fforres

Documentación de arquitectura para pentesting

Contexto

Skyward es una plataforma de Governance, Risk and Compliance (GRC) construida como un monorepo desplegado en Cloudflare Workers. La arquitectura sigue un modelo local-first con sincronización en tiempo real mediante WebSockets.

Objetivo

Este documento resume la arquitectura técnica relevante para un ejercicio de pentesting sobre la plataforma. El foco está puesto en los límites de confianza, los componentes expuestos, los canales de comunicación en tiempo real y los activos que participan en autenticación, autorización y persistencia.

fforres

brew (Might install xcode)

• /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

OhmyZSH

• sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

1Password

• brew install --cask 1password

ghostty

fforres

ABOUT US

JSConf Chile is a community-driven conference, made for developers by developers, with a very clear objective. Fostering the JavaScript engineering community in Chile, beyond its geographical limits.

We accomplish that by running a yearly JavaScript conference, and focusing on 2 key elements.

Highlighting the local talent. We want to showcase Latin American engineering culture — and Chile specifically — as incredible opportunities for companies to both source talent and to invest in the developer ecosystem.

Provide a top-tier platform for knowledge sharing.

fforres

// This script will inject a specific font from google fonts (this one https://fonts.google.com/specimen/Redacted) and will force all text in a page to use it.
// It's a bit easier than changing all the text-nodes from the page into unicode "blocks", and a lot less resource intensive.

// In case you want to have a bookmark, you can do
// javascript:const injectCSS=()=>{let n=document.createElement("style");return n.type="text/css",n.innerText="\n/* latin-ext */\n@font-face {\n  font-family: 'Redacted';\n  font-style: normal;\n  font-weight: 400;\n  font-display: swap;\n  src: url(https://fonts.gstatic.com/s/redacted/v6/Z9XVDmdRShme2O_7aLTX6OymlLGDzCs.woff2) format('woff2');\n  unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;\n}\n/* latin */\n@font-face {\n  font-family: 'Redacted';\n  font-style: normal;\n  font-weight: 400;\n  font-display: swap;\n  src: url(https://fonts.gstatic.com/s/redacted/v6/Z9XVDmdRShme2O_7aLTZ6OymlLGD.woff2) format(

fforres

const IssueCardWizardInternal = () => {
  // many things happen here
  return <SomeComponent />
}

// Wrap your component like this 👇
export default IssueCardWizardInternal

fforres

import puppeteer from "puppeteer"
 
async function generatePdf(htmlContent) {
  const browser = await puppeteer.launch({ headless: true });
  const page = await browser.newPage();
  await page.setContent(htmlContent);
  const pdf = await page.pdf({ format: 'A4' });
  const pdfBuffer = await page.pdf();
  await page.close();
  await browser.close();

fforres

import 'jest'
import { enrichment, IEnrichmentRequest } from '../../src/middlewares/enrichment'
import { mockReq, mockRes } from 'sinon-express-mock'
import * as sinon from 'sinon'

const enrichmentMiddleware = enrichment()
jest.mock('../../src/middlewares/enrichment/api.ts')

let req: IEnrichmentRequest
let res

fforres

var AWS = require("aws-sdk");
var accessKeyId = process.env.accessKeyId;
var secretAccessKey = process.env.secretAccessKey;
var currentTS = Number(process.env.currentTS);
var lambda = new AWS.Lambda({
  accessKeyId,
  secretAccessKey,
  region: "us-east-1"
});

fforres

# Logs
logs
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# Runtime data
pids
*.pid

fforres

source $HOME/antigen.zsh
source $HOME/dev/src/github.com/segmentio/dotfiles/index.sh


DISABLE_UNTRACKED_FILES_DIRTY="true"
ENABLE_CORRECTION="false"
export SEGMENT_TEAM="app"

# Load the oh-my-zsh's library.
antigen use oh-my-zsh