HTML Injection Attacks: Impact and Mitigation Strategies
YQL: More than just data
1. YQL: Find more than just data
Philip Tellis / philip@bluesmoon.info
Yahoo!7 Open Session – 11 May 2010 – #y7os
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
2. $ finger philip
Philip Tellis
philip@bluesmoon.info
@bluesmoon
yahoo
geek
http://bluesmoon.info/
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
4. missingkids.com
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
5. missingkidsmap.com
http://www.missingkidsmap.com/read.php?state=CA
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
6. <locations>
<maplocation zoom="5"
state_long="-119.838867"
state_lat="37.370157"/>
<location id="1"
firstname="Anastasia"
lastname=" Shearer "
picture="img width=160 target=_new src=http://www.missingkids.com/photographs/NCM
picture2="img width=160 target=_new src=http://www.missingkids.com/photographs/NC
medpic = "img width=60 border=0 target=_new src=http://www.missingkids.com/photog
smallpic="img width=30 border=0 target=_new src=http://www.missingkids.com/photog
policenum="1-661-861-3110"
policeadd="Kern County Sheriff´ Office (California)"
s
policenum2=""
policeadd2=""
st=" CA"
city="BAKERSFIELD"
missing="12/26/2009"
status="Endangered Runaway"
age="16"
url="1140669"
lat="35.3733333333333"
lng="-119.017777777778"/>
...
</locations>
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
7. Death by 404
API call on every 404 page =⇒
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
8. This looks like a job for...
YQLCAT
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
9. SELECT
SELECT * From xml Where
url=’http://www.missingkidsmap.com/read.php?state=ZZ’
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
10. Geo
More useful if we find local kids
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
11. YQL can do it
SELECT * From ip.location Where ip=@ip
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
12. {
"query":{
...
"results":{
"Response":{
"Ip":"209.117.47.253",
"Status":"OK",
"CountryCode":"US",
"CountryName":"United States",
"RegionCode":null,
"RegionName":null,
"City":null,
"ZipPostalCode":null,
"Latitude":"38",
"Longitude":"-97",
"Timezone":"-6",
"Gmtoffset":"-6",
"Dstoffset":"-5"
}
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
13. WoEID
SELECT place.woeid From flickr.places
Where lat=@lat And lon=@lon
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
14. WoEID
SELECT place.woeid From flickr.places
Where (lat, lon) IN
(
SELECT Latitude, Longitude From ip.location
Where ip=@ip
)
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
15. {
"query":{
"count":"1",
...
"results":{
"places":{
"place":{
"woeid":"12588378"
}
}
}
}
}
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
16. Country/State
SELECT country.code, admin1.code
From geo.places
Where woeid=@woeid
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
17. All together
SELECT country.code, admin1.code From geo.places
Where woeid IN
(
SELECT place.woeid From flickr.places
Where (lat, lon) IN
(
SELECT Latitude, Longitude
From ip.location
Where ip=@ip
)
)
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
18. {
"query":{
"count":"1",
...
"results":{
"place":{
"country":{
"code":"US"
},
"admin1":{
"code":"US-KS"
}
}
}
}
}
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
19. And that’s it
Throw in a bit of PHP to turn the JSON into HTML
CSS to style it
Wrap it in your page template
eg: http://bluesmoon.info/foobar
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
20. PHP
$json = http_get($missing_kids_url);
$o = json_decode($json, 1);
$children = $o[’query’][’results’]
[’locations’][’location’];
$child = array_rand($children);
print_404($child);
...
header(’HTTP/1.0 404 Not Found’);
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
22. Links
http://tech.bluesmoon.info/2010/02/convert-ip-to-geo-info-
using-yql.html
http://tech.bluesmoon.info/2010/02/missing-kids-on-your-
404-page.html
http://developer.yahoo.com/yql/
http://www.missingkidsmap.com/
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
23. Photo credits
http://lolcats.com/view/11439/
http://lolcats.com/view/13347/
http://www.flickr.com/photos/wwworks/440672445/
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data
24. Thank you
Philip Tellis
philip@bluesmoon.info
@bluesmoon
http://bluesmoon.info/
slideshare.net/bluesmoon
Yahoo!7 Open Session – 11 May 2010 – #y7os YQL: Find more than just data