Drupal Surveillance

Building things and breaking things properly both require a knowledge of how the system works, what it’s made of, where the loose chains are likely to be, etc.  A discussion of Drupal therefore seems a fairly obvious early post for a Drupal fan to make.

The first step is usually to know that you are in fact dealing with a Drupal site.  Most of the time this is fairly obvious, the forms are all instinctively Drupalesque regardless of how much the owner has customised.  There’ll be a Drupal favicon, urls with node in them, one of the standard Drupal themes, or an error message in a standard format.  If it’s not a specific Drupal site you’re looking for, then Google will find some of these things for you.  There’s also indicators in the html and http headers if you know what to look for.

Now that we’re at least fairly sure it’s a Drupal site, the next stage is to take a look at the standard files that a Drupal installation leaves in place.  CHANGELOG.txt is a good one, as it gives the exact version number the site is running, INSTALL.txt is another.  cron.php may indicate Drupal, but usually isn’t conclusive. update.php and install.php however are conclusive in that they will return pages which are sometimes left insecure and therefore can be used to break the site.

So now we know we’ve got a Drupal site, and have a version number to target.  We can look at Drupal.org’s security pages to see what vulnerabilities older versions have listed against them, but Drupal’s usually quite secure and so there’s rarely something usable here.  Modules are a better option, but to know about version numbers of those you normally need admin access.

All this information isn’t doing us any good at all unless we can actually do anything with it.  And so the next step is to try creating content or an account, preferably through an anonymiser if we’re actually doing this for real and not just learning how to secure Drupal.  Who knows, we may be lucky enough to be able to create content using the php filter (thereby returning the contents of settings.php and getting full database access, or simply deleting index.php to annoy the owner.)

This clearly isn’t a full howto on hacking into Drupal, nor is it a full howto on securing Drupal, and it doesn’t even cover every method of Drupal surveilance in detail.  It does however introduce the first few principles of checking out a site running Drupal, and I leave everything else as an exercise for the reader (at least for now.)

Virtual plane spotting

First you need to find out what planes are flying overhead.  This is the traditional way, by hooking up an airband radio to your computer.  Luckily there are now other ways of monitoring what’s flying overhead.  This software can also handle input from the newer radar equipment available.

Flight Aware will track planes coming in and out of (or nearby) your local airport.  Here we are looking at traffic in and around Seattle, if it’s night time then you won’t see much on the map.  If you’re serious then it’s worth creating a free account here.

Flight Stats also has information about what’s happening at your local airport.  It also has information on delays, and a ticker of delays around the USA. If those delays look at all interesting, then you can tune in to air traffic control all around the world by finding a streaming mp3 at this site.

We should by now have some aircraft registration numbers.  You can find pictures of the planes by searching this airliners.net or planespotting.net.

This site will tell you what plane spotters with radar have seen recently, you can search by aircraft or airport.  It won’t include every single flight, but it may find things that the public databases we started with won’t.  Similarly, but designed more towards getting a fleet, this site also has plane sightings.