Posts

Showing posts from May, 2015

Viewport and responsive design and scaling

Just found that if you have a website and it rotates; then it won't resize properly on landscape with the following viewport <meta name="viewport" content="width=device-width"> You need to specify the initial scale: <meta name="viewport" content="width=device-width, initial-scale=1.0"> This seems to be mainly an IOS thing. To see the acutal sizes of viewports, see this link : http://viewportsizes.com/ Different Properties available are as follows: Property Description width The width of the virtual viewport of the device. device-width The physical width of the device screen. height The height of the virtual viewport of the device. device-height The physical height of the device screen. initial-scale The initial zoom when visiting the page, 1.0 does not zoom. minimum-scale The minimum amount the visitor can zoom on the page, 1.0 does not zoom. maximum-scale The maximum amount the visitor can zoom on the page,

URLScan and UseFastPathReject fix to stop disclosure of sensitive information

There is a flag in URLScan 3 to stop URL Scan redirecting dodgy requests and instead sending back a 404 response quickly, this is "UseFastPathReject=1" (by default it is 0) The issue outlined: http://www.securityfocus.com/bid/7767/info The fix explained: http://www.securityfocus.com/archive/1/323389

Ghost Records, Card Recon and PCI Compliance

As part of a PCI Compliance audit, I recently ran a scan on a database using software call Card Recon. A little odd thing occurred. At a point in the past, a row of data in a column, which had been dropped from the database schema, contained a single test credit card number. However, the Card Recon software showed that the data was still there in the database file (this was a SQL Database) in the form of a SQL Ghost Record. A Ghost Record can appear when running a delete or insert command and when running delete and insert in different queries but related by the same indexed data, you can read all about it over at Ghost "Rows" Buster in  SQL Server on Technet. It's basically a record somewhere in the database file, but not directly in a database table and is living in a bit of spare fragmented space somewhere and this needs to be cleaned up. Following this procedure managed to remove the Ghost Record: Convert the database to Simple (only so the transactio