Expertiza_Wiki - User contributions [en]

CSC/ECE 517 Spring 2014/security audit

2014-05-08T19:43:31Z

Drfarrel: Added Overview section

= Overview =

This wiki documents the more interesting results of a security audit against the main Expertiza server and the latest version of the Expertiza code. The audit made extensive use of Metaspolit, NMap, Wireshark and a few additional online scanners. These are realistic tools, used in the wild by blackhats and whitehats alike.

= Scans =

== Basic server info ==

<pre>
[~]$ nslookup http://expertiza.ncsu.edu
Server: 209.18.47.61
Address: 209.18.47.61#53

Non-authoritative answer:
Name: http://expertiza.ncsu.edu
Address: 198.105.251.210
Name: http://expertiza.ncsu.edu
Address: 66.152.109.110
</pre>

== Nmap scans ==

Collecting open ports.

<pre>
[~]$ nmap -Pn 66.152.109.110

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 7.26 seconds
[~]$ nmap -Pn 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 6.36 seconds
</pre>

Full port scan. No SSH port was shown in the default scan, but it's possible it has been changed to a non-default port.

<pre>
[~]$ nmap -Pn -p1-65535 66.152.109.110

Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-29 17:03 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 128.19 seconds
</pre>

Checking for a firewall (none evident).

<pre>
[~]$ sudo nmap -sA 66.152.109.110
Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:26 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.034s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 6.15 seconds
[~]$ sudo nmap -sA 198.105.251.210
Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-29 16:57 EDT
Nmap scan report for 198.105.251.210
Host is up (0.056s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 7.25 seconds
</pre>

Check versions of running services.

<pre>
[~]$ nmap -sV 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:21 EDT
Nmap scan report for 198.105.251.210
Host is up (0.069s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
443/tcp closed https

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.04 seconds
</pre>

Determine OS.

<pre>
[~]$ sudo nmap -A -Pn 198.105.251.210
[sudo] password for daniel:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:29 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
|_http-methods: No Allow or Public header in OPTIONS response (status code 410)
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Site doesn't have a title (text/html).
443/tcp closed https
Aggressive OS guesses: Linux 3.0 (95%), Linux 2.6.32 (93%), Linux 2.6.38 (93%), OpenWrt White Russian 0.9 (Linux 2.4.30) (90%), OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34) (90%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (90%), HP P2000 G3 NAS device (90%), Linux 2.4.18 (88%), D-Link DIR-615, Encore 3G, or EnGenius ESR-9752 WAP (88%), Linux 2.6.19 - 2.6.32 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 13 hops

TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 101.01 ms 10.0.0.1
2 136.69 ms cpe-075-182-096-001.nc.res.rr.com (75.182.96.1)
3 118.38 ms 66.26.47.101
4 118.44 ms ae19.rlghncpop-rtr1.southeast.rr.com (24.93.64.0)
5 125.87 ms 107.14.19.42
6 118.50 ms ae0.pr1.dca10.tbone.rr.com (107.14.17.200)
7 118.50 ms ix-17-0.tcore2.AEQ-Ashburn.as6453.net (216.6.87.149)
8 146.79 ms if-2-2.tcore1.AEQ-Ashburn.as6453.net (216.6.87.2)
9 139.47 ms if-7-2.tcore1.MLN-Miami.as6453.net (66.198.154.178)
10 146.84 ms 66.110.8.46
11 48.12 ms 10ge-ten1-2.mia-89p-cor-2.peer1.net (216.187.124.129)
12 53.93 ms 216.187.124.60
13 48.89 ms 198.105.251.210

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.55 seconds
</pre>

== Metasploit wmap ==

<pre>
[~]$ msfconsole

=[ metasploit v4.9.2-2014040906 [core:4.9 api:1.0] ]
+ -- --=[ 1299 exploits - 791 auxiliary - 217 post ]
+ -- --=[ 334 payloads - 35 encoders - 8 nops ]

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] === et [ ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://expertiza.ncsu.edu/
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

Id Host Vhost Port Proto # Pages # Forms
-- ---- ----- ---- ----- ------- -------
0 152.14.105.146 152.14.105.146 80 http 0 0
msf > wmap_targets -t http://152.14.105.146/home.html
msf > wmap_targets -t http://152.14.105.146/home
msf > wmap_targets -l
[*] Defined targets
===============

Id Vhost Host Port SSL Path
-- ----- ---- ---- --- ----
0 152.14.105.146 152.14.105.146 80 false /home.html
1 152.14.105.146 152.14.105.146 80 false /home
msf > wmap_run -t
[*] Testing target:
[*] Site: 152.14.105.146 (152.14.105.146)
[*] Port: 80 SSL: false
============================================================
[*] Testing started. 2014-04-21 02:33:20 -0400
[*] Loading wmap modules...
msf > wmap_run
[*] 39 wmap enabled modules loaded.
<snip>
[*] Done.
msf > wmap_vulns -l
msf > # No vuls discovered
</pre>

== Metasploit dir_listing ==
<pre>
msf > use auxiliary/scanner/http/dir_listing
msf auxiliary(dir_listing) > show options

Module options (auxiliary/scanner/http/dir_listing):

Name Current Setting Required Description
---- --------------- -------- -----------
PATH / yes The path to identify directoy listing
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

msf auxiliary(dir_listing) > set RHOSTS 66.152.109.110
RHOSTS => 66.152.109.110
msf auxiliary(dir_listing) > run

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
</pre>

== Metasploit WebDAV IIS6 Unicode vulnerability ==
<pre>
msf > use auxiliary/scanner/http/dir_webdav_unicode_bypass
msf auxiliary(dir_webdav_unicode_bypass) > set RHOSTS 66.152.109.110
RHOSTS => 66.152.109.110
msf auxiliary(dir_webdav_unicode_bypass) > run

[*] Using first 256 bytes of the response as 404 string
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
</pre>

= Results and Future Work =

This security audit addressed the HTTP server software and configuration, SQL injection attacks, XSS attacks and privilege escalation attacks via poorly coded checks. The major vulnerability that was detected and exploited was a result of the site's use of HTTP (cleartext) for all communication. The attacker was able to use Wireshark to quickly and easily intercept his own password. Perhaps more importantly, this audit should establish some confidence in the setup of the server used to host Expertiza. It withstood serious attacks from major tools like Metaspolit, which are very realistic examples of the types of automated scanning attacks the server is likely to face in practice. The site's use of cookies seems to be managed by Rails properly, preventing XSS attacks. The attacker was unable to find SQL injection attacks using sophisticated automated tools, but did note some sections of the codebase that don't follow SQL-related best practices. Two areas that need future study are the site's manual SQL code and privilege-related coding errors that could allow escalation attacks. The server itself and the site's protection against XSS attacks should be considered fairly robust at this time.

CSC/ECE 517 Spring 2014/security audit

2014-05-08T19:33:25Z

Drfarrel: /* Overview */ Added notes about results and future work

= Results and Future Work =

This security audit addressed the HTTP server software and configuration, SQL injection attacks, XSS attacks and privilege escalation attacks via poorly coded checks. The major vulnerability that was detected and exploited was a result of the site's use of HTTP (cleartext) for all communication. The attacker was able to use Wireshark to quickly and easily intercept his own password. Perhaps more importantly, this audit should establish some confidence in the setup of the server used to host Expertiza. It withstood serious attacks from major tools like Metaspolit, which are very realistic examples of the types of automated scanning attacks the server is likely to face in practice. The site's use of cookies seems to be managed by Rails properly, preventing XSS attacks. The attacker was unable to find SQL injection attacks using sophisticated automated tools, but did note some sections of the codebase that don't follow SQL-related best practices. Two areas that need future study are the site's manual SQL code and privilege-related coding errors that could allow escalation attacks. The server itself and the site's protection against XSS attacks should be considered fairly robust at this time.

= Scans =

== Basic server info ==

<pre>
[~]$ nslookup http://expertiza.ncsu.edu
Server: 209.18.47.61
Address: 209.18.47.61#53

Non-authoritative answer:
Name: http://expertiza.ncsu.edu
Address: 198.105.251.210
Name: http://expertiza.ncsu.edu
Address: 66.152.109.110
</pre>

== Nmap scans ==

Collecting open ports.

<pre>
[~]$ nmap -Pn 66.152.109.110

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 7.26 seconds
[~]$ nmap -Pn 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 6.36 seconds
</pre>

Full port scan. No SSH port was shown in the default scan, but it's possible it has been changed to a non-default port.

<pre>
[~]$ nmap -Pn -p1-65535 66.152.109.110

Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-29 17:03 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 128.19 seconds
</pre>

Checking for a firewall (none evident).

<pre>
[~]$ sudo nmap -sA 66.152.109.110
Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:26 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.034s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 6.15 seconds
[~]$ sudo nmap -sA 198.105.251.210
Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-29 16:57 EDT
Nmap scan report for 198.105.251.210
Host is up (0.056s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 7.25 seconds
</pre>

Check versions of running services.

<pre>
[~]$ nmap -sV 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:21 EDT
Nmap scan report for 198.105.251.210
Host is up (0.069s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
443/tcp closed https

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.04 seconds
</pre>

Determine OS.

<pre>
[~]$ sudo nmap -A -Pn 198.105.251.210
[sudo] password for daniel:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:29 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
|_http-methods: No Allow or Public header in OPTIONS response (status code 410)
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Site doesn't have a title (text/html).
443/tcp closed https
Aggressive OS guesses: Linux 3.0 (95%), Linux 2.6.32 (93%), Linux 2.6.38 (93%), OpenWrt White Russian 0.9 (Linux 2.4.30) (90%), OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34) (90%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (90%), HP P2000 G3 NAS device (90%), Linux 2.4.18 (88%), D-Link DIR-615, Encore 3G, or EnGenius ESR-9752 WAP (88%), Linux 2.6.19 - 2.6.32 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 13 hops

TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 101.01 ms 10.0.0.1
2 136.69 ms cpe-075-182-096-001.nc.res.rr.com (75.182.96.1)
3 118.38 ms 66.26.47.101
4 118.44 ms ae19.rlghncpop-rtr1.southeast.rr.com (24.93.64.0)
5 125.87 ms 107.14.19.42
6 118.50 ms ae0.pr1.dca10.tbone.rr.com (107.14.17.200)
7 118.50 ms ix-17-0.tcore2.AEQ-Ashburn.as6453.net (216.6.87.149)
8 146.79 ms if-2-2.tcore1.AEQ-Ashburn.as6453.net (216.6.87.2)
9 139.47 ms if-7-2.tcore1.MLN-Miami.as6453.net (66.198.154.178)
10 146.84 ms 66.110.8.46
11 48.12 ms 10ge-ten1-2.mia-89p-cor-2.peer1.net (216.187.124.129)
12 53.93 ms 216.187.124.60
13 48.89 ms 198.105.251.210

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.55 seconds
</pre>

== Metasploit wmap ==

<pre>
[~]$ msfconsole

=[ metasploit v4.9.2-2014040906 [core:4.9 api:1.0] ]
+ -- --=[ 1299 exploits - 791 auxiliary - 217 post ]
+ -- --=[ 334 payloads - 35 encoders - 8 nops ]

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] === et [ ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://expertiza.ncsu.edu/
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

Id Host Vhost Port Proto # Pages # Forms
-- ---- ----- ---- ----- ------- -------
0 152.14.105.146 152.14.105.146 80 http 0 0
msf > wmap_targets -t http://152.14.105.146/home.html
msf > wmap_targets -t http://152.14.105.146/home
msf > wmap_targets -l
[*] Defined targets
===============

Id Vhost Host Port SSL Path
-- ----- ---- ---- --- ----
0 152.14.105.146 152.14.105.146 80 false /home.html
1 152.14.105.146 152.14.105.146 80 false /home
msf > wmap_run -t
[*] Testing target:
[*] Site: 152.14.105.146 (152.14.105.146)
[*] Port: 80 SSL: false
============================================================
[*] Testing started. 2014-04-21 02:33:20 -0400
[*] Loading wmap modules...
msf > wmap_run
[*] 39 wmap enabled modules loaded.
<snip>
[*] Done.
msf > wmap_vulns -l
msf > # No vuls discovered
</pre>

== Metasploit dir_listing ==
<pre>
msf > use auxiliary/scanner/http/dir_listing
msf auxiliary(dir_listing) > show options

Module options (auxiliary/scanner/http/dir_listing):

Name Current Setting Required Description
---- --------------- -------- -----------
PATH / yes The path to identify directoy listing
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

msf auxiliary(dir_listing) > set RHOSTS 66.152.109.110
RHOSTS => 66.152.109.110
msf auxiliary(dir_listing) > run

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
</pre>

== Metasploit WebDAV IIS6 Unicode vulnerability ==
<pre>
msf > use auxiliary/scanner/http/dir_webdav_unicode_bypass
msf auxiliary(dir_webdav_unicode_bypass) > set RHOSTS 66.152.109.110
RHOSTS => 66.152.109.110
msf auxiliary(dir_webdav_unicode_bypass) > run

[*] Using first 256 bytes of the response as 404 string
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
</pre>

CSC/ECE 517 Spring 2014/security audit

2014-04-29T21:20:09Z

Drfarrel: /* Metasploit WebDAV IIS6 Unicode vulnerability */

= Overview =

This page will document a security audit of Expertiza.

= Scans =

== Basic server info ==

<pre>
[~]$ nslookup http://expertiza.ncsu.edu
Server: 209.18.47.61
Address: 209.18.47.61#53

Non-authoritative answer:
Name: http://expertiza.ncsu.edu
Address: 198.105.251.210
Name: http://expertiza.ncsu.edu
Address: 66.152.109.110
</pre>

== Nmap scans ==

Collecting open ports.

<pre>
[~]$ nmap -Pn 66.152.109.110

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 7.26 seconds
[~]$ nmap -Pn 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 6.36 seconds
</pre>

Full port scan. No SSH port was shown in the default scan, but it's possible it has been changed to a non-default port.

<pre>
[~]$ nmap -Pn -p1-65535 66.152.109.110

Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-29 17:03 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 128.19 seconds
</pre>

Checking for a firewall (none evident).

<pre>
[~]$ sudo nmap -sA 66.152.109.110
Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:26 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.034s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 6.15 seconds
[~]$ sudo nmap -sA 198.105.251.210
Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-29 16:57 EDT
Nmap scan report for 198.105.251.210
Host is up (0.056s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 7.25 seconds
</pre>

Check versions of running services.

<pre>
[~]$ nmap -sV 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:21 EDT
Nmap scan report for 198.105.251.210
Host is up (0.069s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
443/tcp closed https

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.04 seconds
</pre>

Determine OS.

<pre>
[~]$ sudo nmap -A -Pn 198.105.251.210
[sudo] password for daniel:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:29 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
|_http-methods: No Allow or Public header in OPTIONS response (status code 410)
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Site doesn't have a title (text/html).
443/tcp closed https
Aggressive OS guesses: Linux 3.0 (95%), Linux 2.6.32 (93%), Linux 2.6.38 (93%), OpenWrt White Russian 0.9 (Linux 2.4.30) (90%), OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34) (90%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (90%), HP P2000 G3 NAS device (90%), Linux 2.4.18 (88%), D-Link DIR-615, Encore 3G, or EnGenius ESR-9752 WAP (88%), Linux 2.6.19 - 2.6.32 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 13 hops

TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 101.01 ms 10.0.0.1
2 136.69 ms cpe-075-182-096-001.nc.res.rr.com (75.182.96.1)
3 118.38 ms 66.26.47.101
4 118.44 ms ae19.rlghncpop-rtr1.southeast.rr.com (24.93.64.0)
5 125.87 ms 107.14.19.42
6 118.50 ms ae0.pr1.dca10.tbone.rr.com (107.14.17.200)
7 118.50 ms ix-17-0.tcore2.AEQ-Ashburn.as6453.net (216.6.87.149)
8 146.79 ms if-2-2.tcore1.AEQ-Ashburn.as6453.net (216.6.87.2)
9 139.47 ms if-7-2.tcore1.MLN-Miami.as6453.net (66.198.154.178)
10 146.84 ms 66.110.8.46
11 48.12 ms 10ge-ten1-2.mia-89p-cor-2.peer1.net (216.187.124.129)
12 53.93 ms 216.187.124.60
13 48.89 ms 198.105.251.210

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.55 seconds
</pre>

== Metasploit wmap ==

<pre>
[~]$ msfconsole

=[ metasploit v4.9.2-2014040906 [core:4.9 api:1.0] ]
+ -- --=[ 1299 exploits - 791 auxiliary - 217 post ]
+ -- --=[ 334 payloads - 35 encoders - 8 nops ]

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] === et [ ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://expertiza.ncsu.edu/
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

Id Host Vhost Port Proto # Pages # Forms
-- ---- ----- ---- ----- ------- -------
0 152.14.105.146 152.14.105.146 80 http 0 0
msf > wmap_targets -t http://152.14.105.146/home.html
msf > wmap_targets -t http://152.14.105.146/home
msf > wmap_targets -l
[*] Defined targets
===============

Id Vhost Host Port SSL Path
-- ----- ---- ---- --- ----
0 152.14.105.146 152.14.105.146 80 false /home.html
1 152.14.105.146 152.14.105.146 80 false /home
msf > wmap_run -t
[*] Testing target:
[*] Site: 152.14.105.146 (152.14.105.146)
[*] Port: 80 SSL: false
============================================================
[*] Testing started. 2014-04-21 02:33:20 -0400
[*] Loading wmap modules...
msf > wmap_run
[*] 39 wmap enabled modules loaded.
<snip>
[*] Done.
msf > wmap_vulns -l
msf > # No vuls discovered
</pre>

== Metasploit dir_listing ==
<pre>
msf > use auxiliary/scanner/http/dir_listing
msf auxiliary(dir_listing) > show options

Module options (auxiliary/scanner/http/dir_listing):

Name Current Setting Required Description
---- --------------- -------- -----------
PATH / yes The path to identify directoy listing
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

msf auxiliary(dir_listing) > set RHOSTS 66.152.109.110
RHOSTS => 66.152.109.110
msf auxiliary(dir_listing) > run

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
</pre>

== Metasploit WebDAV IIS6 Unicode vulnerability ==
<pre>
msf > use auxiliary/scanner/http/dir_webdav_unicode_bypass
msf auxiliary(dir_webdav_unicode_bypass) > set RHOSTS 66.152.109.110
RHOSTS => 66.152.109.110
msf auxiliary(dir_webdav_unicode_bypass) > run

[*] Using first 256 bytes of the response as 404 string
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
</pre>

CSC/ECE 517 Spring 2014/security audit

2014-04-29T21:17:34Z

Drfarrel:

= Overview =

This page will document a security audit of Expertiza.

= Scans =

== Basic server info ==

<pre>
[~]$ nslookup http://expertiza.ncsu.edu
Server: 209.18.47.61
Address: 209.18.47.61#53

Non-authoritative answer:
Name: http://expertiza.ncsu.edu
Address: 198.105.251.210
Name: http://expertiza.ncsu.edu
Address: 66.152.109.110
</pre>

== Nmap scans ==

Collecting open ports.

<pre>
[~]$ nmap -Pn 66.152.109.110

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 7.26 seconds
[~]$ nmap -Pn 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 6.36 seconds
</pre>

Full port scan. No SSH port was shown in the default scan, but it's possible it has been changed to a non-default port.

<pre>
[~]$ nmap -Pn -p1-65535 66.152.109.110

Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-29 17:03 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 65533 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 128.19 seconds
</pre>

Checking for a firewall (none evident).

<pre>
[~]$ sudo nmap -sA 66.152.109.110
Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:26 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.034s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 6.15 seconds
[~]$ sudo nmap -sA 198.105.251.210
Starting Nmap 6.45 ( http://nmap.org ) at 2014-04-29 16:57 EDT
Nmap scan report for 198.105.251.210
Host is up (0.056s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 7.25 seconds
</pre>

Check versions of running services.

<pre>
[~]$ nmap -sV 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:21 EDT
Nmap scan report for 198.105.251.210
Host is up (0.069s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
443/tcp closed https

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.04 seconds
</pre>

Determine OS.

<pre>
[~]$ sudo nmap -A -Pn 198.105.251.210
[sudo] password for daniel:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:29 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
|_http-methods: No Allow or Public header in OPTIONS response (status code 410)
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Site doesn't have a title (text/html).
443/tcp closed https
Aggressive OS guesses: Linux 3.0 (95%), Linux 2.6.32 (93%), Linux 2.6.38 (93%), OpenWrt White Russian 0.9 (Linux 2.4.30) (90%), OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34) (90%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (90%), HP P2000 G3 NAS device (90%), Linux 2.4.18 (88%), D-Link DIR-615, Encore 3G, or EnGenius ESR-9752 WAP (88%), Linux 2.6.19 - 2.6.32 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 13 hops

TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 101.01 ms 10.0.0.1
2 136.69 ms cpe-075-182-096-001.nc.res.rr.com (75.182.96.1)
3 118.38 ms 66.26.47.101
4 118.44 ms ae19.rlghncpop-rtr1.southeast.rr.com (24.93.64.0)
5 125.87 ms 107.14.19.42
6 118.50 ms ae0.pr1.dca10.tbone.rr.com (107.14.17.200)
7 118.50 ms ix-17-0.tcore2.AEQ-Ashburn.as6453.net (216.6.87.149)
8 146.79 ms if-2-2.tcore1.AEQ-Ashburn.as6453.net (216.6.87.2)
9 139.47 ms if-7-2.tcore1.MLN-Miami.as6453.net (66.198.154.178)
10 146.84 ms 66.110.8.46
11 48.12 ms 10ge-ten1-2.mia-89p-cor-2.peer1.net (216.187.124.129)
12 53.93 ms 216.187.124.60
13 48.89 ms 198.105.251.210

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.55 seconds
</pre>

== Metasploit wmap ==

<pre>
[~]$ msfconsole

=[ metasploit v4.9.2-2014040906 [core:4.9 api:1.0] ]
+ -- --=[ 1299 exploits - 791 auxiliary - 217 post ]
+ -- --=[ 334 payloads - 35 encoders - 8 nops ]

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] === et [ ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://expertiza.ncsu.edu/
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

Id Host Vhost Port Proto # Pages # Forms
-- ---- ----- ---- ----- ------- -------
0 152.14.105.146 152.14.105.146 80 http 0 0
msf > wmap_targets -t http://152.14.105.146/home.html
msf > wmap_targets -t http://152.14.105.146/home
msf > wmap_targets -l
[*] Defined targets
===============

Id Vhost Host Port SSL Path
-- ----- ---- ---- --- ----
0 152.14.105.146 152.14.105.146 80 false /home.html
1 152.14.105.146 152.14.105.146 80 false /home
msf > wmap_run -t
[*] Testing target:
[*] Site: 152.14.105.146 (152.14.105.146)
[*] Port: 80 SSL: false
============================================================
[*] Testing started. 2014-04-21 02:33:20 -0400
[*] Loading wmap modules...
msf > wmap_run
[*] 39 wmap enabled modules loaded.
<snip>
[*] Done.
msf > wmap_vulns -l
msf > # No vuls discovered
</pre>

== Metasploit dir_listing ==
<pre>
msf > use auxiliary/scanner/http/dir_listing
msf auxiliary(dir_listing) > show options

Module options (auxiliary/scanner/http/dir_listing):

Name Current Setting Required Description
---- --------------- -------- -----------
PATH / yes The path to identify directoy listing
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

msf auxiliary(dir_listing) > set RHOSTS 66.152.109.110
RHOSTS => 66.152.109.110
msf auxiliary(dir_listing) > run

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
</pre>

== Metasploit WebDAV IIS6 Unicode vulnerability ==
<pre>
msf auxiliary(dir_webdav_unicode_bypass) > run

[*] Using first 256 bytes of the response as 404 string
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
</pre>

CSC/ECE 517 Spring 2014/security audit

2014-04-21T07:31:53Z

Drfarrel: /* Nmap scans */ Added many more scan results

= Overview =

This page will document a security audit of Expertiza.

= Scans =

== Basic server info ==

<pre>
[~]$ nslookup http://expertiza.ncsu.edu
Server: 209.18.47.61
Address: 209.18.47.61#53

Non-authoritative answer:
Name: http://expertiza.ncsu.edu
Address: 198.105.251.210
Name: http://expertiza.ncsu.edu
Address: 66.152.109.110
</pre>

== Nmap scans ==

Collecting open ports.

<pre>
[~]$ nmap -Pn 66.152.109.110

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.038s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 7.26 seconds
[~]$ nmap -Pn 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:18 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 6.36 seconds
</pre>

Checking for a firewall (none evident).

<pre>
[~]$ sudo nmap -sA 66.152.109.110
Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:26 EDT
Nmap scan report for 66-152-109-110.tvc-ip.com (66.152.109.110)
Host is up (0.034s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
80/tcp unfiltered http
443/tcp unfiltered https

Nmap done: 1 IP address (1 host up) scanned in 6.15 seconds
</pre>

Check versions of running services.

<pre>
[~]$ nmap -sV 198.105.251.210

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:21 EDT
Nmap scan report for 198.105.251.210
Host is up (0.069s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
443/tcp closed https

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.04 seconds
</pre>

Determine OS.

<pre>
[~]$ sudo nmap -A -Pn 198.105.251.210
[sudo] password for daniel:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-21 03:29 EDT
Nmap scan report for 198.105.251.210
Host is up (0.058s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http nginx
|_http-methods: No Allow or Public header in OPTIONS response (status code 410)
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Site doesn't have a title (text/html).
443/tcp closed https
Aggressive OS guesses: Linux 3.0 (95%), Linux 2.6.32 (93%), Linux 2.6.38 (93%), OpenWrt White Russian 0.9 (Linux 2.4.30) (90%), OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34) (90%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (90%), HP P2000 G3 NAS device (90%), Linux 2.4.18 (88%), D-Link DIR-615, Encore 3G, or EnGenius ESR-9752 WAP (88%), Linux 2.6.19 - 2.6.32 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 13 hops

TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 101.01 ms 10.0.0.1
2 136.69 ms cpe-075-182-096-001.nc.res.rr.com (75.182.96.1)
3 118.38 ms 66.26.47.101
4 118.44 ms ae19.rlghncpop-rtr1.southeast.rr.com (24.93.64.0)
5 125.87 ms 107.14.19.42
6 118.50 ms ae0.pr1.dca10.tbone.rr.com (107.14.17.200)
7 118.50 ms ix-17-0.tcore2.AEQ-Ashburn.as6453.net (216.6.87.149)
8 146.79 ms if-2-2.tcore1.AEQ-Ashburn.as6453.net (216.6.87.2)
9 139.47 ms if-7-2.tcore1.MLN-Miami.as6453.net (66.198.154.178)
10 146.84 ms 66.110.8.46
11 48.12 ms 10ge-ten1-2.mia-89p-cor-2.peer1.net (216.187.124.129)
12 53.93 ms 216.187.124.60
13 48.89 ms 198.105.251.210

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.55 seconds
</pre>

== Metasploit wmap ==

<pre>
[~]$ msfconsole

=[ metasploit v4.9.2-2014040906 [core:4.9 api:1.0] ]
+ -- --=[ 1299 exploits - 791 auxiliary - 217 post ]
+ -- --=[ 334 payloads - 35 encoders - 8 nops ]

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] === et [ ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://expertiza.ncsu.edu/
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

Id Host Vhost Port Proto # Pages # Forms
-- ---- ----- ---- ----- ------- -------
0 152.14.105.146 152.14.105.146 80 http 0 0
msf > wmap_targets -t http://152.14.105.146/home.html
msf > wmap_targets -t http://152.14.105.146/home
msf > wmap_targets -l
[*] Defined targets
===============

Id Vhost Host Port SSL Path
-- ----- ---- ---- --- ----
0 152.14.105.146 152.14.105.146 80 false /home.html
1 152.14.105.146 152.14.105.146 80 false /home
msf > wmap_run -t
[*] Testing target:
[*] Site: 152.14.105.146 (152.14.105.146)
[*] Port: 80 SSL: false
============================================================
[*] Testing started. 2014-04-21 02:33:20 -0400
[*] Loading wmap modules...
msf > wmap_run
[*] 39 wmap enabled modules loaded.
<snip>
[*] Done.
msf > wmap_vulns -l
msf > # No vuls discovered
</pre>

CSC/ECE 517 Spring 2014/security audit

2014-04-21T07:20:30Z

Drfarrel: Added basic nmap scans, better formatting

CSC/ECE 517 Spring 2014/security audit

2014-04-21T07:19:34Z

Drfarrel: Added nslookup results

= Overview =

This page will document a security audit of Expertiza.

= Scans =

== Basic server info ==

[~]$ nslookup http://expertiza.ncsu.edu
Server: 209.18.47.61
Address: 209.18.47.61#53

Non-authoritative answer:
Name: http://expertiza.ncsu.edu
Address: 198.105.251.210
Name: http://expertiza.ncsu.edu
Address: 66.152.109.110

== Metasploit wmap ==

<pre>
[~]$ msfconsole

=[ metasploit v4.9.2-2014040906 [core:4.9 api:1.0] ]
+ -- --=[ 1299 exploits - 791 auxiliary - 217 post ]
+ -- --=[ 334 payloads - 35 encoders - 8 nops ]

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] === et [ ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://expertiza.ncsu.edu/
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

Id Host Vhost Port Proto # Pages # Forms
-- ---- ----- ---- ----- ------- -------
0 152.14.105.146 152.14.105.146 80 http 0 0
msf > wmap_targets -t http://152.14.105.146/home.html
msf > wmap_targets -t http://152.14.105.146/home
msf > wmap_targets -l
[*] Defined targets
===============

Id Vhost Host Port SSL Path
-- ----- ---- ---- --- ----
0 152.14.105.146 152.14.105.146 80 false /home.html
1 152.14.105.146 152.14.105.146 80 false /home
msf > wmap_run -t
[*] Testing target:
[*] Site: 152.14.105.146 (152.14.105.146)
[*] Port: 80 SSL: false
============================================================
[*] Testing started. 2014-04-21 02:33:20 -0400
[*] Loading wmap modules...
msf > wmap_run
[*] 39 wmap enabled modules loaded.
<snip>
[*] Done.
msf > wmap_vulns -l
msf > # No vuls discovered
</pre>

CSC/ECE 517 Spring 2014/security audit

2014-04-21T06:53:35Z

Drfarrel: Added basic wmap scan data

== Overview ==

This page will document a security audit of Expertiza.

== Metasploit wmap ==

<pre>
[~]$ msfconsole

=[ metasploit v4.9.2-2014040906 [core:4.9 api:1.0] ]
+ -- --=[ 1299 exploits - 791 auxiliary - 217 post ]
+ -- --=[ 334 payloads - 35 encoders - 8 nops ]

msf > load wmap

.-.-.-..-.-.-..---..---.
| | | || | | || | || |-'
`-----'`-'-'-'`-^-'`-'
[WMAP 1.5.1] === et [ ] metasploit.com 2012
[*] Successfully loaded plugin: wmap
msf > wmap_sites -a http://expertiza.ncsu.edu/
[*] Site created.
msf > wmap_sites -l
[*] Available sites
===============

Id Host Vhost Port Proto # Pages # Forms
-- ---- ----- ---- ----- ------- -------
0 152.14.105.146 152.14.105.146 80 http 0 0
msf > wmap_targets -t http://152.14.105.146/home.html
msf > wmap_targets -t http://152.14.105.146/home
msf > wmap_targets -l
[*] Defined targets
===============

Id Vhost Host Port SSL Path
-- ----- ---- ---- --- ----
0 152.14.105.146 152.14.105.146 80 false /home.html
1 152.14.105.146 152.14.105.146 80 false /home
msf > wmap_run -t
[*] Testing target:
[*] Site: 152.14.105.146 (152.14.105.146)
[*] Port: 80 SSL: false
============================================================
[*] Testing started. 2014-04-21 02:33:20 -0400
[*] Loading wmap modules...
msf > wmap_run
[*] 39 wmap enabled modules loaded.
<snip>
[*] Done.
msf > wmap_vulns -l
msf > # No vuls discovered
</pre>

CSC/ECE 517 Spring 2014

2014-04-21T06:48:07Z

Drfarrel: Added link to wiki that will document my security audit project

*[[CSC/ECE_517_Fall_2012/example_page]]
*[[CSC/ECE 517 Spring 2014/ch1a 1a rt]]
*[[CSC/ECE 517 Spring 2014/ch1a 1e rm]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1h jg ]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1b np]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1f mj]]
*[[CSC/ECE 517 Spring 2014/ch1a 1d mm]]
*[[CSC/ECE 517 Spring 2014/ch1a 1c yj]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1l m]]
*[[CSC/ECE 517 Spring 2014/ch1 1w1m bm]]
*[[CSC/ECE 517 Spring 2014/ch1a 1p fy]]
*[[CSC/ECE 517 Spring 2014/oss E1401 lmn]]
*[[CSC/ECE 517 Spring 2014/oss E1402 mmb]]
*[[CSC/ECE 517 Spring 2014/oss E1404 mnp]]
*[[CSC/ECE 517 Spring 2014/oss E1405 irw]]
*[[CSC/ECE 517 Spring 2014/oss E1406 st]]
*[[CSC/ECE 517 Spring 2014/oss S1402 jyy]]
*[[CSC/ECE 517 Spring 2014/oss E1413 mnp]]
*[[CSC/ECE 517 Spring 2014/oss E1414 st]]
*[[CSC/ECE 517 Spring 2014/security_audit]]

CSC/ECE 517 Spring 2014/oss E1405 irw

2014-04-01T03:14:04Z

Drfarrel: /* Objective 2: Add additional tests */ Added note about better tests vs more tests

'''Improve tests & investigate regex warnings for student_task '''

== Introduction ==

=== Background ===

This model allows for much of the functionality the student requires to interact effectively with expertiza. Here a student is able to sign up for topics, form teams, submit assignments, review other students' work, and check his or her own scores.

== Work accomplished ==

=== Objective 1: Fix existing tests ===

Initially, there were 26 tests with errors. Many tests required functionality or fixtures that were likely changed by people working on expertiza over the years.

==== Issues ====

Many fixtures required to correct the tests were missing, and had to be added or created. Additionally, several tests were referencing deleted elements of fixture files which were added in order to correct test functionality. Finally, there were certain elements of the code itself in the controller file which had to be corrected in order for tests to run.

==== Result ====

All tests now pass without errors, failures or deprecation warnings:

.........................

Finished in 1.235192136 seconds.

25 tests, 26 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications

=== Objective 2: Add additional tests ===

After digging into the code, it became clear that what's needed isn't more tests, but better tests. The existing tests were very obtuse and frequently broken. They are now much more maintainable.

== Future work ==
There is no current unit test file for student_task, which means there aren't unit tests. Such tests should be added in the future in order to ensure proper functionality.

With regard to student_task_controller_test.rb, it really should be refactored more than expanded. It has reasonable test coverage, what it needs is easier to understand, more elegant tests.

CSC/ECE 517 Spring 2014/oss E1405 irw

2014-04-01T03:10:43Z

Drfarrel: Added note about refactoring existing tests, added test passing details

'''Improve tests & investigate regex warnings for student_task '''

== Introduction ==

=== Background ===

This model allows for much of the functionality the student requires to interact effectively with expertiza. Here a student is able to sign up for topics, form teams, submit assignments, review other students' work, and check his or her own scores.

== Work accomplished ==

=== Objective 1: Fix existing tests ===

Initially, there were 26 tests with errors. Many tests required functionality or fixtures that were likely changed by people working on expertiza over the years.

==== Issues ====

Many fixtures required to correct the tests were missing, and had to be added or created. Additionally, several tests were referencing deleted elements of fixture files which were added in order to correct test functionality. Finally, there were certain elements of the code itself in the controller file which had to be corrected in order for tests to run.

==== Result ====

All tests now pass without errors, failures or deprecation warnings:

.........................

Finished in 1.235192136 seconds.

25 tests, 26 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications

=== Objective 2: Add additional tests ===

== Future work ==
There is no current unit test file for student_task, which means there aren't unit tests. Such tests should be added in the future in order to ensure proper functionality.

With regard to student_task_controller_test.rb, it really should be refactored more than expanded. It has reasonable test coverage, what it needs is easier to understand, more elegant tests.

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-24T04:28:22Z

Drfarrel: /* See Also */ Added some links to resources I found helpful

= Design Patterns Involving Closures =

== Background ==
=== Explanation of Closures ===

====Blocks in Ruby====
A block is a segment of code that can be used as an argument for a method[http://www.robertsosinski.com/2008/12/21/understanding-ruby-blocks-procs-and-lambdas/]. These segments of code may have their own initialized variables only able to be referenced locally in the block, much like in a method. Single line blocks are commonly encapsulated in curly braces after a method call, and multi-line blocks are between "do" and "end" statements. A block's code is not executed when it is encountered, but rather after all instances of the yield statement within the method.

<code>
=begin
Ruby Code blocks are chunks of code between braces or
between do- end that you can associate with method invocations
=end
def call_block
puts 'Start of method'
# you can call the block using the yield keyword
yield
yield
puts 'End of method'
end
# Code blocks may appear only in the source adjacent to a method call
call_block {puts 'In the block'}
</code>
The above code outputs the following:
<code>
>ruby p022codeblock.rb
Start of method
In the block
In the block
End of method
>Exit code: 0
</code>

====So what's a closure?====
Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called.[https://www.princeton.edu/~achaney/tmve/wiki100k/docs/Closure_(computer_science).html] A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

=== Decorators ===

[https://wiki.python.org/moin/PythonDecorators Decorators] are an interesting and powerful language feature that can be implemented elegantly with closures.

<code>
#!/usr/bin/env python

def decorate(func):
def decorated_func():
print "About to call func"
func()
print "Back from calling func"
return decorated_func

@decorate
def func_to_decorate():
print "In func_to_decorate"

func_to_decorate()
</code>

<code>
[~517/wiki]$ chmod ug+x decorator.py
[~517/wiki]$ ./decorator.py
About to call func
In func_to_decorate
Back from calling func
</code>

=== Command Pattern===
The [https://en.wikipedia.org/wiki/Command_pattern Command Pattern] can be implemented using proc objects, which are the closure of an object.

In the Command Pattern, commands for objects to be implemented are queued and can be executed at any time. Arguments are considered passed when the method is called.

<code>
count = 0

commands = []
(1..10).each do |i|
commands << proc { count +=i }
end

puts "Count is initially #{count}"
commands.each { |cmd| cmd.call }
puts "Performed all commands. count is #{count}"
</code>

===Strategy Pattern===
The [http://www.codeproject.com/Articles/52807/Design-Patterns-Part-1-The-Strategy-Pattern Strategy Pattern] allows an algorithms behavior to be determined at runtime. It describes the definition of a family of interchangeable algorithm classes whose functionality is different for identically named methods.

<code>
class Fighter
def initialize(&fighting_behavior)
@finish_move = fighting_behavior
end

def finish_opponent
@finish_move.call
end
end

boxer = Fighter.new { puts 'Left hook to the body!' }
boxer.finish_opponent #=> Left hook to the body!

mortal_kombat_warrior = Fighter.new { puts 'Blast him with a lighting bolt' }
mortal_kombat_warrior.finish_opponent #=> Blast him with a lighting bolt

mma = Fighter.new { puts 'Put you to sleep, Good Night!' }
mma.finish_opponent #=> Put you to sleep, Good Night!

lion = Fighter.new { puts 'Bites your head off' }
lion.finish_opponent #=> Bites your head off!
</code>

=== Function Factory ===

A version of the classic [http://python-3-patterns-idioms-test.readthedocs.org/en/latest/Factory.html Factory Pattern], but for use with functions, can be implemented easily with the help of closures.

<code>
#!/usr/bin/env python

def status():
"""Returns the status of the system. Just a stub, for demo.

:returns: Always returns True. Just a demo.

"""
return True

def messenger_factory(messenger_type):
"""Builds very lightweight messenger functions.

:param messenger_type: Currently supported types are human and wire.
:type messenger_type: string
:returns: Function that creates messages of the required format.

"""
version = "Version 1.0"
dynamic_status = status
if messenger_type == "human":
def human_messenger():
"""Messenger with a format that is human-readable.

:returns: Human-readable string of status and version.

"""
return "Status is {}. Version is {}".format(dynamic_status(), version)
return human_messenger
elif messenger_type == "wire":
def wire_messenger():
"""Messenger with format that is ready to be put on the wire.

:returns: JSON (dict) message with status and version.

"""
return {"version": version, "status": dynamic_status()}
return wire_messenger
else:
raise ValueError("Unexpected messenger type: {}".format(messenger_type))

human_messenger = messenger_factory("human")
wire_messenger = messenger_factory("wire")

print "Human: {}".format(human_messenger())
print "Wire: {}".format(wire_messenger())
</code>

<code>
[~517/wiki]$ chmod ug+x func_factory.py
[~517/wiki]$ ./func_factory.py
Human: Status is True. Version is Version 1.0
Wire: {'status': True, 'version': 'Version 1.0'}
</code>

== See Also ==
* [http://www.robertsosinski.com/2008/12/21/understanding-ruby-blocks-procs-and-lambdas/ Understanding Ruby Blocks, Procs and Lambdas]
* [https://en.wikipedia.org/wiki/Closure_(computer_programming) Closure (Computer Programming)]
* [https://en.wikipedia.org/wiki/Software_design_pattern Software Design Patterns]
* [http://joeybutler.net/ruby/what-is-a-closure What is a Closure?]

== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-24T04:23:17Z

Drfarrel: /* Blocks in Ruby */ Added citation for block def

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-24T04:22:09Z

Drfarrel: /* So what's a closure? */ Cited definition of closure

= Design Patterns Involving Closures =

== Background ==
=== Explanation of Closures ===

====Blocks in Ruby====
A block is a segment of code that can be used as an argument for a method. These segments of code may have their own initialized variables only able to be referenced locally in the block, much like in a method. Single line blocks are commonly encapsulated in curly braces after a method call, and multi-line blocks are between "do" and "end" statements. A block's code is not executed when it is encountered, but rather after all instances of the yield statement within the method.

<code>
=begin
Ruby Code blocks are chunks of code between braces or
between do- end that you can associate with method invocations
=end
def call_block
puts 'Start of method'
# you can call the block using the yield keyword
yield
yield
puts 'End of method'
end
# Code blocks may appear only in the source adjacent to a method call
call_block {puts 'In the block'}
</code>
The above code outputs the following:
<code>
>ruby p022codeblock.rb
Start of method
In the block
In the block
End of method
>Exit code: 0
</code>

====So what's a closure?====
Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called.[https://www.princeton.edu/~achaney/tmve/wiki100k/docs/Closure_(computer_science).html] A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

=== Decorators ===

[https://wiki.python.org/moin/PythonDecorators Decorators] are an interesting and powerful language feature that can be implemented elegantly with closures.

<code>
#!/usr/bin/env python

def decorate(func):
def decorated_func():
print "About to call func"
func()
print "Back from calling func"
return decorated_func

@decorate
def func_to_decorate():
print "In func_to_decorate"

func_to_decorate()
</code>

<code>
[~517/wiki]$ chmod ug+x decorator.py
[~517/wiki]$ ./decorator.py
About to call func
In func_to_decorate
Back from calling func
</code>

=== Command Pattern===
The [https://en.wikipedia.org/wiki/Command_pattern Command Pattern] can be implemented using proc objects, which are the closure of an object.

In the Command Pattern, commands for objects to be implemented are queued and can be executed at any time. Arguments are considered passed when the method is called.

<code>
count = 0

commands = []
(1..10).each do |i|
commands << proc { count +=i }
end

puts "Count is initially #{count}"
commands.each { |cmd| cmd.call }
puts "Performed all commands. count is #{count}"
</code>

===Strategy Pattern===
The [http://www.codeproject.com/Articles/52807/Design-Patterns-Part-1-The-Strategy-Pattern Strategy Pattern] allows an algorithms behavior to be determined at runtime. It describes the definition of a family of interchangeable algorithm classes whose functionality is different for identically named methods.

<code>
class Fighter
def initialize(&fighting_behavior)
@finish_move = fighting_behavior
end

def finish_opponent
@finish_move.call
end
end

boxer = Fighter.new { puts 'Left hook to the body!' }
boxer.finish_opponent #=> Left hook to the body!

mortal_kombat_warrior = Fighter.new { puts 'Blast him with a lighting bolt' }
mortal_kombat_warrior.finish_opponent #=> Blast him with a lighting bolt

mma = Fighter.new { puts 'Put you to sleep, Good Night!' }
mma.finish_opponent #=> Put you to sleep, Good Night!

lion = Fighter.new { puts 'Bites your head off' }
lion.finish_opponent #=> Bites your head off!
</code>

=== Function Factory ===

A version of the classic [http://python-3-patterns-idioms-test.readthedocs.org/en/latest/Factory.html Factory Pattern], but for use with functions, can be implemented easily with the help of closures.

<code>
#!/usr/bin/env python

def status():
"""Returns the status of the system. Just a stub, for demo.

:returns: Always returns True. Just a demo.

"""
return True

def messenger_factory(messenger_type):
"""Builds very lightweight messenger functions.

:param messenger_type: Currently supported types are human and wire.
:type messenger_type: string
:returns: Function that creates messages of the required format.

"""
version = "Version 1.0"
dynamic_status = status
if messenger_type == "human":
def human_messenger():
"""Messenger with a format that is human-readable.

:returns: Human-readable string of status and version.

"""
return "Status is {}. Version is {}".format(dynamic_status(), version)
return human_messenger
elif messenger_type == "wire":
def wire_messenger():
"""Messenger with format that is ready to be put on the wire.

:returns: JSON (dict) message with status and version.

"""
return {"version": version, "status": dynamic_status()}
return wire_messenger
else:
raise ValueError("Unexpected messenger type: {}".format(messenger_type))

human_messenger = messenger_factory("human")
wire_messenger = messenger_factory("wire")

print "Human: {}".format(human_messenger())
print "Wire: {}".format(wire_messenger())
</code>

<code>
[~517/wiki]$ chmod ug+x func_factory.py
[~517/wiki]$ ./func_factory.py
Human: Status is True. Version is Version 1.0
Wire: {'status': True, 'version': 'Version 1.0'}
</code>

== See Also ==
== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-24T04:13:32Z

Drfarrel: /* Decorators */ Added external reference for decorators

= Design Patterns Involving Closures =

== Background ==
=== Explanation of Closures ===

====Blocks in Ruby====
A block is a segment of code that can be used as an argument for a method. These segments of code may have their own initialized variables only able to be referenced locally in the block, much like in a method. Single line blocks are commonly encapsulated in curly braces after a method call, and multi-line blocks are between "do" and "end" statements. A block's code is not executed when it is encountered, but rather after all instances of the yield statement within the method.

<code>
=begin
Ruby Code blocks are chunks of code between braces or
between do- end that you can associate with method invocations
=end
def call_block
puts 'Start of method'
# you can call the block using the yield keyword
yield
yield
puts 'End of method'
end
# Code blocks may appear only in the source adjacent to a method call
call_block {puts 'In the block'}
</code>
The above code outputs the following:
<code>
>ruby p022codeblock.rb
Start of method
In the block
In the block
End of method
>Exit code: 0
</code>

====So what's a closure?====
Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

=== Decorators ===

[https://wiki.python.org/moin/PythonDecorators Decorators] are an interesting and powerful language feature that can be implemented elegantly with closures.

<code>
#!/usr/bin/env python

def decorate(func):
def decorated_func():
print "About to call func"
func()
print "Back from calling func"
return decorated_func

@decorate
def func_to_decorate():
print "In func_to_decorate"

func_to_decorate()
</code>

<code>
[~517/wiki]$ chmod ug+x decorator.py
[~517/wiki]$ ./decorator.py
About to call func
In func_to_decorate
Back from calling func
</code>

=== Command Pattern===
The [https://en.wikipedia.org/wiki/Command_pattern Command Pattern] can be implemented using proc objects, which are the closure of an object.

In the Command Pattern, commands for objects to be implemented are queued and can be executed at any time. Arguments are considered passed when the method is called.

<code>
count = 0

commands = []
(1..10).each do |i|
commands << proc { count +=i }
end

puts "Count is initially #{count}"
commands.each { |cmd| cmd.call }
puts "Performed all commands. count is #{count}"
</code>

===Strategy Pattern===
The [http://www.codeproject.com/Articles/52807/Design-Patterns-Part-1-The-Strategy-Pattern Strategy Pattern] allows an algorithms behavior to be determined at runtime. It describes the definition of a family of interchangeable algorithm classes whose functionality is different for identically named methods.

<code>
class Fighter
def initialize(&fighting_behavior)
@finish_move = fighting_behavior
end

def finish_opponent
@finish_move.call
end
end

boxer = Fighter.new { puts 'Left hook to the body!' }
boxer.finish_opponent #=> Left hook to the body!

mortal_kombat_warrior = Fighter.new { puts 'Blast him with a lighting bolt' }
mortal_kombat_warrior.finish_opponent #=> Blast him with a lighting bolt

mma = Fighter.new { puts 'Put you to sleep, Good Night!' }
mma.finish_opponent #=> Put you to sleep, Good Night!

lion = Fighter.new { puts 'Bites your head off' }
lion.finish_opponent #=> Bites your head off!
</code>

=== Function Factory ===

A version of the classic [http://python-3-patterns-idioms-test.readthedocs.org/en/latest/Factory.html Factory Pattern], but for use with functions, can be implemented easily with the help of closures.

<code>
#!/usr/bin/env python

def status():
"""Returns the status of the system. Just a stub, for demo.

:returns: Always returns True. Just a demo.

"""
return True

def messenger_factory(messenger_type):
"""Builds very lightweight messenger functions.

:param messenger_type: Currently supported types are human and wire.
:type messenger_type: string
:returns: Function that creates messages of the required format.

"""
version = "Version 1.0"
dynamic_status = status
if messenger_type == "human":
def human_messenger():
"""Messenger with a format that is human-readable.

:returns: Human-readable string of status and version.

"""
return "Status is {}. Version is {}".format(dynamic_status(), version)
return human_messenger
elif messenger_type == "wire":
def wire_messenger():
"""Messenger with format that is ready to be put on the wire.

:returns: JSON (dict) message with status and version.

"""
return {"version": version, "status": dynamic_status()}
return wire_messenger
else:
raise ValueError("Unexpected messenger type: {}".format(messenger_type))

human_messenger = messenger_factory("human")
wire_messenger = messenger_factory("wire")

print "Human: {}".format(human_messenger())
print "Wire: {}".format(wire_messenger())
</code>

<code>
[~517/wiki]$ chmod ug+x func_factory.py
[~517/wiki]$ ./func_factory.py
Human: Status is True. Version is Version 1.0
Wire: {'status': True, 'version': 'Version 1.0'}
</code>

== See Also ==
== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-24T04:12:15Z

Drfarrel: /* Strategy Pattern */ Link to Strategy Pattern reference

= Design Patterns Involving Closures =

== Background ==
=== Explanation of Closures ===

====Blocks in Ruby====
A block is a segment of code that can be used as an argument for a method. These segments of code may have their own initialized variables only able to be referenced locally in the block, much like in a method. Single line blocks are commonly encapsulated in curly braces after a method call, and multi-line blocks are between "do" and "end" statements. A block's code is not executed when it is encountered, but rather after all instances of the yield statement within the method.

<code>
=begin
Ruby Code blocks are chunks of code between braces or
between do- end that you can associate with method invocations
=end
def call_block
puts 'Start of method'
# you can call the block using the yield keyword
yield
yield
puts 'End of method'
end
# Code blocks may appear only in the source adjacent to a method call
call_block {puts 'In the block'}
</code>
The above code outputs the following:
<code>
>ruby p022codeblock.rb
Start of method
In the block
In the block
End of method
>Exit code: 0
</code>

====So what's a closure?====
Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

=== Decorators ===

Decorators are an interesting and powerful language feature that can be implemented elegantly with closures.

<code>
#!/usr/bin/env python

def decorate(func):
def decorated_func():
print "About to call func"
func()
print "Back from calling func"
return decorated_func

@decorate
def func_to_decorate():
print "In func_to_decorate"

func_to_decorate()
</code>

<code>
[~517/wiki]$ chmod ug+x decorator.py
[~517/wiki]$ ./decorator.py
About to call func
In func_to_decorate
Back from calling func
</code>

=== Command Pattern===
The [https://en.wikipedia.org/wiki/Command_pattern Command Pattern] can be implemented using proc objects, which are the closure of an object.

In the Command Pattern, commands for objects to be implemented are queued and can be executed at any time. Arguments are considered passed when the method is called.

<code>
count = 0

commands = []
(1..10).each do |i|
commands << proc { count +=i }
end

puts "Count is initially #{count}"
commands.each { |cmd| cmd.call }
puts "Performed all commands. count is #{count}"
</code>

===Strategy Pattern===
The [http://www.codeproject.com/Articles/52807/Design-Patterns-Part-1-The-Strategy-Pattern Strategy Pattern] allows an algorithms behavior to be determined at runtime. It describes the definition of a family of interchangeable algorithm classes whose functionality is different for identically named methods.

<code>
class Fighter
def initialize(&fighting_behavior)
@finish_move = fighting_behavior
end

def finish_opponent
@finish_move.call
end
end

boxer = Fighter.new { puts 'Left hook to the body!' }
boxer.finish_opponent #=> Left hook to the body!

mortal_kombat_warrior = Fighter.new { puts 'Blast him with a lighting bolt' }
mortal_kombat_warrior.finish_opponent #=> Blast him with a lighting bolt

mma = Fighter.new { puts 'Put you to sleep, Good Night!' }
mma.finish_opponent #=> Put you to sleep, Good Night!

lion = Fighter.new { puts 'Bites your head off' }
lion.finish_opponent #=> Bites your head off!
</code>

=== Function Factory ===

A version of the classic [http://python-3-patterns-idioms-test.readthedocs.org/en/latest/Factory.html Factory Pattern], but for use with functions, can be implemented easily with the help of closures.

<code>
#!/usr/bin/env python

def status():
"""Returns the status of the system. Just a stub, for demo.

:returns: Always returns True. Just a demo.

"""
return True

def messenger_factory(messenger_type):
"""Builds very lightweight messenger functions.

:param messenger_type: Currently supported types are human and wire.
:type messenger_type: string
:returns: Function that creates messages of the required format.

"""
version = "Version 1.0"
dynamic_status = status
if messenger_type == "human":
def human_messenger():
"""Messenger with a format that is human-readable.

:returns: Human-readable string of status and version.

"""
return "Status is {}. Version is {}".format(dynamic_status(), version)
return human_messenger
elif messenger_type == "wire":
def wire_messenger():
"""Messenger with format that is ready to be put on the wire.

:returns: JSON (dict) message with status and version.

"""
return {"version": version, "status": dynamic_status()}
return wire_messenger
else:
raise ValueError("Unexpected messenger type: {}".format(messenger_type))

human_messenger = messenger_factory("human")
wire_messenger = messenger_factory("wire")

print "Human: {}".format(human_messenger())
print "Wire: {}".format(wire_messenger())
</code>

<code>
[~517/wiki]$ chmod ug+x func_factory.py
[~517/wiki]$ ./func_factory.py
Human: Status is True. Version is Version 1.0
Wire: {'status': True, 'version': 'Version 1.0'}
</code>

== See Also ==
== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-24T04:11:03Z

Drfarrel: /* Command Pattern */ Link to description of CMD Pattern

= Design Patterns Involving Closures =

== Background ==
=== Explanation of Closures ===

====Blocks in Ruby====
A block is a segment of code that can be used as an argument for a method. These segments of code may have their own initialized variables only able to be referenced locally in the block, much like in a method. Single line blocks are commonly encapsulated in curly braces after a method call, and multi-line blocks are between "do" and "end" statements. A block's code is not executed when it is encountered, but rather after all instances of the yield statement within the method.

<code>
=begin
Ruby Code blocks are chunks of code between braces or
between do- end that you can associate with method invocations
=end
def call_block
puts 'Start of method'
# you can call the block using the yield keyword
yield
yield
puts 'End of method'
end
# Code blocks may appear only in the source adjacent to a method call
call_block {puts 'In the block'}
</code>
The above code outputs the following:
<code>
>ruby p022codeblock.rb
Start of method
In the block
In the block
End of method
>Exit code: 0
</code>

====So what's a closure?====
Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

=== Decorators ===

Decorators are an interesting and powerful language feature that can be implemented elegantly with closures.

<code>
#!/usr/bin/env python

def decorate(func):
def decorated_func():
print "About to call func"
func()
print "Back from calling func"
return decorated_func

@decorate
def func_to_decorate():
print "In func_to_decorate"

func_to_decorate()
</code>

<code>
[~517/wiki]$ chmod ug+x decorator.py
[~517/wiki]$ ./decorator.py
About to call func
In func_to_decorate
Back from calling func
</code>

=== Command Pattern===
The [https://en.wikipedia.org/wiki/Command_pattern Command Pattern] can be implemented using proc objects, which are the closure of an object.

In the Command Pattern, commands for objects to be implemented are queued and can be executed at any time. Arguments are considered passed when the method is called.

<code>
count = 0

commands = []
(1..10).each do |i|
commands << proc { count +=i }
end

puts "Count is initially #{count}"
commands.each { |cmd| cmd.call }
puts "Performed all commands. count is #{count}"
</code>

===Strategy Pattern===
The Strategy Pattern allows an algorithms behavior to be determined at runtime. It describes the definition of a family of interchangeable algorithm classes whose functionality is different for identically named methods.

<code>
class Fighter
def initialize(&fighting_behavior)
@finish_move = fighting_behavior
end

def finish_opponent
@finish_move.call
end
end

boxer = Fighter.new { puts 'Left hook to the body!' }
boxer.finish_opponent #=> Left hook to the body!

mortal_kombat_warrior = Fighter.new { puts 'Blast him with a lighting bolt' }
mortal_kombat_warrior.finish_opponent #=> Blast him with a lighting bolt

mma = Fighter.new { puts 'Put you to sleep, Good Night!' }
mma.finish_opponent #=> Put you to sleep, Good Night!

lion = Fighter.new { puts 'Bites your head off' }
lion.finish_opponent #=> Bites your head off!
</code>

=== Function Factory ===

A version of the classic [http://python-3-patterns-idioms-test.readthedocs.org/en/latest/Factory.html Factory Pattern], but for use with functions, can be implemented easily with the help of closures.

<code>
#!/usr/bin/env python

def status():
"""Returns the status of the system. Just a stub, for demo.

:returns: Always returns True. Just a demo.

"""
return True

def messenger_factory(messenger_type):
"""Builds very lightweight messenger functions.

:param messenger_type: Currently supported types are human and wire.
:type messenger_type: string
:returns: Function that creates messages of the required format.

"""
version = "Version 1.0"
dynamic_status = status
if messenger_type == "human":
def human_messenger():
"""Messenger with a format that is human-readable.

:returns: Human-readable string of status and version.

"""
return "Status is {}. Version is {}".format(dynamic_status(), version)
return human_messenger
elif messenger_type == "wire":
def wire_messenger():
"""Messenger with format that is ready to be put on the wire.

:returns: JSON (dict) message with status and version.

"""
return {"version": version, "status": dynamic_status()}
return wire_messenger
else:
raise ValueError("Unexpected messenger type: {}".format(messenger_type))

human_messenger = messenger_factory("human")
wire_messenger = messenger_factory("wire")

print "Human: {}".format(human_messenger())
print "Wire: {}".format(wire_messenger())
</code>

<code>
[~517/wiki]$ chmod ug+x func_factory.py
[~517/wiki]$ ./func_factory.py
Human: Status is True. Version is Version 1.0
Wire: {'status': True, 'version': 'Version 1.0'}
</code>

== See Also ==
== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-24T04:01:56Z

Drfarrel: /* Function Factory */ Added link to Factory Pattern example

= Design Patterns Involving Closures =

== Background ==
=== Explanation of Closures ===

====Blocks in Ruby====
A block is a segment of code that can be used as an argument for a method. These segments of code may have their own initialized variables only able to be referenced locally in the block, much like in a method. Single line blocks are commonly encapsulated in curly braces after a method call, and multi-line blocks are between "do" and "end" statements. A block's code is not executed when it is encountered, but rather after all instances of the yield statement within the method.

<code>
=begin
Ruby Code blocks are chunks of code between braces or
between do- end that you can associate with method invocations
=end
def call_block
puts 'Start of method'
# you can call the block using the yield keyword
yield
yield
puts 'End of method'
end
# Code blocks may appear only in the source adjacent to a method call
call_block {puts 'In the block'}
</code>
The above code outputs the following:
<code>
>ruby p022codeblock.rb
Start of method
In the block
In the block
End of method
>Exit code: 0
</code>

====So what's a closure?====
Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

=== Decorators ===

Decorators are an interesting and powerful language feature that can be implemented elegantly with closures.

<code>
#!/usr/bin/env python

def decorate(func):
def decorated_func():
print "About to call func"
func()
print "Back from calling func"
return decorated_func

@decorate
def func_to_decorate():
print "In func_to_decorate"

func_to_decorate()
</code>

<code>
[~517/wiki]$ chmod ug+x decorator.py
[~517/wiki]$ ./decorator.py
About to call func
In func_to_decorate
Back from calling func
</code>

=== Command Pattern===
The command Pattern can be implemented using proc objects, which are the closure of an object

In the command pattern, commands for objects to be implemented are queued and can be executed at any time. Arguments are considered passed when the method is called.

<code>
count = 0

commands = []
(1..10).each do |i|
commands << proc { count +=i }
end

puts "Count is initially #{count}"
commands.each { |cmd| cmd.call }
puts "Performed all commands. count is #{count}"
</code>

===Strategy Pattern===
The Strategy Pattern allows an algorithms behavior to be determined at runtime. It describes the definition of a family of interchangeable algorithm classes whose functionality is different for identically named methods.

<code>
class Fighter
def initialize(&fighting_behavior)
@finish_move = fighting_behavior
end

def finish_opponent
@finish_move.call
end
end

boxer = Fighter.new { puts 'Left hook to the body!' }
boxer.finish_opponent #=> Left hook to the body!

mortal_kombat_warrior = Fighter.new { puts 'Blast him with a lighting bolt' }
mortal_kombat_warrior.finish_opponent #=> Blast him with a lighting bolt

mma = Fighter.new { puts 'Put you to sleep, Good Night!' }
mma.finish_opponent #=> Put you to sleep, Good Night!

lion = Fighter.new { puts 'Bites your head off' }
lion.finish_opponent #=> Bites your head off!
</code>

=== Function Factory ===

A version of the classic [http://python-3-patterns-idioms-test.readthedocs.org/en/latest/Factory.html Factory Pattern], but for use with functions, can be implemented easily with the help of closures.

<code>
#!/usr/bin/env python

def status():
"""Returns the status of the system. Just a stub, for demo.

:returns: Always returns True. Just a demo.

"""
return True

def messenger_factory(messenger_type):
"""Builds very lightweight messenger functions.

:param messenger_type: Currently supported types are human and wire.
:type messenger_type: string
:returns: Function that creates messages of the required format.

"""
version = "Version 1.0"
dynamic_status = status
if messenger_type == "human":
def human_messenger():
"""Messenger with a format that is human-readable.

:returns: Human-readable string of status and version.

"""
return "Status is {}. Version is {}".format(dynamic_status(), version)
return human_messenger
elif messenger_type == "wire":
def wire_messenger():
"""Messenger with format that is ready to be put on the wire.

:returns: JSON (dict) message with status and version.

"""
return {"version": version, "status": dynamic_status()}
return wire_messenger
else:
raise ValueError("Unexpected messenger type: {}".format(messenger_type))

human_messenger = messenger_factory("human")
wire_messenger = messenger_factory("wire")

print "Human: {}".format(human_messenger())
print "Wire: {}".format(wire_messenger())
</code>

<code>
[~517/wiki]$ chmod ug+x func_factory.py
[~517/wiki]$ ./func_factory.py
Human: Status is True. Version is Version 1.0
Wire: {'status': True, 'version': 'Version 1.0'}
</code>

== See Also ==
== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-24T03:59:37Z

Drfarrel: Added example of a Factory Pattern for functions using closures

= Design Patterns Involving Closures =

== Background ==
=== Explanation of Closures ===

====Blocks in Ruby====
A block is a segment of code that can be used as an argument for a method. These segments of code may have their own initialized variables only able to be referenced locally in the block, much like in a method. Single line blocks are commonly encapsulated in curly braces after a method call, and multi-line blocks are between "do" and "end" statements. A block's code is not executed when it is encountered, but rather after all instances of the yield statement within the method.

<code>
=begin
Ruby Code blocks are chunks of code between braces or
between do- end that you can associate with method invocations
=end
def call_block
puts 'Start of method'
# you can call the block using the yield keyword
yield
yield
puts 'End of method'
end
# Code blocks may appear only in the source adjacent to a method call
call_block {puts 'In the block'}
</code>
The above code outputs the following:
<code>
>ruby p022codeblock.rb
Start of method
In the block
In the block
End of method
>Exit code: 0
</code>

====So what's a closure?====
Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

=== Decorators ===

Decorators are an interesting and powerful language feature that can be implemented elegantly with closures.

<code>
#!/usr/bin/env python

def decorate(func):
def decorated_func():
print "About to call func"
func()
print "Back from calling func"
return decorated_func

@decorate
def func_to_decorate():
print "In func_to_decorate"

func_to_decorate()
</code>

<code>
[~517/wiki]$ chmod ug+x decorator.py
[~517/wiki]$ ./decorator.py
About to call func
In func_to_decorate
Back from calling func
</code>

=== Command Pattern===
The command Pattern can be implemented using proc objects, which are the closure of an object

In the command pattern, commands for objects to be implemented are queued and can be executed at any time. Arguments are considered passed when the method is called.

<code>
count = 0

commands = []
(1..10).each do |i|
commands << proc { count +=i }
end

puts "Count is initially #{count}"
commands.each { |cmd| cmd.call }
puts "Performed all commands. count is #{count}"
</code>

===Strategy Pattern===
The Strategy Pattern allows an algorithms behavior to be determined at runtime. It describes the definition of a family of interchangeable algorithm classes whose functionality is different for identically named methods.

<code>
class Fighter
def initialize(&fighting_behavior)
@finish_move = fighting_behavior
end

def finish_opponent
@finish_move.call
end
end

boxer = Fighter.new { puts 'Left hook to the body!' }
boxer.finish_opponent #=> Left hook to the body!

mortal_kombat_warrior = Fighter.new { puts 'Blast him with a lighting bolt' }
mortal_kombat_warrior.finish_opponent #=> Blast him with a lighting bolt

mma = Fighter.new { puts 'Put you to sleep, Good Night!' }
mma.finish_opponent #=> Put you to sleep, Good Night!

lion = Fighter.new { puts 'Bites your head off' }
lion.finish_opponent #=> Bites your head off!
</code>

=== Function Factory ===

A version of the classic Factory Pattern, but for use with functions, can be implemented easily with the help of closures.

<code>
#!/usr/bin/env python

def status():
"""Returns the status of the system. Just a stub, for demo.

:returns: Always returns True. Just a demo.

"""
return True

def messenger_factory(messenger_type):
"""Builds very lightweight messenger functions.

:param messenger_type: Currently supported types are human and wire.
:type messenger_type: string
:returns: Function that creates messages of the required format.

"""
version = "Version 1.0"
dynamic_status = status
if messenger_type == "human":
def human_messenger():
"""Messenger with a format that is human-readable.

:returns: Human-readable string of status and version.

"""
return "Status is {}. Version is {}".format(dynamic_status(), version)
return human_messenger
elif messenger_type == "wire":
def wire_messenger():
"""Messenger with format that is ready to be put on the wire.

:returns: JSON (dict) message with status and version.

"""
return {"version": version, "status": dynamic_status()}
return wire_messenger
else:
raise ValueError("Unexpected messenger type: {}".format(messenger_type))

human_messenger = messenger_factory("human")
wire_messenger = messenger_factory("wire")

print "Human: {}".format(human_messenger())
print "Wire: {}".format(wire_messenger())
</code>

<code>
[~517/wiki]$ chmod ug+x func_factory.py
[~517/wiki]$ ./func_factory.py
Human: Status is True. Version is Version 1.0
Wire: {'status': True, 'version': 'Version 1.0'}
</code>

== See Also ==
== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-23T07:28:49Z

Drfarrel: Removed some section headers that I don't think should be developed

= Design Patterns Involving Closures =

== Background ==
=== Explanation of Closures ===

Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

=== Decorators ===

Decorators are an interesting and powerful language feature that can be implemented elegantly with closures.

<code>
#!/usr/bin/env python

def decorate(func):
def decorated_func():
print "About to call func"
func()
print "Back from calling func"
return decorated_func

@decorate
def func_to_decorate():
print "In func_to_decorate"

func_to_decorate()
</code>

<code>
[~517/wiki]$ chmod ug+x decorator.py
[~517/wiki]$ ./decorator.py
About to call func
In func_to_decorate
Back from calling func
</code>

== See Also ==
== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-23T07:27:22Z

Drfarrel: Added a design pattern example - decorators

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-23T07:12:57Z

Drfarrel: /* What is a closure? */ A bit more trimming of closure example

= Design Patterns Involving Closures =

== Background ==
=== What is a closure? ===

Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

== Narration ==

== Links to Important Terms ==

== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-23T07:12:23Z

Drfarrel: /* What is a closure? */ Tried to shorten closure example

= Design Patterns Involving Closures =

== Background ==
=== What is a closure? ===

Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
#!/usr/bin/env python

def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

== Narration ==

== Links to Important Terms ==

== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-23T07:11:03Z

Drfarrel: Somewhat better closure example

= Design Patterns Involving Closures =

== Background ==
=== What is a closure? ===

Very simply, a closure is a function that can use a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
#!/usr/bin/env python

# Define a function that makes use of closures
def closure_builder(message="Default"):
def closure():
# Message is in-scope here
print message
return closure

# Build two functions
default_closure = closure_builder()
custom_closure = closure_builder("Custom")

# In case you're not convinced
del closure_builder

# Call the closures you built
default_closure() # Amazingly, prints "Default"
custom_closure() # Amazingly, prints "Custom"
</code>

== Examples ==

== Narration ==

== Links to Important Terms ==

== References ==
<references />

CSC/ECE 517 Spring 2014/ch1 1w1l m

2014-02-23T06:55:32Z

Drfarrel: Added basic definition of a closure

= Design Patterns Involving Closures =

== Background ==
=== What is a closure? ===

Very simply, a closure is a function that can use a reference to a variable that was valid within the scope that the closure was defined, but need not be in-scope where the closure is called. A quick example is very illustrative.

<code>
>>> def closure_builder():
... message = "String, in-scope where closure is defined"
... def closure(new_msg=None):
... if new_msg is None:
... print message
... else:
... print new_msg
... return closure
...
>>> default_closure = closure_builder()
>>> del closure_builder # Without closures, the message var would be gone now
>>> default_closure() # But it's still here!
String, in-scope where closure is defined
>>> default_closure("I can do this too, although it's bit obvious")
I can do this too, although it's bit obvious
</code>

== Examples ==

== Narration ==

== Links to Important Terms ==

== References ==
<references />