dannvix

module MethodDecorators
  class Decorator
    @@current_decorators = []

    def self.current_decorators
      decs = @@current_decorators
      @@current_decorators = []
      decs
    end

dannvix

// ==UserScript==
// @name        Facebook Sponsored Posts Cleaner
// @description Automatically Hides Sponsored Posts (Ads) in Facebook Stream
// @namespace   http://facebook.example.org
// @author      Shao-Chung Chen
// @license     MIT (http://opensource.org/licenses/MIT)
// @version     1.3
// @include     http://*.facebook.com/*
// @include     https://*.facebook.com/*
//

dannvix

Use nginx as Non-Transparent SSL Proxy

Introduction

Many mobile apps have back-end API servers. They usually rely on the API replies to determine whether certain information is supposed to be shown. If the API responses could be manipulated on the fly, we may easily fool an unmodified app to expose some private data.

This manual guides you to set up nginx as non-transparent SSL proxy, which just subsitutes strings in the server responses (i.e. man-in-the-middle attack ourself). For both server-side (their API servers) and client-side (your device), the whole process is almost transparent.

dannvix

Intercepts HTTPs Traffic with Python & mitmproxy

Warning

This Gist is created in 2014, and it's highliy outdated now, according to one of mitmproxy's manjor contributor (check his comment below). Thanks for letting us know, @mhils!

Introduction

Modern applications usually make use of back-end API servers to provide their services. With a non-transparent HTTPs proxy, which intercepts the communication between clients and servers (aka the man-in-the-middle scheme), you can easily manipulate both API requests and responses.

dannvix

#!/usr/bin/env python
# -*- encoding: utf-8 -*-
import sys, traceback
import json, urllib2

def latlng_to_addr (lat, lng):
  # convert given latitude & longitude to formatted address with Google Maps API
  # ref: http://techslides.com/convert-latitude-and-longitude-to-a-street-address/
  maps_api_url = 'http://maps.googleapis.com/maps/api/geocode/json?latlng=%s,%s&sensor=false' % (lat, lng)
  try:

dannvix

#!/usr/bin/env ruby
require "geocoder"

def latlng_to_addr (lat, lng)
  query_result = Geocoder.search("#{lat},#{lng}")
  return query_result.first.formatted_address
end

if ARGV.length < 2
  puts "usage: ./#{$0} <latitude> <longitude>"

dannvix

#!/usr/bin/env coffee

class SubtitleParser
  LINE_PATTERN = ///
    subtitle #line prefix
    \s+
    (\d+) # timestamp
    \s+
    (\d+) # duration
    \s+

dannvix

# for P piles with N items, generate all possible combinations without redundant
# e.g. for piles(5, 3) -> [(5,0,0), (4,1,0), (3,2,0), (3,1,1), (2,2,1)] 
def make_piles (num, pile, piles=[], c=Array.new(pile, 0), idx=0)
  if num == 0
    piles.push(c.clone)
  else
    top = (c[idx-1] != 0) ? ((c[idx-1] > num) ? num : c[idx-1]) : (num)
    top.downto(1).each do |i|
      c[idx] = i
      make_piles(num-i, pile, piles, c, idx+1)

dannvix

import java.io.*;
import java.net.*;
import java.lang.Thread;

public class EchoServer {
  public static void main (String[] args) {
    try {
      ServerSocket server = new ServerSocket(5566);
      while (true) {
        Socket client = server.accept();

dannvix

--- Log opened Thu Apr 18 14:41:31 2013
14:44 < dannvix> hello world!
15:45 < hcchien> just saw the picture that ingy got Taiwan beer!
20:12 -!- chihchun is now known as zz_chihchun
21:57 < clkao> miyagawa: muchomucho++
21:58 < clkao> grr missing osdc!
22:08 < hcchien> miyagawa: ping
23:17 < hcchien> btw, we will have the hackathron on Sunday.
23:17 < lunastorm> woot
23:17 < lunastorm> where