Chris Hills Chaz6

Recon and Attack Vectors from My Logs

This document contains excerpts from my web server logs collected over a period of 7 years that shows various kinds of recon and attack vectors.

There were a total of 37.2 million lines of logs out of which 1.1 million unique HTTP requests (Method + URI) were found.

$ sed 's/^.* - - \[.*\] "\(.*\) HTTP\/.*" .*/\1/' access.log &gt; requests.txt

Client-side software update verification failures

Exploitable vulnerabilities in client-side software update mechanisms that could have been mitigated by secure transport (TLS).

Contributions welcome. All text taken from the vulnerability descriptions themselves, with additional emphasis mine.

In scope:

I consider exploitation or privilege escalation of the package tool/system itself (that would have been mitigated by secure transport) to be in scope.
Issues only described as being triggered by malicious mirrors are assumed to also be vulnerable to MITM.
Failure to verify the software update at all is currently provisionally in scope if it could have been mitigated by secure transport, but I'm waffling about it. Most of these are actual signature verification failures, and my original purpose was to highlight cases where claims of "It's OK to be HTTP because verification!" seem to me to be specious.
Software components regularly used to verify integrity in other software pipelines a

Hey everyone - this is not just a one off thing, there are likely to be many other modules in your dependency trees that are now a burden to their authors. I didn't create this code for altruistic motivations, I created it for fun. I was learning, and learning is fun. I gave it away because it was easy to do so, and because sharing helps learning too. I think most of the small modules on npm were created for reasons like this. However, that was a long time ago. I've since moved on from this module and moved on from that thing too and in the process of moving on from that as well. I've written way better modules than this, the internet just hasn't fully caught up.

@broros

otherwise why would he hand over a popular package to a stranger?

If it's not fun anymore, you get literally nothing from maintaining a popular package.

One time, I was working as a dishwasher in a restu

Deterministic save load in Factorio

One of the key parts of the save/load process in Factorio is that it must be deterministic. This means that for a given save file (when no external factors change) saving, exiting, and loading the save shouldn't change any observable behavior.

There are a few reasons and benefits for this strict requirement:

Without it: You couldn't join a running multiplayer game (and by proxy save, exit, and resume one)
Without it: the replay system wouldn't work if you ever saved, exited, and resumed playing.
With it: we can easily test that saving and loading produces no observable change letting us know we implemented save/load correctly.
With it: you won't see things change randomly as a result of "reloading" like you do in so many other games.

Here's a list of mildly interesting things about the C language that I learned mostly by consuming Clang's ASTs. Although surprises are getting sparser, I might continue to update this document over time.

There are many more mildly interesting features of C++, but the language is literally known for being weird, whereas C is usually considered smaller and simpler, so this is (almost) only about C.

1. Combined type and variable/field declaration, inside a struct scope [https://godbolt.org/g/Rh94Go]

struct foo {
   struct bar {
 int x;

Prologue

I wrote this answer on stackexchange, here: https://stackoverflow.com/posts/12597919/

It was wrongly deleted for containing "proprietary information" years later. I think that's bullshit so I am posting it here. Come at me.

The Question

Amazon is a SOA system with 100s of services (or so says Amazon Chief Technology Officer Werner Vogels). How do they handle build and release?

	#!/bin/sh
	ip netns add vpn

	ip link add wg0 type wireguard
	ip link set wg0 netns vpn
	ip netns exec vpn wg set wg0 private-key /root/private.key peer sL402eL6MC9jcqbPaUuFHuzbCL5U9QWCzWYCjAyIvx4= \
	allowed-ips 0.0.0.0/0 allowed-ips 2000::/3 endpoint 198.46.198.198:51820
	ip -n vpn addr add 10.66.3.5/24 dev wg0
	ip -n vpn addr add 2001:470:f1db:2::5/64 dev wg0
	ip -n vpn link set wg0 up

	import sys
	import socket
	import select
	import random
	from itertools import cycle

	# dumb netcat server, short tcp connection
	# $ ~ while true ; do nc -l 8888 < server1.html; done
	# $ ~ while true ; do nc -l 9999 < server2.html; done
	SERVER_POOL = [('10.157.0.238', 8888)]

	a4b.amazonaws.com
	access-analyzer.amazonaws.com
	account.amazonaws.com
	acm-pca.amazonaws.com
	acm.amazonaws.com
	airflow-env.amazonaws.com
	airflow.amazonaws.com
	alexa-appkit.amazon.com
	alexa-connectedhome.amazon.com
	amazonmq.amazonaws.com