Secure your site

Dan Catalin Vasile - Hacking the Wordpress Ecosystem OWASP Romania InfoSec Conference, Bucharest, October 25, 2013

More and more web projects require interfacing with the backend using a REST-ful interface. In this presentation we'll discuss Django-REST-Framework's features and walk through how to integrate it into your next project!

Fundamentals of building a Restful API with Django and django-rest-framework. Intended for new developers interested in developing a REST API for their applications. Basic knowledge of Python is nice to have, but the concepts are transferable. Presented at Vancouver Python Day 2013.

This document discusses securing a WordPress site. It begins with an agenda that includes understanding how WordPress works and its file structure, setting up WordPress, and configuring security settings. It then covers how WordPress functions through index.php and includes other files. It also discusses correlating files and folders. The document outlines setting up WordPress via FTP/SSH or SVN and hardening the server. It details common attack vectors like vulnerabilities in core, plugins, and themes as well as account brute forcing. It recommends customizing .htaccess rules and using child themes to modify functionality securely.

This document outlines a presentation on Django Rest Framework (DRF). The agenda includes an introduction to DRF, its main advantages like easy installation and excellent documentation, and core concepts like serializers, views, authentication, and pagination. Main concepts like request/response handling, parsers/renderers, and authentication/permissions are explained. There is also a demo and time for questions. The presenter is a backend developer who has been using Python and Django for many years.

RFStudio's Co-Founder Max (Hassan) Raza delivered a detailed session with demonstrations around WordPress security and shared experiences with WordCamp community about security and how to make WordPress more secure together.

The document discusses making websites secure by default through HTTPS. It covers the required technology and best practices for configuring HTTPS, migrating sites to HTTPS to make them more secure and user-friendly, and improving performance. Implementing HTTPS properly can help protect user privacy and data security.

My presentation slides for Securing Your WordPress Installation during WordPress Meetup September 2014 organised by Singapore WordPress User Group.

This document discusses different versions of popular open-source SQL databases and how to install and configure MySQL. It lists versions of MySQL, MariaDB, Percona, and XtraDB Cluster and how to download, install, start, and connect to MySQL. It also shows how to install MySQL using Debian packages or RPMs, how to view server configuration settings, and how to set permissions to allow remote root connections.

- MySQL injection techniques can be used to extract data through blind injection, union queries, and error-based injection. Time-based blind injection and deep blind injection can extract data character by character. - Load_file and into outfile functions can be used to read and write files in MySQL. Information from information_schema, user-defined functions, and triggers may also be exploitable. - Triggers are database objects that activate when events like insert, update or delete occur and may potentially be exploited to add new accounts or stop the MySQL server.

The document discusses SQL injection exploitation. It begins with an introduction of the presenter and an overview of topics to be covered, including what SQL injection is, what an attacker can do with it, tools to exploit it, safe places to practice, and how to prevent it. It then defines SQL injection as a web application vulnerability where an attacker can run database commands through a vulnerable web application. The document demonstrates SQL injection with an example and discusses how an attacker could read and write database records, bypass authentication, and compromise the server. It recommends tools for discovery and exploitation, suggests the Samurai Web Testing Framework as a safe target practice environment, and shows an exploitation demo. It concludes with recommendations for developers, administrators, and test

This document discusses various HTTP security headers and the W3C Content Security Policy. It provides an overview of headers like X-Content-Type-Options, X-XSS-Protection, X-Frame-Options, cookies, HTTP Strict Transport Security (HSTS), and the Content Security Policy. It also demonstrates how to configure these headers and gives examples of policies for different browsers and sites.

Vault is a tool for securely accessing secrets like API keys and passwords. It allows for [1] generating short-term credentials to access services like AWS, [2] easy revocation of credentials, and [3] auditing of secret access. Vault uses a seal/unseal process where secrets are encrypted at rest requiring threshold of keys to unseal. The document discusses best practices like using tokens for authentication, safeguarding storage backends, and setting up high availability.

A review of AWS security concepts, leaks at Beamly, an Introduction to Hashicorp Vault and how we use use Vault at Beamly. Watch YouTube video here: http://bit.ly/25ytNAD Join DevOps Exchange London Meetup: http://bit.ly/22y4Var Follow DOXLON on Twitter: http://bit.ly/1ZdugEJ

Security is not a question of "if" but "when". People will hit at your server(s). A smaller attack surface means they'll be more likely to miss too. And inflict less damage in general. Let's find out some easy steps we can take to decrease MySQL's attack surface in a typical web setup

My presentation slides for Tips & Tricks in securing your WordPress installation during Hackatron Asia 2014 which takes place on 6th and 7th December 2014. This presentation is just an updated presentation of http://www.slideshare.net/gamerz/singapore-word-press-user-group-meetup-september-2014-wordpress-security

This document provides an overview of HashiCorp Vault for securely storing, accessing, and managing secrets. It discusses how Vault can be used to securely store secrets like API keys, passwords, and certificates. The document outlines Vault's architecture, data storage options, authentication methods, policies for access control, and integrating systems using Vault. It also provides an agenda for a demonstration of Spring Cloud Vault integration for retrieving database credentials from Vault and using them to connect to a MySQL database.

This document discusses customizing Alfresco from an agile framework perspective. It begins by outlining different patterns for customizing Alfresco, including using a non-Alfresco framework on top of Alfresco, customizing Surf or Share, and more. It then tells a tale of customizing Alfresco using both the Django framework and the Surf framework. Key differences are highlighted, showing that Django required fewer lines of code but Surf leveraged more of Alfresco's existing functionality. The document concludes with an example of a heavy Share customization for a real-world client site.

This document discusses blocks and layouts in Drupal and compares approaches between Drupal 7 and Drupal 8. It outlines some of the challenges with blocks in Drupal 7 like managing blocks at admin/structure/block. It then covers composition patterns in Drupal 7 like custom blocks, contextual views, and Panels. The document dives into Context, Display Suite and Panels modules as layout solutions and compares their approaches. It highlights new block capabilities in Drupal 8 like blocks being plugins and having custom block types, fields, and view modes.

The slides for the Twig for Drupal 7 introduction talk I gave at FrontendUnited in Amsterdam. No hardcore coding, just examples why Twig is for HTML was SASS is for your CSS.

The document discusses how Drupal can help power a lean startup. It suggests starting as a freelancer using Drupal to build skills and clients, then leveraging those skills and community connections when starting a business. Key advantages of Drupal include its ability to help build a website with low costs and quickly while also drawing on an existing support community to help reduce startup needs and costs.

Originally presented on April 2, 2014 at Drupal Camp Toronto by Qasim Virjee - Principal at designguru.org

This document appears to be slides from a presentation about contributing to Drupal. It discusses issues, patches, modules and themes, Drupal core, and initiatives. It encourages participation in core mentoring hours and sprints. Useful links are provided and credits are given to others who contributed slides. The presentation aims to get more people involved in contributing to Drupal in various ways, not just coding.

1. The document discusses how to tap into the creative potential of online crowds through careful project design. It explores examples of successful and unsuccessful crowd-powered projects. 2. Two projects are described in more detail: Ideas2Ideas, which aimed to encourage constructive brainstorming through its interface design; and WikiTasks, which sought to help Wikipedia editors better organize and collaborate on tasks. 3. The document outlines several principles for designing crowd-powered projects, such as encouraging small contributions, iterative work, and contextual displays of information to maintain participation and creativity. Carefully considering crowd applications and interface is important.

Slides for presentation at DrupalCon Munich August 2012 http://munich2012.drupal.org/program/sessions/backbonejs-frontend Author: David Corbacho http://corbacho.info

Automating Drupal Development discusses automating various aspects of Drupal development using Drush Make and installation profiles. Drush Make allows developers to define a Drupal site's codebase and dependencies in a makefile that can then retrieve all necessary code and libraries with a single command. Installation profiles extend this concept to automate site configuration and installation tasks. The document demonstrates how to create reusable templates for profiles and makefiles that can generate new customized sites through commands like Drush Bake.

This document provides an overview of configuration management in Drupal 8. It discusses how configuration is now stored in files rather than the database for easier transport between environments. It outlines the process for modifying configuration on a development site, exporting changes, and importing them into a production site. It also notes some limitations of the current configuration management system and areas still under development before Drupal 8 is released.

Drupal has become a serious player in the enterprise market, encountering a new set of competitors along the way. Free software alone isn't enough for most larger organizations to choose Drupal. The technical selection process is more intensive, with many more stakeholders influencing the decision process. Additionally, enterprises rely on guidance from industry analysts and their peers to create their short list of potential options to consider. Raising the visibility of Drupal's strengths and success stories is critical to competing effectively in the enterprise market. At Acquia, we spend a great deal of time helping organizations understand the power of both Drupal and the community, and why this combination is what makes Drupal the best choice for high performance organizations serious about the social web. In this session, we'll share our experiences discussing Drupal with the analyst community and with senior executives. We'll share lessons we've learned when Drupal has lost during the technical selection process, and how we, as a community, can work together to improve our chances in the future.

Charla sobre Multilenguaje en Drupal 8, parte del programa de la Drupalcamp Spain 2012 celebrada en Madrid.

Views is an essential module for Drupal sites that allows building custom lists and displays of content. It provides powerful tools for filtering, sorting, and displaying content in different layouts. Views is so important that it is being incorporated directly into the core of Drupal 8, which is planned for release in August 2013. The document then discusses how Views can be used to create a photo gallery by defining a content type for images, building a view to display thumbnail images in different styles, and using lightbox effects to view full images in a popup or slideshow.

Charla sobre como contribuir en Drupal, parte del programa de la Drupalcamp Spain 2012 celebrada en Madrid.

Some design patterns and concepts for industrial grade deployment of Drupal on Solaris, plus a specific example of an interesting Drupal site deployed on Solaris

This document is a collection of tweets from various people expressing frustration and complaints about Drupal, a content management system. The tweets discuss issues with Drupal's infrastructure, administration interface, learning curve, upgrade process, and community. Some tweets praise specific aspects like its modules or large community. Overall, the document shows negative sentiment from Drupal users and developers.

Configuration Management is one of the prominent new features coming with Drupal 8. The reference use case for Configuration Management in Drupal 8 is quite different than the standard Drupal 7 + Features use case, both for a site builder and for a developer. And the Features module in Drupal 8 will have to be used in a different way.

The year is 2015, in the wasteland that is the internet frontend community, Decoupled Drupal is all the rage. China, India and the African continent are releasing an army of juggernaut armed with cheap or "outdated" hardware onto the internet. Clients wants single page apps, fancy JS frontend, app-level experience for their next coporate social media extranet, better known as the "corporate cat picture library". This developer stuck in the methane refinery of web development will pit juggernauts against client's obnoxious wishes in… The Frontend Thunderdome. This talk is about putting reality back into the current mass hysteria around full js frontend. It features 5 years old hardware, angular, ember, performance and graphs.

Face it: most Drupal intranets / extranets / back-offices feel sluggish, and that's because they do too much during the page cycle. Make them snappier by deferring work to a Queue worker.

Drupal 7 allows to easily build and maintain distributions, i.e. repeatable website templates; you can benefit from this in all cases, whether you aim at large-scale deployments or even at maintaining a single website. We will show how to package core and contributed modules in a distribution by using a Makefile and a profile and keeping them up-to-date during the whole development cycle. Then you will learn how to use Code-Driven Development to store all settings in a sustainable way: use the Features module to easily describe configuration in code, a proper separation between Features to make your code reusable and extendible, a well-thought design of Features to create easier development patterns, CTools and Exportables to put your configuration in code even when a module does not support it natively. Last, we will see how the distributions update mechanism allows you to create a new version of your distribution for easy and painless configuration updates of a live site.

Guarda il talk su http://www.youtube.com/watch?v=QEu9JKRehQ8 E dai un giudizio su https://joind.in/talk/view/7699

This class is intended for people who know some HTML and CSS, and covers the fundamental principles of Drupal theming geared toward people who wish to take a static mockup of a site design and turn it into a Drupal theme. You will also learn about using base themes, grid-based layout and helper modules to streamline and customize your Drupal theme. Trainer Ryan Price has built entertainment sites, social networks, and eCommerce sites for clients including Popular Science, Field and Stream and Outdoor Life magazines. With over 10 years of experience building sites with PHP and other technologies, Ryan began immersing himself in Drupal around 2006. Ryan often teaches and writes articles along with Mike Anello, and the duo is also known for producing the DrupalEasy Podcast with their host Andrew Riley.