Raspberry Pi cases

My favorite raspberry pi case so far was this one, with pretty colors. With a heatsink on the CPU, the temperature averaged around 56 degrees C. Other cases I've used include this one without the top for air ventilation, and this one for Pi Zero, which is simple and utilitarian.

Recently I decided to try to clean up the mess of Raspberry Pis by the router, and got a "cluster-type" case to put them all together. Assembly was trickly, but the end result looks clean. The only issue is the temperatures, which are roughly 10-15 degrees C warmer inside the cluster than outside, where the devices were exposed to ambient room temperatures and air currents. Although the case did come with extra heatsinks for LAN and CPU, some devices did not receive the new addition (for space reasons), and so they heat up. Average around 60 C, warmer for items nested deeper in the case. With temperatures going even higher when I leave for travel and raise the A/C setting, it behoves me to get something that could permit more air-flow, and thus it was. The next case will be a stackable dog-bone style set.

Busy busy bee

How interesting that I'm more likely to post when super busy with a task that has a pending deadline. Anyway, just wanted to share a neat tool for combing segments of HTTP streaming files into one. Last night I decided to see if the content of a certain music video streaming site could be downloaded offline. The website can be clunky, and streaming over the internet is sometimes less preferable to watching offline and reducing system load (ish).

First, some basics. (This won't be an exhaustive list, just what I've encountered in the past.)

When you stream media, it will come to your browser via several methods.

One method is to simply provide a whole big file, and let the browser handle how to play it. Firefox has a built-in media player, and HTML5 has built-in tags, so why not have the user click on a link that hides an MP4 file and let the browser play it how it wishes.

An alternative method is to build your own serving capability and web application around serving media, such as Soundcloud, which appends all sorts of authentication and one-time-use tokens to actually get to a file, rather than just having a list of files.A corollary to this one is to encrypt the music and decrypt on-the-fly, such as with RTSP, which adds some level of restrictions against bypass, but can still be scripted away.

A third method, possibly more in use for large video files, is to "break the overall stream into a sequence of small HTTP-based file downloads, each download loading one short chunk of an overall potentially unbounded transport stream." (Wikipedia, HTTP Live Streaming) This works well for live video, such as on Youtube, Facebook Live, Snapchat, etc, where there is no defined end and therefore no file size to start with. It's also easier on the user, which only needs to load content chunk by chunk, and can be used in situations where the user's network might be unreliable.

Before the stream beings, an m3u8 playlist file is downloaded by the browser, with all the pieces listed. The segments have an extension of .ts, and if you look at just one, it'll be a few seconds or so of the overall piece.

Now, on to the process. If you open an intercepting proxy such as BurpSuite or Zap, load a webpage with streaming media on the associated browser, and watch the traffic, you'll see a series of requests being made. First the HTTP page where the media, for example's sake a piece of music, sits. Next will be some script and content style files which could have some use, but most likely not. Then a request will be made for something like "file_128kpbs.mp3", and a big file will show up, which is the entire mp3 itself. If we're loading a streaming movie, you'll see a request made for an m3u8 file with a response containing all 507 pieces.

There is a tool on Github called HLS-fetch, which can be given either the page with the content or the m3u8 link itself to download all the files and stitch them into a TS file. Plex can play that right off the bat, no transcoding.

Back from Europe - Update

A fitful sleep (like switching to night shift), and I'm back from Europe. Wish so much that photos could be posted of the trip in linear format just as they were in WhatsApp, but that is quite some hassle. For now I simply assure you it was like no other.

Update - While unpacking I thought it worthwhile to document what was most and least useful. Prior to packing I'd read many posts from reddit.com/r/solotravel, on vital things to do, to take, to prepare, and purchased many items that would not otherwise have come up.

More Useful:

Merino fleece - Best recommendation ever. Light but warm, machine-wash warm, dries quickly when sweating. They were worth the higher price, when purchased in-store from REI. (Relevant thread.) However, on my laundry cycle it was necessary to purchase an additional long-sleeve shirt in Prague.

Bandana - Sneeze? No napkins? You got this.
Bottle opener
Light sweater - It proved to be much colder than I'd expected, and a thicker sweater was purchased in Prague.
Sewing Kit - Wasted too much time walking around Prague looking for this when the single light sweater developed a rip along the shoulder seam. Found one in a cute store called Little Copenhagen in the tourist area of Prague.
Sleep mask for travel
More t-shirts for sleeping - Purchased in Prague, as I'd forgotten about sweating during sleep.
Day Pack -  The one in the link worked, but was a bit too light. It tended to cause more sweating on my back, and in the future a more solid backpack is the way to go.
Large Ziplock bags - Stinky laundry.

 Less Useful:

Umbrella - Better to just have a good rainjacket and a cover for the Osprey Backpack.
Siddur - Everything is available online.

Europe here I come!

Last weekend before my trip to Europe. Here's the planned itinerary. I've packed, mostly, but still trying to figure out how much clothing to take and how to pack it properly into a 46L bag, which is all I'm taking as opposed to 70 pounds of luggage that went with me to Paris, and 75+ that came back. Also still planning what to do in each city, but I have a good idea and should have no trouble finding what to do.

Here goes nothing!

Busy recent weeks

I've been traveling for five consecutive weeks now, which is the longest stretch so far during my time at this current job. As such it leaves little time for other projects, but I promise to post a guide to setting up GoPhish on Windows Server 2012 sometime next week.

As a substitute, here's a short blurb about SQL Injection.

In my time doing manual verification of scanner results, I found 1 certain SQL injection vulnerability and maybe 2 potential others. When doing manual web application assessments I found none (the cool stuff had already been picked out by previous testing).

I wonder if hitherto unchecked internal environments are more likely to have SQL injection vulnerabilities. As an example, let's look at this site:

example.com/dir/default.asp?page=profile&action=lookup&option=Name&StrSearch=

We're looking up user profiles, testing each parameter for generic XSS and SQL with something like <>"'%^&*()[] or some other banging of the keyboard. And what do we see when we put a single tick in the StrSearch parameter?

Let's pull out SQLMap and direct it at the StrSearch parameter, making sure to include the right cookies. Voila, it works!



A shell and all the database content our heart desires.

A second example. This one came courtesy of Nessus which flagged it as a potential Blind SQL injection, using a time-based injection. I wouldn't have found it otherwise, as this was a pentest where the only IP information given was a list of IPs to exclude. The rest was up to me to find. I found 2100 live hosts, and was told there are about 2500 total. Just the 2100 was enough for me.

Here's the query string (some parameters removed):

example.com/index.asp?tbUserName=&tbPassword=&search=&a=verify&t=66

The potentially vulnerable parameter was "t". After verifying that the time-based injection worked (ala ;WAITFOR DELAY '0:0:5'--) by sending various commands that request for a response after a certain number of seconds, I fed it to SQLmap.

Payload: 66 UNION ALL SELECT NULL,CHAR(113) etc etc

And oh hey, look, all the database tables of this company. Users, passwords in clear text (from some tables), PII (which I didn't dare touch), all your greedy little heart desires. The passwords looked like they came from a time before minimum password restrictions, because "1v10" isn't terribly secure.

So in conclusion: SQL injection is super rare but when you find it you get the keys to the kingdom.