Posts

When maintaining or purging relational data in MySQL and MariaDB, deleting rows from a parent table that are referenced by existing foreign keys in child tables triggers a constraint violation error: ERROR 1451 (23000): Cannot delete or update a parent row: a foreign key constraint fails While referential integrity is essential during standard application execution, administrative migrations, database seeding, or emergency data cleanup frequently require temporarily suspending constraint validation. Suspending Constraint Checks To allow MySQL to delete or truncate rows without evaluating foreign key dependencies, disable FOREIGN_KEY_CHECKS in the active database session: ...

During penetration testing assessments, FTP services (such as vsftpd or ProFTPD) are sometimes configured to disable directory listings (LIST or NLST commands return 550 Access is denied). While users cannot browse the file hierarchy interactively, read and traversal permissions may still allow direct path navigation (CWD) and file retrieval (RETR). In such “blind” scenarios, dictionary-based brute forcing reveals hidden folders and downloadable assets. 1. Directory Fuzzing via CWD This Python script tests candidate directory names against the FTP server using the CWD (Change Working Directory) command. If the directory exists and permissions permit traversal, the server returns a positive status code rather than error_perm (550). ...

Level 6 on the Smash The Stack IO wargame takes two command-line arguments (username and password) and prints a greeting: level6@io:/levels$ ./level06 user pass Hi user Notice that the application checks the LANG environment variable to determine which greeting to print: level6@io:/levels$ export LANG=fr level6@io:/levels$ ./level06 user pass Bienvenue user level6@io:/levels$ export LANG=de level6@io:/levels$ ./level06 user pass Willkommen user Vulnerability Analysis The program structure internally organizes credentials into a record: ...

When exploiting buffer overflows in space-constrained stack frames (e.g., when the vulnerable buffer is only 20 or 30 bytes), you cannot fit a standard 50-byte shellcode payload directly on the stack. A classic exploitation technique is ret2env: injecting the shellcode into an environment variable (export EGG=...) and redirecting execution to its address located near the high end of the process address space. Why Addresses Shift Environment variables reside at the top of the user stack directly below the initial stack frame. Because the program name (argv[0]) is pushed onto the stack immediately following the environment pointer (envp), the exact address of an environment variable depends slightly on the length of the binary name: ...

When developing CLI utilities, long-running batch jobs, or automation scripts, providing real-time visual feedback improves user experience. While libraries like tqdm or rich are excellent, standalone scripts or restricted production environments often benefit from a pure standard-library implementation without external dependencies. Minimal Standard-Library Progress Bar By leveraging the carriage return character (\r), the terminal cursor returns to the start of the current line rather than advancing to a new line. Pairing this with sys.stdout.flush() forces immediate buffer rendering: ...

Redundant and duplicated files consume valuable disk capacity and complicate backup management. Because identical files often have different names or modification timestamps, simple filename comparisons are insufficient. By computing cryptographic checksums (MD5 or SHA-256) for each file’s binary content, we can reliably group and identify duplicate files across extensive filesystem trees. Python Duplicate File Scanner This script traverses the target directory recursively, calculates chunked cryptographic checksums to minimize memory usage, and prompts interactively to safely delete redundant copies. ...

Encrypted disk containers generated by TrueCrypt (and modern successors like VeraCrypt) do not contain detectable headers or magic bytes. The container appears indistinguishable from random noise, protecting against forensic identification. During forensic investigations or lost credential recovery, if specialized GPU cracking tools (such as Hashcat or John the Ripper) are unavailable, you can audit container passwords using a headless CLI mounting script. Python Dictionary Testing Script (tc_crack.py) This script iterates through a wordlist, attempting non-interactive mount commands against the target container file until a successful exit status is returned: ...

A quick-reference architectural guide covering essential patterns in Django web applications: querysets, signals, raw database queries, session handling, and authentication. 1. Django ORM Query Patterns # Query basic datasets Article.objects.all() Article.objects.all().count() Article.objects.filter(is_published=True).exists() # Slicing (LIMIT and OFFSET) Article.objects.filter(is_published=True)[:5] # Specific field projections Article.objects.filter(is_published=True).values('title', 'created_at')[:5] # Ordering Article.objects.filter(is_published=True).order_by('-created_at') # Field lookups and date filtering from datetime import datetime Article.objects.filter(created_at__gte=datetime(2025, 1, 1)) Article.objects.filter(created_at__year=2025).order_by('id') # Inspect underlying compiled SQL query = Article.objects.filter(is_published=True) print(str(query.query)) 2. Raw SQL and Database Connections When complex reporting queries or performance bottlenecks require bypassing the ORM: ...

During peak holiday seasons, securing airline seats on heavily booked routes often requires repeatedly checking booking engines for cancellations. Using browser automation frameworks like Splinter (an abstraction layer built on top of Selenium WebDriver), we can automate the search loop, detect flight inventory releases, fill passenger details, and hold reservations automatically. What is Splinter? Splinter provides a pythonic API for browser automation. It allows developers to: Navigate web portals and wait for elements. Select radio buttons, dropdowns, and checkboxes. Fill form fields and submit via JavaScript execution. Inspect rendered DOM structures and handle session timeouts. Automated Booking Workflow The script continuously queries available flight options for specific routes and travel dates. If the airline portal reports “no flights available” or sessions expire, it automatically restarts the search until seats open up, then populates passenger credentials: ...

Monitoring volatile market movements often requires immediate notifications without constantly watching browser tabs or mobile trading apps. By combining public REST APIs with native Linux desktop notification tools (notify-send) and speech synthesis engines (espeak), we can build a lightweight background tracker that speaks out when price targets are reached. Prerequisites On Debian/Ubuntu systems, install espeak and libnotify-bin: sudo apt-get install -y espeak libnotify-bin Python Price Alert Script The script queries a public ticker API, evaluates target price thresholds, and delivers desktop notifications alongside synthesized voice alerts: ...