Perl and Shodan

The search engine Shodan (http://www.shodanhq.com/) has recently drawn a lot of attention as the “scariest search engine on the internet” since it lets you search for computers and other devices by IP, OS, location, etc, and in doing so often reveals information that the computer owner’s might not have ever intended to be public.  For security professionals it makes for an interesting tool for pen-testing and forensics.  For any Perl developers that are interested in such work the good news is that they have an API and they have a nice Perl tutorial already in place documenting how to use it (http://docs.shodanhq.com/perl/tutorial.html#).  They also provide one sample Perl script that lets you generate a list of IP addresses that match your query terms (http://docs.shodanhq.com/perl/examples.html).  The API does make use of an API key that requires registration to use. 

Randomize the Elements of an Array

Sometimes it is useful to be able to randomize the elements of an array and this posting will demonstrate a simple way of accomplishing that using the shuffle subroutine of the List::Util Perl module.  As a sample use case let’s consider a simplistic random password generator that was designed to generate passwords that contain two uppercase characters, two numbers, and four lowercase characters. A sample code snippet that would accomplish such a task might look as follows:

#!usr/bin/perl

use List::Util 'shuffle';

use strict;

use warnings;

#Ensure number of each character type requirements are met

my @randuc=map{('A'..'Z')[rand(26)]}(1..2);

my @randlc=map{('a'..'z')[rand(26)]}(1..4);

my @randnum=map{int(rand(10))}(1..2);

my @pass=(@randuc, @randlc, @randnum);

my $passwd=join("", @pass);

print "$passwd \n";

If executed, this code would create random passwords such as “SEadzs55”, which clearly meet the complexity requirements, but if we run the password generator over and over again a pattern should emerge.  The two upper case characters will always be first, followed by the four lowercase characters, followed by the two numbers.  This pattern greatly reduces the randomness of our passwords and is a common mistake you see in many random password generators.  We could greatly improve this code by adding some additional code that will randomize the elements of the password, so there is no definitive pattern as to the ordering of characters.  We could do this with the following code snippet:

#Shuffles the generated characters so uc characters not always first

#followed by lc characters, etc to improve randomness

my @mixed = shuffle(@pass);

$passwd=join("", @mixed);

print "$passwd \n";

If we now execute the code with this addition multiple times, will see that after each execution the ordering of the characters is randomized, thereby improving the entropy of our password. 

Comparing DNS Requests with Perl

I was recently helping someone troubleshoot an issue in which one of their DNS servers was returning incorrect IP information for certain domains. Below is a Perl script that makes use of the Net::DNS module to compare the resolved IP addresses for a specified list of domains from a specified list of nameservers. I have it commented out in the script below, but by uncommenting the appropriate line you can also execute a system call to flush the DNS cache of the machine before each set of DNS requests.

#!usr/bin/perl

use Net::DNS;
use strict;
use warnings;

my @domains = ('perl.org','cpan.org','perlmonks.org','perlfoundation.org','perlweekly.com','perlbuzz.com','perlsphere.net');
my @DNServers = ('167.206.112.138','8.8.8.8','208.67.222.222');

foreach my $DNS (@DNServers){
  #flush DNS cache by uncommenting OS specific option   
  #system('/etc/init.d/nscd restart');
  #system('ipconfig /flushdns');
  print "Results for $DNS:\n";
   my $res=Net::DNS::Resolver->new;
   $res->nameservers($DNS);
   foreach my $domain(@domains){
       #queries server
      my $answer = $res->search("$domain");
       #extract IPs specified in A records
      foreach my $record ($answer->answer) {
         next unless $record->type eq "A";
         print "$domain:" . $record->address . "\n";
      }
   };
   print "\n\n";
}

Searchable Encryption Systems

Searchable Encryption Systems from cfrenz

Extract Information from JavaScript Enabled Content with Perl and V8

One of the common challenges for anyone that currently performs information extraction from Web pages is that more and more Web content is being served up by JavaScript, which makes the content much less accessible than for sites whose content resides solely in HTML. This is one of the reasons that JavaScript based obfuscation is used to protect against email address harvesting like in the HTML shown below:

<title>Contact XYZ inc</title>
<H1>Contact XYZ inc</H1><br>
<p>For more information about XYZ inc, please contact us at the following Email address</p>
<script type="text/javascript" language="javascript">
<!--
// Email obfuscator script 2.1 by Tim Williams, University of Arizona
// Random encryption key feature by Andrew Moulden, Site Engineering Ltd
// This code is freeware provided these four comment lines remain intact
// A wizard to generate this code is at http://www.jottings.com/obfuscator/
{ coded = "OKUxkq@KwtoO2K.0ko"
  key = "l7rE9B41VmIKiFwOLq2uUGYCQaWoMfzNASycJj3Ds8dtRkPv6XTHg0beh5xpZn"
  shift=coded.length
  link=""
  for (i=0; i<coded.length; i++) {
    if (key.indexOf(coded.charAt(i))==-1) {
      ltr = coded.charAt(i)
      link += (ltr)
    }
    else {   
      ltr = (key.indexOf(coded.charAt(i))-shift+key.length) % key.length
      link += (key.charAt(ltr))
    }
  }
document.write("<a href='mailto:"+link+"'>"+link+"</a>")
}
//-->
</script><noscript>Sorry, you need Javascript on to email me.</noscript>

When having to perform information extraction on sites that use JavaScript to serve up content, I find the JavaScript::V8 module very helpful.  Here is a segment of Perl code that uses the V8 JavaScript engine to extract the email address from the HTML page shown above.  

 #!usr/bin/perl

use JavaScript::V8;
use LWP;
use Text::Balanced qw(extract_codeblock);
use strict;
use warnings;


#delimiter used to distinguish code blocks for use with Text::Balanced
my $delim='{}';

#downloads Web page
my $ua=LWP::UserAgent->new;
my $response=$ua->get('http://localhost/email.html');
my $result=$response->content;

#print "$result\n\n";

#extracts JavaScript
my $js;
if($result=~s/.*?http:\/\/www.jottings.com\/obfuscator\/\s*\{/{/s){
   $js=extract_codeblock($result,$delim);
}

#modified JS to make it processable by V8 module
$js=~s/document.write/write/;
$js=~s/'/\\'/g;

#print "$js\n\n";

#processes JS
my $context = JavaScript::V8::Context->new();
$context->bind_function(write => sub { print @_ });

my $mail=$context->eval("$js");

print "$mail\n\n";

A GDB-like Debugger for Perl – Devel::Trepan

Earlier today I saw an interesting talk at a meeting of the NY Perl Mongers in which Rocky Bernstein highlighted some of his recent work creating a GDB-like debugger for Perl.  While Perl does ship with its own integrated debugger, which can be invoked with the –d switch, the Devel::Trepan module demonstrated appears to have great potential for turning into a Perl debugger that could one day rival or even exceed the current Perl debugger.  The Trepan module borrows much of its command set from the GDB debugger, which many users who have migrated to Perl from C\C++ might find helpful.  Moreover, the debugger as demonstrated, while still a work in progress, already appears to be functional enough to begin to be evaluated as a serious possibility for use in debugging tasks. This is a module that I will definitely be taking a closer look at in the near future and one that I think would be worth it for other Perl programmers to take a look at as well.  More information on the module can be found at https://github.com/rocky/Perl-Devel-Trepan.