5th semester project – Adwiteeya Agrawal | Home

A little disappointment after the 5th semester project viva

Adwiteeya Agrawal — Sat, 20 Oct 2012 17:02:57 +0000

I had been playing around too much with the VoIP PBX(asterisk) that I had setup and hence I decided it to be the 3rd year project. I had really worked hard for this one. Firstly it was a totally different technology all together, plus whatever work you do is more of kinda research rather than knowing before hand weather it was going to work or not.

Now we hadour viva for the project on 29th of September 2012. And obviously 28th was going to be the day for its final completion. The binding and printing was destined to be done on 29th itself. That’s the general trend we go by, here in colleges in Delhi, India.

So late till 4:30 i had completed my projected. I was a little relaxed with the printing because I had a colored printer at home and it was working fine. So the very next morning at around 8:30 i started the printing of the project.
The first disappointment that I had was that there was not going to be any kinds of project presentation it was only and only a viva. But this was not that harmful as if i talk about only and only me…. my project required setting up hardware and yes that could have been cumbersome for an on the spot kind of a thing plus it was not enough to write a blog post…things like this happen a million times when you are in IP university. The disappointment came as follows:-

I had been making an excuse for not scoring really good in exams, for getting up late in the morning, for always being on my laptop to friends and family that I was doing “security”, and this right here was going to be my very first project about security. So I had nerved myself for this viva. This was the right moment where I would have been tested on grounds that I consider my grounds.

Not that I was prepared and all set to face the music, I was scared too, I was as afraid as I would have been if I were giving a viva related to java programming, but the only difference was that i am going to test myself here, and it was happening the way it was supposed to be, people were being questioned like hell each viva being conducted for a span of 20 minutes. And finally i was the next in line for viva, but then suddenly a different teacher entered the room who is supposedly a lenient teacher but a really knowledgeable one. She was going to take my viva. I was both happy and sad. I was happy that the viva was going to be a comfortable one, on the other hand i was sad, and here comes the disappointment, because it was over in 5 minutes. All I was asked was what a PBX is and what is your project about. Then randomly i was asked about what one of the attacks were. I wasnt asked what codes are used, should be used, what are the tradeoffs in the communication channel, i wasnt asked protocol compositions, I wasnt asked really anything technical.
A lot of my friends who I told about this, said that if they were in my place they would have been more than just super happy and would have danced as they walked out of the room. Yes i would have done that too if it were not about security.

Anyways case close. Move on.

The SQL injection Presentation.

Adwiteeya Agrawal — Sat, 18 Aug 2012 02:07:30 +0000

Hi, so we have this subject called DBMS (database management system) which is taken up by Miss. Nishtha Jatana. Nishtha maam follows a different routine for her classes…a rather constructive one. She converts her initial 2 – 3 tutorial classes into presentations that are delivered by the students. If you don’t know what a tutorial class is.. it is basically a kind of an extra class where students can ask doubts or there can be revision of topics or some numerical problems related to the topics can be done. Now the presentations are conducted on a voluntary basis. There is no compulsion, so i decidedto give a presentation on SQL injection. Off course, this was the topic that was closely related to both DBMS and security. So I had the presentation scheduled for 13th august at 4:30pm. BUT I reached the room 10 minutes late! and then my laptop for some reason(winsock reset) did not connect to tata photon that wasted another 20 minutes so i was practically left with 20 minutes only… we (initially i and my friend were giving the presentation together) started the presentation but offcourse it did not end and also there were only 6 students in the class :D . So maam postponed it to 17th august at 2:20pm and the awesome part was she booked the seminar hall !!! and also I had two periods for the presentation!!! and one of the periods was a lecture!! not a tute!! I really thank her for making me do this… because I too learned a lot while researching on SQLi.

Though I had in my mind that 2 periods! thats long …am I really gonna be able to make it till then..! Allright so this time the presentation in the seminar hall and all my classmates present there! :) The best part is that I knew they were bored like hell… obviously its not of there interest … but they supported me… they were quite and occasionally tried listening as well.. :) Thanks to them for being awesome. :) Now I started with the presentation (this time only I was doing it) and noticed that even my proctor Saba maam was present there… Then it went on ….things worked fine.. one of examples took time hence was not completed on the spot… like you know when your software does not recognize the version of the DBMS on the server… But apart from that it was nice… it went how i had planned… and also i loved the complements … in fact I got the best compliment from my proctor. She said that it was really practical… and generally seminars are not so practical!!! And that pretty much is the motto of my life… to keep things practical. :) Then my classmates’ comments… which actually gave me the right feedback and scope for improvement… Things like i need to take breaks in between, i have to interact more with the audience, include less of backtrack and I could use the zoom tool’s bar feature rather than zooming the entire screen. I would keep that in mind next time :) … and lastly the shocking part was i fucking took the entire too periods!! sorry classmates. :D
Also my offer of sharing the resources for a total of more than 12 types of sql injections is still open if you buy me a coke. :D

The Asterisk Project.

Adwiteeya Agrawal — Wed, 25 Jul 2012 13:56:33 +0000

Hi reader,

I am not sure if you stumbled upon this post from the archive or reached here by a search. But I am going to be verbose anyways :D

Asterisk is an open source PBX. Well i would say its too less to call it as just a PBX. It has immense potential it can do things so easily and so correctly that it is actually an unparalleled solution for PBXs. Ohkay if you are wondering what a PBX is it is those system you see in offices, where the receptionist dials one and the call is transferred to another guy. So why am I playing around with this thing… ? Well there is this one very annoying thing, rather a concept called as the “5th semeseter Project”. Exactly thats why.! :

Now for the project I could have joined some course and could have easily got a project from that institution…. But I did not like that…I did not want that… I had to go for a training in hacking and so I went for ECSA (EC COUNCIL Certified Security Analyst). Well, now I had to make a project that was related to my training and hence hacking… Shit! You give me a server and ask me to do a penetration testing I would do that…but writing a PROJECT… it seemed like the world is ending. :D

But then there was this awesome friend of mine. Mr. Vipul Bhojwani who asked me if i had an IVR solution. I did not know what that was… so I googled. Interactive Voice Respone….no i did not have a solution for that. So I asked him what does he wish to do.. He said he wants to set it up on gmail! Fuck. Wont that be awesome if someone calls you on gmail and you have an IVR set up there… yes it would be!!

I wanted that…. i started this from the scratch… and after 1 hour of googling i realized that this was possible only if i had a google voice number(which turns out to be incorrect)… which obviously i couldnt as I am in India. But every time i searched IVR on google there were results that let me to asterisk.org. I was curious that maybe somehow i can atleast complete it till the point i am not asked for a google voice number. So i downloaded asterisk. :D
And successfully configured it. Now the very next day i had a class on VOIP penetration testing at my training so I should my trainer what i had set up…. That is i should him how i could make free VOIP calls within the subnet. So he told me to intercept the call. WHAT!!!

yes he told me to capture what to guys were talking ….something like phone tapping . So i did that ..infact was a piece of cake …and here was my project born. :)
So I am making a project now on different vulnerabilites of a PBX system and the associated protocols and offcourse the ways to fix those issues. I am writing in the first person…i think that is the correct way… and i am being reaallllyyyy verbose… who so ever gets the project will be able to make such a system. I hope things work fine… I am doing a lot of reading for this… Getting to learn about new protocols day by day…