Monday, May 22, 2017

Report: Cryptography

Introduction

Many people these days are using computers. Some use computers for personal use like browsing the web or saving their pictures on the hard drive, and some others for educational purposes or for business. In each case, people mostly care about one thing: keeping their data protected and one technique to do that is cryptography. In this report I will firstly define cryptography and provide a brief history. Next I will talk about the importance of cryptography in the modern world with some technologies that are currently used to crypt data. Finally, I will talk about future of cryptography.

Encryption
Encryption is an essential part of web security (Picture taken by Ibrahim)

Background


What is Encryption?

Encryption is a technique that is used to transform data to a form in which an unauthorized person cannot understand (Bright). More generally, it is about protecting sensitive data such as passwords and account numbers. It enables secure communication, online business and the protection of secret data.

History of Cryptography

The word “cryptography” is actually two Greek words that are merged together: “kryptos” which means “covered” and “grapheni” which means “handwriting” (Damico). In the early days of cryptography, it was only about hiding information that was written on a message while it was carried from one place to another. Cryptography was initially founded by some of the great civilizations that are comprised of Egypt, Greece and Rome. Egyptian writers used hieroglyphs in a non-standard way, apparently to protect the contents of the message. Greeks used then a different way, a stick that was wrapped by a tap. When the tap was removed the words would become meaningless. The one who received the letter would have a stick that had the same diameter as the one that’s used to hide the letter to decrypt the message. Romans used Caesar Cipher. The idea of Caesar Cipher is to shift the letters of the message by a specific number. By using the same number, the receiver of the message has to shift the letters back in order to decrypt it.

Importance of Cryptography

By storing personal data on a computer, web or sending it by email it becomes risky to lose it, and if it falls in the wrong hands it might be used to harm the one who owns that data. According to Rice, people have to provide such data to specific organizations in order to provide appropriate service. These organizations must keep data secure. 

In order to do so, organizations must take some actions to lower the risk of improper disclosure. By using a suitable encryption technique, personal data can be kept secure and thus, no one can access it without permission.

Techniques of Encryption

There are many ways to encrypt data. Usually the use of any technique depends on what type of data will be encrypted, sensitivity of data and where data will be stored (Rice). Here are the three common used techniques to encrypt data.

Full data Encryption

This process is mostly used when encrypting desktop computers, laptops and mobile devices. This technique encrypts the whole data on the hard drive from normal information to personal data. After encryption, a key is generated. This key is the only way that can be used to decrypt data and read it.

BitLocker is commonly used tool on windows to encrypt flash drivers and hard-disks

File Encryption

This technique involves encrypting standalone file or creating encrypted container that files can be added to. When the container is locked, content inside it cannot be reached. When the container is moved from one device to another, contents inside the container will stay safe. But when files are moved from the container, they will no longer be protected.

Transportable Data Encryption

Usually people share sensitive data between each other by using email. Data is encrypted before it can be transferred. The process of encrypting data is done by using an encrypted data transfer protocol. There are two types of protocols that are used to encrypt data in transit: Secure Socked Layer (SSL) and Transport Layer Security (TLS). When a web site uses encrypted data transfer protocol, the web browser displays a small lock on the adders bar. The lock indicates that it is safe to transfer sensitive data to the web site.

When the connection to a website is secure (Encrypted), a small lock will appear on the browser's address bar

Current Algorithms on Encrypting and Decrypting Data

Encrypting and decrypting data can be done in many different ways. Each way depends on the sender and receiver of data.

Symmetric key Algorithms

The algorithms that are using this approach mainly depend on mixing the plain text in complicated ways and repeating the same process more than one time (Bright). The key that is used to mix the plaintext is the thing that will specify the mixing pattern.

Asymmetric Key Algorithms

Also known as public key encryption, RSA algorithm was the first algorithm to use asymmetric keys. It was developed in secret by two British agencies: SIGINT and GCHQ in 1973 (Bright). Public-key encryption mainly depends on the existence of mathematical problems. The solution to theses mathematical problems is the key that is used to encrypt data. There are two keys to decrypt data in this approach, the public key and the private key. Public key is used to encrypt data, while the other one is used to decrypt data.

Future of Cryptography

As time goes on, new algorithms for encryption are developed to satisfy the rise of security and performance needs (McGrew). The next generation of algorithms to replace algorithms such as RSA is called Elliptic Curve Cryptography (ECC).One use of Next Generation Encryption (NGE) technologies will be used to protect IPsec Private Virtual Networks. It can provide 128 bits of security level or more. The use of NGE lets to achieve the requirements of security of the next decade. 

The algorithm that is used in NEG is a new, one suite of algorithms called Suite B. This suite provides algorithms that are designed to meet the needs of future security. For network security, Suite B sets a good direction and thus, the algorithms have been incorporated into many standards.

Conclusion

In conclusion, cryptography is an essential thing to consider in this developing world since almost everything must be done using computers. Many companies try to get the latest technologies on encryption to protect their customers’ personal data. The most important thing to be careful about is keeping the key secure, and therefore the data (Rice). The new technologies on cryptography aim to make all data secure in the most efficient way.

List of References








Thursday, May 11, 2017

تخصص هندسة البرمجيات, الفرق بينه و بين تخصصات الكمبيوتر الأخرى


مقدمة

كثير من الناس في هذه الايام تسمع بتخصص هندسة البرمجيات (Software Engineering) ولكن لا تعرف الفرق بينه و بين اي تخصص آخر يتعلق بالحاسوب مثل تخصص علوم الكمبيوتر (Computer Science) او هندسة الكمبيوتر (Computer Engineering). إذا, ما هو تخصص هندسة البرمجيات؟ و ما هي المناهج اللتي يقومون بدراستها؟ كل هذا و اكثر سوف نتعرف عليه هنا.
المواضيع اللتي سوفَ اتحدث عنها:


تعريف التخصص

هو تخصص يهتم بدراسة بناء البرامج الحاسوبية من الصفر و حتى النشر بطريقة منظمة و غير عشوائية. هندسة البرمجيات ليس فقط مجرد كتابة تعليمات برمجية. بل هي عملية تهتم بتوصيل منتج الى عميل معين بأقل كلفة و في اسرع وقت ممكن. من اجل عمل هذه الاهداف، يدرس من يختار تخصص هندسة البرمجيات عدة مواد تهتم بدراسة دورة حياة المُنتج البرمجي (Software Product Life Cycle).

مراحل دورة حياة المُنتج البرمجي

بشكل عام، هذه الدورة تتألف من خمس مراحل:
  • مرحلة تجميع المتطلبات.
  • مرحلة التصميم.
  • مرحلة التنفيذ.
  • مرحلة الإختبار.
  • مرحلة الصيانة.
لِكل مرحلة مِن مراحل الدورة توجد مُخرجات و مُدخلات و جميع المراحل مُتصلة بِبعضها البعض. ترتيب هذه المراحل يعتمد بِشكل مُباشر على نوع نموذج دورة حياة النظام البرمجي (Software Process Model). بِشكل عام, توجد  ثلاثة نماذج, نموذج الشلال (Waterfall Model), النموذج الحلزوني (Spiral Model)  ومنهجيات آجَايل (Agile​ Methodologies).



وصف مراحل دورة حياة المُنتج البرمجي في نموذج الشلال

في هذا القسم, سوف نتعرف على تفاصيل كُل مرحلة مِن مراحل بِناء المُنتج البرمجي و ما هي مُدخلات و مُخرجات كُل مرحلة في نموذج الشلال. هذا النموذج يُعتبر واحد مِن الأنظِمة الكلاسيكية و اللتي كانت تُستخدم بِشكل كبير.

مرحلة تجميع المُتطلبات (Requirements)

هذه المرحلة تُعتبر حجر الأساس لجميع المراحل. حيثُ انه اي خطأ بهذه المرحلة سوف يكون له تأثير مُكلف جداً و قد يكون إصلاحه صعب. في هذه المرحلة يقوم مُهندس البرمجيات بِتجميع مُتطلبات العميل عبر عِدة طرق. من هذه الطرق هي عمل مُقابلات مع العميل و عصف الذهن و عمل إستطلاعات. ايضاً في هذه المرحلة يقوم مُهندس البرمجيات بِكتابة ما يُسمى بِ "وثيقة مُتطلبات البرنامج (Software Requirements Document)". هذه الوثيقة تحتوي على جميع مُتطلبات العميل و مصدرها و هل تم التَأكُد مِن صحتها ام لا. يتِمُ ايضاً بِهذه المرحلة عمل ما يُسمى ب "مُخطط حالة الإستخدام (Use Case Diagram)" و مُخطط التَسَلسُل (Sequence Diagram)". يُستخدم المخطط الأول لتوفير صورة عامة حول حالات الإستخدام اللتي مِن المُمكِن ان يقوم المُستخدم بإستخدام المُنتج البرمجي فيها. المُخطط الثاني يُستخدم لِتوضيح جميع الأحداث اللتي مِن المُمكِن ان تحصل في حالة حُصول إحدى حالات الإستخدام. لِكُل حالة إستخدام يوجد مُخطط تسلسُل.

Use Case Diagram
مثال على مُخطط حالة الإستخدام


مرحلة التصميم (Design)

بعد مرحلة تجميع المُتطلبات, تبدأ المرحلة التالية مِن دورة حياة المُنتج البرمجي الا وهي مرحلة التصميم. في هذه المرحلة, يتِمُ إستخدام وثيقة مُتطلبات المُنتج البرمجي لِتَصميم البرنامج. ايضاً في هذه المرحلة يُقسمْ البرنامج الى عِدة كُتل مُصغرة تُسمى ب "انظِمة مُصغرة (Sub-Systems)". كُل كُتلة يتم تَصغِيرها إلى وَحَدات اصغر تُسمى بالصُفوف او الفُصول (Classes). عِند تجميع الصفوف مع بعضها البعض, سوف نحصل على ما يُسمى بِ "مُخطط الصف (Class Diagram)". و عِند تجميع البرامج المُصغرة سوف نحصل على ما يُسمى بِ "مُخطط الرُزمة (Package Diagram)". ايضاً في هذه المرحلة يتِم تحديد الخوارزميات (Algorithms) و لغة البرمجة اللتي سوف يتم إستخدامها في مرحلة كِتابة التعليمات البرمجية. مٌخرجات هذه المرحلة سوف تكون وثيقة تصميم البرنامج (Software Design Document).

مِثال على مُخطط الرزمة و نرى اسماء الصفوف داخل كُل رُزمة


مرحلة التنفيذ (Implementation)

هذه المرحلة تُعتبر مِن اسهل مراحل دورة حياة المُنتج البرمجي. في هذه المرحلة يبدأ الفريق المسؤول عن المُنتج البرمجي في عملية كِتابة التعليمات البرمجية. يتِم إستخدام وثيقة تصميم البرنامج و وثيقة مُتطلبات البرنامج كمرجع لِهذه المرحلة. المُخرج النهائي لِهذه المرحلة هو المُنتج البرمجي.

في مرحلة التنفيذ, يتِم كتابة التعليمات البرمجية


مرحلة الإختبار (Testing)

في هذه المرحلة, يتم إختبار البرنامج مِن اجل التأكُد مِن صِحة مُخرجاته. مِن اجل هذه العملية, يقُوم مُهندس البرمجيات بِكِتابة خُطة إختبار المُنتج البرمجي (Test Plan). هذه الخُطة تحتوي على طريقة إختبار البرنامج و كيفية تشغيل حالات الإختبار (Test Cases). ايضاً هذه الخطة تحتوي على نتيجة تشغيل كُل حالة إختبار على البرنامج و نِسبة نجاح الإختبارات.


مرحلة الصيانة (Maintenance)

بعد الإنتهاء مِن إختبار البرنامج و تنصيبه في بيئة التشغيل, تبدأ اطول مرحلة مِن مراحل دورة حياة المُنتج البرمجي, الا وهي مرحلة الصيانة. في هذه المرحلة يتمُ عمل إصلاحات دورية للبرنامج في حال وجود أخطاء برمجية (Bugs) بعد التثبيت. ايضاً في هذه المرحلة يتِم توفير الدعم و المُساعدة للأشخاص اللذين سوفَ يقومون بِإستِخدام المُنتج البرمجي.

تحديثات نظام التشغيل تعتبر واحدة من مراحل حياة النظام البرمجي



مناهج تخصص هندسة البرمجيات بِجامعة الملك فهد للبترول و المعادن

بما انني درست تخصص هندسة البرمجيات بِجامعة الملك فهد للبترول و المعادن, سوف اقوم بِوضع شرح مُبسط لِكُل منهج اساسي مِن مناهج تخصص هندسة البرمجيات بجامعة الملك فهد للبترول و المعادن. عِلماً بأنه تُوجد بعض المناهج اللتي لم اذكرها هنا.

SWE 205: Introduction to Software Engineering

هذا المنهج هو مقدمة لِجميع مراحل دورة حياة المُنتج البرمجي. سوف يتم التحدث فيه عن كُل مرحلة بِشكل مُبسط و ما يحصل بها. ايضا سوف يتعلم الطالب عن ما يُسمى بِ نماذج دورات حياة النظام البرمجي (Software Process Model). هذه النماذج تُعتبر حجر الأساس في العمليات اللتي يقوم بِها مٌهندس البرمجيات. بِشكل عام, سوف يتم التحدث عن ثلاثة انواع, نموذج الشلال (Waterfall Model), النموذج الحلزوني (Spiral Model)  ومنهجيات آجَايل (Agile Methodologies).


SWE 215: Software Requirements Engineering

بعد تعَلُم اساسيات دورة حياة المُنتج البرمجي, سوف يتعلم الطالب في هذا المنهج على تفاصيل المرحلة الأُولى مِن الدورة. في هذا المنهج سوف تتعلم عن طُرق تجميع و إستخراج و تَتَبُع مُتطلبات العميل و كيفية كتابة وثيقة مُتطلبات المُنتج البرمجي (Software Requirements Document). ايضا سوف تتعلم التعامل مع التغيرات الغير مُوتوقعة في مُتطلبات العميل.


SWE 312: User Interface Design

هذا المنهج يعتبر منهج غير اساسي لكنه يعتبر مُهم. في هذا المنهج سوف يتعلم الطالِب عن انواع واجهات المستخدم المُختلفة (User Interface) و كيف يتعامل المُستخدم معها. كما نعلم كُل تطبيق برمجي له واجهة مُستخدم مُختلفة. فمثلاً, نجد ان للهواتف النقالة طريقة مُختلفة في إبراز واجهة المُستخدم عن تطبيقات سطح المكتب. ايضاً سوف تتعلم عن طُرق إنشاء واجهة مُستخدم سهلة الإستخدام. و بالنهاية, سوف تتعلم عن طُرق إنشاء دليل لكيفية تعامل المُستخدم مع المُنتج البرمجي.


SWE 216: Software Design and Architecture

هدف هذا المنهج هو تَعَلُم الطُرق المُختلِفة المُستخدمة في تصميم البرنامج. ايضاً سوف يتعلم الطالب في هذا المنهج الأهداف المُختلفة للتصميم. فعلى سبيل المِثال, قد يكون هدف التصميم هو زيادة امان النظام. او قد يكون هدف التصميم هو جعل عملية الصيانة اسهل. في نهاية هذا المنهج, سوف تتعلم كيفية كِتابة وثيقة تصميم البرنامج (Software Design Document).


SWE 326: Software Testing and Quality Assurance

في هذا المنهج يقوم الطالب بِتعلُم الطُرق المُختلفة المُستخدمة في إختبار البرنامج. ايضاً في هذا المنهج يتِم تدريس الطالب عن مفهوم جودة البرنامج و مقاييس الجودة اللتي يتِم إستخدامها لِتقييم المُنتج البرمجي. بالنهاية, سوفَ يقوم الطالب بِكِتابة خُطة إختبار البرنامج و يقوم بِتَنفيذها على مشروع برمجي صغير.


SWE 363: Web Engineering and Development

إن هذا المنهج يُعتبر مُقدمة لِتِقنيات الشبكة و كيفية عمل الإنترنت بشكل عام. سوفَ يتِم التحدث عن تطبيقات الشبكة و لُغات البرمجة المُستخدمة في عمل صفحات الشبكة مثل إتش تي إم إل (HTML) و جافاسكربت (JavaScript) و سي إس إس (CSS). ايضاً سوفَ يتِم التحدث عن الفرق بين العميل (Client) و الخادم (Server) بشكل مُختصر.


SWE 387: Software Project Management

هذا المنهج هو مُقَدِمة لِمفاهيم إدارة المشاريع و الطرق المُستخدمة في إدارة المشاريع البرمجية. بشكل عام, سوفَ يتِم التحدث عن المواضيع التالية, ادارة الموارد البشرية (Human Resources Management), تخطيط المشروع (Project Planning), مُراقبة المِيزانية (Budget Control) و كيفية تحليل المخاطر (Risk Analysis). سوفَ يتِم دراسة هذه المواضيع مِن منظور مُهندس البرمجيات.



هندسة البرمجيات و سوق العمل

مِن المُمكن ان يعمل خريج هندسة البرمجيات في عِدة مجالات. بِشكل عام, الخريج الحديث إما يعمل كمٌبرمج (Programmer) او يعمل كمُهندس إختبار (Test Engineer). مُهندس الإختبار هو الشخص اللذي يقوم بإنشاء و تشغيل الإختبارات على البرنامج. ايضا تُوجد اعمال أُخرى لِخرجي هذا التخصص. فعلا سبيل المِثال, من المُمكن ان يعمل خريج هذا التخصص كمُهندس مُتطلبات (Requirements Engineer) او مُهندس مِعمارية البرنامج(Software Architecture Engineer). غير هذه الوظائف, تُوجد مُسميات أُخرى لِعدة مناصِب من المُمكن ان يتوظف خريج هندسة البرمجيات فيها و منها:
  • مُطور تطبيقات أندرويد (Android Developer).
  • مُطور تطبيقات آيفون (IPhone Developer).
  • مُطور تطبيقات ويندوز (Windows Developer).
  • مُطور تطبيقات الشبكة (Web Developer).
  • رئيس فريق التطوير (Team Lead).
  • مُصمم مواقع إلكترونية (Web Designer).
  • مطور العاب (Game Developer).
  • مُصمم العاب (Game Designer).
  • مسؤول موقع إلكتروني (Webmaster).
  •  مدير قاعدة بيانات (Database Administrator).


الخاتمة

كما نرى, تخصص هندسة البرمجيات يختلف بشكل عام عن تخصص عُلوم الكمبيوتر و هندسة الكمبيوتر. كثير مِن الناس تُفكر بأن مُهندس البرمجيات يعمل فقط على كتابة البرامج و نشرها لكن بالواقع تُوجد عملية طويلة خلف البرنامج. شيء آخر مِن المُمكن قوله عن مُهندس البرمجيات هو انه  لابُد مِن ان يدرس مُعظم مواد عُلوم الكمبيوتر. فلِهذا السبب نستطيع القول بأن كُل مُهندس برمجيات هو عالم كُمبيوتر و ليس كُل عالم كُمبيوتر مُهندس برمجيات.

Saturday, May 6, 2017

Building a Website from Scratch: What to Consider

In 2015, I had an idea to lunch my own personal website. The aim of the web site is to provide programming lessons for Arabic and English speakers. After 2 years from then, the website is launched and the name of the website is Programming Academia.

Programming Academia logo. One of my big projects that I'm Still working on.


During the year after the idea, I did not do that much work since I was kinda busy with my studies. After finishing term 152 (Around the end of May, 2016) , I started getting my hands dirty with web development. From then till now, I did many things. Some of them were wrong and some of them were correct. In this post, I will briefly till you what are the steps that I did from then till the website has become online.

Since I did not have any experience in web development, many of the steps were overlapping. But now that I have some experience, I will order them according to the correct order that I think is the best. The things that you must consider are:
  • Website Idea
  • Choosing the Name + Domain Name
  • Programming Language Selection
  • Setup Local Environment for Development and Testing
  • Start Developing your Site
  • Buying Domain Name + Hosting Service
  • Publish Your Website
  • Maintaining The Website.

If you plan to create your website from scratch without using any frameworks, you must have enough knowledge about the following:
  • HTML.
  • CSS.
  • JavaScript.
  • One server side scripting language (PHP, ASP.NET, JSP, ... ).
  • Responsive web design (Creating a grid system).

The Idea

The first and most important thing is the website idea. As for me, the initial idea was to create a website for programming lessons in Arabic. But at later stage, I changed the idea from Arabic lessons to English and Arabic lessons.after I started adding content, I have noticed that the quality of the website content was poor. What I did to fix that is to provide content in English and then translate it to Arabic since my English writing skills are better than Arabic writing skills. 

Choosing The Name and Domain

Once I have selected the idea, I started thinking about a name and a domain for the website. Usually the name of the website should be associated with the domain name but it is not necessary. Also the name should reflect the main idea of your website. Personally, I selected 4 different names for my website, Unidemics, Programming Cities, Programming Academics, and Programming Academia. At this stage, I did not think about domain name which was my first mistake. At this stage, you should select all possible domain names that reflects the type of service your website will provide. It is good idea to go to any domain registration service provider and check domain names and prices. As for me, I did not know about the existence of such services till I started thinking about buying a domain. I have used two to search for available domain names, the first one is register.com and the second one was register.hostgator.com. You should not buy a domain, only check available names and prices. Usually the prices are between 10$ to 15$ for one year. If it include other services (Such as domain protection) the price will go up.

Programming Language Selection

When I say programming language selection, I don't mean HTML or JavaScript. What I mean is the server side programming language. As for me, I did not have any knowledge in any server side scripting when I started working on the website. The first server side scripting language I have dealt with was ASP.NET. It was very hard language for me to learn. After few months, I have decided to learn PHP for my senior project at university. It took me around 2 weeks to digest the basics of PHP which is good.  For that reason, I selected PHP. Note that the selection of server side language will affect the selection of hosting provider and the plan you select at later stage.


Setup Local Environment for Development and Testing

This step was very hard for me as there was not that much information about it. The first thing to do is to select an IDE and after that install a local server for testing the website locally before publishing.

IDE Selection

The first thing I did is to search the web for good IDE that can be used for web development. The problem is that I did not find any specific answer. For that reason, I was jumping from one IDE to another. This is the second mistake that I did which costed me a lot of time. Don,t change IDE very frequent. The first one was Microsoft Expression Web. After developing a small skeleton for my website (HTML + CSS only), I switched to  Microsoft WebMatrix. When I started using WebMatrix, I started learning about server side scripting and ASP.Net + Some PHP. After that, I switched to my favorite IDE of all time,  NetBeans IDE. After selecting NetBeans IDE, I did not change it till now.

Installing Local Web Server for Testing

One thing that I did is testing my website locally. The idea is to install a local server that can run your server-side code. If you select PHP as I did, then you will need to install Apache Server. After installing the server, you need to install PHP it self. Finally, One additional thing you might need is database. Every website will need a database at some point.

Installing the 3 alone is kinda difficult. For that reason, there are Software Stacks that contain the 3 and can install them at once. The stacks called 'AMP' and stands for 'Apache, MySQL and PHP. The first stack that I have used is called WampServer. After having hard time with it, I switched to new stack called Bitnami WAMP Stack. It include a lot of features which I don't use but it is the best stack for me so far.

Starting The Real Development

The next step of website development is to start writing website code. One of the good practices in my opinion is to create a templates that you should use for each different part of your website. For example, If your website is a news website, create a template for displaying news in a neat way.

Writing CSS + HTML

The first thing in building a website is to create the user interface. One possible way is to build HTML and CSS at the same time (As I did). By using this way, you will create the CSS code that you need for the current part of your page. The other thing is that make sure your design is modular and responsive. This means that the same web page should look good in small screens and big screens. One way to achieve this is to create your own grid system using CSS.

Also there are other things to consider while structuring your HTML page. The correct use of HTML tags will have an effect in how your website will rank in search engines. Also the use of schema.org vocabulary in your HTML will help web crawlers understand your content easily.

Creating Content

Once you have created your templates, it is time to create content for your website. One important factor to attract visitors to your website is to create a unique content that your visitors find very useful. Also the other thing is to make sure that your contents are up to date.


Buying The Domain Name + Hosting Provider

Once you have created sufficient content for your website, it is time to think about publishing your work and share it with the people you love. The first step in doing that is to buy a domain name. Buying a domain name is a simple task. As for me, I bought programmingacademia.com from register.hostgator.com for around 74$ for 3 years with a service called domain protection. This service hides domain owner information from being visible to public.

After buying the domain, it is time to select hosting plan. Usually when you go to any hosting provider, It will ask you what type of server you need for your website. The selection of server type will  Depend on the selected server-side scripting language. For example, If you selected PHP, then you will need Apache Server With PHP installed on it. If you have selected Node.JS, you will need a server with Node.JS support. As for me, PHP was the selected option. For that reason, I have selected Apache Server With PHP as my server.

For the hosting provider, I have decided to go with hostgator.com since I bought my domain name from them. The type of hosting is shared and the package is called 'baby' according to hostgator. It costed me around 130$ for 3 years. I also included SSL for one year with additional cost. The total cost was around 150$.

Publishing Your Website 

Usually, after buying the hosting plan, it takes around 1 day for your server to run 100% perfectly. Uploading website content to your server is simple. There are two ways to do this task, Either you do it manually by going to your cPanel and then upload files or use FTP Client to upload content. The best option is to setup an FTP account and use FTP client. As for me, I use FileZilla to manage my website content. It is very easy to use.

Maintaining Website After Publishing

Now that you have something that you can share with people,  you need to maintain it and add more content to it. In my opinion, this is the most difficult stage in the process of building a website. At this stage, you need to collect feedback from your website users, respond to them and allow them to talk with you.

Final Words

Now a days, it is possible to build a website in a matter of hours by using one of many automation tools available. But if you would like to learn every thing, building the website from scratch by your self would be your option. For sure it will take time to build it but you will enjoy the whole thing and you will be happy by the result of your work at the end.

Also I would like to mention that there are many other steps that I did in between which I did not include. If you have any question please feel free to ask me in the comment section bellow.

Tuesday, May 2, 2017

Software Vulnerabilities and Exploit: Heap Overflow Explained

According to Wikipedia, "A heap overflow is a type of buffer overflow that occurs in the heap data area.". Before we continue with the details of this type of vulnerability, we have to understand how computer memory is structured for any given program. Also we need to keep in mind the following concepts:
  • 1 Byte = 8 Bits.
  • sizeof(char) = 1 byte.
  • sizeof(int) = 4 bytes.
  • If we locate an integer at address 0x00000000, the next integer will be at 0x00000004.
  • If we locate a character at address 0x00000000, the next character will be at 0x00000001.
Also you must have basic knowledge about how the memory of a program looks like.

How to Exploit The Heap?

One possible scenario is as follows, we locate two memory locations to hold two pieces of data. We try to place more data in the first located location to override the data on the second location. This seems simple. Before we try to do it in C Language, we need to look at the structure of the heap in memory.

Heap Memory Structure

The first thing to know is that heap memory is divided into chunks. One chunk can have one of two states:
An allocated chunk contain the following information: Size of previous chunk (if allocated), Size of chunk (in bytes) with some bit flags and  User data. A free chunk contain the following information: Size of previous chunk, Size of chunk (in bytes),  Forward pointer to next chunk (FD), Back pointer to previous chunk (BK) and unused space (it can be 0).

 Exploiting the Heap

 Now let's return to the scenario that we have talked about before and explain it in more details. When we locate memory in the heap, the top chunks will be the last chunks that was located.

 Heap over flow can happen when we try to fit more data in the first chunk than its size. The next code example shows a vulnerable code in C. 
int main(int c, char ** argv) {

//buffer for 2 chars
char *buf = (char *)malloc(sizeof(char)*2);
//the buffer can have only 2 bytes
//argv[0] will be the name of file
//it can be more than 2 characters -> overflow
strcpy(buf, argv[0]);
}

The next picture shows how the heap will look like when buffer overflow happen.



This is the  basics behind buffer heap overflow.