Somewhere is an Apache running a smal set of custom Scripts. Now you need to limit the access to this bunch of quick and dirty Apps. Typical solution: put an htaccess file and some htpasswd manages passwords on it. This works but everyone needs to remember his windows login and his Application password. What happens if a user leaves the company? You disable the Windows account. But did you remember to remove him from all the htaccess files?

Goal is to have only one user/password. For everything in the Company and only one central usermanagement. This is your Active Directory. It has the users and LDAP is the interface to use it.

mod_authnz_ldap

Make sure your apache supports mod_authnz_ldap. If it is compiled into the binary you can use httpd -L to list it. Otherwise it is in the modules directory as mod_authnz_ldap.so. Maybe you need to install it from your Distributions repository. If you compile from source, use these switches during configure

        --enable-ldap \
        --enable-authnz-ldap \
        --with-included-apr \
        --with-ldap 

Prepare Active Directory

Authentication consists of

1. Finding the user (getting the Distinguished Name DN) in the Active Directory using the supplied username
2. Binding to the Active Directory using the now found DN and the supplied password
3. Doing stuff to find group memberships

your administration account! Create a new account with minimal rights.

So what is the username? Depends on your AD Layout. This should give you a pretty good hint

CN=John Doe,OU=IT Department,OU=Germany,DC=example,DC=com

httpd.conf

Let's start with an example

<Location /protected>
# Using this to bind
AuthLDAPBindDN "CN=John Doe,OU=IT Department,OU=Germany,DC=example,DC=com"
AuthLDAPBindPassword "XXX"
# search user
AuthLDAPURL "ldap://IP-DOMAIN-CONTROLLER/ou=Germany,dc=example,dc=com?sAMAccountName?sub?(objectClass=*)"

AuthType Basic
AuthName "USE YOUR WINDOWS ACCOUNT"
AuthBasicProvider ldap
# Important, otherwise "(9)Bad file descriptor: Could not open password file: (null)"
AuthUserFile /dev/null
require valid-user
</Location>

 AuthLDAPBindDN and AuthLDAPBindPassword are uesd for the first step, Accessing the active directory.

Next we need to find the users, this is AuthLDAPURL. It looks like AD won't allow to search the complete Tree (dc=example,dc=com). I always needed to specify at least one organizational unit (ou). We search the whole subtree (sub) not just one folder. When searching the tree we compare sAMAccountName with the username supplied to us. You could also the eMail Addresses

AuthLDAPURL "ldap://IP-DOMAIN-CONTROLLER/ou=Germany,dc=example,dc=com?mail?sub?(objectClass=*)"

AuthType, AuthName should be known.

Important is the AuthUserFile directive.

Specific Users, Groups

# specific user
#   Require ldap-user "john.doe"
# specific user by DN
#   Require ldap-dn CN=John Doe,OU=Finance,OU=Germany,DC=example,DC=com
# member of group
#   Require ldap-group CN=Finance Department,OU=Finance,OU=Germany,DC=example,DC=com

Well, flash games need to store highscores somewhere on the server. So on some point during the game, scores are posted. And this happens via http. As http is a well known easy protocoll and most games don't think about protecting the scores someone just posted his score.

Step 1: log the http traffic. 

For simple cases firebugs net log is enough. For more complicated stuff add a local proxy and capture the traffic. There is no way flash games can prevent you from this.

Step 2: check how scores are submitted

If you know the score you just submitted, it is in most cases enough to grep the traffic log and find the http POST request that submits it.

Step 3: manual submit

write a five line python to submit the same request again but this time submit a different score.

#!/usr/bin/python
import urllib2
import urllib

url = 'http://example.com/submit.php'
values = {
    'score': 1234,
}
cookies = ['a=b',]
headers = {
    'User-Agent': 'python',
    'cookie': '; '.join(cookies)
}
data = urllib.urlencode(values)
req = urllib2.Request(url, data, headers)
response = urllib2.urlopen(req)
print response.read()

Advanced

Flash might encode or encrypt the submitted data. Use a actionscript decompiler and read the code

Or...

simply play the game to have fun and not to reach a highscore ;)

I used to check if some services (like http, smtp) are working by telnetting into them. Then i could just execute commands as needed. Usefull for example to check if an apache normaly accessed by a loadbalancer is serving something for a virtual host.

echo -e "GET / HTTP/1.1\nhost:www.example.com\n\n" |\
nc physical.example.com 80

But as encryption is on the raise i need to check https services. And that is something i can't do by hand.

openssl comes to the rescue.

openssl s_client -connect www.example.com:443

To make the same example as before, you can't simply replace the echo. openssl will terminate the connection as soon as the EOF ist sent via stdin. That is before the response is retrieved. So we make the echo in a subshell and add a sleep

(echo -e "GET / HTTP/1.1\nhost:www.example.com\n\n"; sleep 5) |\

openssl s_client -connect physical.example.com:443

Another nice thing is the check of certifcates. For example expiration date.

echo ""  |\
openssl s_client -connect www.example.com:443 |\
 openssl x509 -noout -enddate

Here the immediate termination by openssl is fine, we already got the cert.