>/dev/rand

Drupal Theming – Creating a Drupal theme from scratch – 2

charan puvvala — Mon, 19 Jul 2010 11:14:04 +0000

In case you bumped into this post without visiting the first post on this tutorial. This is the link to the first part of the post.Give a quick look at the first part which explains the .info file of a theme. I have observed that most of the visits to this blog land on the part 1 of creating a drupal theme, which I think doesn’t give any useful information in actually building a theme but just a kick start with the basic .info file. I am going to continue from where I left off.

After reading this post I hope you are ready with a folder with the name of your theme and a .info file that you have built describing your theme. This tutorial will help you build a drupal theme from a css template in a quick dirty way, which works!! Once it is built you will have an idea about how to build a drupal theme in a matter of few minutes. First get your css html ready, I am using LazyBreeze free css template from freecsstemplates.org . You can follow along the tutorial by downloading the template or using a different one of your choice.

Here is my .info file


name = Lady Breeze
description = Theme by f4k1r for Drupal tutorial. Design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License.
screenshot = screenshot.png
version = 0.1
core = 6.x
engine = phptemplate

;Regions
regions[header]       = Header
regions[left-cols] = SideBar Left
regions[main_content] = Content
regions[footer]       = Footer
regions[link_navigation] = Primary Links

;Stylesheet
stylesheets[all][] = css/style.css

Our .info file tells drupal about the name,description of the theme and then defines the regions that the theme will be having and the location of the stylesheets. Next create a folder called css in our theme folder and put the style.css of the downloaded LadyBreeze into it. Also copy the images folder of the LadyBreeze into the theme folder.
Now our theme folder directory should look like this:

LadyBreeze
-ladybreeze.info
-css
—-style.css
-images
—-all the images from LadyBreeze

Once this is setup we will have to create our template file (page.tpl.php). All the pages on our Drupal website will be rendered based on this file. This file will use the drupal variables to fetch the content and then use our css to wrap the content in it and then displays to the user. If you are building a Drupal theme for the first time then use the already built node.tpl.php from the garland theme. First create a directory named templates and place the copied file into it. So now your directory structure should be like this

LadyBreeze
-ladybreeze.info
-css
—-style.css
-images
—-all the images from LadyBreeze
-templates
—-node.tpl.php

Next we are going to create our page.tpl.php based from the page.tpl.php of the garland theme(Default Drupal theme for 6.x). So copy the page.tpl.php and the index.html from the downloaded template into a temporary directory for editing. Now move into the templates folder and create a new file page.tpl.php ,Next we are going to copy the markup from the index.html into this.

Lazy Breeze by Free CSS Templates

lazybreeze
design by CSS Templates

Home
Blog
Photos
About
Links
Contact

Welcome to lazybreeze
May 10, 2010Posted by Someone

This is LazyBreeze , a free, fully standards-compliant CSS template designed by FreeCssTemplates for CSS Templates. This free template is released under a Creative Commons Attribution 3.0 license, so you’re pretty much free to do whatever you want with it (even use it commercially) provided you keep the links in the footer intact. Aside from that, have fun with it :)
Sed lacus. Donec lectus. Nullam pretium nibh ut turpis. Nam bibendum. In nulla tortor, elementum ipsum. Proin imperdiet est. Phasellus dapibus semper urna. Pellentesque ornare, orci in felis. Donec ut ante. In id eros. Suspendisse lacus turpis, cursus egestas at sem.
Read More | Comments

Lorem ipsum sed aliquam
May 10, 2010Posted by Someone

Sed lacus. Donec lectus. Nullam pretium nibh ut turpis. Nam bibendum. In nulla tortor, elementum vel, tempor at, varius non, purus. Mauris vitae nisl nec metus placerat consectetuer. Donec ipsum. Proin imperdiet est. Phasellus dapibus semper urna. Pellentesque ornare, orci in consectetuer hendrerit, urna elit eleifend nunc, ut consectetuer nisl felis ac diam. Etiam non felis. Donec ut ante. In id eros. Suspendisse lacus turpis, cursus egestas at sem. Mauris quam enim, molestie in, rhoncus ut, lobortis a, est.
Read More | Comments

Consecteteur hendrerit
May 10, 2010Posted by Someone

Aliquam tempus
Mauris vitae nisl nec metus placerat perdiet est. Phasellus dapibus semper consectetuer hendrerit.

Netsuite to Drupal

charan puvvala — Mon, 19 Jul 2010 10:06:19 +0000

There has been lots of users looking for a module which integrate Drupal CMS and Netsuite CRM. Here is a thread from drupal.org. It is very difficult to build a generic module which provides all the features that Netsuite provides into a drupal website. Most of the usecases of a client are very specific and so is his netsuite setup. Here is my attempt to make a generic module Drupal to Netsuite, if anyone interested in helping me out, I would be glad to restart the work on the module.

Moving to drupal gardens

charan puvvala — Thu, 01 Apr 2010 12:44:07 +0000

I am going to move my blog to Drupal Gardens in the coming week. Drupal Gardens is really exciting and fun playing around with.

http://f4k1r.drupalgardens.com

Drupal Theming Basics – Creating A theme from Scratch – 1

charan puvvala — Sat, 06 Feb 2010 06:50:27 +0000

Drupal theming is generally frightening for a newbie and possibly one of the reason which drives away people from drupal. Drupal Gardens is an innovative idea to make drupal theming easy by Acquia. This is going to be the first post of the series of Drupal tutorials to create a simple drupal theme from the scratch. It took me 2 years to get over the fear of theming and build my own Drupal theme. Few references to go through before you start making your own theme.
Drupal Theming Handbook
Installing a Drupal Theme
Anatomy of a Drupal theme
Toold and Modules to get started
This tutorial isn’t about creating a sub-theme of zen. Its a good starting point for making a sub-theme of it, but I rather prefer making it from the scratch as I have complete control over my theme.

Creating a .info file

The .info describes your theme and its a way of introducing your theme with your Drupal installation. Before creating a .info we need to get started by creating our theme directory in your drupal installation at sites/all/theme/”your theme name” . We can also create a folder for our theme in the theme directory in the root folder of the installation. But it isn’t advisable as we will be updating the drupal core in the future and it would be painful while doing it. Once you create your theme folder with your theme name, start with creating an empty .info file. The .info file has the information required for drupal about your theme name, description, version, core of drupal which it supports, the theme engine being used, stylesheets, scripts and the regions of your theme.

An example .info file

name = droid
description = Theme by f4k1r for Charan Puvvala Drupal tutorial.
screenshot = screenshot.png
version = 0.1
core = 6.x
engine = phptemplate

;Regions
regions[header]       = header
regions[left-cols] = left-cols
regions[main_content] = main_content
regions[right] = Right sidebar
regions[footer]       = footer
regions[news_section] = News Section
regions[content_bottom] = Content Bottom
regions[link_navigation] = Primary Links
stylesheets[all][] = style/style.css

The name describes the name of the theme which will be displayed in the themes section while enabling it. The description gives a brief description of the theme, credits. Its perfectly even if the description isn’t used in the .info file. The core suggests which Drupal core our theme supports. This tutorial is aimed for drupal 6.x.
The screenshot presents the user with a screenshot about the theme in the Administer>>SiteBuidling>>Themes. The theme engine tag suggests the theme engine you will be using in building the theme. I prefer the phptemplate and 95% of drupal themers use the same. If none is provided, the theme is assumed to be stand alone, i.e., implemented with a “.theme” file. PHPTemplate’s job is to discover theme functions and templates for the behavior of the theme. Omit this entry only if you know what you are doing. There is another tag available to the user called basetheme which will tell drupal that our theme is a subtheme of the one specified with the basetheme tag.
The regions give us control over our blocks and content as to where they are to be placed in our page. You can define as many regions as possible in the regions section. This regions show up in the block sectionfor the blocks to be placed in our website. If no regions are specified here in the .info file, the following regions are assumed by drupal

regions[left] = Left sidebar
regions[right] = Right sidebar
regions[content] = Content
regions[header] = Header
regions[footer] = Footer

Traditionally drupal takes in style.css as the default stylesheet and and could add additional stylesheets by calling drupal_add_css() in their template.php file. There are other tags available that can be used in the .info file but I will not be going in as this will be enough to start our theme. In the next post I will describe as to how to convert a static HTML and css into a Drupal theme. Till then Have Fun and I am off for a DOTA tourney. More info

Microsoft IE URLMON Sniffing Cross Domain Information Disclosure Vulnerability

charan puvvala — Thu, 04 Feb 2010 11:49:03 +0000

Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability.

An attacker can exploit this issue to access local files or content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or may aid in further attacks.

Link to Security Focus

Credit: Jorge Luis Alvarez Medina and Federico Muttis from Core Security Technologies

The investigation so far has shown that if a user is using a version of Internet Explorer that is not running in Protected Mode an attacker may be able to access files with an already known filename and location. These versions include Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service 4; Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4; and Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on supported editions of Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows Server 2003 Service Pack 2. Protected Mode prevents exploitation of this vulnerability and is running by default for versions of Internet Explorer on Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008.

The vulnerability exists due to content being forced to render incorrectly from local files in such a way that information can be exposed to malicious Web sites.

The URLMON sniffing vulnerability refers to the variant discovered in the CORE-2008-0826 time line. When loading a local file Internet Explorer’s HTML rendering engine [7] will only check its MIME type to see if it is a positive match on the files it can handle. For unknown types that are treated as HTML because they’ve been referred to by a redirection, content type determination will default to ‘text/html’ in absence of a type explicitly set by the content source. In the case of non-html files for which there isn’t an explicit content-type set, URLMON will default to the ‘text/html’ type as suggested from the redirection. As a result Internet Explorer will end up loading non-html local files and rendering them as HTML and running any scripting code included in the file in the context of the Security Zone assigned to the content’s source.

ptrace() on OpenBSD can lead to DOS

charan puvvala — Thu, 04 Feb 2010 06:23:59 +0000

011: RELIABILITY FIX: January 29, 2010 All architectures
By using ptrace(2) on an ancestor process, a loop in the process tree could be created, violating assumptions in other parts of the kernel and resulting in infinite loops.
Patch

Make your Ubuntu Box ready for pentesting

charan puvvala — Wed, 03 Feb 2010 09:30:59 +0000

Most of the post is ripped from jcran’s post on his blog which I found very useful. This is a shell script which will install most of the tools required for pentesting from a ubuntu box. I’ve been using more of Ubuntu and FreeBSD lately and found this really helpful. Now you dont have to switch back to backtrack or any other operating system for pentesting a network…do it right from your ubuntu box. Thanks to jcran,Hackuin for parts of the script.
The script can make installs which sometimes can break your system. So kindly go through it completely before executing it.

#!/bin/bash

# System Configuration & Utilities
apt-get -y install build-essential
apt-get -y install linux-headers-`uname -r`
apt-get -y install sysvconfig
apt-get -y install bum ## Boot-Up Manager
apt-get -y install tofrodos ## DOS utils
apt-get -y install xinetd ## why not.
apt-get -y install unrar ## RAR support
apt-get -y install p7zip-full ## 7-Zip support
apt-get -y install fcrackzip ## Zip cracking
apt-get -y install ipcalc ## handy
apt-get -y install sharutils ## uuencode / uudecode
apt-get -y install xclip ## piping is handy
apt-get -y install ldap-utils
apt-get -y install cabextract ## damn microsoft!
apt-get -y install g++
apt-get -y install ssh

## Network services
apt-get -y install samba
apt-get -y install nis
apt-get -y install nfs
apt-get -y install smbfs ## samba utilities
## apt-get -y install tftpd ## you need to modify the /etc/init.d file…

# system monitoring
apt-get -y install ntop ##
apt-get -y install sysstat ## iostat,sar,mpstat
apt-get -y install procinfo

# Package Management
#apt-get -y install apt-build
#apt-get -y install apt-dpkg-ref
#apt-get -y install apt-listbugs
apt-get -y install apt-file
#apt-get -y install apt-howto
apt-get -y install apt-utils
apt-get -y install apt-listchanges
apt-get -y install dconf

# Terminal Emulators
apt-get -y install tn5250
apt-get -y install screen

# Filesystem Support
apt-get -y install sshfs
apt-get -y install ntfs-3g
apt-get -y install ntfs-config
apt-get -y install ntfsprogs
apt-get -y install mkisofs

# Gnome-Specific Configuration
apt-get -y install gconf
apt-get -y install gnomebaker
apt-get -y install nautilus-open-terminal

# ISAKMPD
# apt-get -y install isakmpd
apt-get -y install vpnc

# Multimedia
apt-get -y install amarok
apt-get -y install xmms
apt-get -y install xmms-skins
apt-get -y install xmms-mp4
apt-get -y install mpg123
apt-get -y install totem-xine
apt-get -y install ksnapshot
apt-get -y install istanbul
apt-get -y install recordmydesktop
apt-get -y install gtk-recordmydesktop
apt-get -y install xvidcap

# Basics

# Netcat & Tunnelling
apt-get -y install netcat
apt-get -y install sbd
apt-get -y install cryptcat
apt-get -y install socat
apt-get -y install vtun
apt-get -y install stunnel

# Scanning Tools
apt-get -y install nmap
apt-get -y install nessusd
apt-get -y install nessus
apt-get -y install fping
apt-get -y install hping2
apt-get -y install hping3
apt-get -y install scapy
apt-get -y install snmp
#apt-get -y install sing #send icmp nasty garbage
apt-get -y install traceroute
apt-get -y install tcptraceroute
apt-get -y install ike-scan ## ipsec vpn tool
apt-get -y install nbtscan ## cifs info tool
apt-get -y install sslscan

# Passive Scanning Tools
apt-get -y install p0f
apt-get -y install pads

# Sniffing Tools
apt-get -y install wireshark
apt-get -y install ettercap
apt-get -y install ettercap-gtk
apt-get -y install tcpdump
apt-get -y install tcpflow
apt-get -y install ssldump
apt-get -y install nemesis # packet injection
apt-get -y install dsniff
apt-get -y install etherape

# Libraries
apt-get -y install libssl #Medusa
apt-get -y install libssl-dev #Medusa
apt-get -y install libssh-2 #Medusa
apt-get -y install python-pycurl #wfuzz
apt-get -y install libnet-dns-perl #fierce.pl
apt-get -y install libsnmp-perl #??
apt-get -y install libcrypt-ssleay-perl #HEAD,GET,POST, libwhisker
apt-get -y install libnet-ssleay-perl # “” “”
apt-get -y install ncurses-dev # kismet-newcore
apt-get -y install libpcap-dev # kismet-newcore

# Cracking Tools
apt-get -y install john
apt-get -y install medusa
## apt-get -y install hydra? ## not really that useful..

# Wireless Tools
##apt-get -y install kismet ## disabled because of kismet-ng
apt-get -y install aircrack
apt-get -y install aircrack-ng

# App Layer Tools
apt-get -y install wget
apt-get -y install curl
apt-get -y install nikto

## Scripting
apt-get -y install ruby
apt-get -y install python
apt-get -y install perl
apt-get -y install perl-doc
apt-get -y install gawk
apt-get -y install vim-ruby
apt-get -y install vim-python

## Ruby – Gems
apt-get -y install gems
apt-get -y install rubygems

## Metasploit dependencies
apt-get -y install libopenssl-ruby
apt-get -y install ruby-libglade2
apt-get -y install libgtk2-ruby

## Scapy – Python Dependencies – http://www.secdev.org/projects/scapy/portability.html
apt-get -y install graphviz # graph stuff
apt-get -y install imagemagick # graph stuff
apt-get -y install python-gnuplot # PacketList.plot()
apt-get -y install python-crypto # WEP Stuff
apt-get -y install python-visual # 3D Stuff
apt-get -y install python-pyx # pdfdump() / psdump()
apt-get -y install acroread
apt-get -y install gv
apt-get -y install sox

## ProxyStrike Dependencies
apt-get -y install python-qt4
apt-get -y install python-openssl

## W3af Dependencies
apt-get -y install python-pyparsing
apt-get -y install python-pydot
apt-get -y install python-soappy

## Coding
##apt-get -y install eclipse – get the latest version…
apt-get -y install kdevelop
apt-get -y install subversion
apt-get -y install rapidsvn
apt-get -y install vim-full
apt-get -y install git
apt-get -y install git-core

## Documentation
apt-get -y install notecase
apt-get -y install vim
apt-get -y install liferea

## Web / Browser Utilities
apt-get -y install azureus
apt-get -y install opera
apt-get -y install filezilla
apt-get -y install flashplugin-nonfree
apt-get -y install pidgin
apt-get -y install pidgin-otr
apt-get -y install thunderbird
apt-get -y install lightning-extension
apt-get -y install enigmail
apt-get -y install irssi
apt-get -y install silc
apt-get -y install tor

## Windows Stuff
apt-get -y install wine
apt-get -y install quicksynergy

## Encryption
apt-get -y install dmsetup
apt-get -y install password-gorilla
apt-get -y install gpa
apt-get -y install seahorse

## Java
apt-get -y install sun-java6-jre
apt-get -y install sun-java6-plugin

#set our java version to java-6-sun as this plays well with burpsuite
update-java-alternatives -s java-6-sun

## Upgrade & Such
apt-get update
apt-get upgrade
apt-get dist-upgrade

## Remove auto-start services
update-rc.d -f exim4 remove
update-rc.d -f tor remove
update-rc.d -f ntop remove
update-rc.d -f p0f remove ## not sure this is necessary
update-rc.d -f pads remove
update-rc.d -f isakmpd remove
update-rc.d -f nessusd remove
update-rc.d -f cups remove
update-rc.d -f samba remove
update-rc.d -f nis remove
update-rc.d -f nfs-common remove

### Manual installs
### ——————————————————————————————
### truecrypt — http://www.howtogeek.com/howto/ubuntu/install-truecrypt-on-ubuntu-edgy/
### – you will need the linux kernel source for this one…
### onesixtyone — http://www.phreedom.org/solar/onesixtyone/
### libdvdcss2 — “sudo /usr/share/doc/libdvdread3/./install-css.sh”

#!/bin/sh
#
#
#
# ::::: HACKUIN’S SIMPLE SCRIPT to Install :::::
# METASPLOIT
#
# Hello, Every one, before installing
# Metasploit, you supposed to install this
# Pakages.
#
#############################################################
#
#
#echo “Installing required pakages”
#sudo apt-get install ruby
#sudo apt-get install ruby libruby rdoc
#sudo apt-get install libyaml-ruby
#sudo apt-get install libzlib-ruby
#sudo apt-get install libopenssl-ruby
#sudo apt-get install libdl-ruby
#sudo apt-get install libreadline-ruby
#sudo apt-get install libiconv-ruby
#sudo apt-get install rubygems
#
#wget http://spool.metasploit.com/releases/framework-3.2.tar.gz
#
#tar xvzf framework-3.2.tar.gz
#
#echo “Finished”
#
#
# If you instant wan to be at MSF CONSOLE
#
# cd framework-3.2/
#./msfconsole
# ENJOY METASPLOIT !!
# I guess you know, what you supposed to do, for running this script,
# If you dont, You simple doesn’t supposed to use METASPLOIT :]
#
#
#
# -Hackuin
################################################################
hope it will be useful!! and keep contributing to the script guys.

Shodan

charan puvvala — Wed, 03 Feb 2010 07:35:07 +0000

Shodan in HINDI means to search for something. SHODAN lets you find servers/ routers/ etc. Most of the data in the index covers web servers at the moment, but there is some data on FTP, Telnet and SSH services as well.

Lets say you want to find servers running the ‘Apache’ web daemon. A simple attempt would be to use:

apache

How about finding only apache servers running version 2.2.3?

apache 2.2.3

You can also narrow down the results using the following search parameters:

country:2-letter country code
hostname:full or partial host name
net:IP range using CIDR notation (ex: 18.7.7.0/24 )
os:operating system (ex: Windows)
port:21, 22, 23 or 80

For example: get all web (port:80) hosts running ‘apache’ in switzerland (country:CH) that also have ‘.ch’ in any of their domain names:

apache country:CH port:80 hostname:.ch

Another example: get all hosts running Microsoft IIS on a Windows 2000 server located in the US:

Microsoft IIS os:”windows 2000″ country:US

Note: To use the ‘country’ or ‘net’ filtering options, you need to be logged in. You can login to SHODAN using your existing Google, Twitter, OpenID etc. accounts, or create a free one on SHODAN.

The above was the description of Shodan from its homepage. I find Shodan very useful for security-pentesters, black hat, gray hat or whatever hat and the security community. Shodan scans the entire internet and indexes the information about the servers on which they are running, the ports open and the operating system. The use of Shodan along with a virus or a script aimed at defacing based on a vulnerability of Apache or IIS could be devastating. The features like geo-location of the servers and the country based filters simply makes it easy for Hacker Groups targeting a country.
I was playing around with Shodan 2 months back and these are a few queries I could come up with. My original Post

http://shodan.surtri.com/?q=cisco-IOS

http://shodan.surtri.com/?q=IIS+6.0

http://www.exploit-db.com/exploits/9718

Vulnerable machines

http://shodan.surtri.com/?q=Xerver

http://shodan.surtri.com/?q=%22Anonymous+access+allowed%22

http://shodan.surtri.com/?q=Server:%20SQ-WEBCAM

Reverse Engineering a 12 year old dll

charan puvvala — Wed, 27 Jan 2010 12:04:11 +0000

Today I was asked to reverse engineer a 12 year old dll from one of our company’s product, for which an iphone app is being developed as well as a web version. Unfortunately the source of the dll was lost and the dll is packed with an annoying bug in it. The iphone developers are directly importing the dll and using it, as the source is not available. The programmer whosoever coded the dll inserted a check, where a command prompt opens up for the user to press enter. I wonder why he has done that. Leaving that aside I was asked to look at the assembly, find the piece of code with this bug and then make a simple jump. An alternative method has already been implemented using a robot which does the entry instead of the user when the program enters this state. But this results in an annoying command prompt popping up and then fading. After a long time had some interesting stuff to do at the workplace. Got to taste IDA Pro .

Should I be blogging??

charan puvvala — Fri, 15 Jan 2010 15:22:07 +0000

I haven’t blogged in a while not that I was a hardcore blogger before, but my friends have been asking what the reason was for me being inactive, dormant for the past one year and the missing posts. Well a lots of things that has happened (one year to be exact by Jan 7th 2010) which changed me. I think its time for me to get over them and start having fun again. Lately I have been working on an exciting idea in my leisure time. I have lot of things to write about and share, so I think this will very well be a active blog soon. I have been experimenting a lot with drupal framework,python,J2ee, Spring Framework, Spring Security and hacking FreeBSD lately on my new shiny Inspiron and Toshiba. But I still miss my old loyal Pentium which served me for 4years and went through all the shit I threw at it. I miss you buddy!! Still I am not sure whether I should be blogging or not, but its fun writing this post and I hope I will continue to do this as long as I enjoy and get time to do it.

>/dev/rand

Drupal Theming – Creating a Drupal theme from scratch – 2

lazybreeze

Welcome to lazybreeze

Lorem ipsum sed aliquam

Consecteteur hendrerit

Aliquam tempus

Categories

Blogroll

Archives