Remote Exploit Forums

Go Back   Remote Exploit Forums > Specialist Topics > Programming


Programming A place for our community to discuss their own security related coding projects.

   

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 11-04-2009, 08:46 PM
Nick_the_Greek's Avatar
Senior Member
 
Join Date: Jul 2009
Location: Greece
Posts: 177
Default Validating user input in bash.

Hi community

I am doing some experimentations in bash script. Learning from various sites. The last time that I do programming was since Locomotive Basic.(Remember Amstard 6128 ?)

I can find out a better way to validate user's inputs with read command.(please see below). I am trying to accept only those inputs from users that are meet some criteria.

Like:
read WEP keys --> accept only (5 or 13 ascii) or (10 or 26 hex)

I found a way and a really don't think is the correct one because it is "command specific". With that I mean that I use the errors from a specific command (in my case iwconfig) to see if that input (key xxxx..) that I get from the user, fits to the command.

Code:
 #!/bin/bash

clear
echo -n "WEP Key: ?"

while read key; do
     if [ -z "${key}" ]; then
        clear  
	echo "That was empty, do it again!"
	echo -n "WEP Key: ?"
     else
          echo "Checking now..."
          break
     fi
done

iwconfig wlan0 key $key >/dev/null 2>&1

if [ $? != 0 ]; then
	echo "Your key is `echo ${#key}` characters long"
	echo "It should be : a) 10 or 26 ASCII characters long"
	echo "          or : b) 5 or 13 HEX characters long" 
else
	echo "Valid key"
fi
I don't want to use the above, since with that I must have a wireless interface up. And if I got one then that he will use that key before I wanted to. After all there are cases that there aren't commands to validate user's inputs.

Can you suggest me a better way to validate user inputs?

Thank you in advanced.

Nick
__________________
The quieter you become....

Last edited by Nick_the_Greek; 11-06-2009 at 04:24 PM. Reason: (5 or 13 ascii) or (10 or 26 hex) is correct
Reply With Quote
  #2 (permalink)  
Old 11-04-2009, 10:20 PM
Gitsnik's Avatar
Senior Member
 
Join Date: Jun 2009
Location: The Crystal Wind
Posts: 637
Default

Quote:
Originally Posted by Nick_the_Greek View Post
read WEP keys --> accept only (10 or 26 ascii) or (5 or 13 hex)
As always, most of this is untested (or deliberately flawed) to make sure you have to figure it out for youself
Code:
read WEPKEY
WEPKEY=`echo $WEPKEY | cut -c 1-26`
HEXSTRIPPED=`echo $WEPKEY | sed 's/[^0-9A-F]//g'`
if [ $HEXSTRIPPED -ne $WEPKEY ];
then
    # key is ASCII
    SHORTASCII=`echo $WEPKEY | cut -c 1-10`
    # now we have $SHORTASCII and $WEPKEY, we need to check the length
    # of SHORTASCII and compare it to the length of WEPKEY. If SHORT is equal
    # to 10, and wepkey is not equal to 26, then we use short, else wepkey
    # unless neither are the right size, then we bail out.
    # bonus side effect: we fail through to a 10char ascii key, rather than a
    # 15 character ascii key
    SHORTLEN=`expr length $SHORTASCII`
    # etc. Same applies to HEX
else
    # key is HEX
fi
The -z you are using merely checks if the variable is empty (or zero), expr length $BLAH lets you figure out the length of the variable, and the cut command is the one that lets you strip them back to the appropriate sizes.

Edit: And wahey he finally joins the ranks of Senior Members!
__________________
Never underestimate the power of human stupidity - it is like a force of nature, capable of destroying even the most well laid plans.

Last edited by Gitsnik; 11-04-2009 at 10:34 PM.
Reply With Quote
  #3 (permalink)  
Old 11-05-2009, 08:13 PM
Nick_the_Greek's Avatar
Senior Member
 
Join Date: Jul 2009
Location: Greece
Posts: 177
Default Got it

OK Gitsnik

Sorry for being late to respond. It was a hell of day, today. I think I got it now. I have hard time with sed. It's not fully understandable by me, until now. It will be.

Quote:
Originally Posted by Gitsnik View Post
As always, most of this is untested (or deliberately flawed) to make sure you have to figure it out for yourself
Where is joy of making if you spoonfeed me ? I most cases when I try to find a solution for something, while I do searching, I learn x100 more.

Anyway. I am starting to believe that it is fate's (or yours ) decision to carry me out in your shoulders.

Thank you, again

Nick

PS Get out of my way newbies. Here comes a Senior member.
__________________
The quieter you become....

Last edited by Nick_the_Greek; 11-05-2009 at 08:51 PM.
Reply With Quote
  #4 (permalink)  
Old 11-05-2009, 10:29 PM
Gitsnik's Avatar
Senior Member
 
Join Date: Jun 2009
Location: The Crystal Wind
Posts: 637
Default

sed is a joy once you get it - there is a page full of one liners on sourceforge, as well as one similar for awk and others.
Quote:
Originally Posted by Nick_the_Greek View Post
Anyway. I am starting to believe that it is fate's (or yours ) decision to carry me out in your shoulders.
I doubt the Moirae have anything to do with me - though they might because you keep asking questions I have answers to!
__________________
Never underestimate the power of human stupidity - it is like a force of nature, capable of destroying even the most well laid plans.
Reply With Quote
  #5 (permalink)  
Old 11-06-2009, 01:10 PM
thorin's Avatar
Senior Member
 
Join Date: Feb 2006
Location: Northern Hemisphere
Posts: 2,545
Default

It's not pretty but you could also simply try the command with the given input and then check the exit status based on the $? environment variable.
__________________
I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.

I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.
Reply With Quote
  #6 (permalink)  
Old 11-06-2009, 04:12 PM
Nick_the_Greek's Avatar
Senior Member
 
Join Date: Jul 2009
Location: Greece
Posts: 177
Default

Quote:
Originally Posted by thorin View Post
It's not pretty but you could also simply try the command with the given input and then check the exit status based on the $? environment variable.
This is what I already did.

Maybe you missed out my first post Thorin.
Code:
.....
iwconfig wlan0 key $key >/dev/null 2>&1

if [ $? != 0 ]; then
	echo "Your key is `echo ${#key}` characters long"
	echo "It should be : a) 10 or 26 ASCII characters long"
	echo "          or : b) 5 or 13 HEX characters long" 
else
	echo "Valid key"
fi
Yesterday I finished that. It is not that difficult. I just needed some help with `sed`.

Thank you for trying.
__________________
The quieter you become....

Last edited by Nick_the_Greek; 11-06-2009 at 04:18 PM.
Reply With Quote
  #7 (permalink)  
Old 11-06-2009, 07:56 PM
thorin's Avatar
Senior Member
 
Join Date: Feb 2006
Location: Northern Hemisphere
Posts: 2,545
Default

Ya I didn't bother reading your code, oh darn....
__________________
I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.

I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 03:40 PM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.3.2