Simple SQL Injection testing

In this post I will write my own simple penetration testing, trying to exploit Phrogress with simple common SQL Injection vurnerability. To simplify and automate the testing process, we are going to use tools sqlmap

We are going to test Project Details page. To access the page, we need to be authenticated first, so we need to give cookie header to the sqlmap.

adam@redframe:~$ sqlmap -u "http://0.0.0.0:3000/projects/3*" --headers="cookie: _phrogress_session=ZGpOTUQ5aEFic243ZGxsR1Q2QmsrNzYzbWJlWXZJQjN0ZnBuN0NtYWVaNVV1bzAwS2c1bENQbTlVRHNhdnNEQndqYUg5UkZmdWhqcEJyNWU1clhKem56cHVNeU1XbzdEZVZZc3pCNFE0L2txem8rd2dNdnRNWi8vcmtUMVF5N01JWklnQnBEYjlxVDZYWlRSc2QzbDZLOGhObVFtTHZvZWJGcWx5OGs0bU5HV08xalFyWVBHbzlxeWtLVS9Fc2Fad3A2Y0ViM3VVQ0l0V2NBUEZvV1RqNDVwcmx6dWJ0Q3lmQ1VaS3c0SUlVWm5xZEtFdTU4UUFwNUFPK2gxb3FpTDUxSXNUMjhaSkwvbzZEd0Y2SWRHZXV0d2k4eno2VUM1aXNzTlZueTl3TGF5WWdYZTAyUzk5dHl0aDdnNHd6eElZZXhDcTdlS2ZSa0VRdXNqSGUyUzRhK3BWcmtWaStZcHNkb2UxcGxXYi9qRTl3Q1pBeUtCWVZhTFBmVnU0RGxEMkdvTmtuckNrQUNHUHNUMDlHb0JjTU5qeXorYmZyME1YTnc2dWk0RHRFZVlrUzA3dUhjVkhKQUtETE5ZbFNyci0tR0FYcndKMGVOWlhBaEg1MjhsU3o2Zz09--4341b6586c94c6d60e93abd70df968f889316650"

Stress Testing with Load Impact’s k6

Test-driven development ensures our project satisfies some requirements set by our product owner. “Why some requirements?”, you might ask — it is because TDD often emphasizes on the functional requirements. Non-functional requirements — like stability of a system — will need to be tested separately, often using external tools separate from the project’s framework. In this post I’ll explore on how to the stability of iur project using Load Impact’s k6 stress tester.

Git Workflow & Branching – An Aftermath

Git is such a masterpiece tool that programmers use for collaboration work with others. Use it carefully and it will help you very much. Careful you not will trigger a wildfire in the codes. In our implementation of git workflow and branching, we have faced some problems. Actually, I don’t know what to write, so let’s just pretend this is a serious problem.

btw, Git 2.13.0 just released by our Savior, Torvalds

Looking Back to Our Backend

Because platform selection review is mandatory

Rails is an open source web framework build on top of ruby, first released on December 2005. It uses MVC design pattern and emphasize CoC (Convention over Configuration) and DRY (Don’t Repeat Yourself) paradigm. Ruby itself is known as a clear and lean language. So in the ideation phase of this project, when faced with the problem presented to us, we thought that RoR is a suitable solution.

Design Pattern – Publish-Subscribe

On my last post, I’ve talked one of design patterns, which is Template Method. Now I want to talk about other design pattern which is Publish-Subscribe. I used this pattern to make a communication between React components which are not directly related.

Design Pattern – Template Method

In this time, I will explain about one of design pattern that you can apply when developing a software. Yep, the pattern is called by Template Method. I also applied Template Method pattern when developing our project. In a simple explanation, Template Method is a pattern where there’s an abstract class that contains template(s) to execute its methods then its subclasses can override the method implementation as what’s needed.

Why use React

In our project, we use React for handling frontend business. Our project is a web-based application, in which interactivity is required, views that are dynamically transformed are something common in the project.

In this post, I will write why we choose to use React.

ES6 – Compared with current Javascript

The current Javascript standard that is mostly supported are the 5th Edition (or ES5). In 2015, the 6th edition (ES6) is officially finalized, and ES7 is officially finalized in 2016. But, the browser support for ES5 is still incomplete, thus developers should not write their current javascript in ES5 standard. So, developers dreaming to write their code in ES6 (or ES7) should use a transpiler (e.g. Babel) to transpile their code into ES5 code.

ES6 brings many many cool features, which is highly useful for developers in writing their code more cleanly. In this post, it will be mentioned some really useful features added to ES6 which is not there in ES5.

Roses are Red, I Catch Flu; How I Succeed on Testing My Own Code (Part Two)

In the last post, I talked about how RSpec is insufficient in testing codes that run in thread different than the one RSpec runs in. So I decided to try using MiniTest, and it kind of works. Yay!

Understanding Spy, Stub, and Mock

Welcome back readers! Well, after creating 2 posts explaining about testing on frontend in a row, on this time I’ll also talk about testing! Lol. Actually this time will be more general. However, I applied this knowledge most of cases on frontend so I’ll give an example on frontend side too haha, forgive me plz. Yep, on this time I will talk about testing techniques which are spy, stub, and mock. I was really really starved to know what actually they are and now I want to end my curiosity. I’ll explain to you what actually they are! 😀

Connect to the Data

When developing an applications, developers need a way to save modify and query the data. The application may use the a database management system (DBMS) to store the data but how to modify and retrieve data in the DBMS? DBMS has a set of raw commands to run operations on the system, for example SQL commands. We could use it in raw but it will make the codes look dirty.

Creating a React Component in this project

In this post, I will guide you how to create a React Component step-by-step

Step 1: Create the Component

Create a new file in app/assets/javascripts/components , for example in this guide I will create a component called ProjectBar. So create a file named ProjectBar.jsx (use CamelCase!)