biblicalph

DNS Rebind Attack

2024-02-04T00:00:00+00:00

DNS rebinding is an example of a blind server side request forgery vulnerability.

Blind Server Side Request Forgery (SSRF) vulnerabilities arise when an application can be induced into issuing a back-end HTTP request to a supplied URL, but the response from the back-end is not returned in the application’s front-end response. Source portswigger.

Applications that accept URLs from users and make calls to them may be susceptible to DNS rebinding. Example: a payment application that notifies a client via webhook of payment transactions.

How is DNS rebinding attack executed?

Let’s use a fictitious payment application, call it RebindPay, as a case study here.

A client of RebindPay must provide a webhook URL to post notifications to.
The client provides a URL with a very low time-to-live (TTL). Example: https://myhost.mydomain.com/resources. The domain myhost.domain.com first resolves to an external IP address 51.195.136.169 with a TTL of 5 seconds. After 5 seconds, the URL resolves to 127.0.0.1, an internal/local IP address
The RebindPay app validates the provided URL by verifying the domain resolves to an external IP address. The validation passes and the URL is saved
A payment transaction occurs and the RebindPay app makes a request to notify the client
The client domain, myhost.domain.com, now resolves to 127.0.0.1, an internal IP addresss
The RebindPay app makes a request to the resolved IP, 127.0.0.1/resources

Consequences of rebind attacks

Attackers can use DNS rebinding to attack internal networks, potentially forcing requests to memory or CPU intensive internal addresses

How to prevent DNS rebinding?

Reject domain resolutions with low TTL, say below 30 seconds
Validate all IP resolutions, verifying that the resolve to external address. In the above described scenario, validation must occur before data is posted to the URL

Final thoughts

Stay safe and build secure applications

Inheritance in Javascript

2019-06-30T00:00:00+00:00

Everything in Javascript is an object; this includes functions, strings, numbers, booleans, arrays and objects. Read more about objects in Javascript here Every object has a private property (the [[Prototype]] property) which holds a link to another object called its prototype. The prototype of an object has a prototype of its own and in this way, objects in Javascript are linked until an object is reached whose prototype is null. null has no prototype and thus, acts as the final link in the chain. This chain linking objects to one another is called the prototype chain and is the medium through which Javascript implements inheritance.

How Prototype Chain Works

Consider the four related people below:

Joe has a friend called James
James is friends with Jane
Jane is also friends with a banker by name Doe

Let’s say you approach Joe for a loan of $2k. Unfortunately, Joe doesn’t have it but rather than turn you away, Joe asks James for help. Like Joe, James doesn’t have it and asks from Jane who further asks from Doe. Doe has the money and sends it to you receive through the reverse relation.

Request: You ask Joe who asks James who asks Jane who asks Doe

Response: Doe gives to Jane who gives to James who gives to Joe who gives to You

The illustration above is exactly how the prototype chain works; if you query an object’s property, it checks if the property is on the object. If the object has the property, it returns it, else it recursively checks the prototype chain of the object and returns the property if found or undefined otherwise.

Accessing/Modifying an Object’s Prototype

You can access or modify the prototype of an object (the private [[Prototype]] property) by calling Object.getPrototypeOf or Object.setPrototypeOf methods respectively. Note: The __proto__ getter/setter for getting or setting the prototype of an object is deprecated - mozilla docs

Difference Between proto, [[Prototype]] and prototype

__proto__ is an accessor/mutator (getter/setter) for the private [[Prototype]] property. It is, however, deprecated; use Object.getPrototypeOf and Object.setPrototypeOf instead.

[[Prototype]] is the private property of an object which holds a reference to the object’s prototype.

Function objects (objects created using the function keyword) have a prototype property which is an object that has several properties including the private [[Prototype]] property of the function. Other properties, such as name, length and constructor are present on the prototype of a function. Read more here. The snippet below shows an example of how to get the [[Prototype]] of an object and a function.

const obj = {
  name: 'John'
};
const sayHello = function(message) {
  console.log(`Hello! ${message}`);
}
// Print the `[[Prototype]]` of obj
console.log(Object.getPrototypeOf(obj)); 
// Print the `[[Prototype]]` of the function sayHello 
console.log(Object.getPrototypeOf(sayHello.prototype)); 

Note: Non-function objects don’t have a prototype property.

Prototypal Inheritance Examples

Example 1: (Non-function Objects)

const user = {
  name: 'John',
  yearOfBirth: 1992,
  getName: function() {
    return this.name;
  },
  setName: function(name) {
    this.name = name;
  },
  getAge: function() {
    return new Date().getFullYear() - this.yearOfBirth;
  }
};
// Create employee that extends user
const employee = {
  id: '122223',
  getId: function() {
    return this.id;
  },
  setId: function(id) {
    this.id = id;
  }
};
Object.setPrototypeOf(employee, user);
// Employee's prototype is user
console.log(`employee's prototype: `, Object.getPrototypeOf(employee));
// Prints true
console.log(`user is employee's prototype: `, Object.getPrototypeOf(employee) === user);
// Looks up getAge from user, employee's prototype
console.log('employee age: ', employee.getAge());

Example 2: (Function Objects) - No ES6 class

const User = function({firstname, lastname, email, password, gender, yearOfBirth}) {
  this.firstname = firstname;
  this.lastname = lastname;
  this.email = email;
  this.password = password;
  this.gender = gender;
  this.yearOfBirth = yearOfBirth;
};
User.prototype.getAge = function() {
  if (this.yearOfBirth) {
    return new Date().getFullYear() - this.yearOfBirth;
  }
  return -1;
};
User.prototype.getFullName = function() {
  return `${this.firstname} ${this.lastname}`;
};

const Employee = function({firstname, lastname, email, password, gender, yearOfBirth, id}) {
  // Call parent constructor
  User.call(this, {firstname, lastname, email, password, gender, yearOfBirth});
  this.id = id;
};
// Set prototype of Employee to User's prototype (prototype linkage)
// NB: Using Object.create is important here - we get a new object and can override it's constructor property
Employee.prototype = Object.create(User.prototype, {
  constructor: {
    value: Employee.name,
    enumerable: false,    // shouldn't appear in 'for in' loop
    writable: true
  }
});
Employee.prototype.getDisplayInfo = function() {
  return `
    name: ${this.getFullName()}\n
    email: ${this.email}\n
    gender: ${this.gender}\n
    age: ${this.getAge()}\n
    id: ${this.id}
  `;
};

const employeeOne = new Employee({
  firstname: 'John',
  lastname: 'Doe',
  email: 'johndoe@email.com',
  password: 'secret',
  gender: 'Male',
  yearOfBirth: 1992,
  id: 'emp-12345'
});
console.log(Object.getPrototypeOf(employeeOne));
console.log(employeeOne.getDisplayInfo());

Note: The above can be written using es6 classes as illustrated below:

class User {
  constructor({ firstname, lastname, email, password, gender, yearOfBirth }) {
    this.firstname = firstname;
    this.lastname = lastname;
    this.email = email;
    this.password = password;
    this.gender = gender;
    this.yearOfBirth = yearOfBirth;
  }

  getAge() {
    if (this.yearOfBirth) {
      return new Date().getFullYear() - this.yearOfBirth;
    }
    return -1;
  }

  getFullName() {
    return `${this.firstname} ${this.lastname}`
  }
}

class Employee extends User {
  constructor({ firstname, lastname, email, password, gender, yearOfBirth, id }) {
    super({ firstname, lastname, email, password, gender, yearOfBirth });
    this.id = id;
  }

  getDisplayInfo() {
    return `
      name: ${this.getFullName()}\n
      email: ${this.email}\n
      gender: ${this.gender}\n
      age: ${this.getAge()}\n
      id: ${this.id}
    `;
  }
}

const employeeOne = new Employee({
  firstname: 'John',
  lastname: 'Doe',
  email: 'johndoe@email.com',
  password: 'secret',
  gender: 'Male',
  yearOfBirth: 1992,
  id: 'emp-12345'
});
console.log(employeeOne.getDisplayInfo());

Prototypal (Prototype Based) Versus Classical (Class Based) Inheritance

Class based languages implement inheritance by extending classes, the blue print (or template) from which objects are created, while prototype based inheritance is achieved through objects that hold a reference to another object. There is no concept of a class. Infact, the class keyword, introduced in es2015 (es6) and beyond, is just syntactical sugar for prototype based inheritance.
In classical inheritance, the parent of an object cannot be changed at runtime. The prototype of an object can, however, be changed at runtime using the Object.setPrototypeOf mutator. This makes prototypal inheritance extremely flexible

Summary

In this article we discussed:

what prototypal inheritance is
the difference between __proto__, [[Prototype]] and prototype (of function objects)
examples of prototypal inheritance
how prototypal inheritance differs from classical inheritance.

Until next time, keep rising. Cheers.

Additional References

Master the Javascript Interview, Eric Elliot
Javascript Prototype
Exploring Javascript, Venkat Subramaniam
Javascript. The Core

Continuous Integration Using Circle CI

2019-02-08T00:00:00+00:00

In this article, I’ll explain:

What continuous integration is
Why I set it up for guidebook, a project I started to share my thoughts on building NodeJS applications
How to setup continuous integration using Circle CI

What is Continuous Integration (Definition)?

Continuous integration, also known as CI, is the process of automating the building and testing of code as developers merge changes into a central shared repository, usually, several times a day. See Microsoft’s definition and Thoughtwork’s definition

Why Continuous Integration (Benefits)?

One of the major benefits of continuous integration is early detection of errors. The automated build process, which includes execution of automated tests, helps to identify any issues - incompatible changes, and failing tests, etc - before a set of changes are merged to the main branch (usually called master branch) . For guidebook, using a CI ensures that broken code is not merged into the master branch. You can learn more about the benefits of CI in Azure’s article and Thoughtwork’s article

How to Setup Continuous Integration Using Circle CI

In this section, I’ll describe how to setup continuous integration (CI) using Circle CI. It is, however, worth mentioning that alternatives to Circle CI exist for setting up continuous integration. They include Jenkins, Travis CI, and Codeship, etc.

To setup CI using Circle CI,

Create a .circleci directory in the root directory of your git repository
Create a config.yml file in the .circleci directory. config.yml is a yaml file that instructs Circle CI on how to setup and build your project.
Add the configuration instructions to the config.yml file. Below is the config file for guidebook.

Circle CI can be configured to run multiple sequentially or in parallel, run jobs on specific branches or at scheduled intervals and deploy code automatically to staging or production servers (continuous delivery, the subject of another post).
Visit Circle CI’s configuration reference to learn more.
Commit the changes and push to the remote/shared version control host
Create an account on Circle CI. Both Github and Bitbucket signup options are offered by Circle CI
Select projects from your account for which you want to setup CI. If you are cannot find the project you want to select, make sure the correct account is selected in Circle CI. At the top left corner, select the desired account as shown in the image below:
Click the add projects link in the side menu, search for the desired project and click setup
Scroll down and click the start building button

Bonus

Manually triggering a build from Circle CI’s dashboard each time you push changes to your central version control host is not ideal and defeats the purpose of CI. Instead, it is better to configure Circle CI to automatically build your project each time changes are pushed to the version control host. In this section, I’ll explain how to setup Circle CI to automatically trigger builds for projects hosted on Github. Kindly note that a similar thing can be done for Bitbucket and other hosts.

Click the settings link in the side menu of Circle CI
If you are not already logged in to Github, login when prompted.
Scroll to the bottom of the page and select the list of repositories for which you want to authorize checks

Congratulations! You have successfully setup continuous integration for your project using Circle CI.

Next Steps

In a follow-on article, I’ll explain how continuous delivery and how to set it up using Circle CI.

Summary

In this article, I have explained what continuous integration is, what its’ benefits are and how to set it up using Circle CI.

Many thanks for following along. Until next time.

Linting with Eslint, Prettier and Airbnb Style Guide

2019-01-07T00:00:00+00:00

This is the second part of a 2-series article in which I talk about setting up a NodeJS project. The first article focused on using ES6 modules in NodeJS. This article dives into enforcing a consistent code format and style in a NodeJS project.

Why Enforce a Code Format and Style?

In any project, private or public, with more than one contributor, misunderstandings are likely to occur over how code should be formatted and generally written. This is why it is important to define a coding style and format at the very start of a project. To define a coding style, you use a linter.

A linter refers to a tool that analyzes source code to flag programming errors, bugs, stylistic errors and suspicious constructs - Wikipedia

You can read more about the benefits of linting in does linting make you a better developer and why you should always use a linter.

Setting Up a Linter

We’ll be setting up eslint, a linting utility for Javascript, for the project started in the first part of this article. Eslint allows you to define a set of rules to enforce a coding style and format. For our purposes, we will be using the Airbnb style guide, a set of rules defined and used by the Airbnb team. The Airbnb guide is comprehensive and covers everything from variable declarations to functions and control flow statements. Let’s begin.

Install eslint

npm install eslint eslint-plugin-import --save-dev

Create a .eslintrc.js file, the eslint configuration file, with the following content. Note: the configuration file can be a javascript, json or yaml file.

module.exports = {
  env: {
 // allow NodeJs global variables and NodeJS scoping
 node: true,
 // allow use of ES6 globals such as Set
 es6: true
  },
  parserOptions: {
 // allow use of object rest/spread properties as well as other ES8 features
 ecmaVersion: 2018,
 // allow use of Ecmascript modules
 sourceType: "module"
  }
}

Create a .eslintignore file with the following content.
```
dist/
node_modules/
```
This file tells eslint to not lint files in the dist and node_modules directory. This is important because dist contains the output of babel compilation and we didn’t write any of the code in the node_modules directory.
Add lint commands to package.json
```
...
scripts: {
  ...,
  "lint": "eslint **/*.js",
  "lint:fix": "npm run lint -- --fix"
}
```
The lint command runs the linter and reports any errors found. The lint:fix command runs the linter and fixes all errors that don’t require an intervention from you - example, adding missing semicolons.
Note: eslint comes with a default set of rules which are used when we run lint. Instead of using the eslint defaults, let’s use the Airbnb style guide.
Install Airbnb’s rules for eslintnpm install eslint-config-airbnb-base
Add the Airbnb config to the plugins (rules) checked by eslint
```
extends: ["airbnb-base"]
```
Run npm run lint. You should get an error saying eslint is unable to understand import/export syntax. To fix this, install the import plugin npm install eslint-import-plugin --save-dev
npm run lint should now work as expected; it displays a list of errors as shown below:

We have successfully set up a linter for our project. Every contributor can run the lint commands to either lint or fix lint errors. At this point, we can configure our continuous integration (CI) pipeline to run the lint command. This will help us report lint errors before a pull request gets merged.

Even though we have done well so far, we can do more to make local development for individual contributors much easier. We can automate running of the linter such that a contributor can afford to “forget” manually running it. This way, even if a contributor forgets to lint, the linter is automatically run allowing him/her to attend to lint errors instead of waiting a while to be notified by the CI. We’ll automate this by setting up Git hooks.

Setting Up Git Hooks

Install husky, a module for managing git hooks in NodeJS
```
npm install husky--save-dev
```
Install lint-staged, a module for running linters against staged git files
```
npm install lint-staged --save-dev
```
Configure husky and lint-staged to run lint by adding the following to package.json
```
  "husky": {
 "hooks": {
   "pre-commit": "lint-staged",
   "pre-push": "npm run lint"
 }
  },
  "lint-staged": {
 "{src|test}/**/*.js": [
   "npm run lint:fix",
   "git add"
 ]
  }
```
Anytime a contributor attempts to commit changes, the linter is run to fix all lint errors (those that can be fixed without intervention) before the files are committed. Similarly, prior to pushing up a branch, the linter is run and any lint errors are reported to the contributor.

Bonus

We have done a great job so far in terms of enforcing a consistent coding style and format. However, let’s do a little more to make it easier to enforce consistent code formatting. Meet prettier, an opinionated code formatter that takes the burden off the developer as relates to code formatting. We’ll use prettier to ensure that code is properly formatted before it is pushed to the main repo.

Install prettier npm install prettier --save-dev
Install prettier plugins for eslint. See integrating prettier with eslint for details
```
npm install eslint-plugin-prettier eslint-config-prettier --save-dev
```

Add prettier to eslint config

extends: ["airbnb-base", "plugin:prettier/recommended"]

Prettier will now be run each time you run npm run lint:fix. Since lint fix is run prior to each commit, you can be sure that prettier will always be invoked to format your code.

Congratulations on making it to the end of this article. I hope you have enjoyed yourself as much as I. At this point, your package.json, .eslintrc.js and .eslintignore files should be looking as below (exact package versions may differ). Be sure to consult these files in case you missed anytime. Until next time, cheers.

package.json

{
  "name": "es6-modules-app",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "build": "babel src -d dist",
    "start": "node dist/index.js",
    "start:dev": "nodemon src/index.js --exec babel-node",
    "lint": "eslint **/*.js",
    "lint:fix": "npm run lint -- --fix"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "devDependencies": {
    "@babel/cli": "^7.2.3",
    "@babel/core": "^7.2.2",
    "@babel/node": "^7.2.2",
    "@babel/preset-env": "^7.2.3",
    "eslint": "^5.12.0",
    "eslint-config-airbnb-base": "^13.1.0",
    "eslint-config-prettier": "^3.3.0",
    "eslint-plugin-import": "^2.14.0",
    "eslint-plugin-prettier": "^3.0.1",
    "husky": "^1.3.1",
    "lint-staged": "^8.1.0",
    "nodemon": "^1.18.9",
    "prettier": "^1.15.3"
  },
  "husky": {
    "hooks": {
      "pre-commit": "lint-staged",
      "pre-push": "npm run lint"
    }
  },
  "lint-staged": {
    "{src|test}/**/*.js": [
      "npm run lint:fix",
      "git add"
    ]
  }
}

.eslintrc.js

module.exports = {
    "env": {
        "es6": true,
        "node": true
    },
    "extends": ["airbnb-base", "plugin:prettier/recommended"],
    "parserOptions": {
        "ecmaVersion": 2018,
        "sourceType": "module"
    }
};

.eslintignore

dist/
node_modules/

Using ES6 Modules in NodeJS

2019-01-06T00:00:00+00:00

While working on Node Guidebook, a project I started to share my thoughts on building NodeJS applications, I needed to answers a couple of questions.

Which do I use? commonjs (aka module.exports and require) or the new ES6 modules? Note: As at NodeJS v11, ES6 modules are not supported in NodeJS.
How do I ensure a consistent code format and style?

Commonjs or ES6 Modules?

I decided to go with ES6 modules for Guidebook as it is the future of module management in Javascript. I also decided to not use --experimental-modules NodeJS flag - I personally don’t like the .mjs extensions required to use it. As a result, I chose to write ES6 modules code and compile down to ES5 commonjs code using babel. This seems rather counterintuitive. Why not use commonjs modules directly and skip the compile step? Well, I reasoned that sometime in the near future, ES6 modules will be fully supported in NodeJS. When that day arrives, I can safely remove babel and not have to touch any of my code.

A Gist About Babel

Babel is a piece of software used to transform ES6+ code into a backwards compatible version. Code transformation in babel is achieved through the use of small Javascript programs called plugins. For example, the @babel/plugin-transform-arrow-functions transforms ES6+ arrow functions to ES5 functions. To transform code, you simply specify the list of plugins to apply to it. To simplify the process of using multiple plugins, babel provides presets. A preset is a pre-determined collection of plugins. For example, the env preset includes all the plugins required to transform modern Javascript (ES6+) into a backwards compatible version.

Setting Up Babel

Create a new directory for the ES6 modules app
```
mkdir es6-modules-app
cd es6-modules-app
```
Create a package.json file
```
npm init -y
```
Note: You can run npm init instead and follow the on-screen prompts to setup a package.json file.
Install babel and nodemon
```
npm install @babel/cli @babel/core @babel/node @babel/preset-env nodemon --save-dev
```
Note: nodemon is a tool used to start NodeJS applications. It restarts the application when file changes in the application source directory are detected.
Create .babelrc file, the babel configuration file, with the following content
```
{
  "presets": [
 "@babel/env", 
 {
   "targets": {
     "node": "8"
   },
   "modules": "commonjs"
 }
  ]
}
```
"modules": "commonjs" tells babel to transform ES6 modules to commonjs.
{ "targets": { "node": "8" } } tells babel to compile against node 8. To compile against the current version of node, specify { "targets": { "node": true } }. Learn more about env preset options here
Add build and start commands to scripts section of package.json.

Your package.json file should look something like this. Note, however, that package version numbers may differ.

{
  "name": "es6-modules-app",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "build": "babel src -d dist",
    "start": "node dist/index.js",
    "start:dev": "nodemon src/index.js --exec babel-node"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "devDependencies": {
    ...
  }
}

The build command will compile code from the source directory, src and output it to a destination directory dist. Note: you are free to decide the directory names.

Create a src directory
```
mkdir src
```
Create the following files with their contents

math.js

export const sum = a => b => a + b
export const prod = a => b => a * b
export const divide = a => b => {
  if (b > 0) return a / b;
  throw new Error('Cannot divide by 0');
}

index.js

import { sum, prod, divide } from './math.js'

console.log('sum of %d and %d = %d', 8, 10, sum(8)(10));
console.log('product of %d and %d = %d', 6, 5, prod(6)(5));
console.log('%d divided by %d = %d', 22, 5, divide(22)(5));

To start the application, run npm run start:dev. While the application is running, editing either math.js or index.js reloads it. That is, you don’t have to stop and restart it. To deploy your changes to production, run npm run build. This creates a dist directory which can be deployed to the production server.

Hope you enjoyed this article. See you in the follow up article. In the meantime, feel free to leave comments and suggestions.

Why I started this blog

2018-11-19T00:00:00+00:00

Hi there! I’m Kwabena Boadu. I’m a software engineer and life-long learner. When I’m not working, I love to workout, play football games and watch/play football and basketball, among other things.

I don’t write much - I have just about 3 articles in the past 5 years. Over the course of this period (the past 5 years), however, I have benefited from the knowledge of others through writings and video recordings. I have also acquired a lot of knowledge that I could and should have shared for the benefit of others.

I am looking to change this trend and this is why I started this blog. For starters, I am committing to writing at least an article each month. My writings will mostly share things I’m learning, challenges I am or have faced, and hopefully, how I have or will solve them.

I have no idea how it’s going to pan out, but I’m highly excited to get started anyway. As Steve Jobs famously said:

the journey is the reward

Come along. I’ll be happy to share your company as I embark on this journey. Thanks for offering to be there. See you again soon.

biblicalph

DNS Rebind Attack

How is DNS rebinding attack executed?

Consequences of rebind attacks

How to prevent DNS rebinding?

Final thoughts

Inheritance in Javascript

How Prototype Chain Works

Accessing/Modifying an Object’s Prototype

Difference Between __proto__, [[Prototype]] and prototype

Prototypal Inheritance Examples

Example 1: (Non-function Objects)

Example 2: (Function Objects) - No ES6 class

Prototypal (Prototype Based) Versus Classical (Class Based) Inheritance

Summary

Additional References

Continuous Integration Using Circle CI

What is Continuous Integration (Definition)?

Why Continuous Integration (Benefits)?

How to Setup Continuous Integration Using Circle CI

Bonus

Next Steps

Summary

Linting with Eslint, Prettier and Airbnb Style Guide

Why Enforce a Code Format and Style?

Setting Up a Linter

Setting Up Git Hooks

Bonus

Using ES6 Modules in NodeJS

Commonjs or ES6 Modules?

A Gist About Babel

Setting Up Babel

Why I started this blog

Difference Between proto, [[Prototype]] and prototype