Posts on Leander's Blog

When life gives you a broken typewriter, fix it! 🛠

Sun, 22 Sep 2024 13:27:36 +0200

Something uneventful happened in my life again: I am on Erasmus in France when suddenly I hear someone knocking at my door. I open up to find my English neighbour holding a pretty beaten up typewriter. I take a quick look and accept the challenge.

Facts

The typewriter is actually a west-german one called Gabriele 25, by a company called Adler. That’s interesting since my typewriter back at home is the east-german competitor’s Erika #14.

Erasmus is pretty neat, but I did not expect to need a set of screwdrivers during my first month being here. Well, I’ve always wanted to see the inside of a french hardware store anyways 😉

Fun-Fact: Here in 🇫🇷 many hardware stores have the word “Brico” in their name because of bricoler (eng.: to fix, to diy)

The insides 🫀

Equipped with new screwdrivers I got to work and opened Gabriele

Dear Garbriele must have stood outside for a long time because there were a lot of tiny bugs and flies inside 🤢🤮

I had to open Gabriele up in the first place because the carriage (the part that should move while typing) stopped moving half way. This was probably due to the fact that Gabriele had rested too long in “travel mode”¹, combined with a little moisture this resulted in rust.

How to fix it?

Answer: Cleaning and oiling 🛢 (aka WD40)

Hack: WD40 and candles don’t like each other (🔥)

A lot of WD40 later and the carriage was moving perfectly smoothly.

Last To-do: No typewriter without an inkband

I quickly ordered one off of Amazon² (shoutout to my university here that has some deals so we get Prime free for 3 months!)

Voilà:

One headache remains with Gabriele tho…

She has a french keyboard layout 😳

Special thanks to

Arthur (Typewriter-Finder, Proofreader)

Caro (Article-Reminder, Proofreader)

Dani (Screwdriver-Lender)

Gonzalo (Chill-Roommate)

Fabienne (English pedantic)

Travel mode is common for portable typewriters so that the damages while carrying it are reduced. ↩︎
Unfortunately I couldn’t find a local store here that sold typewriter inkbands :( ↩︎

scraping austria - a painful lesson in webscraping

Wed, 10 Jun 2020 00:00:00 +0000

Servus! I got the inspiration for this project by a youtube video I watched. In the video, the guy scrapes some embassy websites and automatically sends an e-mail to every single embassy. It’s a very entertaining video, you can watch the video here. Inspired by the “simple” approach, I thought: Well, embassies are taken, what else is there to scrape? And I wanted something more challenging than scraping 10 accumulating websites that have basically done my job already. So I came up with something original:

scraping every single website of every municipality in austria 🇦🇹

The task was determined, now all I needed was a well thought out plan:

find a list of ALL municipalities
combine each municipality’s name with different domains
find existing domains
look for indicators that the current site is the correct one (and not just a registered, unused one or - even worse - a business site)

Let’s go!

finding a list - all hail statistik austria

Finding a complete and up-to-date list wasn’t quite as hard as I thought it would be. Turns out that Statistik Austria has some pretty cool stuff on their website, like this table which contains every municipality, it’s postal code (PLZ) and it’s Gemeindekennziffer (GKZ).

What the hell is a GKZ?

Glad you asked! It’s a unique number assigned to each municipality, much like a postal code number, but still very much different. The GKZ has five digits, while the PLZ has only four. PLZs are an old system which has it’s pros and cons, the biggest disadvantage being that PLZs don’t have geographical meaningfulness:

2384 is the PLZ for Breitenfurt, Lower Austria
3012 is the PLZ for Wolfsgraben, Lower Austria (only 4km away from the former)
Vorarlberg’s PLZs all start with 6, which is also Tyrol’s first number
Except South Tyrol’s PLZ: starts with 9, which is otherwise Carinthia’s!

One can see: This system is not good, especially if you want to retrieve geographical data from it.
That’s why Statistik Austria came up with the GKZ

the genius way of GKZ

As mentioned above the GKZ consists of 5 numbers: The first representing the state with numbers 1 to 9. Second and third represent the political districts within the state. The last two digits represent the municipalities within that district. So Bisamberg for example has the GKZ: 3 12 01

3: Lower Austria
12: District of Korneuburg
01: Bisamberg¹

Way better!

combinations and permutations are a pain in the ass

So Austria has roughly 2100 municipalities. That’s a lot. Especially if you think about all possible combinations for domains. ‘‘‘python gemeinde_name = “Bisamberg”.lower()

list_possible_domains = [

    # If the website isn't in HTTPS, trying to access it via HTTPS will throw an error
    "http://www.{gemeinde_name}.gv.at".format(gemeinde_name)

    # Not everybody uses .gv domains
    "http://www.{gemeinde_name}.at".format(gemeinde_name)

    # Turns out: states have domains??? Mostly Tyrol (.tirol), Burgenland (.bgld) and Upper Austria (.ooe)
    "http://www.{gemeinde_name}.bgld.gv.at".format(gemeinde_name)

]

’’’ For one-worded municipalities this approach works fine but it won’t work with such as “Krems an der Donau”. Another example are all municipalities with “Sankt”, like “St. Georgen im Lavanttal”. The work-around I came up with is a very simple one:

ugly_gemeinde_name_1 = "Krems an der Donau".lower()

split_gemeinde_name_1 = ugly_gemeinde_name_1.split(" ") // => ['krems','an','der','donau']

# Then I wrote some very ugly functions that format different possible domain names - I will spare you the details.
# In the end, the list of possible domains looked like this

list_of_possible_domains = [

    "http://www.krems.at",
    "http://www.krems-an-der-donau.at",
    "http://www.krems-donau.at",
    "http://www.krems.gv.at",
    "http://www.krems-an-der-donau.gv.at",
    "http://www.krems-donau.gv.at"

# ... and more ]

requests and false positives

So after generating all possibilities, I cycled through them and sent a GET request to each one. If the domain doesn’t exist, python will throw an error and with a simple try except magic, you can easily catch those and verify existing sites.

are you 4 real?

So it turned out: just because the site exists doesn’t mean that it’s the right one. There are business or private sites that use one of the generated domains. I had to check for keywords like “Rathaus”, “Gemeindeamt” etc. And even with these checks, I am pretty sure that there are STILL wrong sites in my table - nobody’s perfect!

you got mail

After hours of crawling & scraping I finally had a table to work with for scraping the e-mail adresses. It’s basically the same step as before when I checked for keywords, only that this time I was looking for words like “Kontakt” and “Impressum” and then had to parse only the adress without any unwanted text like the “to:” junk. For this step I had to use selenium because many of the sites use an excessive amount of javascript. So I had to render it. But I actually really enjoyed working with selenium - very powerful tool!

Now all that was left to do was to look for errors (there were a LOT) and some general cleanup and encoding issues. I learned a lot while doing this and also had a lot of fun. You can find the data on my github.

My hometown! ↩︎

schools and privacy: don't mix!

Fri, 10 Jan 2020 00:00:00 +0000

If you are/ were a student in Austria during thr last 10 years, you probably came into contact with the company WebUntis. Mostly known for their timetable manager tool and security flaws.

So the company’s reputation really isn’t the best when it comes to security vulnerabilities and how they handle them. It took them allegedly 5 months to close a XSS-vulnerability on their site¹ But for an austrian enterprise whose headquarters are located in Lower Austria they are actually doing pretty good.

Or so I thought.

School-Admins are just people too

Being responsible for the IT-System of a school must be horrible. Colleagues forget their passwords, the student-database needs to be constantly kept up-to-date and you have to work with horrible Software, such as Excel(😔), Word(🤮)

Heartfelt condolences to you, admins ❤️

But nevertheless: some mistakes can not be forgiven!

So it turns out that most school administrators either did not read the WebUntis-Manuals carefully enough or they simply misunderstood the meaning of some website-settings. But these “minor” mistakes are the reason for why the data of 100s of students is freely accessible online.

So what’s the problem now?

As much as I would like to show you what I mean by that: I won’t.

Why?

Because we are talking about data of minors, children. And this is not a “how-to-get-arrested tutorial”. AFAIK 3 schools in and outside of Vienna are affected - roughly 1800 students total. The data you can access freely include:

Class-Name 🤨
First and Last name 🤨🤨
Electives and schedule 🤨🤨
Religious belief (can be deducted from religion-class) 🤨🤨🤨

But what I can show you is how stupid some of WebUntis’ design really is!

Enjoy 😁

WebUntis Security Bullshit

When I went to school, our admin configured the timetable-accessibilty by groups. So if you were a student, you could see any other students timetable.

For a long time, I thought only our admin did this bad practice

Turns out: This is pretty normal for most schools!

This alone is a big security hazard. It only takes one students compromised account to get access to the whole network.

But it even get’s better!

The default username and password can be configured and most of the time the login credentials look like this:

    # Schüler: Maximilian Mustermann (10.10.2001)
    Username: "must.max"
    Password: "20011010"

Every admin has the possibility to customize these defaults, so every school does their own thing - which is good for security!

But oh boy you gotta look at this:

😐

Apparently, a lot of schools send out guides on how to use WebUntis. With a little bit of Google-Dorking² you will find most of them. Now you know the default credential sytle 🎉 And I am pretty sure that there will be some students that don’t change their default password.

But this alone is not yet the real problem!

Once you are logged in, you can see your fellow students usernames. No fullnames?

Great, so where do the fullnames come from then?

Well, you can not only see everyones timetable, but you can also print them:

Clicking on that will open a new window with the timetable being formatted in HTML (no PDFs are created)

and what is that?

Stay safe y’all

Bug report ↩︎
also called Google-Hacking ↩︎