I was searching around Packet Storm today and wanted to add there new files as a RSS/ATOM feed on my browser. I didn't find a link for this, so I created one in PHP. Below is the code that creates the atom.xml file.

Click Here To View

<?php
/
  Connects to packstormsecurity.org and created a 
  atom feed of the last 20 uploaded files.
  
  @requires php-curl php-tidy
  @author Tully Rankin
  @url    http://www.TullyRankin.com
 /
$ch = curlinit();
$url = 'http://www.packetstormsecurity.org/last20.html';
$site = 'http://www.packetstormsecurity.org';
curlsetopt($ch, CURLOPTURL, $url);
curlsetopt($ch, CURLOPTHEADER, 0);
curlsetopt($ch, CURLOPTRETURNTRANSFER, 1);
$data = curlexec($ch);
curlclose($ch);

$tidyconfig = array( 
        'clean' => true,
        'output-xhtml' => true,
        'show-body-only' => false,
        'wrap' => 0
        );
$tidy = tidyparsestring($data, $tidyconfig, 'UTF8');
$tidy->cleanRepair();
$xhtml = pregreplace('/\<spacer.*\>/','',$tidy);

$xml = new DOMDocument();
$xml->loadHTML($xhtml);

$body = $xml->getElementsByTagName("body")->item(0);
$links = $body->getElementsByTagName("a");
$x = 0;
foreach($links as $link) 
{
    if ($link->getAttribute("class") == "fname")
    {
        $files[$x]['name'] = $link->nodeValue;
        $files[$x]['link'] = $link->getAttribute("href");
        $x++;
    }
}

$tables = $body->getElementsByTagName("table");
foreach ($tables as $table) 
{
    if ($table->getAttribute("class") != "fbox2") continue;
    $tRows = $table->getElementsByTagName("tr");
    foreach($tRows as $row) 
    {
        if ($row->getAttribute("class") == "finfo")
        {
            if ($row->getElementsByTagName("td")->item(1) != null && 
                $row->getElementsByTagName("td")->item(1)->getAttribute("valign") == "top")
            {
                $td = $row->getElementsByTagName("td")->item(1);
                $text[] = $td->nodeValue;
            }
        }
    }
}

$x = 0;
$fileNames = array();
foreach ($files as $file) 
{
    if (substr($file['link'],0,1) == "/")
    {
        $content[$x]['name'] = $file['name'];
        $content[$x]['link'] = $site.$file['link'];
        $content[$x]['text'] = $text[$x];
        $x++;
    }
}

$result =  '<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
<title>PacketStorm Security</title>
<link rel="alternate" type="text/html" href="http://www.tullyrankin.com/" />
<link rel="self" type="application/atom+xml" href="http://www.tullyrankin.com/atom.xml" />
<id></id>
<updated>2010-03-03</updated>
<subtitle>Security Feed</subtitle>
';
foreach ($content as $node) 
{
    $result .= "<entry>";
    $result .= "<title>{$node['name']}</title>";
    $result .= "<link href=\"{$node['link']}\" />";
    $result .= "<summary>{$node['text']}</summary>";
    $result .= "</entry>";
}    
$result .= "</feed>";

$conn = @fopen('packetstorm.xml','w+');

if (@fwrite($conn, $result) === false)
{
    die('<h1>Could Not create feed</h1>');
    
}
else
{
    echo '<h1>Created new packetstorm.xml file!</h1>';
}
fclose($conn);


Just for fun, I wrote a short simple class to parse the Linux "passwd" file. The class has functions to return the content in either html or text for the command line. The difference being one has "<br />" statements and the other has "\n" for new lines. The class also contains a function to search for a user, and a function to delete a user.


/**
 * Class is used to read, search, and manipulate linux passwd file.
 *
 * @author  Tully Rankin
 * @website www.tullyrankin.com
 */
class ReadPasswd {
    private $file;
    private $fileData;
    private $error;

    /*
     * Initialize the class and add contents of
     * the password file into the variable file.
     */
    function __construct($file) {
        try{
            if (is_file($file))
            {
                $this->fileData = file($file);
                $this->file = $file;
            }
            else
            {
                throw new Exception("Couldn't open file.");
            }
        } catch (Exception $e) {
            $this->error[] = $e->getMessage();
        }
    }
   
    /*
     * Returns string of all rows of data from the passwd file.
     * Use this file if your trying to display in the browser.
     *
     * @type Public
     * @return String
     */
    public function getAllHTML() {
        foreach ($this->fileData as $content)
        {
            $temp = explode(':', $content);
            $output .= "<b>Username:  {$temp[0]} </b><br />";
            $output .= "Validation: {$temp[1]} <br />";
            $output .= "User Identifier: {$temp[2]} <br />";
            $output .= "Group Identifier: {$temp[3]} <br />";
            $output .= "Gecos Field: {$temp[4]} <br />";
            $output .= "Home Directory: {$temp[5]} <br />";
            $output .= "Shell: {$temp[6]} <br />";
            $output .= "<br />";
        }
        return $output;
    }
   
    /*
     * Returns string of all rows of data from the passwd file. This is
     * used if running the command from the command line.
     *
     * @type Public
     * @return String
     */
    public function getAllCLI() {
        foreach ($this->fileData as $content)
        {
            $temp = explode(':', $content);
            $output .= "Username: {$temp[0]} \n";
            $output .= "Validation: {$temp[1]} \n";
            $output .= "User Identifier: {$temp[2]} \n";
            $output .= "Group Identifier: {$temp[3]} \n";
            $output .= "Gecos Field: {$temp[4]} \n";
            $output .= "Home Directory: {$temp[5]} \n";
            $output .= "Shell: {$temp[6]} \n";
            $output .= "\n";
        }
        return $output;
    }
   
    /*
     * Searches for a user. Will return an array with
     * the users credentials unless the second param is set.
     * If true is set on the second parameter then the function
     * will withold add the the user information to the returned array.
     *
     * @type Public
     * @params String, Boolean
     * @return Array
     */
    public function searchUser($user,$data=0) {
        try{
            $data = array();
            if (is_string($user))
            {
                foreach($this->fileData as $line)
                {
                    $temp = explode(':', $line);
                    if (in_array($user,$temp))
                    {
                        if ($data) return 1;
                        $data['username'] = $temp[0];
                        $data['validation'] = $temp[1];
                        $data['user_identifier'] = $temp[2];
                        $data['group_identifier'] = $temp[3];
                        $data['gecos'] = $temp[4];
                        $data['home_directory'] = $temp[5];
                        $data['shell'] = $temp[6];
                    }
                }
            }
            else
            {
                throw new Exception('A search error has occured.');
            }
        } catch (Exception $e) {
            $this->error[] = $e->getMessage();
        }
    return $data;
    }
   
    /*
     * Getter for Error Exception Array
     * @type Public
     * @return Array
     */
    public function getError() {
        return $this->error;
    }
   
    /*
     * Removes user from passwd file
     * @type public
     * @return Boolean
     */
    public function deleteUser($user) {
        try{
            if ($this->searchUser($user,1))
            {
                foreach ($this->fileData as $line)
                {
                    $lines = explode(":",$line);
                    if (!in_array($user,$lines))
                    {
                        $final .= $line;
                    }
                }
                if(!file_put_contents($this->file,$final))
                {
                    throw new Exception("Could not delete user.");
                }
            }
            else
            {
                throw new Exception("User doesn't exist.");
            }
        } catch (Exception $e) {
            echo $this->error[] = $e->getMessage();
        }
    }   
}

I started re-writing a lot of my old code today to use AJAX. AJAX stands for (Asynchronous Javascript and XML) and is a way of making your web applications more interactive. So for example, you can refresh results on the page from a form without having to reload the page. The example that I'm going to show you is a name suggestion form. It will display a html form input and will return results from a mysql database that start with whatever char/chars you type in real time.

The form page looks like the following...

<html>
<head>
<title>Simple Ajax Example</title>
<script type="text/javascript">
var xmlhttp;

function showUser(str) {
    xmlhttp=GetXmlHttpObject();
    if (xmlhttp==null)
    {
      alert ("Browser does not support HTTP Request");
      return;
    }
    var url="getNames.php";
    url=url+"?name="+str.value;
    url=url+"&nocache="+Math.random();
    xmlhttp.onreadystatechange=stateChanged;
    xmlhttp.open("GET",url,true);
    xmlhttp.send(null);
}

function stateChanged() {
    if (xmlhttp.readyState==4)
    {
        document.getElementById("nameHint").innerHTML=xmlhttp.responseText;
    }
}

function GetXmlHttpObject() {
    if (window.XMLHttpRequest)
    {
      // code for IE7+, Firefox, Chrome, Opera, Safari
      return new XMLHttpRequest();
    }
    if (window.ActiveXObject)
    {
      // code for IE6, IE5
      return new ActiveXObject("Microsoft.XMLHTTP");
    }
return null;
}
</script>
</head>
<body>

<form name="formName" id="formName">
<input type="text" name="name" id="name" onKeyUp="showUser(this)">
</form>

<span id="nameHint" name="nameHint"></span>


</body>
</html>

The form calls getNames.php with the params name=[Input Field Value]. The Input field value is the value of whatever you type into the form text input. The code that processes this request is below:

<?php

$name = striptags($GET['name']);

if (!empty($name)) 
{
    if ($con = mysqlconnect('127.0.0.1', 'root', '1234'))
    {
        if (!mysqlselectdb('test'))
        {
            echo 'Could not connect to database';
            exit;
        }
        $sql = sprintf("SELECT name FROM names WHERE name like '%s'", 
                        mysqlrealescapestring($name.'%'));
        $result = mysqlquery($sql,$con);
        if (!$result) 
        {
            echo 'Bad Query';
        }
        $rowCount = mysqlnumrows($result);
        while ($row = mysqlfetch_assoc($result)) 
        {
            $names[] = $row['name'];
        }
    }
}


if (count($names) > 0) 
{
    echo '<ul>';
    foreach ($names as $name)
    {
        echo "<li>$name</li>";
    }
    echo '</ul>';
}

As you can see, the getNames.php file first looks at the GET value for the name Parameter. I also have it wrapped in the striptags function which will eliminate the chance of a user entering any kind of tags that may end up breaking or altering the script. Next, I check to see if the $name value is empty. The script will not display anything if the $name value is empty or there is no results. Now the script can connect to a mysql server and select the correct DB. Now I write the query using the sprintf function. This allows me to alter multiple variables in the string. I use the %s for string and have mysqlrealescapestring function return the $name variable. The mysqlrealescape_string prepends backslashes to the following characters "\x00, \n, \r, \, ', " and \x1a".

I now query the database with the $sql string that I just created. I create the variable rowCount which will return the # of rows returned from the query. Next we loop through the results and add each name to the $names variable.

We now have all the results in an array and need to display the result. I first check to see if the array is not empty. I do this by using the count() function on the $names array. If the count is greater then 0 we will display each of the rows returned in a unordered list <ul> tag.

This is by far the simplest AJAX example. We could have returned the results as JSON and looped through them better in the index.php page. I will write a more technical and more advanced example in the near future.

So I am now on my second week of learning the C language. I have been writing a lot of small programs just to get the hang of the code. I have written simple calculators, guess my number games, and simple quizzes. Tonight I was working on code that could parse a apache config and only display the DocumentRoot. The code I wrote to do this is shown below.

include <stdlib.h>
#include <string.h>
#define MAXLINE 128

FILE file;

int main(int argc, char argv[])
{

    int i,x;
    char line[MAXLINE];
    char  temp;

    if (argc == 1)
    {
        puts("You must enter a file/files to search.");
        exit(1);
    }
    for (i=1; i<argc;i++)
    {
        file = fopen(argv[i], "r");
        if (file == NULL)
        {
            puts("Could'nt open file");
            exit(1);
        }
        while ( (fgets(line, MAXLINE, file)) != NULL)
        {
            temp = malloc(sizeof (char)  128);
            for (i=0; i<MAXLINE; i++)
            {
                do 
                {
                    temp[i] = line[i];
                    i++;
                } while (line[i] != '\n');
            temp[i] = '\0';
            break;
            }
            if (strstr(temp, "DocumentRoot") != NULL) {
                printf("%s\n", temp);
            }
            free(temp);
        }
    }
}