[url=http://devzone.zend.com/article/2143-Zend-Webinar-Wednesdays-Zend-Framework-1.0—An-Overview]Zend-Webinar-Wednesdays-Zend-Framework-1.0—An-Overview[/url]
From the site:
Tunein to learn more about the value Zend Framework can offer your web
project. You will leave having learned:
* Three ways you can use Zend Framework to make your applications more secure
* Four ways Zend Framework promotes software development best practices
* Five ways Zend Framework can free you from reinventing the wheel – so you can focus on your area of innovation
Histograms are just a way to graphically represent data. This can be color data from an image, or data in a text or binary file. Really, histograms are just simple bar graphs.
Read on for the rest of the details.
Without posting everything that Joel and I said in the meeting, it’d pretty difficult for me to convey exactly how histograms can be used for cryptanalysis. Simply put, the histogram shows the number of times each character appears in a file. In a simple letter-substitution scheme, it would be easy to see what letters show up most often in natural language and in the encrypted text. There’s a fairly good chance that you can start replacing letters that have similar frequency. Once you’ve accurately substituted enough letters in the encrypted text to form a few whole words or easily-guessed partial words, it becomes no more difficult to completely decrypt the message than playing a game of hangman that’s already half-solved.
Here are a few histograms I generated for large text files. This is useful for analyzing the frequency that certain characters appear in a file:
As you can see, the charts both top out at the same place. That’s a space character. Spaces are easily the most common character found in written text. All the bars to the left of the tall bar are “control characters” such as carriage returns. Directly to the right of the tall bar are symbols, numbers, upper-case and lower-case letters respectively.
Notice the whole right side of the above graphs are empty, because those are called “high ascii” characters that aren’t commonly found in written text, but are common in binary files.
This is a histogram of a file containing only random data:
And finally, a histogram of an OpenBSD binary executable file (which has a lot of nulls on the far left) throwing off the curve. Nulls are very common on executable files on almost any platform.
Finally, you can take a look at my code. It was a pretty quick hack for personal research reasons, but I decided to bring it up in the meeting today. I made sure to document most of the important logic in the code.
http://churchofpuffy.com:7080/histogram.phps
Thanks to everyone who showed up for this month’s meeting!
[url=http://www.howtoforge.com/php_arrays]Full article here –>[/url]
[i]Stefan Esser is the founder of both the Hardened-PHP Project and the PHP Security Response Team (which he recently left). Federico Biancuzzi discussed with him how the PHP Security Response Team works, why he resigned from it, what features he plans to add to his own hardening patch, the interaction between Apache and PHP, the upcoming “Month of PHP bugs” initiative, and common mistakes in the design of well-known applications such as WordPress.[/i]
[url=http://www.securityfocus.com/columnists/432][b]Full Interview via Security Focus –>[/b][/url]
We did discuss two Firefox Extensions that may be very interesting to Web Application developers out there.
The first one is called [url=http://www.getfirebug.com/]Firebug[/url]. I’m a HUGE fan of the Web Developer tool bar, but seriously; If you haven’t used Firebug, please go get it now. Think of it as a JavaScript / CSS IDE built into the browser.
The second one is more of a complete package with a FireFox extension. If you have ever wanted to generate a testing harness on your user-interface itself, or you have wanted to automate any functional testing; [url=http://www.openqa.org/selenium/]Selenium[/url] may be the tool for you.
Selenium (from OpenQA) comes in two parts, the [url=http://www.openqa.org/selenium-ide/]Selenium-IDE[/url] and the [url=http://www.openqa.org/selenium-core/]Selenium-core[/url]. Grab the IDE and kick the tires, or just [url=http://wiki.openqa.org/display/SIDE/Recording+a+Test]watch the movie[/url]. If you want to see how take your single test and start building an automated suite; go check out Selenium-Core.
Again, I hope you all had a great time! See you again next month!