Skowronek.org » Development

SWFObject Codebase Moves to Google Code

Skowronek — Mon, 28 Apr 2008 23:59:01 +0000

While doing some Flash coding today I noticed the SWFObject homepage had a notice that all the code had moved to Google Code as the new and improved (lowercase) swfobject. For anyone not familiar with swfobject, it is (IMHO) the de facto JavaScript library/API for embedding and enabling Adobe Flash applications on the web. Version 2.0 has been completely revamped with a pretty steep upgrade path, so do not do it lightheartedly.

google Project Page

Skowronek.org Facelift

Skowronek — Sun, 06 Jan 2008 10:05:56 +0000

It’s been a couple of weeks since I finished the final design, and now, after a day or so of coding and fussing with WordPress, it is finally done. Completely rebuilt with widgets (I’ll post my twitter and other such widgets later perhaps) and dynamic everything. Now time for bed.

Custom, Undocumented YouTube Player Parameters

Skowronek — Wed, 19 Dec 2007 18:25:35 +0000

Apparently, YouTube has a few undocumented parameters that can effect the display of certain elements of an embedded player. I ran across this post in their developer forums following a request by a work associate to figure out how to hide the options displayed at the end of a played movie. Here is the list of known parameters along with the URL to the actual post:

rel = 0/1 -> value for showing related videos
color1 = hexadecimal color code -> value for the base color
color2 = hexadecimal color code -> value for the over color
border = 0…x -> value for the border width
autoplay 0/1 -> value for automatically starting the video to play
eurl = http://www.yourwebsite.com -> I believe this is the referring URL. Please correct me if I’m wrong.
iurl = Path to the thumbnail image (I believe)

Custom URL parameters for YouTube embedded players

Silverlight Live Streaming

Skowronek — Fri, 14 Dec 2007 22:13:10 +0000

While reading another Silverlight development articles, I ran across a new service/feature Microsoft is offering for Silverlight developers/practioners. They claim to offer 4GB streaming services for free. I’m not sure all the stipulations and/or limitations, but hey, it’s not YouTube!

Index of /wp-content/uploads

Skowronek — Fri, 07 Dec 2007 08:32:02 +0000

Tonight, whilst experimenting with the various advanced Google search techniques (hacks) to locate web content, I had an epiphany. Any web directory/folder that has indexes enabled (show an index of the contents of the folder of no directory index file exists) will list the contents of said directory with the phrase “Index of” followed by the actual root-relative path to available list of assets. This is due to the fact that the directory/folder does not have an index document/file present, so the web server spits out the entire list of the folder’s content. But I digress.

I have been using WordPress as my blogging platform for a few years now. Before that was a hybrid of PHPBB and custom PHP application I wrote. WordPress works great and has robust features that make blogging a snap for the more technical (such as myself, ehem) and also for the less technical netizens out there. Now, one of these great features is the ability to upload pictures and files (content) through a web interface. What a great concept (this is where the epiphany came in) except if you weren’t planning on listing up the contents of your entire uploads folder to the world. which happens to be the case with some (okay a lot of) default installations of WordPress.

Lets say you “Google” the “Index of” any WordPress uploads folders (/wp-content/uploads). You don’t have to be a rock scientist (yes, that was a joke) to realize the possible implications. Let me give you an idea of the figure as of tonight: 4,143,000 indexes. That’s 4,143,000 WordPress installations that have directory indexes enabled and are completely wide open to crawlers and spiders that can pilfer (argh) their content.

Try it yourself: http://www.google.com/search?q=Index+of+%2Fwp-content

There are plenty of other “Index of” combinations out there:

Now obviously if someone is using WordPress and uploading content, it’s more than likely related to their blog, and perfectly okay for the world to sneak a peak. However, for those sites that are using WordPress as a corporate platform, with confidential information (don’t ask me why you would want to do this with WordPress…), this is a huge security issue.

Moral of the story, unplug your computer, no one is safe.

Here are a bunch I found in a forum while actually doing a search on _vti (Front Page extensions).

filetype:htpasswd htpasswd
intitle:"Index of" “.htpasswd" -intitle:"dist"
           -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurl:passlist.txt (para encontrar listas de passwords)
intitle:"Index of..etc" passwd
intitle:admin intitle:login
“Incorrect syntax near" (SQL script error)
intitle:"the page cannot be found" inetmgr
intitle:index.of ws_ftp.ini
“Supplied arguments is not a valid PostgreSQL result"
_vti_pvt password intitle:index.of
inurl:backup intitle:index.of inurl:admin
“Index of /backup"
index.of.password
index.of.winnt
inurl:"auth_user_file.txt"
“Index of /admin"
“Index of /password"
“Index of /mail"
“Index of /" +passwd
Index of /" +.htaccess
Index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: “index of/admin"
allintitle: “index of/root"
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurl:passwd filetype:txt
inurl:admin filetype:db
inurl:iisadmin
inurl:"auth_user_file.txt"
inurl:"wwwroot/*."
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:"Index of" .sh_history
intitle:"Index of" .bash_history
intitle:"Index of" passwd
intitle:"Index of" people.1st
intitle:"Index of" pwd.db
intitle:"Index of" etc/shadow
intitle:"Index of" spwd
intitle:"Index of" master.passwd
intitle:"Index of" htpasswd
intitle:"Index of" members OR accounts
intitle:"Index of" user_carts OR user _cart

Encoding and Downloading FLV Media

Skowronek — Tue, 04 Dec 2007 06:53:59 +0000

One of the greatest features of Flash is the ability to encode video for online playback. For those that have not done this, the quick notes version:

Create a blank Flash movie (somewhere near the dimensions of the source video)
File | Import | Import to library…
Select Windows | Library OR CTRL + L for those key-jockeys out there
Select the imported movie from the library
Right-click | Properties
In the Embedded Video Properties dialog box, click Export.
Save the movie for later use

Now, what if we want to be able to download an FLV movie from somewhere on the web. Lately I have been researching ways to leverage various online social media provider’s technologies (and uhm, assets.) In doing so, I rely heavily on Fiddler, an HTTP debugging proxy which logs all HTTP traffic between your computer and the Internet (that is all IE traffic.) By listening to the HTTP requests being sent from any embedded Flash application from your local computer, FLV assets from YouTube, Brightcove and others are easily retrievable. Although there are freely available plug-ins for Firefox and Internet Explorer that occasionally work, oftentimes it becomes necessary to dig in and get your hands dirty. Let’s dirty up…

Download, install and run Fiddler 2 (you’ll need the latest version of .NET 2.0)
Disable capture (F12)
Launch IE (any recent flavor will due)
Open up YouTube.com, Brightcove.tv or any media outlet that offers streaming video via Flash
Return to Fiddler and click F12 to begin capture (this is important or you will miss the capture part of this mini-tutorial)
Now, browse to a page that has the video you wish to “archive” and allow it to load and begin playing (I have found that sometimes Fiddler or the site will hang, you may need to start capture a few times to get the page to load up.)
Return to Fiddler and click F12 again (we have captured all we need)

You should have a list of links that Fiddler has so graciously tracked for us. Now time to locate the actual session that contains the source movie.

Click CTRL + F (find) and type video/flv in the text box
Search | Requests and Headers
Examine | Headers and Body
Click Find Sessions

Now the final step, download the FLV source. This is the easy part. Fiddler gives us an easy copy context menu to handle this:

Right-click the link session that the find from above highlighted.
Copy | Just Url (CTRL + U)
Paste the copied URL into your favorite download accelerator or just paste it directly into IE or Windows Explorer.

As long as you do not have the FLV extension associated to any other Windows application, you should be prompted with a Save/Open dialog box. Save the file down to your computer and you are done.

Granted, not a lot you can do directly with an FLV file. Perhaps I’ll put something together on how to actually use the FLV source at a later day.

Feedback welcome.

Using Visual Studio.NET to Debug JavaScript

Skowronek — Thu, 01 Nov 2007 22:22:11 +0000

I have been using the Visual Studio JavaScript debugger for years (since VS 6.0). Apparently, a lot of developers with which I have spoken are oblivious to the fact that, in fact, you can debug many things from VS.NET (JS being one of them). Rather than put up a lengthy tutorial, I figured I would at least share what the keystroke combination is to access the Script Explorer from within VS.NET.

First, you’ll need to actually be attached to Internet Explorer (will not work with Firefox, at least to my knowledge) in script mode. Once attached, you then hit the CTRL + ALT + N keys to bring up the Script Explorer window. This will list out all the files IE has loaded at that time. You can then open up any HTML, JS, etc. files and set breakpoints to debug at runtime.

Amazing and pretty dang useful at the same time. Feel free to comment if you find this useful.

Doug Crawford on Google Gears and Mashups

Skowronek — Thu, 04 Oct 2007 06:42:29 +0000

Ran across this video of Doug Crawford (JSON, JSMin, JSLint, etc) talking about Google mashups and Gears. Very boring to those non-coders. Somewhat interesting to some coders. Very interesting to those of us who live and breath code.

Create Multiple Web Sites on XP Version of IIS

Skowronek — Sat, 30 Sep 2006 22:32:38 +0000

‘ Create an instance of the virtual directory object
‘ that represents the default Web site.
Set IIsWebVDirRootObj = GetObject(“IIS://localhost/W3SVC/1/Root”)

‘ Use the Windows ADSI container object “Create” method to create
‘ a new virtual directory.
Set IIsWebVDirObj = IIsWebVDirRootObj.Create(“IIsWebVirtualDir”, “NewVDir”)

‘ Use the Windows ADSI object “Put” method to
‘ set some required properties.
IIsWebVDirObj.Put “Path”, “C:\NewContent”
IIsWebVDirObj.Put “AccessRead”, True
IIsWebVDirObj.Put “AccessScript”, True

‘ Use the AppCreate2 method of the IIS ADSI provider to
‘ create an application on the new virtual directory.
IIsWebVDirObj.AppCreate2 1
IIsWebVDirObj.Put “AppFriendlyName”, “NewApp”

‘ Use the Windows ADSI object “SetInfo” method to
‘ save the data to the metabase.
IIsWebVDirObj.SetInfo

Converting .NET DateTime to UNIX Timestamp

Skowronek — Tue, 22 Aug 2006 21:36:17 +0000

Note to self:

How to convert .NET DateTime to UNIX timestamp (as in PHP, etc.)

int timestamp = (DateTime.UtcNow – new DateTime(1970,1,1,0,0,0)).TotalSeconds

and convert a Unix timestamp to an ASP.NET DateTime value:

DateTime date = (new DateTime(1970,1,1,0,0,0)).AddSeconds(datestamp)