K̶e̶v̶i̶n̶ KevCui

Read Shape Up by basecamp on a kindle / reMarkable / eReader

Basecamp's new book Shape Up is now available online (https://basecamp.com/shapeup) to read page-by-page.

There is a .pdf version, but that's not the best format for Kindle / other eReaders. Instead, we can convert the page-by-page into an eReader friendly format.

Part 1: Convert to a single page

NOTE: This has only been tested on Chrome

Setup

Add this to your .profile, .bashrc, .zshrc...

BASE64_DECODER_PARAM="-d" # option -d for Linux base64 tool
echo AAAA | base64 -d > /dev/null 2>&1 || BASE64_DECODER_PARAM="-D" # option -D on MacOS

decode_base64_url() {
  local len=$((${#1} % 4))
  local result="$1"
 if [ $len -eq 2 ]; then result="$1"'=='

Windows Toolkit

Binary

Native Binaries

IDA Pro

IDA Plugins	Preferred	Neutral	Unreviewed

GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.

Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.

$ python githubcloner.py --org organization -o /tmp/output

	// create a bookmark and use this code as the URL, you can now toggle the css on/off
	// thanks+credit: https://dev.to/gajus/my-favorite-css-hack-32g3
	javascript: (function() {
	var elements = document.body.getElementsByTagName('*');
	var items = [];
	for (var i = 0; i < elements.length; i++) {
	if (elements[i].innerHTML.indexOf('* { background:#000!important;color:#0f0!important;outline:solid #f00 1px!important; background-color: rgba(255,0,0,.2) !important; }') != -1) {
	items.push(elements[i]);
	}
	}

	// Tracking cursor position in real-time without JavaScript
	// Demo: https://twitter.com/davywtf/status/1124146339259002881

	package main

	import (
	"fmt"
	"net/http"
	"strings"
	)

	let regex;

	/* matching a specific string */
	regex = /hello/; // looks for the string between the forward slashes (case-sensitive)... matches "hello", "hello123", "123hello123", "123hello"; doesn't match for "hell0", "Hello"
	regex = /hello/i; // looks for the string between the forward slashes (case-insensitive)... matches "hello", "HelLo", "123HelLO"
	regex = /hello/g; // looks for multiple occurrences of string between the forward slashes...

	/* wildcards */
	regex = /h.llo/; // the "." matches any one character other than a new line character... matches "hello", "hallo" but not "h\nllo"
	regex = /h.llo/; // the "" matches any character(s) zero or more times... matches "hello", "heeeeeello", "hllo", "hwarwareallo"

	// How many ways can you alert(document.domain)?
	// Comment with more ways and I'll add them :)
	// I already know about the JSFuck way, but it's too long to add (:

	// Direct invocation
	alert(document.domain);
	(alert)(document.domain);
	al\u0065rt(document.domain);
	al\u{65}rt(document.domain);
	window['alert'](document.domain);

	/*

	Arc Dark theme for styling Vimium link hints

	By Giorgi Gzirishvili (@giogziro95). This code is in the public domain.

	To use:
	1. Copy the code.
	2. Go to the Vimium options.
	3. Click Show Advanced Options.

	#!/bin/bash

	# Tom Hale, 2016. MIT Licence.
	# Print out 256 colours, with each number printed in its corresponding colour
	# See http://askubuntu.com/questions/821157/print-a-256-color-test-pattern-in-the-terminal/821163#821163

	set -eu # Fail on errors or undeclared variables

	printable_colours=256