DEV Community: BigCoder

Backend and frontend

BigCoder — Fri, 15 Apr 2022 17:36:40 +0000

The backend of a web development project is responsible for the server-side of the application, including the database, security, and any other back-end processes.

The frontend is responsible for the client-side of the application, including the user interface, interactivity, and any other front-end processes.

Backend

The backend developer must have a strong understanding of server-side technologies such as Python, PHP, Ruby on Rails, or Node.js.

They must also be able to work with databases such as MySQL or MongoDB. In addition to these technical skills, they must also be able to communicate effectively with the frontend developers and understand their needs.

Frontend

The frontend developer must have a strong understanding of client-side technologies such as HTML5, CSS3, and JavaScript. They should also be familiar with frameworks such as AngularJS or ReactJS. In addition to these technical skills, they must also be able to communicate effectively with the backend developers and understand their needs.

Python for webdev?

If you work with Python, a common choice is Flask for the backend. Flask is a microframework for creating web applications in Python.

It includes everything you need to get started, such as a development server and built-in debuggers. Flask is also very lightweight, which makes it perfect for developing smaller applications or prototypes.

Typically the frontend communicates with the backend using an API. An API can be created in Python and many other languages.

Some things you can do with Python

BigCoder — Thu, 14 Apr 2022 20:22:44 +0000

Python is a high level programming language. It can be used for everything from writing simple scripts to building complex applications.

There are thousands of modules created by other programmers that can be used in python programs along with the python standard library.

To get a feel for what you can do with python check out this list of common things people use it for.

Games

PyGame is a Python module designed for writing games. It uses the SDL library to provide fast low level access to audio, keyboard, mouse, joystick, and graphics.

Developing games in Python with PyGame is a great way to get started in game development. PyGame is fast and easy to use, and it provides all the features you need to develop complex games.

It's mainly aimed at simple 2d games like arcade, rts or tetris. It is quite easy to learn.

Web development

Web development is a tricky industry, one in which there are hundreds of different languages at play, each with its own quirks and features. The problem becomes even more complicated when you need to combine web development with other skills.

Flask is one of the most popular Python web framework for developing web applications. It is designed to make getting started quick and easy, with the ability to scale up to complex applications.

One of the ideas of web apps with Python is to be dynamic. Not every page should be the same, but data should be grabbed from a database. In the web, it's always SQL
that is used for that.

Desktop apps

You can build desktop apps with Python and Qt. It's easy to use and has great documentation, making it a breeze to create professional-looking applications. It currently supports Windows, Mac and Linux. It has tons of features and widgets.

Qt is a powerful toolkit that can help you create great-looking desktop applications. Python is a great language for creating desktop apps. Together, these two technologies can help you quickly create desktop apps. Qt has tons of features and widgets, making it easy to create rich, user-friendly applications. Python is easy to use and has great documentation, making it a breeze to get started with creating desktop apps.

Hacking MS SQL

BigCoder — Mon, 13 Dec 2021 10:48:04 +0000

Hacking MS SQL is a very useful skill to learn. Especially in this recent world of computers everyone uses MS SQL (or MariaDB) and with that comes the concern of how to protect ourselves.

Why do we use SQL anyway?

Many web apps interact with a database and are CRUD applications (create, read, update, delete data). SQL databases can be used with Python, PHP and other programming languages. Besides SQL injection, there can be other vulnerabilities.

SQL database hacking (injection) is the art of making database vulnerable for data thefts. However, in this article we are interested not in the database, but in running system commands 😄

Brute force

First you must already know the password which you may obtain through brute force with hydra.

You can use a list of usernames and a list of passwords to brute force mssql server.

hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt 192.168.1.128 mssql

Change the ip to the MS SQL server ip address. The username and password list should exist. You can find such lists on the internet, like rockyou.txt

You can also use medusa, xhydra, nmap or metasploit for this. These tools can also be used on linux for brute forcing other services. After getting the password, what's next?

You could explore the data. But chances are you are not interested in the data, but in gaining system access.

Browsing file system

MS SQL servers can have the command xp_cmdshell enabled. This lets you run commands through its command prompt.

sqsh -S MACHINE_IP -U sa -P "your_password"
1> xp_cmdshell 'whoami'
2> go

  output

One command you can do is type filename. This lets you read files from the file system. You can use dir to list al files and folders. There may be interesting files in the users home folder!

From there on, you can try starting a reverse shell (with nc.exe) or try other things.

To learn more about web hacking, you may like this course

Hacking: Local File Inclusion

BigCoder — Thu, 09 Dec 2021 18:00:02 +0000

Linux is a widely popular system for hosting web apps. It's users often think that by using Linux on a server, that it is secure.

But, just because you use Linux on your server and are good at the shell commands, does not mean your web app is secure. Sure you may know how to use vim, but neither that will stop a hacker.

LFI (or File Inclusion) is a common vulnerability in web appps that provides access to files on the server in question. This allows an attacker to read files and sometimes to create or modify files on the target web server.

In this article I will explain a vulnerability known as local file inclusion (LFI) and how this hack is carried out.

LFI explained

With many server side programming languages, you can include files. In php that is often done with:

include
require
include_once
require_once

Lets say a web app has a parameter that lets you specify the file. The web app url can look like this:

http://webapp.dev/forum.php?file=myCV.pdf

And the code like this:

<?php
    include($_GET["file"]);
?>

By changing the url parameter file, the attacker can open different files on the server.

Give me an example

An attacker might change the url and read different files. These can include system files:

http://webapp.dev/forum.php?file=/etc/passwd
http://webapp.dev/forum.php?file=../../../../../etc/passwd
http://webapp.dev/forum.php?file=/etc/shadow
http://webapp.dev/forum.php?file=/etc/issue

So what, the attacker can read system files?

The attacker can get your username from /etc/passwd and your hashed password from /etc/shadow.

The hashed password can be cracked using crackstation, giving them full access to the server.

To prevent this as coder, always check and test user input (especially GET and POST variables)

The LFI vulnerability can also exist on other operating systems, but they store system files elsewhere.

To learn more about web hacking, you may like this course

Linux Tips For Beginners

BigCoder — Tue, 07 Dec 2021 14:26:06 +0000

Newcomers to Linux could find this article helpful. I am sure that once you have finish reading this article you will find them very easy to follow also.

For example, I am sure that you know all the basics of using a computer such as the internet, word processing and spreadsheets. If you are unsure about these basic functions then maybe it's time to come up with the laptop and practice using them before using a Linux desktop computer or laptop.

So if you want to learn more about Linux then do not hesitate to follow the tips that I have put down below.

1- Explore the default repositories

Linux (along with the distributions) are software projects. What better way than looking at the available software?

First of all search for GUI installation program for Linux. On Ubuntu it is called Ubuntu Software Center. Other distributions have their own GUI program for this. This program is already installed on your Linux distro. Once it has been opened, a window will pop up asking you what kind of software you need.

You can use the command line to install anything, but every distribution has a different package manager. The GUI lets you browse through available software.

2- Learn bash

The command line is a programmers best friend. Learning the command line is useful skill because you can easily deploy servers with your apps if you know how to use the command line.

Granted, there are many commands and it may seem like overwhelming. But this is with all things new. Once you learn how to use the command line, it opens up many new possibilities like maintaining servers, controlling computers remotely and more.

3- Learn vim

Vim is a powerful editor that is available on any computer system. Mastering vim can save you a lot of time in the future.

But what about IDE X? While the latest IDE is cool now, it may change in the future. Having key bindings that don't change for the next decades is a big plus in an already overwhelming world.

But, vim can be quite difficult to learn because the keybindings are unusual. You can use vimtutor or vim.is to learn quickly.

4- Deploy a VM

These days you can deploy a Linux server with one click. You don't need to go through an installation process on your computer to try out Linux.

Just launch a Linux server and you'll instantly have access to the command line and can explore that different Linux distributions that.

Not only that, but you can also test how it works as server. If you want a web server there is Nginx and Apache.

4- Install developer tools

You can program almost any programming language in Linux. C, C++, Java, Python, Golang everything is supported.

Of course, you can also do web programming with JavaScript, Node and other languages.

As developer, you learn by doing so why not do some programming on Linux?

Many developers like VSCode (supports vim keys), but other IDEs are used too.

5- Take courses

One of the ways to learn faster is using an instructor instead of figuring out everything on your own. There are many courses about Linux that can help you boost your skills.

6- Choose a distribution wisely

Linux is only the core component of a Linux system. Distributions come and go, so pick a popular Linux distribution that will be around for the next ten years. Something like OpenSuse, Debian, Fedora or Ubuntu.

Vim like tools

BigCoder — Mon, 06 Dec 2021 10:06:40 +0000

As developers you spent a lot of time on the keyboard. While you can make programs with the mouse in some graphical programming languages, it just isn't very convenient. So what keyboard driven programs exist?

Vim is a popular editor that has been around for ages. Many developers use vim or vim keybindings in their IDE, simply because it's convenient to press keys rather than going through the file menu.

Vim has always been one of my favorite text editors for Linux and Mac. Vim is similar to the editor vi, but has more features.

It is keyboard driven and has quite a hard learning curve (learn vim). Because it's been designed decades ago, some things makes less sense today. To give you an example, you can use both the keys h,j,k,l and the arrow keys to move the cursor. That's because in those times, there were no arrow keys.

It can be used both in the Linux shell and in a graphical interface. Personally I have also used its keybindings in Visual Studio, Visual Studio Code and other programs.

Vim isn't the only keyboard driven program out there. So what else is out there?

sxiv: an image viewer
vifm: a file manager with curses interface, which provides Vim-like environment
qtile: window manager for the X Window System
i3: a tiling window manager. It doesn't use vim keys by default but is completely keyboard driven
tmux a terminal multiplexer that you can use instead of tabs
vimium add vim bindings to chrome
qutebrowser a vim keyboard-focused browser with a minimal GUI.

While many graphical programs have keyboard shortcuts, they aren't all completely controllable with the keyboard.

If you know of other cool programs that rely on keyboard shortcuts, let me know in the comments.

How to Hack Into a Website

BigCoder — Sun, 05 Dec 2021 12:12:37 +0000

Hacking into websites is one of the most fundamental skills a hacker can learn. As a developer, you should be aware of the risks.

Many websites get hacked! So how can you prevent your website or web app from being hacked? You should learn how a hacker thinks.

Once you learn how to hack into a website, you will be able to test the security of your website (or web app) and also know how others can hack into your website.

There are many tools available for hacking, but for beginners, I suggest Burp Suite or hydra. Burp Suite is a GUI tool and hydra is a terminal tool.

These tools are included in Kali Linux, a computer system for hacking. You should have some knowledge of the Linux command line.

Wait.. roll my own tools?

As a developer, you may be inclined to roll your own hacking tools. That is possible, but why reinvent the wheel?

If your goal is to test the security of your website, you wouldn't start with writing an operating system and designing a CPU. Instead, just use the tools that exist.

But.. how does the coding work?

Create a script in your favorite editor like VSCode or vim (learn vim). For example, to brute force you could intercept a curl request and run it through a Python for loop with a password text file to brute force.

hydra

Hydra lets you brute force passwords of any server. You do by having a password word list. This is a let of millions of passwords that Hydra will automatically try.

You can let it automatically bruteforce, with any protocol

The syntax is:

hydra -L <USERNAME_LIST> -P <PASSWORD_LIST> <TARGET_IP> <PROTOCOL>

You can brute force ssh, mysql, ftp and many other protocols.

hydra -L users.txt -P passwords.txt 192.168.0.1 ssh -u -V

It will output the passwords in the terminal:

Affirmative, this is a low level tool. For more high level attacks you can use a tool called burp suite.

Burp Suite

The way Burp Suite works is by intercepting your browser traffic. It then lets you modify the requests, so you can for instance brute force passwords on a login form. In the browser, you can set the Proxy to Burp Suite.

Step 1. Run Burp Suite
Step 2. Open Firefox and navigate to the login form
Step 3. Navigate to the Proxy tab in Burp Suite
Step 4. Press "Intercept On" in "Proxy -> Intercept"
Step 5. Set Burp in FoxyProxy

Step 6. Submit dummy data by clicking login with the dummy username and password in Firefox
Step 7. In Proxy Intercept -> Right click and Send to Intruder

Step 8. Click "Clear $" and add "$" around the username nad password
Step 9. Select "Cluster Bomb"
Step 10. In "Intruder -> Payloads" set a wordlist (password list) to try. You can set the payload for both parameter 1 and 2 (username and password)

Step 11. Click Start Attack and wait for credentials

Whew, this was quite a setup. Main difference is that with Burp Suite you only have to click, with hydra you have to use the command line. Burp Suite has more features than hydra.

More on web hacking? You may like: Ethical Hacking: Web App hacking

My favorite Linux command line apps

BigCoder — Sat, 04 Dec 2021 11:23:41 +0000

A long time ago, in an internet far, far away, it was still the Wild West with open plains and free land for all to explore. On these plains, some people came across a land that would become known as Linux.

This new land was free for the taking and there wasn't a soul in sight. The ones who discovered Linux claimed it for themselves and called it theirs. They tamed the land and built roads throughout the countryside. They made a system to run the land so that it would always be there when they returned. This system they called Linux.

Linux is a unix-like system and comes with a command line. While the days are long gone when everyone had to use a command line interface, it's a very powerful set of tools for developers.

vim

Vim is one of my favorite terminal apps. It's a command line editor (has GUI version too) that let's you edit files very quickly. The whole app is using keyboard shortcuts that can be challenging to learn.

It's available on any server (or their predecessor vi), can be used over the network and any IDE supports its key bindings. It was here 20 years ago and will still be here 20 years from now.

ranger

ranger is a free, open-source software file manager for the linux desktop. It aims to help both new and experienced users to efficiently manage their files, and to seamlessly navigate their file systems.

ssh

The linux ssh command is used to connect to a Linux server using a secure shell protocol. It works by connecting to the given hostname or IP address and then creating a secure channel between the local machine and its remote counterpart.

In the past telnet was used for that, but it was unencrypted and insecure. The community has moved on to use secure shell or ssh in short.

$ ssh user@ip

From there on you can use the remote Linux system as if it were your own. This also works for OS X and Windows, but the Windows prompt works differently of course.

What are your favorite command line programs?

Linux: An Intro For Newbies

BigCoder — Fri, 03 Dec 2021 17:19:21 +0000

The Linux operating system is one of the most widely used pieces of software in the world, though its open source nature means that most people don’t know this. You might be using Linux every day, whether you know it or not.

Linux (the core system) comes bundled with many software packages called a Linux distribution. There are many different Linux distributions available like OpenSuse, Ubuntu, Fedora, Kali and many others.

Linux server

Linux has been widely used in web servers for some time now. In fact, the majority of websites you visit are served by a computer running Linux.

The easiest way is to start a linux cloud vps on a service like Vultr or Digital Ocean. That gives you access to a Linux server. From there, you can use the Linux command line.

As a developer, knowing the Linux command line is a must have skill. Because so much software uses Linux: web apps, routers, embedded systems etc. Often times you'll have to login through a remote terminal connection (ssh).

Linux on desktop?

It’s also increasingly popular on the desktop, with users able to take advantage of its cross-platform nature. This means that Linux can be installed on almost any computer, whether Apple or Windows-based, and work exactly as it should.

There are many different graphical environments and there isn't a "Linux way" of doing things. In fact, when it comes to Linux usually there's a dozen ways of doing the same thing. There are many graphical choices like Gnome, kde, mate etc. Usually a Linux distributions comes bundled with all of them.

Given the Linux desktop share, it doesn't seem like there will ever be the "year of the Linux desktop" but nonetheless it's comfy system for doing software development.

Many development tools are available including VSCode, Vim (learn vim), Android Studio and loads of others. In fact, most developers I've met use either Linux or OS X all the time.

Install Linux

As you might imagine, installing Linux is a little more complicated than downloading an app on your phone. The good news is that it’s not actually that hard to install.

The general idea is to download the .iso file and write it on a bootable USB disk. Then boot from the usb disk using the bios. Sometimes it doesn't boot because secure boot is enabled.

After booting, you may find yourself in an installation menu. Some distributions however, just give you a terminal where you can type commands to install everything like Gentoo (those are only free if your time is worthless). However, most Linux distributions guide you through some kind of graphical installer.

Vim Tips and Tricks for Beginners

BigCoder — Wed, 01 Dec 2021 23:22:04 +0000

Vim is an amazingly powerful, yet super simple text editor. It's an easy to use and free text/programming editor that anyone can use regardless of their skill level.

You can use vim both in the terminal and in a GUI version (gvim). You can also use it over a remote network session (ssh).

Here are some Vim tips and tricks that will help you get started with Vim.

Basic Navigation

To move around, we use the h, j, k and l keys to move left, down, up, and right respectively.

h moves the cursor one character to the left.
j moves the cursor one line down.
k moves the cursor one line up.
l moves the cursor one character to the right.

Vim also uses the arrow keys to move around too!

gg moves to the top of the file.
G moves to the bottom of the file.

Opening and saving

In order to save a file with vim, you need to first open it with vim editor. You can do so with the command line:

vim filename.txt
vim /home/you/Documents/filename.txt

To save the file, press ESC followed by :w!

Inside vim you can open files using ESC followed by :e filename.

Quit vim

To quit vim, you can either press ESC followed by :q! (quit without saving) or press ZQ.

To save and exit, press ESC followed by :wq!

.vimrc

While vim does a lot of things out of the box, you may want to configure it to work with certain programming languages, to show line numbers etc.

You can customize with your .vimrc file. You can configure vim with that file.

To enable syntax highlighting:

" Turn syntax highlighting on.
syntax on

To enable line numbers

" numbers on each line
set number

If you don't want to configure manually, you can generate a vimrc config file on this website.

Programming in vim

You can use vim as a programming IDE. I do this quite a lot, as vim is a very powerful editor and great for editing some files on the fly.

Let's say you want to create a hello world program. The first thing you will want to do when opening vim

$ vim

Run the following command:

:edit hello_world.py

This will open up a blank python file. From here, you can start writing code by pressing i (or insert) to go into insert mode.

Write your code.

After press esc to exit insert mode, the buffer should be saved automatically. You can then run esc :wq to close and save the file.

what's next? 😄

It can take a while to get used to all the keyboard commands when learning vim. It can be challenging to use vim while at the same time learning vim.

So what to do? If you want to learn vim quickly, you can use vim.is

Free courses for December

BigCoder — Wed, 01 Dec 2021 10:49:27 +0000

Ethical Hacking
Ethical Hacking: Hacking with Python
Ethical Hacking: Network Attacks
Ethical Hacking: John the Ripper

Python
Excel Files with Python
Python Performance Optimization
Create Snake with Python PyGame

Linux
Linux Desktop Automation
Linux awk tutorial
Redis database tutorial

Free courses for november

BigCoder — Wed, 03 Nov 2021 09:07:01 +0000

Some of my courses, free this month :)

Ethical Hacking
Ethical Hacking: Introduction to Exploits
Ethical Hacking: Hacking Web Apps
Ethical Hacking: SQL Injection for Beginners

Cyber Security
Cyber Security: Secure Passwords
Cyber Security: Linux AppArmor

Programming
Make Simple Games with Python
awk tutorial
Redis databases