Skillings & Sons Website Launch

After nearly 3 weeks of programming, graphic design, ajax debugging, a custom gallery and countless trips through iStockPhoto, we are proud to launch Skillings & Sons' corporate website.

This launch marks the culmination of nearly 6 months of joint effort by Ben Sgro (President), Devin Bousquet (Vice President), Diana Melgarego (Finance Director) of ProjectSkyLine LLC and Brandi Coulter (Marketing Manager & website liaison) of Skillings & Sons.

In an on going effort to support the online needs of Skillings & Sons, we are providing hosting support in conjunction with Nexcess, and managing a robust online marketing plan with the assistance of Matt VanWager of FindMeFaster.

(Matt will be speaking at SEMNE on Sept 11, check if out if your around!)

The new Skillings & Sons site exhibits a terrific user-interface (UI) design, fueled by the artistic excellence of Devin Bousquet. The tabbed interface provides a simple to navigate and user friendly interface for Skillings' target demographic.

::tech note:: The original tabbed interface used Ajax to load the content, which worked fine. We use CSS to control the mouse over attributes and we chose to have the state of "on" (the currently loaded page) be represented with a specific color. Since the CSS had to be redrawn and sent along with the Ajax, we soon found out that you CANNOT do this IE. Smooth.
We removed this feature and went with something that worked cross browser. We'll get into more of the technical aspect of this at a later date.

The site also sports a "search" ability, which is powered by MySQL fulltext indexing. It works well, but will be receiving a tune in the approaching days.

ProjectSkyLine built ajax drop down menus to highlight (and hide) specific data. In conjunction with the scriptaculous javascript library, we've added fluid motion to the drop down of these menus. We've also used the scriptaculous library to selectively highlight important messages within the site. In keeping with a smooth and memorable user experience, we are using cookies to keep track of the state of the drop down menus. Meaning, when a user navigates away from a page and then returns, the drop down is in the same state as they left it. Terrrrrrrific!

Another thing**** we learned while building our custom image gallery (powered by scriptaculous and Ajax) is that IE on VISTA (NOT XP) does not allow you to rewrite a cookie
multiple times without a page refresh. Sheesh.

::tech note:: Our original image gallery design was suppose to be modular enough that it could be both 1) used again and 2) released as open source. To maintain state (if the user leaves and then returns) we used cookies. However, we soon found out IE7 on Vista doesn't allow cookies to be written more than once. On IE7-XP & FF-XP & FF-Vista this technique worked. So, what's the reason ...? We checked and altered the browser security settings to see if that effected it, adding out development server to the list of "ok" sites, and lowering security to exploit enticing levels. heh. Nothing. So, we rolled back the code to instead of cookies, use sessions. Those HAD to work. And they did. For those that are interested, the source to the gallery will be made open shortly.

Skillings & Sons is full of other subtle design features that make it clear why ProjectSkyLine LLC is moving on up and setting some triumphant trends.

- psl

Joomla, XSS and Obfuscated Code

Hello again,

Yesterday, our chief engineer Ben, came about an interesting backdoor php script that a friend off irc was talking about. He was studying the joomla source, prior to implementation, and found that tons of joomla sites had been owned with a XSS used to load the r57shell php script.

We've included a copy of the script here for educational purposes: http://www.projectskyline.com/phplist/r57shell.txt

Ben went and posted this information to the NYPHPlist to provide fellow developers
an insight into the tools crackers are using against us.

A member of the PHPList pointed out that the script has some backdoor, author alerting features: http://seclists.org/fulldisclosure/2006/Sep/0083.html

Ben decided to base64_decode( ) the obfuscated variables and see what kinds of programs the
shellscript was building and executing.

The first section of code is that of the author alert...this provides the author w/the ip of the owned machine.

Ben then went ahead and decode the programs...a link to them is here:
http://www.projectskyline.com/phplist/test.php

Can't trust those russians!

- psl