use "Safe Browsing Lookup API".

News Forum Rich Text Sanitizing with Bleach

- Bleach github
       - Is bleach already in django?
       - Example of bleach
- Make a news forum


Bleach
- Get the bleach module


(playdoh)haoqili@host-3-248:11:50:59:~/dev/playdoh/playdoh/playdoh$ ./manage.py shell
Python 2.7.1 (r271:86832, Jun  6 2011, 13:57:48)
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> import bleach
Traceback (most recent call last):
  File "<console>", line 1, in <module>
ImportError: No module named bleach
>>>
KeyboardInterrupt
>>>
(playdoh)haoqili@host-3-248:12:00:06:~/dev/playdoh/playdoh/playdoh$ pip install -e git://github.com/jsocol/bleach.git#egg=bleach
Obtaining bleach from git+git://github.com/jsocol/bleach.git#egg=bleach
  Cloning git://github.com/jsocol/bleach.git to /Users/haoqili/.virtualenvs/playdoh/src/bleach
  Running setup.py egg_info for package bleach
   
Downloading/unpacking html5lib (from bleach)
  Downloading html5lib-0.90.zip (99Kb): 99Kb downloaded
  Running setup.py egg_info for package html5lib
   
Installing collected packages: bleach, html5lib
  Running setup.py develop for bleach
   
    Creating /Users/haoqili/.virtualenvs/playdoh/lib/python2.7/site-packages/bleach.egg-link (link to .)
    Adding bleach 1.0.2 to easy-install.pth file
   
    Installed /Users/haoqili/.virtualenvs/playdoh/src/bleach
  Running setup.py install for html5lib
   
Successfully installed bleach html5lib
Cleaning up...
(playdoh)haoqili@host-3-248:12:00:54:~/dev/playdoh/playdoh/playdoh$ ./manage.py shellPython 2.7.1 (r271:86832, Jun  6 2011, 13:57:48)
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> import bleach
>>> bleach.clean('an <script>evil()</script> example')
u'an &lt;script&gt;evil()&lt;/script&gt; example'
>>> bleach.linkify('an http://example.com url')
u'an <a href="http://example.com" rel="nofollow">http://example.com</a> url'

==========
jsocol: the "u" indicates that it's a unicode string instead of a simple bytestring, it's a python thing
==========

jsocol: haoqili: there's no Bleach() class anymore, it's just "import bleach" or "from bleach import clean, linkify"









haoqili: I'm looking at __init__.py
[12:25pm] jsocol: ok
[12:25pm] haoqili: What is the significance of TLDS = """ac ad ae aero af ag ai al am an ao aq ar arpa as asia at au aw ax az
[12:25pm] haoqili: ba bb bd be bf bg bh bi biz bj bm bn bo br bs bt bv bw by bz ca cat?
[12:25pm] haoqili: i.e. what is TLDS?
[12:26pm] jsocol: TLD = Top Level Domain, it's supposed to be an exhaustive list of all the current, valid TLDs
[12:26pm] jsocol: so that, for example, "example.com" or "example.co.uk" gets linkified, but "example.txt" does not
[12:26pm] haoqili: ah
[12:26pm] haoqili: okay
[12:27pm] haoqili: I'm also trying to understand how clean's ALLOWED_TAGS get added to the pre-defined ALLOWED_TAGS
[12:28pm] haoqili: is it added or replaced?
[12:28pm] haoqili: I guess it's replaced?
[12:28pm] jsocol: replaced. if you pass in a tags= kwarg, your list supercedes the default list, so you can be more restrictive

Security Websites: Top 10 Vulnerabilities, Safe Password

Top 10 web vulnerabilities of 2010

Top 10 vulnerabilities in PDF format

In addition to these vulnerabilities:

- commonware adaptive brute force prevention - captcha
- blacklisted passwords
- bcrypt password storage
- Password reset option
- SSL
- Cookies SECURE Flag, HTTPOnly Flag
- (XFO) X Frame Options for Clickjacking (so scary. You could be playing a game, but in fact giving bad guys your money)
- (HSTS) HTTP Strict Transport Security.  Transportation Layer Protection Cheat Sheet.

====

Password Safe, Java version

PGP GPG Web of Trust, Find Most Secure Path

Web of Trust explaination

http://zarb.org/~gc/html/pgppathfinder.html  (http://pgp.cs.uu.nl/)

Showing trust levels with "gpg":
gpg --with-colons --list-keys
The second field and the ninth field are the ones you want. The
second field contains the validity, and the ninth field contains the
trust setting. See doc/DETAILS from the GnuPG distribution for all the possible values there.

2. Field:  A letter describing the calculated trust. This is a single
     letter, but be prepared that additional information may follow
     in some future versions. (not used for secret keys)
  o = Unknown (this key is new to the system)
                i = The key is invalid (e.g. due to a missing self-signature)
  d = The key has been disabled
      (deprecated - use the 'D' in field 12 instead)
  r = The key has been revoked
  e = The key has expired
  - = Unknown trust (i.e. no value assigned)
  q = Undefined trust
             '-' and 'q' may safely be treated as the same
      value for most purposes
  n = Don't trust this key at all
  m = There is marginal trust in this key
  f = The key is fully trusted
  u = The key is ultimately trusted.  This often means
      that the secret key is available, but any key may
      be marked as ultimately trusted.
 9. Field:  Ownertrust (primary public keys only)
     This is a single letter, but be prepared that additional
     information may follow in some future versions.  For trust
     signatures with a regular expression, this is the regular
     expression value, quoted as in field 10.

$ gpg --with-colons --list-keys
tru::1:1304353633:1309537403:3:1:5
pub:-:4096:1:EEB79C73B8EC3AC9:2009-05-18:::-:Geoffrey Thomas ::escESC:
pub:e:2048:1:B576D161BD18CA24:2010-04-27:2010-08-25::-:MIT 6.033 sp2010 (Key for hands-on #6 - Crypto) <6.033-staff@mit.edu>::sc:
sub:e:2048:1:6AC6D22E0D016CE7:2010-04-27:2010-08-25:::::e:
pub:-:1024:17:882E0BAD0B72EB0F:2009-04-27:2012-01-20::-:Barack Hussein Obama (DOD) ::scaSCA:
pub:-:4096:1:4372CDFF95630310:2010-04-08:::-:Chris Post ::scESC:
uid:-::::2010-04-09::A5898B3ADF21B9261C6F342945D94F0392F4E1F8::Chris Post :
sub:-:4096:1:365783180773FB2D:2010-04-08::::::e:
pub:u:2048:1:304085A3F33AAB16:2011-05-02:2011-07-01::u:HaoQi Li ::scESC:
sub:u:2048:1:182358B0146708AD:2011-05-02:2011-07-01:::::e:

mean shortest distance, strong set

pathfinder, with graphs, Wotsap
pathfinder in gpgwww.c of onak, example: looking up path to

leaf of trust graphs

PGP trust statistics

We found a few sites that talked about people implementing pgp web of trust and even making a graphical display. How does PGP use the trust signature (shown below, from document of OpenPGP) and the trust level of PGP for the web of trust?

5.2.3.13. Trust signature

The trust amount is in a range from 0-255, interpreted such that
    values less than 120 indicate partial trust and values of 120 or
    greater indicate complete trust.  Implementations SHOULD emit values
    of 60 for partial trust and 120 for complete trust.

No, PGP doesn't use "trust level" linked in webs.

===
GPG tutorial

===

Our project is to figure out how much you can trust paths, and in turn, keys, in the web of trust. It has 2 parts, Reiter and Stubblebine wrote papers on these topics:

1. Finding paths. How to find paths. PathServer is a web-based service for authenticating PGP public keys, i.e., determining their owners. It works by enabling a user to find paths of certificates from a key she trusts to a key she wants to learn about. You can find out more about this by having a look at "Path independence for authentication in large-scale systems." (1997) and "Resilient Authentication Using Path Independence" (1998)
2. Evaluating the validity of paths based on the level of trust on the nodes. A metric of authentication is a procedure for evaluating the assurance one has in a name-to-key binding. That is, it tells you how sure you can be regarding the apparent owner of a key, given the information available to you and how much you trust the various entities that apparently contributed this information. In this work, we developed a number of principles for the design of metrics of authentication, demonstrated how several proposed metrics fall short of them, and described a new metric that we believe comes close to being an acceptable metric of authentication: "Authentication metric analysis and design" (1999) and "Toward acceptable metrics of authentication" (1997)

PGP GPG Web of Trust, Find Most Secure Path

Web of Trust explaination

http://zarb.org/~gc/html/pgppathfinder.html  (http://pgp.cs.uu.nl/)

Showing trust levels with "gpg":
gpg --with-colons --list-keys
The second field and the ninth field are the ones you want. The
second field contains the validity, and the ninth field contains the
trust setting. See doc/DETAILS from the GnuPG distribution for all
the possible values there.
2. Field: A letter describing the calculated trust. This is a single
letter, but be prepared that additional information may follow
in some future versions. (not used for secret keys)
o = Unknown (this key is new to the system)
i = The key is invalid (e.g. due to a missing self-signature)
d = The key has been disabled
(deprecated - use the 'D' in field 12 instead)
r = The key has been revoked
e = The key has expired
- = Unknown trust (i.e. no value assigned)
q = Undefined trust
'-' and 'q' may safely be treated as the same
value for most purposes
n = Don't trust this key at all
m = There is marginal trust in this key
f = The key is fully trusted
u = The key is ultimately trusted. This often means
that the secret key is available, but any key may
be marked as ultimately trusted.
9. Field: Ownertrust (primary public keys only)
This is a single letter, but be prepared that additional
information may follow in some future versions.

$ gpg --with-colons --list-keys
tru::1:1304353633:1309537403:3:1:5
pub:-:4096:1:EEB79C73B8EC3AC9:2009-05-18:::-:Geoffrey Thomas ::escESC:
pub:e:2048:1:B576D161BD18CA24:2010-04-27:2010-08-25::-:MIT 6.033 sp2010 (Key for hands-on #6 - Crypto) <6.033-staff@mit.edu>::sc:
sub:e:2048:1:6AC6D22E0D016CE7:2010-04-27:2010-08-25:::::e:
pub:-:1024:17:882E0BAD0B72EB0F:2009-04-27:2012-01-20::-:Barack Hussein Obama (DOD) ::scaSCA:
pub:-:4096:1:4372CDFF95630310:2010-04-08:::-:Chris Post ::scESC:
uid:-::::2010-04-09::A5898B3ADF21B9261C6F342945D94F0392F4E1F8::Chris Post :
sub:-:4096:1:365783180773FB2D:2010-04-08::::::e:
pub:u:2048:1:304085A3F33AAB16:2011-05-02:2011-07-01::u:HaoQi Li ::scESC:
sub:u:2048:1:182358B0146708AD:2011-05-02:2011-07-01:::::e:

leaf of trust graphs

===

GPG tutorial

6.858 lab set up - Install VMware Player, Change Keymap (to Dvorak) on VMware Ubuntu Terninal

Part 1. Setting up 6.858 (fall 2010 version) VMware Player

Yesterday at the College Hackathon, I was talking to dcluo about 6.858, the Computer Systems Security Class I took last semester. To my dismay, I realised that I have forgotten the details behind a lot of the cool tricks I learned from the 6.858. So I want to go through all the cool labs again.

6.858 Lab 1 - a more concise version of the detailed lab instructions!


1a. Install VMware Player if you are an MIT student, you can get VMware Player for free.
Can't click to open the "VMware-Player-3.1.3-324285.1386.bundle" to install it. Clicking just shows a blank gedit.

To install do:
        1. Move the bundle to Desktop
        2. Open a terminal, cd to Desktop
        3. chmod +x VMware-Pl[tab complete]
        4. sudo ./VMware-Player-3.1.3-324285.i386.bundle

1b. Or install Virtual Box, which is free. You will also need to follow these instructions so that you can convert the VMware image below to Virtual Box image.

2. Install the 6.858 2010 course image. Move the "vm-6858.vmwarevm" to your Desktop or somewhere. Open it, and click on "vm-6858.vmx" to start the VMware :)


3. Log in with username: httpd, password: 6858


4. VMware tips: press SHIFT+CTRL to get out of the VMware window
Optional: For those who want to change the keymap from Qwerty to Dvorak, please go down to see Part 2 of this post.



5. SSH into the VMware so that it's much easier to work with.

SSH into VM from host:
        1. In VMware terminal do: /sbin/ifconfig eth0
        2. look at the IP address of "inet addr," e.g. 172.16.197.128
        3. Open up terminal on your host machine
        4. ssh httpd@172.16.197.128
        5. password is 6858
        6. Now you are in!

6. Retrieve the lab files: git clone http://pdos.csail.mit.edu/6.858/lab-2010.git lab
It might take a while.
- ls
- cd lab
- ls again and you should see files:

bin.tar.gz           http.c      Makefile     zoobar     zook-exstack.conf
clean-env.sh         http.h      shellcode.S  zook.conf  zookfs.c
exploit-template.py  index.html  test.sh      zookd.c    zookld.c

7. Compile the web server: make


8. Now you're ready to start Part 1: Finding buffer overflows!


Part 2. Change Keymap (to Dvorak) on New VMware Ubuntu Terminal
I'll demonstrating switching the keymap from Qwerty to Dvorak (which I use exclusively on my laptop).

1. First I tried "setxkbmap dvorak", that had an error that told me to install:
2. sudo apt-get install x11-xkb-utils, in Dvorak it's oger aly[i.y cboyann q11[qtx[gycno
3. When I typed "setxkbmap dvorak" again, it told me cannot open display "default display" Solution:
4. sudo apt-get install console-data, in Dvorak it's oger aly[i.y cboyann jrborn.[eaya. If at this point you get a cannot open display "default display", do sudo loadkeys /usr/share/keymaps/i386/dvorak/dvorak, in Dvorak it's oger nraet.fo zgopzodap.zt.fmalozc386zekrpatzekrpat
5. Choose "Select keymap from arch list"
6. Choose "dvorak"
7. Be happy typing in dvorak!