Sissel Siss3l

Google CTF 2023 - web/Biohazard

14 solves / 333 pts
CTFtime: https://ctftime.org/event/1929
Official repository: https://github.com/google/google-ctf/tree/master/2023/web-biohazard ¹

Summary writeup

I predict that this URL will be broken because the directory structure will change when the final round source code is released, as in previous years 😅 ↩

GitHub Search Syntax for Finding API Keys/Secrets/Tokens

As a security professional, it is important to conduct a thorough reconnaissance. With the increasing use of APIs nowadays, it has become paramount to keep access tokens and other API-related secrets secure in order to prevent leaks. However, despite technological advances, human error remains a factor, and many developers still unknowingly hardcode their API secrets into source code and commit them to public repositories. GitHub, being a widely popular platform for public code repositories, may inadvertently host such leaked secrets. To help identify these vulnerabilities, I have created a comprehensive search list using powerful search syntax that enables the search of thousands of leaked keys and secrets in a single search.

Search Syntax:

(path:*.{File_extension1} OR path:*.{File_extension-N}) AND ({Keyname1} OR {Keyname-N}) AND (({Signature/pattern1} OR {Signature/pattern-N}) AND ({PlatformTag1} OR {PlatformTag-N}))

Examples:

**1.

Reverse Engineering Webpack Apps

Some notes and techniques for reverse engineering Webpack (and a little bit about React/Vue/Angular) apps.

Does ChatGPT have a criminal mind?

Exploring the Potential Impact of Large Language Models on Fraud Perpetration


Image generated with DALL-E 2/OpenAI

Adapted to Markdown from https://medium.com/@adnane.lahbabi/does-chatgpt-have-a-criminal-mind-84f98cdce22a

Open Source Business Challenges and Reality

Original Japanese note here.

Original Author: Rui Ueyama (creator of the mold linker)

Translated by @windowsboy111

Minimally edited by @lleyton

How I freed up one TiB of space

I didn't realize just how much space those 24 Hour YouTube tracks take up. After hearing the same song on repeat I decided to check:

$ pip install xklb
$ lb fsadd --audio ~/lb/audio.db /mnt/d/81_New_Music/ /mnt/d/82_Audiobooks/
$ lb listen ~/lb/audio.db /81_New_Music/ --duration +3hr -p a
╒═══════════╤═════════╤═══════════════════════════════════════════╤═══════════════════════════╤══════════════════════════════════════════╤════════╤════════════╕
│ path      │   count │ duration                                  │ avg_duration              │ cadence_adj_duration                     │ size   │ avg_size   │

╞═══════════╪═════════╪═══════════════════════════════════════════╪═══════════════════════════╪══════════════════════════════════════════╪════════╪════════════╡

	using System.Text;
	using AsmResolver;
	using AsmResolver.DotNet;
	using AsmResolver.DotNet.Builder.Metadata.Blob;
	using AsmResolver.DotNet.Builder.Metadata.Strings;
	using AsmResolver.DotNet.Code.Cil;
	using AsmResolver.DotNet.Signatures;
	using AsmResolver.IO;
	using AsmResolver.PE;
	using AsmResolver.PE.DotNet.Builder;

	/*
	*
	* Author: @javierprtd
	* Date : 22-06-2023
	* Kernel: 5.10.77
	* Bug : https://lkml.org/lkml/2019/12/5/814
	* Review: This bug has never been in the official kernel
	* Post : https://soez.github.io/posts/no-cve-for-this.-It-has-never-been-in-the-official-kernel
	*
	*/

	<body>
	<script>
	const sleep = (time) => new Promise((resolve) => setTimeout(resolve, time))
	const frame = document.createElement('iframe');
	frame.src = `https://sbx-hoge.postviewer2-web.2023.ctfcompetition.com/shim.html?o=${encodeURIComponent(location.origin)}`;
	document.body.appendChild(frame);

	const frame2 = document.createElement('iframe');
	frame2.src = `https://sbx-hoge.postviewer2-web.2023.ctfcompetition.com/shim.html?o=${encodeURIComponent(location.origin)}`;
	frame2.setAttribute('sandbox', 'allow-downloads allow-downloads-without-user-activation allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-presentation allow-same-origin allow-scripts allow-storage-access-by-user-activation allow-top-navigation allow-top-navigation-to-custom-protocols')

	// Adapted from https://raddle.me/f/Privacy/3722/how-to-circumvent-cloudflare-s-email-protected-thing-without with the help of chatGPT
	function fixObfuscatedEmails() {
	const elements = document.getElementsByClassName('__cf_email__');
	for (let i = 0; i < elements.length; i++) {
	const element = elements[i];
	const obfuscatedEmail = element.getAttribute('data-cfemail');
	if (obfuscatedEmail) {
	const decodedEmail = decrypt(obfuscatedEmail);
	element.setAttribute('href', 'mailto:' + decodedEmail);
	element.innerHTML = decodedEmail;