Skip to content

Instantly share code, notes, and snippets.

View cktricky's full-sized avatar
🏠
Working from home

Ken Johnson cktricky

🏠
Working from home
View GitHub Profile
@cktricky
cktricky / mandrill.rb
Created October 3, 2014 19:41
Mandrill Configuration File
# THIS FILE IS FOUND WITHIN config/initializers/mandrill.rb
require 'mandrill'
# Use an environment variable instead of placing the key in source code
MANDRILL = Mandrill::API.new ENV['MANDRILL_API_KEY']
@cktricky
cktricky / my_mailer.rb
Created October 3, 2014 19:35
Forgot Password - MyMailer
class MyMailer < Devise::Mailer
def confirmation_instructions(record, token, opts={})
# code to be added here later
end
def reset_password_instructions(record, token, opts={})
options = {
:subject => "Password Reset",
:email => record.email,
@cktricky
cktricky / my_mailer.rb
Created October 3, 2014 19:09
MyMailer (override Devise's Mailer)
class MyMailer < Devise::Mailer
def confirmation_instructions(record, token, opts={})
# code to be added here later
end
def reset_password_instructions(record, token, opts={})
# code to be added here later
end
@cktricky
cktricky / devise.rb
Created October 3, 2014 19:03
Devise Configuration File - Mailer
# THIS FILE IS FOUND WITHIN config/initializers/devise.rb
# ==> Mailer Configuration
# Configure the e-mail address which will be shown in Devise::Mailer,
# note that it will be overwritten if you use your own mailer class
# with default "from" parameter.
config.mailer_sender = '[email protected]'
# Configure the class responsible to send e-mails.
config.mailer = 'MyMailer'
@cktricky
cktricky / mailer.rb
Created October 3, 2014 18:57
devise mailer
if defined?(ActionMailer)
class Devise::Mailer < Devise.parent_mailer.constantize
include Devise::Mailers::Helpers
def confirmation_instructions(record, token, opts={})
@token = token
devise_mail(record, :confirmation_instructions, opts)
end
def reset_password_instructions(record, token, opts={})
@cktricky
cktricky / xssable.js
Created June 4, 2014 19:21
example JS/XSS context
<script type="text/javascript">
function someThing(){
$("#someDiv").append("someUserContent");
}
</script>
@cktricky
cktricky / django_session_deobfuscation.py
Last active August 29, 2015 14:02
Django Session Deobfuscation
import re
import zlib
import base64
import pickle
orig_session_id = ".eJxrYKotZNQIFYpPLC3JiC8tTi2KT0pMzk7NSylkCtVMyUrMS8_XS87PKynKTNIDqdGDShfr-eanpOY4QRUzh_IiGZGZUsjizVyqBwA9cCGB:1WrtB4:7bnqeUSJ2mJCPeyPA0FcskLq0m0"
def b64_decode(s):
number = (-len(s) % 4)
pad = number * "="
@cktricky
cktricky / rails_session_deobfuscation.rb
Created June 3, 2014 18:10
Rails session deobfuscation
require 'base64'
require 'cgi'
orig_session_id = "BAh7CEkiD3Nlc3Npb25faWQGOgZFVEkiJWViYTgyMTMwYjE3ZmJkMDVmOTI4MTYzYzhjMWI1YTcwBjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMVhJblpXL2NQNERnQVZZT0NTeWs5RXJzb2JpNzFOSlJwZ0NVQjlnNWplc3c9BjsARkkiDHVzZXJfaWQGOwBGaQo%3D--be5328b6089949b1a5da6eb3b21e220744705ab8"
new_session_id = CGI::unescape(orig_session_id).split('--').first
decoded = Marshal.load(Base64.decode64(new_session_id))
puts "Deobfuscated cookie: #{decoded}"
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
X-UA-Compatible: IE=Edge
ETag: "2333488e856669ac637e37cb4cf09cb6"
Cache-Control: max-age=0, private, must-revalidate
X-Request-Id: baa6a1c90004838793614e4c61633767
X-Runtime: 0.092768
Connection: close
{"email":"[email protected]","first_name":"Jack","last_name":"Mannino","user_id":2}
def as_json
super(only: [:user_id, :email, :first_name, :last_name])
end