John Poulin forced-request

CTO @CloudSecurityPartners, ex-GitHub Security

forced-request / server.js

Created February 22, 2019 21:06

Handle all uncaught exceptions to prevent node service from crashing. This is useful for preventing denial-of-service attacks in Node.JS

	/* Tell Node not to crash */
	process.on('uncaughtException', function (err) {
	console.log('Caught exception: ', err);
	});

forced-request / rails_dynamic_render_code_exec.rb

Created January 25, 2016 22:03

	require 'msf/core'

	class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking
	@@trav_string = '%5c%2e%2e%2f'

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
	super(update_info(info,

forced-request / json_encode-xss-prevention.php

Created July 27, 2015 23:37

Using json_encode to prevent JS context XSS

	<html>
	<body>
	<script>
	var a = “prefix” + <?= json_encode($_GET['p']); ?> + “suffix”;
	</script>
	</body>
	</html>

forced-request / htmlentities_javascript.php

Last active August 29, 2015 14:26

htmlentities in JavaScript context

forced-request / mitigated_dynamic_render.rb

Last active August 29, 2015 14:19

	def show
	template = params[:id]
	d = Dir[“myfolder/*.erb]

	if d.include?(“myfolder/#{template}.erb”)
	render "myfolder/#{template}"
	else
	# throw exception or 404
	end
	end

forced-request / mitigated_dynamic_render.rb

Created April 23, 2015 16:03

	def show
	template = params[:id]

	valid_templates = {
	"dashboard" => "dashboard",
	"profile" => "profile",
	"deals" => "deals"
	}

	if valid_templates.include?(template)

forced-request / dynamic_render.rb

Last active August 29, 2015 14:19

forced-request / gist:7ff7fe31632c23d47f6c

Created December 23, 2014 13:14

SlimerJS callbacks not working

	wp = require("webpage").create();
	wp.onAlert = function(text) {
	console.log("Alerted: " + text);
	};

	wp.content = "<html><body>Hello: <iframe src='f' onerror='prompt(299792458)'></iframe><script>window.alert(\"Normal Func\")</script></body></html>";
	wp.evaluate(function (wp) {

	}, wp);

forced-request / attack.rb

Created December 9, 2014 01:20

	def Attack
	end

forced-request / main.rb

Created December 9, 2014 01:19

	require 'lib/request'
	puts "hi"