Fixed header for a html page

I was recently working with an application in which users requested for a fixed header that would not move  with the web page as its users scroll left or right.

I went through a bunch of options  to do it and every attempt I have made in the past with similar requests were kind of close and I had to include the usage of either quick javascrit functions that runs with a specified interval or I had to use the tag named "<!doctype>" and end up screwing my happiness with thanks to the different versions of the beautiful internet explorer.

I dont remember where I got the following stuff, but I really though that using "expression" with css is a no brainer. I also remember words from certain geeks advicing not to rely on them.

May be I dont understand the geeks yet, cos this 'expression' stuff with css seems to be good. Following is what I am taking about

<div style="left: 0px; left: expression(eval(document.body.scrollLeft)); position: fixed; top: 0px; top: expression(eval(document.body.scrollTop));">
My header contents </div>


I never knew that I had to use expression with eval of something. kriss... Thats some trick that I got to know better and remember. After all it makes life easier. Plus, this still has a few issues with the great internet explorer.Advanced users will eventually never use IE so better find a different browser to always work with.

On top of it, this code, I mean the usage of Expression keyword with Eval keyword is a trouble that you have to go through for IE alone. Because, "position:fixed" alone would do the work in Firefox and Chrome.

List all ODBC Connections mapped with Lotus Notes using Lotusscript

A while ago I was given a very nice job of finding why a lotus script agent was not able to communicate with a DB2 server. And the nice stupid part about that is I never had acess to even view the log files of the server where the issue occurs. It was kind of frustrating for a while to understand/find the source of the issue with virtually no resources. It was that I was thinking about the most basic of the scenarios like, network problems, lan cable issues etc etc,

So eventually I just wanted to know if there is a way to list down the kind of connections that are prevalent with a lotus domino server and ended up discovering the following. Again I just discovered if for myself. It was always able on the innernet some how of the other.:)

The following code gives you a message box with something like,
 "The usable connections are file, notes, odbc2, oledb"

Atleast this is what I got. Evidently db2 was missing in the list for me and hurray, administrators found it at last that db2 was not mapped properly with the lotusdomino servers after looking at the proof . What ever that means. :P

Dim session As New LCSession
 Dim conName As String
 Dim text_str As String
' list the connectors available
' the parameters for connector code, identity flags, and
' identity names are optional and omitted in this example
 Call session.ListConnector(LCLIST_FIRST, conName)
 text_str = conName
 While session.ListConnector(LCLIST_NEXT, conName)
  text_str = text_str + ", " + conName
 Wend
 Msgbox "The usable Connectors are " & text_str

Formula inMemory note - Web Hack

When researching about the _doClick related concepts, I found a hack that might possibly be a serializaied representation of the memory segment where a formula command will be stored in a server.

This sounds funny and frightening to me - "Yin and Yang" concept, if I am not wrong.

Well as usual try the following ridiculous stuff and tell me that I am not crazy.

1. Create/open a form in Lotus Notes
2. Create a button and put some formula code inside it as illustrated in the following screen shot.

3. Now navigate to the HTML tab of the button properties dialog and simply add "<>" in the 'Other' field as illustrated in the previous screen shot .

4. Now preview the form in browser and you will be able to see some thing like this

Discussion points in few forums say that these numbers are memory segment representation sort of stuffs in the server with the domino uses via "_click" field in post data or a &click argument in a url  to trigger and execute these formula commands.

Man this stuff is crazy.

_doClick in Lotus Notes - A javascript refresh trigger other than window.reload

This was a strange stuff that I have never encountered before. This is a nice stuff that one can use to screw your lotus domino based web pages with as well. Hope there are not too many hackers around.

I stumbled upon this when I had to avoid a page refresh that was triggered due to selection of the property named "Refresh fields on keyword change" for a combobox field type in the lotus notes form.

It was like there were no ways to impose a partial refresh of web page segments like the ones available with XPages. Eventually search for a desparate hack went in vain but I was able to discover the existence of this particular hack.

Hope this helps some one though I did not have any use for the same. Following is what I am speaking about.

1. Create a form. Include a dropdown "combo" field in it. Give it some options and select the property "Refresh fields on keyword change".



2. The property selection I am speaking about is illustrated as follows

3. Put a date time field near by the combo box and ensure that it displays time upto seconds at any point of its display

 5. Now preview the form on the web. Nothing big right. You see 2 simple fields just as expected

 6. And if you change a value in the dropdown, you page will be refreshed because of the associated option "Refresh fields on keyword change". So eventually, you will be able to see a new time that is computed and displayed on the webpage

 7. Now go back to the designer and uncheck the option "Refresh fields on keyword change" in your combobox properties window

 8. And add the following code in the onchange event of the dropdown box.

_doClick('$Refresh', this, '_self', '#_RefreshKW',"myDropDown")

9. Now save and preview your webpage again and try changing the values in the dropdown again. You will be able to recognize that the page behaves in a simialr way and it is no different from the property selection on the dropdown field.

10. Interesting right.

Now my worry is I guess, I will be able to perform a few hacks with this. So more to think about when developing webpages in future  :(

Hope this helps :)

A list of Mime Types

Following is a list of mime types of most used file types. I wish I had found this earlier

Extension	Mime Types	File Types
	Audio formats
.snd	audio/basic	Sun/NeXT audio format
.au	audio/basic	Sun/NeXT audio format
.aiff	audio/x-aiff	Apple audio format
.aifc	audio/x-aiff	Apple audio format
.aif	audio/x-aiff	Apple audio format
.wav	audio/x-wav	Windows WAV format
.mid	audio/mid	Windows MIDI format
.rmi	audio/mid	Windows MIDI format
	Image formats
.bmp	image/bmp	Windows bitmap format
.gif	image/gif	GIF
.ief	image/ief	Image Exchange format
.jpg	image/jpeg	JPEG
.jpe	image/jpeg	JPEG
.jpeg	image/jpeg	JPEG
.tif	image/tiff	TIFF
.tiff	image/tiff	TIFF
.ras	image/cmu-raster	CMU raster format
.png	image/png	PNG
.pnm	image/x-portable-anymap	PBM Anymap format
.pbm	image/x-portable-bitmap	PBM Pixmap format
.pgm	image/x-portable-graymap	PBM Graymap format
.ppm	image/x-portable-pixmap	PBM Pixmap format
.rgb	image/x-rgb	RGB format
.xbm	image/x-xbitmap	7bit-X bitmap
.xpm	image/x-xpixmap	X pixmap format
.xwd	image/x-xwindowdump	X window dump (xwd)
.cmx	image/x-cmx	Corel CMX format
.ico	image/x-icon	X-Icon format
	Video formats
.mpg	video/mpeg	MPEG
.mpe	video/mpeg	MPEG
.mpeg	video/mpeg	MPEG
.qt	video/quicktime	QuickTime
.mov	video/quicktime	QuickTime
.avi	video/avi	MS Video for Windows
.movie	video/x-sgi-movie	SGImovieplayer
.asf	video/x-ms-asf	MS Active streaming format
.asx	video/x-ms-asf	MS Active streaming format
.vdo	video/x-vdolive	VDOLive script
	Message formats
.eml	message/rfc822	Outlook Mail Message
.mht	message/rfc822	Mail Message
.mhtml	message/rfc822	Mail Message
	Text formats
.html	text/html	8bit-HTML
.htm	text/html	8bit-HTML variant
.htmls	text/html	8bit-HTML w/ Server-side includes
.shtml	text/html	8bit-HTML w/ Server-side includes
.css	text/css	8bit-Cascading Style Sheet
.xml	text/xml	8bit-XML
.htc	text/x-component	8bit-HTML component
.c	text/plain	7bit-C source
.h	text/plain	7bit-C headers
.cc	text/plain	7bit-C++ source
.cpp	text/plain	7bit-C++ source
.cxx	text/plain	7bit-C++ source
.hh	text/plain	7bit-C++ headers
.hxx	text/plain	7bit-C++ headers
.m	text/plain	7bit-Objective-C source
.f90	text/plain	7bit-Fortran 90 source
.txt	text/plain	7bit-Plain text
.rtx	text/richtext	7bit-MIME Richtext format
.tsv	text/tab-separated-values	7bit-Tab-separated values
.etx	text/x-setext	7bit-Structure Enhanced Text
.for	text/plain	7bit-Fortran
.mar	text/plain	7bit-MACRO
.log	text/plain	7bit-logfiles9
.com	text/plain	7bit-scripts
.sdml	text/plain	7bit-SDML
.list	text/plain	7bit-listfiles
.lst	text/plain	7bit-listfiles
.def	text/plain	7bit-definition files
.conf	text/plain	7bit-definition files
.cnf	text/plain	7bit-definition files
.vcf	text/x-vcard	7bit-VCard
.manifest	text/cache-manifest	7bit-manifest file
	Compressed file formats
.gz	application/x-gzip	GNU Zip
.zip	application/x-zip	PKZIP
.tar	application/x-tar	4.3BSD tar
.ustar	application/x-ustar	POSIX tar
	Lotus application formats
.123	application/vnd.lotus-1-2-3	Lotus 1-2-3 97
.wk4	application/vnd.lotus-1-2-3	Lotus 1-2-3 97
.wk3	application/vnd.lotus-1-2-3	Lotus 1-2-3 97
.wk1	application/vnd.lotus-1-2-3	Lotus 1-2-3 97
.wks	application/vnd.lotus-1-2-3	Lotus 1-2-3 97
.scm	application/vnd.lotus-screencam	Lotus ScreenCam Movie
.lwp	application/vnd.lotus-wordpro	Lotus Freelance 97
.sam	application/vnd.lotus-wordpro	Lotus Freelance 97
.prz	application/vnd.lotus-freelance	Lotus Freelance 97
.pre	application/vnd.lotus-freelance	Lotus Freelance 97
.imp	application/vnd.lotus-improv	Lotus Improv
.odt	application/vnd.oasis.opendocument.text	Lotus Symphony OpenDocument Text
.odp	application/vnd.oasis.opendocument.presentation	Lotus Symphony OpenDocument Presentation
.ods	application/vnd.oasis.opendocument.spreadsheet	Lotus Symphony Opendocument Spreadsheet
	Microsoft application formats
.doc	application/msword	Microsoft Word
.dot	application/msword	Microsoft Word
.docx	application/vnd.openxmlformats-officedocument.wordprocessingml.document
.dotx	application/vnd.openxmlformats-officedocument.wordprocessingml.template
.docm	application/vnd.ms-word.document.macroEnabled.12
.dotm	application/vnd.ms-word.template.macroEnabled.12
.pub	application/x-mspublisher	Microsoft Publisher
.mpp	application/vnd.ms-project	Microsoft Project
.pot	application/vnd.ms-powerpoint	Microsoft Powerpoint
.ppt	application/vnd.ms-powerpoint	Microsoft Powerpoint
.pps	application/vnd.ms-powerpoint	Microsoft Powerpoint
.ppa	application/vnd.ms-powerpoint
.pptx	application/vnd.openxmlformats-officedocument.presentationml.presentation
.potx	application/vnd.openxmlformats-officedocument.presentationml.template
.ppsx	application/vnd.openxmlformats-officedocument.presentationml.slideshow
.ppam	application/vnd.ms-powerpoint.addin.macroEnabled.12
.pptm	application/vnd.ms-powerpoint.presentation.macroEnabled.12
.potm	application/vnd.ms-powerpoint.presentation.macroEnabled.12
.ppsm	application/vnd.ms-powerpoint.slideshow.macroEnabled.12
.scd	application/vnd.ms-schedule	Microsoft Schedule
.wcm	application/vnd.ms-works	Microsoft Works
.wdb	application/vnd.ms-works	Microsoft Works
.wps	application/vnd.ms-works	Microsoft Works
.wri	application/x-mswrite	Microsoft Write
.xla	application/vnd.ms-excel	Microsoft Excel
.xlc	application/vnd.ms-excel	Microsoft Excel
.xlm	application/vnd.ms-excel	Microsoft Excel
.xls	application/vnd.ms-excel	Microsoft Excel
.xlt	application/vnd.ms-excel	Microsoft Excel
.xlw	application/vnd.ms-excel	Microsoft Excel
.xlsx	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
.xltx	application/vnd.openxmlformats-officedocument.spreadsheetml.template
.xlsm	application/vnd.ms-excel.sheet.macroEnabled.12
.xltm	application/vnd.ms-excel.template.macroEnabled.12
.xlam	application/vnd.ms-excel.addin.macroEnabled.12
.xlsb	application/vnd.ms-excel.sheet.binary.macroEnabled.12
	Macromedia formats
.dcr	application/x-director	Shockwave for Director
.dir	application/x-director	Shockwave for Director
.dxr	application/x-director	Shockwave for Director
.swf	application/x-shockwave-flash	Shockwave Flash
.spl	application/futuresplash	Future Splash Animator
	RealAudio formats
.rm	application/vnd.rn-realmedia	RealPlayer
.rpm	audio/x-pn-realaudio-plugin	RealAudio plug-in
.ra	audio/x-pn-realaudio	RealPlayer
.ram	audio/x-pn-realaudio	RealPlayer
.rv	video/vnd.rn-realvideo	RealPlayer
	VRML formats
.wrl	x-world/x-vrml	VRML
.wrz	x-world/x-vrml	VRML
.xaf	x-world/x-vrml	VRML
.xof	x-world/x-vrml	VRML
	Other application formats
.cdf	application/x-cdf	Channel file
.323	application/h323	H.323 Internet Telephony
.js	application/x-javascript	JavaScript
.class	application/octet-stream	Java class file
.bin	application/octet-stream	Uninterpreted binary
.wp5	application/wordperfect5.1	WordPerfect
.oda	application/oda	Open Document Architecture
.pdf	application/pdf	Adobe Acrobat
.ai	application/postscript	8bit-Adobe Illustrator
.eps	application/postscript	8bit-Encapulated PostScript
.ps	application/postscript	8bit-PostScript
.rtf	application/x-rtf	7bit-RTF
.csh	application/x-csh	7bit-C-shell script
.dvi	application/x-dvi	TeX DVI
.hdf	application/x-hdf	NCSA HDF data file
.latex	application/x-latex	8bit-LaTeX source
.nc	application/x-netcdf	Unidata netCDF data
.sh	application/x-sh	7bit-Shell-script
.tcl	application/x-tcl	7bit-TCL-script
.tex	application/x-tex	8bit-TeX source
.texi	application/x-texinfo	7bit-Texinfo
.texinfo	application/x-texinfo	7bit-Texinfo
.t	application/x-troff	7bit-Troff
.roff	application/x-troff	7bit-Troff
.tr	application/x-troff	7bit-Troff
.man	application/x-troff-man	7bit-Troff with man macros
.me	application/x-troff-me	7bit-Troff with me macros
.ms	application/x-troff-ms	7bit-Troff with ms macros
.src	application/x-wais-source7bit	WAIS source
.bcpio	application/x-bcpio	Old binary CPIO
.cpio	application/x-cpio	POSIX CPIO
.gtar	application/x-gtar	Gnu tar
.shar	application/x-shar	8bit-Shell archive
.sv4cpio	application/x-sv4cpio	SVR4 CPIO
.sv4crc	application/x-sv4crc	SVR4 CPIO with CRC
.ice	x-conference/x-cooltalk	Cooltalk
.rrf	application/x-InstallFromWeb	InstallFromTheWeb
.wis	application/x-InstallFromWeb	InstallFromTheWeb plug-in
.jnlp	application/x-java-jnlp-file	Java Web Start
.crl	application/pkix-crl	Certificate Revocation List

Hope this helps :)

XSS - Possible measures

I understand that there are some tools like Nessus and Nikto that would help detect such attacks. I have no idea about them though. Just came across these stuffs and hence though of sharing the same.

Following is a shame less copy and paste. Again just wanted to share what I read.

How to Protect Yourself

The primary defenses against XSS are described in the OWASP XSS Prevention Cheat Sheet.

Also, it's crucial that you turn off HTTP TRACE support on all webservers. An attacker can steal cookie data via Javascript even when document.cookie is disabled or not supported on the client. This attack is mounted when a user posts a malicious script to a forum so when another user clicks the link, an asynchronous HTTP Trace call is triggered which collects the user's cookie information from the server, and then sends it over to another malicious server that collects the cookie information so the attacker can mount a session hijack attack. This is easily mitigated by removing support for HTTP TRACE on all webservers.

The OWASP ESAPI project has produced a set of reusable security components in several languages, including validation and escaping routines to prevent parameter tampering and the injection of XSS attacks. In addition, the OWASP WebGoat Project training application has lessons on Cross-Site Scripting and data encoding.

And I guess you can get more ideas on the possible ways by which you can be exploited in http://ha.ckers.org/xss.html.

Hope this helps :)

XSS Cross-site scripting makes me worry

The concept of cross site scripting rang a bell inside me a long time ago. I was kind of wary about it and I even learnt to perform it. Hey I am not a hacker, dont start getting ideas already. Its just that I am curious and feel very happy to experiment stuffs the safe way as most of us prefer to do. Recently I came across a nice post about it in https://www.owasp.org/index.php/Cross-site_Scripting_(XSS).

It was very informative and very useful. I am getting newer ideas even when I am typing this one down. All stuffs posted in the site are basic and clean, but opens up my mind to a lot of potentially harzardous methods, if employed by some one against my sites, would be a massacre.

By my thoughts some of the stuffs that bothers me about how XSS may affect us are

1.
<html>
<body>

<? php
print "Not found: " . urldecode($_SERVER["REQUEST_URI"]);
?>

</body>
</html>

2.
http://testsite.test/<script>alert("TEST");</script>

3.<%...
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery("select * from emp where id="+eid);
if (rs != null) {
 rs.next();
 String name = rs.getString("name");
%>

Employee Name: <%= name %>
where name can be an XSS Hack

You can steal user session cookie etc.. and a lot more of such examples can be made

Most of the times when I am into serious mind wrecking program issues, all I would need was one loop hole, however small it may be, and I would fix the issues. I will just get what ever I want out of it.

All I did here was 10 minutes of thinking about what can I do with XSS. And I already got a lot of options.

Worst case, if I could understand a browser, which I definelty can if I spend a couple of months may be, I my self can do idiotic stuffs. So what can a full time hacker be capable of. Hope I dont get a cyber attack. This is scary

Alert box issues in Sencha Touch 2

I believe there is an issue with the Ext.Msg.alert() dialog in chrome right from the first version of the Sencha Touch. However there were css hacks that have been posted in various forums to handle them.

My point is it only has issues with Chrome and not with safari and I believe mobile devices dont use chrome yet. So I just had this tought running in my head.

Just leave it and get on with your work unless u think, it will keep bothering you. :)

Enable/Disable USB Ports

I had a sudden thought on doing things the hard way. So I just wanted to do something that will be done other than the ordinary way. And thats how I ended up with tampering my USB ports. I really hate simple access restrictions :P
After all its is very useful. I found the following stuff which partially worked.

“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR”

Right Click “Start” and Click modify

• To enable USB ports: change the value from “4″ to “3″
• To disable USB ports: change the Value for “3″ to “4″

I got to admit. I am dumb to have expected this to save me. But atleast I learnt something :)

List of all xtypes in Sencha Touch 2

List of all xtypes
# xtype Class

1 actionsheet Ext.ActionSheet
2 audio Ext.Audio
3 button Ext.Button
4 component Ext.Component
5 container Ext.Container
6 image Ext.Img
7 label Ext.Label
8 loadmask Ext.LoadMask
9 map Ext.Map
10 mask Ext.Mask
11 media Ext.Media
12 panel Ext.Panel
13 segmentedbutton Ext.SegmentedButton
14 sheet Ext.Sheet
15 spacer Ext.Spacer
16 title Ext.Title
17 titlebar Ext.TitleBar
18 toolbar Ext.Toolbar
19 video Ext.Video
20 carousel Ext.carousel.Carousel
21 carouselindicator Ext.carousel.Indicator
22 navigationview Ext.navigation.View
23 datepicker Ext.picker.Date
24 picker Ext.picker.Picker
25 pickerslot Ext.picker.Slot
26 slider Ext.slider.Slider
27 thumb Ext.slider.Thumb
28 tabbar Ext.tab.Bar
29 tabpanel Ext.tab.Panel
30 tab Ext.tab.Tab
31 viewport Ext.viewport.Default

DataView Components
---------------------------------------------
32 dataview Ext.dataview.DataView
33 list Ext.dataview.List
34 listitemheader Ext.dataview.ListItemHeader
35 nestedlist Ext.dataview.NestedList
36 dataitem Ext.dataview.component.DataItem
37
Form Components
---------------------------------------------
38 checkboxfield Ext.field.Checkbox
39 datepickerfield Ext.field.DatePicker
40 emailfield Ext.field.Email
41 field Ext.field.Field
42 hiddenfield Ext.field.Hidden
43 input Ext.field.Input
44 numberfield Ext.field.Number
45 passwordfield Ext.field.Password
46 radiofield Ext.field.Radio
47 searchfield Ext.field.Search
48 selectfield Ext.field.Select
49 sliderfield Ext.field.Slider
50 spinnerfield Ext.field.Spinner
51 textfield Ext.field.Text
52 textareafield Ext.field.TextArea
53 textareainput Ext.field.TextAreaInput
54 togglefield Ext.field.Toggle
55 urlfield Ext.field.Url
56 fieldset Ext.form.FieldSet
57 formpanel Ext.form.Panel