Patch for Yaws 1.81 -- Hide your webserver identity

This is a patch for making attackers think you are running Windows and IIS/7.0, when in fact you are running *nix and Yaws. It also includes some mime types for XML/XSLT and .crt files.

diff -ur ./src/mime.types ../yaws-1.81/src/mime.types
--- ./src/mime.types 2009-04-16 12:02:43.000000000 -0700
+++ ../yaws-1.81/src/mime.types 2009-04-16 12:23:35.000000000 -0700
@@ -203,7 +203,7 @@
 application/vnd.motorola.flexsuite.kmr
 application/vnd.motorola.flexsuite.ttc
 application/vnd.motorola.flexsuite.wem
-application/vnd.mozilla.xul+xml
+application/vnd.mozilla.xul+xml xul
 application/vnd.ms-artgalry
 application/vnd.ms-asf
 application/vnd.ms-excel xls
@@ -331,9 +331,10 @@
 application/x-ustar  ustar
 application/x-wais-source src
 application/x400-bp
-application/xml
+application/xml xml xsl
 application/xml-dtd
 application/xml-external-parsed-entity
+application/xslt+xml xslt
 application/zip   zip
 audio/32kadpcm
 audio/basic   au snd
@@ -465,7 +466,7 @@
 text/vnd.wap.wml  wml
 text/vnd.wap.wmlscript  wmls
 text/x-setext   etx
-text/xml   xml xsl
+text/xml
 text/xml-external-parsed-entity
 video/mp4v-es
 video/mpeg   mpeg mpg mpe
@@ -490,3 +491,4 @@
 application/xhtml+xml  xhtml
 image/svg+xml   svg
 application/ogg   ogg
+application/x-x509-ca-cert crt pem
diff -ur ./src/yaws.erl ../yaws-1.81/src/yaws.erl
--- ./src/yaws.erl 2009-04-16 12:02:43.000000000 -0700
+++ ../yaws-1.81/src/yaws.erl 2009-04-16 12:47:42.000000000 -0700
@@ -577,13 +577,7 @@
                end).
 
 
-address() ->
-    ?F("
 ~s Server at ~s 
",
-       [
-        (get(gc))#gconf.yaws,
-        (get(sc))#sconf.servername]).
-
-
+address() -> "".
 
 is_space($\s) ->
     true;
@@ -699,7 +693,7 @@
 
 
 printversion() ->
-    io:format("Yaws ~s~n", [yaws_generated:version()]),
+    io:format("Microsoft-IIS/7.0~n"),
     init:stop().
 
 %% our default arg rewriteer does's of cource nothing
@@ -1284,13 +1278,7 @@
              "\r\n"]
     end.
 make_server_header() ->
-    HasDav = ?sc_has_dav(get(sc)),
-    ["Server: Yaws/", yaws_generated:version(), " Yet Another Web Server\r\n" |
-     if HasDav == true ->
-             ["DAV: 1\r\n"];
-        true ->
-             []
-     end].
+    ["Server: Microsoft-IIS/", "7.0", "\r\n"].
 
 make_last_modified_header(FI) ->
     N = element(2, now()),

plist to JSON (including your iTunes library...)

This is a quick-and-dirty sed script to convert a plist XML file to a no-unnecessary-whitespace JSON format. It has a few caveats, however:

• It uses extended regular expressions


• It slurps the entire XML text into memory before spitting it back out; it does not perform the traditional line-by-line editing/printing as most sed scripts do


• <data> elements are given empty string values

Because of the above conditions, you have to use the "-En" options when running sed otherwise you will get garbage output (on Mac OS X, at least). Here is the code, I saved it in a file called "plist-to-json.sed" and invoke it as "sed -Enf plist-to-json.sed ...":

# Kill newlines
/^[[:space:]]*$/ d

# Kill leading whitespace
s|^[[:space:]]*||g

# Kill trailing whitespace
s|[[:space:]]*$||g

# Kill any base64 lines, <data> elements will not be converted
/^[[:alnum:]]+=*$/ d

# Kill the <?xml...?> line
s|<\?[^>]*>||g

# Kill any XML processing instructions
s|<![^>]*>||g

# String escape any values for JSON
s|"|\\"|g

# Convert the top level <plist> element to an object with a "plist" field
s|<plist[^>]*>|{"plist":|
s|</plist>|}|

# Keys, strings and dates get surrounded with quotes, numbers and booleans left alone
s|<key>|"|g
s|</key>|":|g
s|<string>|"|g
s|</string>|",|g
s|<real>||g
s|</real>|,|g
s|<integer>||g
s|</integer>|,|g
s|<true[[:space:]]*/>|true,|g
s|<false[[:space:]]*/>|false,|g
s|<date>|"|g
s|</date>|",|g

# Arrays and dictionaries convert nicely
s|<array>|[|g
s|</array>|],|g
s|<dict>|{|g
s|</dict>|},|g

# Give <data> elements an empty value
s|<data>|""|g
s|</data>|,|g

# Append the pattern space into the hold space
H

# Everything here happens only on the last line of input, after the above stuff has run
${
   # Bring the hold space into the pattern space (the entire document)
   g

   # Remove tailing commas from the last field definitions in a JSON object
   s|,[[:space:]]*}|}|g
   s|,[[:space:]]*]|]|g

   # Kill remaining unnecessary whitespace
   s|:[[:space:]]*|:|g
   s|{[[:space:]]*|{|g
   s|\[[[:space:]]*|[|g
   s|\n||g

   # Print out the resulting JSON
   p
}

Using this I was able to take my "iTunes Music Library.xml" file (2,365,981 bytes) and convert it nicely to JSON (1,087,270 bytes), which I intend to use in a Flash/Flex application I want to build to listen to my iTunes music over the internet. Unfortunately, Mediamaster (a company I used to work for) is not going to exist anymore and I miss the service... this will be my pathetic attempt at a replacement as I have absolutely no UI skills at all.