Thursday, May 28, 2015

Having fun with Apache Solr opensource search server

Installation is straightforward and hence will not be covered. I use Solr version 5.1.0 and find that the Apache Solr Reference Guide 5.1 does not seems up to date and hence I
have to rely on the help provided by the solr and post binary. This small write-up is for my own record and for anyone who may find it useful.


$ bin/solr create -c test123
Failed to determine the port of a local Solr instance, cannot create test123!

$ bin/solr start -p 8984

Started Solr server on port 8984 (pid=6694). Happy searching!

$ bin/solr create -c test123
WARN  - 2015-05-26 14:52:54.557; org.apache.solr.util.SolrCLI; Request to http://localhost:8984/solr/admin/info/system failed due to: Connection refused, sleeping for 5 seconds before re-trying the request ...

Setup new core instance directory:
/usr/home/fs/solr-5.1.0/server/solr/test123

Creating new core 'test123' using command:
http://localhost:8984/solr/admin/cores?action=CREATE&name=test123&instanceDir=test123

{
  "responseHeader":{
    "status":0,
    "QTime":4023},
  "core":"test123"}

$ bin/solr status

Found 1 Solr nodes:

Solr process 6694 running on port 8984
{
  "solr_home":"/usr/home/fs/solr-5.1.0/server/solr/",
  "version":"5.1.0 1672403 - timpotter - 2015-04-09 10:37:54",
  "startTime":"2015-05-26T02:52:50.118Z",
  "uptime":"0 days, 0 hours, 6 minutes, 29 seconds",
  "memory":"14 MB (%2.9) of 490.7 MB"}


should have start server with default port of 8983, so

$ bin/solr stop
Sending stop command to Solr running on port 8984 ... waiting 5 seconds to allow Jetty process 6694 to stop gracefully.
$ bin/post -c test123 example/exampledocs/*.xml

$ bin/solr start

Started Solr server on port 8983 (pid=7326). Happy searching!

$ bin/post -c test123 example/exampledocs/*.xml
java -classpath /usr/home/fs/solr-5.1.0/dist/solr-core-5.1.0.jar -Dauto=yes -Dc=test123 -Ddata=files org.apache.solr.util.SimplePostTool example/exampledocs/gb18030-example.xml example/exampledocs/hd.xml example/exampledocs/ipod_other.xml example/exampledocs/ipod_video.xml example/exampledocs/manufacturers.xml example/exampledocs/mem.xml example/exampledocs/money.xml example/exampledocs/monitor.xml example/exampledocs/monitor2.xml example/exampledocs/mp500.xml example/exampledocs/sd500.xml example/exampledocs/solr.xml example/exampledocs/utf8-example.xml example/exampledocs/vidcard.xml
SimplePostTool version 5.0.0
Posting files to [base] url http://localhost:8983/solr/test123/update...
Entering auto mode. File endings considered are xml,json,csv,pdf,doc,docx,ppt,pptx,xls,xlsx,odt,odp,ods,ott,otp,ots,rtf,htm,html,txt,log
POSTing file gb18030-example.xml (application/xml) to [base]
POSTing file hd.xml (application/xml) to [base]
POSTing file ipod_other.xml (application/xml) to [base]
POSTing file ipod_video.xml (application/xml) to [base]
POSTing file manufacturers.xml (application/xml) to [base]
POSTing file mem.xml (application/xml) to [base]
POSTing file money.xml (application/xml) to [base]
POSTing file monitor.xml (application/xml) to [base]
POSTing file monitor2.xml (application/xml) to [base]
POSTing file mp500.xml (application/xml) to [base]
POSTing file sd500.xml (application/xml) to [base]
POSTing file solr.xml (application/xml) to [base]
POSTing file utf8-example.xml (application/xml) to [base]
POSTing file vidcard.xml (application/xml) to [base]
14 files indexed.
COMMITting Solr index changes to http://localhost:8983/solr/test123/update...
Time spent: 0:00:01.139

Somehow the link provided in the guide didn't work, but i manage to guess the url to use for query:

go to http://localhost:8983/solr/#/test123/query?q=video to query about video, 


Then i realise i need to remove the # in the url

http://localhost:8983/solr/test123/query?q=video&fl=id,name,price

i got a JSON response:

{
  "responseHeader":{
    "status":0,
    "QTime":1,
    "params":{
      "q":"video",
      "fl":"id,name,price"}},
  "response":{"numFound":3,"start":0,"docs":[
      {
        "id":"MA147LL/A",
        "name":["Apple 60 GB iPod with Video Playback Black"],
        "price":[399.0]},
      {
        "id":"EN7800GTX/2DHTV/256M",
        "name":["ASUS Extreme N7800GTX/2DHTV (256 MB)"],
        "price":[479.95]},
      {
        "id":"100-435805",
        "name":["ATI Radeon X1900 XTX 512 MB PCIE Video Card"],
        "price":[649.99]}]
  }}

using http://localhost:8983/solr/test123/select?q=video&fl=id,name,price

i got a XML response

01videoid,name,priceMA147LL/AApple 60 GB iPod with Video Playback Black399.0EN7800GTX/2DHTV/256MASUS Extreme N7800GTX/2DHTV (256 MB)479.95100-435805ATI Radeon X1900 XTX 512 MB PCIE Video Card649.99

To add more documents to be indexed, use the same command as above, i.e.
bin/post -c test123 example/goodies-sg/file.htm


That's all for now...  This is only the beginning, and Solr really has a lot to offer, but so far the steps here should allow me to go further.

Fook Sheng

Thursday, May 21, 2015

Vulnerable Web Application for learning how to hack

It used to be only WebGoat and Foundstone's Hacme Bank are the only purpose built vulnerable web application available for people wishing to learn how to hack web application. Now there are more..

Some of those I found lately:

bodgeit
DVWA