XSS - example.com

[01:05:19] (PS1) Yaron Koren: Small fixes to formatting and comments [extensions/SemanticForms] - https://gerrit.wikimedia.org/r/266168 [01:08:41] (CR) Yaron Koren: [C: 2 V: 1] Small fixes to formatting and comments [extensions/SemanticForms] - https://gerrit.wikimedia.org/r/266168 (owner: Yaron Koren) [05:33:56] hey everyone, is there any magic that needs to happen to enable the infobox template class? [08:33:26] (CR) Tpt: [C: 2] Rename SG_VERSION [extensions/SemanticGenealogy] - https://gerrit.wikimedia.org/r/266066 (https://phabricator.wikimedia.org/T70703) (owner: MtDu) [08:33:44] (Merged) jenkins-bot: Rename SG_VERSION [extensions/SemanticGenealogy] - https://gerrit.wikimedia.org/r/266066 (https://phabricator.wikimedia.org/T70703) (owner: MtDu) [13:23:17] [SemanticMediaWiki] mwjames created time-format (+1 new commit): https://git.io/vz6Q0 [13:23:17] SemanticMediaWiki/time-format a5154d0 mwjames: Add free date/time formatting support... [13:32:42] [SemanticMediaWiki] mwjames opened pull request #1389: Add free date/time formatting support (master...time-format) https://git.io/vz67N [16:23:10] (PS1) Yaron Koren: Fixes for "partial forms" [extensions/SemanticForms] - https://gerrit.wikimedia.org/r/266247 [16:33:19] (CR) Yaron Koren: [C: 2 V: 1] Fixes for "partial forms" [extensions/SemanticForms] - https://gerrit.wikimedia.org/r/266247 (owner: Yaron Koren) [17:11:39] (PS1) Paladox: Update composer.json [extensions/SemanticForms] - https://gerrit.wikimedia.org/r/266259 [17:13:46] (CR) Paladox: "check experimental" [extensions/SemanticForms] - https://gerrit.wikimedia.org/r/266259 (owner: Paladox) [20:00:31] hey guys question, are properties Namespace specific>? [20:00:39] or are they "global"? [20:15:22] Deep6: They are global. [20:16:00] Deep6: https://www.semantic-mediawiki.org/wiki/Help:$smwgNamespacesWithSemanticLinks may be relevant [20:29:56] FoxT: thanks [20:31:21] FoxT: any chance you know if the infobox class is installed? I can't seem to get an infobox output? [20:31:39] sorry installed by default I mean [20:32:11] Deep6: What is the infobox class? [20:32:28] well the infobox thing [20:32:37] I apologize my terminology is poor [20:32:45] but I see class="wikitable" [20:32:58] and I want to format it as a infobo [20:33:00] x [20:34:25] https://www.mediawiki.org/wiki/Thread:Project:Support_desk/How_to_install_infobox_in_latest_mediawiki/reply [20:34:28] Deep6: Well, MW comes with a CSS class mw-infobox, if that's what you mean [20:34:58] ohhh maybe it's just that [20:35:06] I wasn't usingthe mw- [20:59:06] let me try that [21:00:12] FoxT: is there a special page for Namespaces: [21:00:15] to list them? [21:02:54] Deep6: Don't think so. But if you go to Special:Search and open the Advanced tab, you will get a list. [21:02:55] and is creating a site within a Namespace as simple as : [21:03:40] Deep6: See https://www.mediawiki.org/wiki/Manual:Namespace. Short answer: No. [21:04:54] Deep6: Well, or yes. If the namespace exists, you can just create :. If not, you will have to set up the namespace first [21:05:08] yeah I setup the namespace [21:05:15] and wohoo it works [21:05:22] :)\ [21:05:22] I see it in Advanced [21:07:04] but there's no visual indicator if you create page:foo [21:07:19] sorry bad use of a term there [21:07:33] should have said CoolNamespace:foo [21:07:53] and CoolNamespace hasn't been defined it'll just create a page with a : in the main namespace hey? [21:08:08] Yes [21:08:43] FoxT: You're a genius...that's what the problem was with my infobox [21:08:46] missing the mw- [21:09:05] :) [21:09:08] I only figured out on the weekend that the Template is what controls the visual result [21:10:40] I do have one question though, I have this for a field [21:10:44] {{#arraymap:{{{BusinessOwnerContact|}}}|,|x|{{{#formredlink:target=x|form=Person}}{{#set:Has Business Owner Contact=x}}}} [21:11:00] and it displays it as {John Doe [21:11:45] Deep6: Haven worked it out completely, but in any case there is an imbalance in the braces [21:12:09] Deep6: around formredlink, left {{{, right }} [21:12:15] you know what I just figured that out in talking to you [21:12:26] I thought at first it was some representation [21:12:31] of a redlink [21:12:43] but like you mention it's just a simple typo!!! [21:12:45] sorry [21:12:52] to bother you with a trivial question [21:12:53] np. [21:13:15] want a hard one :P [21:13:25] (at least perceived as hard?) [21:13:34] in my mind right now given my understanding [21:13:50] Deep6: Shoot. Worst that can happen is that I don know [21:25:51] hey FoxT gosh I'm sorry I got hijaacked by 3 people there [21:26:15] are you part of the mailing list by chance? [21:28:16] Deep6: yes [21:30:33] I am the fellow asking about vulnerability data [21:30:40] a few days ago [21:30:56] I want to represent the vuln data on a site within a table on the page [21:31:06] and I actually can logically think how it will work now [21:31:15] just not sure on some of the intricacies [21:31:22] so I created a separate namespace [21:31:27] Web Vulnerability [21:31:36] (and the Talk page) [21:31:52] but I am now wondering about details like [21:32:23] a vulnerability might be logged against [21:33:14] example.com/northamerica/usa/page.php [21:33:53] if we use that as the PageName it'll generate hundreds of thousands of pages [21:34:21] and what I'll want is an #ask query [21:35:01] on the Main:example.com that has the "open" status vulns [21:35:17] and a separate table for the closed [21:35:33] I can expect that the open vs closed is no big deal [21:36:11] but that whole relate the Web Vulnerability: Namespace example.com (substring) part might be tricky [21:38:42] FoxT: is that clear at all or am I really in deep? [21:39:57] Deep6: I think so. I think, Bernhard and Jamie gave you good advise. I also do not like records very much. [21:40:27] FoxT: ok now that I have more understanding I'll maybe go back and try to digest what they said [21:40:31] at the time it went way over my head [21:41:28] Deep6: SMW and its properties takes a bit gettin g used to it, it's true. [21:42:06] well I've never even done anything with a normal wiki [21:42:11] so I'm jumping into the deepend a bit [21:44:21] FoxT: is there a site out there that has template "cookbooks" [21:44:34] as in here's how you do this type of thing [21:48:40] There is http://smw.referata.com/wiki/Main_Page, which is a community wiki that has some stuff. And https://www.semantic-mediawiki.org is the official SMW website of course. Otherwise it is probably easiest to just ask on the various mailing lists. [21:49:42] I probably shouldn't have subscribed to the digest..for me I only get an answer the next day [21:49:51] I've always preferred the immediacy of IRC [21:50:00] I just went and re-read their guidance [21:50:21] pardon my ignorance, but what is a subpage? [21:50:46] A page with a title of the form / [21:52:28] oh hrmm.... [21:52:37] would it be easy to create reports etc out of that ? [21:52:55] the managery folks are interested in the counts, and trends etc [21:53:50] FoxT: but that would be within the same Namespace correct? [21:54:11] For the SMW part it is important to put everythuing you want to query in properties. [21:54:31] agreed [21:54:51] and formulate it into a verb sentence etc [21:55:18] So, if I understood your setup right, it might make sense to have one page per site and one page per vulnerability [21:56:05] ont the pages for the sites you store properties like ownership information, criticality, registrar... [21:56:06] well [21:56:16] yep [21:56:18] exactly [21:56:30] I'll let you continue with the vulnerability thought [21:56:51] on the vulnerability pages you store Vulnerability ID, Finding Date, Criticality, ..., and a propery that stores the respective site that vulnerability occured on [21:57:11] see this is where it gets interesting [21:57:26] and I think you might have made me think of another way as well [21:57:26] the you can e.g. ask for all the vulnerabilities for a site [21:57:37] so...the vulnerability info comes from a vuln scanner [21:57:44] and so it'll puke outsomething like [21:57:54] (in XML> [21:59:12] XSS - example.com [21:59:32] blah blah [22:00:01] and within that I just noticed the output has some info in it that'd rather have as proprties [22:01:28] can I paste here or to you privately [22:01:39] it's 9 lines [22:01:48] sorry 7 [22:01:59] 9 lines shoud be just ok, else use pastebin or something like that [22:02:16] Vulnerability[10]: [22:02:19] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [22:02:22] CWE-ID: 79 [22:02:24] <a href="http://cwe.mitre.org/data/definitions/79.html" class="external-link" rel="nofollow">http://cwe.mitre.org/data/definitions/79.html</a> [22:02:28] Vulnerability attack surface location: [22:02:31] URL: <a href="http://example.com/community_investment" class="external-link" rel="nofollow">http://example.com/community_investment</a> [22:02:35] Parameter: null [22:03:26] that's an example of the detail within the vulnerablity [22:03:34] and it'll have N #'s of records like that... [22:03:53] and that's nested within the title [22:05:16] Meaning you have several records per vulnerability? [22:11:24] FoxT: well yeah our data seems poor [22:11:27] but I am thinking now [22:11:55] there's a few toplevel vulnerability types [22:12:00] Cross Site Scripting (XSS) [22:12:10] well that's actually a sub category [22:12:14] of Code Injection [22:13:14] so could I have a subpage of example.com/Code_Injection/XSS [22:13:29] and then every instance of it on that page? [22:13:46] as in example.com/path1/vulnpage.php [22:14:04] example.com/path2/vulnpage2.php [22:15:22] perhaps with some additional dimensions [22:16:15] Lists and the like are done as reports. I would first think of what are the data entities you want to work with. E.g. Sites, pages, vulnerabilities, records. pages link back to ther parent sites, vulnerabilities link back to the affected pages, records link back to the vulnerabilities. It's a lot like DB design [22:17:26] [22:17:44] yah I am actually looking at it like DB design [22:17:45] for ure [22:17:46] er sure [22:18:17] can you expand on your lists and the like are done as reports? [22:19:09] but before that [22:19:09] Well, once you have all these pages, you can ask for all the pages of a site. or all the vulnerabilities on a site. [22:19:30] lets approach it from that aspect...for a sec... [22:19:43] so a website...example.com [22:20:01] it can have a breadth of vulnerabilty types [22:21:08] lets use the OWASP categories [22:21:24] A1 Injection [22:21:24] A2 Broken Authentication and Session Management [22:21:24] A3 Cross-Site Scripting (XSS) [22:21:24] A4 Insecure Direct Object References [22:21:24] A5 Security Misconfiguration [22:21:27] A6 Sensitive Data Exposure [22:21:29] A7 Missing Function Level Access Control [22:21:32] A8 Cross-Site Request Forgery (CSRF) [22:21:34] A9 Using Components with Known Vulnerabilities [22:21:37] A10 Unvalidated Redirects and Forwards [22:21:45] and then there's sub instances tehre of [22:23:19] for instance a subclass of A1 Injection might be SQL injection [22:24:13] and then there's specific instances of the class or..sub class [22:24:55] www.example.com/pathA/path1/vuln.php [22:28:22] Got to leave, it's late here. Write me a mail, if you want: s7eph4n@gmail.com