huijari

RCE ATTACKS AND TECHNIQUES

• Remote Command or OS Command Injection Basics
• Blind RCE Injection
• RCE Techniques and Cheat Sheet
• Bypassing RCE Filter

JSON HIJACKING

• JSON Hijacking Basics
• JSON Hijacking Demo

huijari

body {
  color: #333;
  font-family: Helvetica;
  line-height: 1.5em;
  margin: 16px auto;
  max-width: 40em;
}

huijari

#!/usr/bin/bash
mpc add $(youtube-dl --prefer-insecure -g -f140 $1)

huijari

# This file is automatically generated by the fish.
# Do NOT edit it directly, your changes will be overwritten.
SET __fish_classic_git_prompt_initialized:\x1d
SET __fish_init_1_50_0:\x1d
SET __fish_init_2_39_8:\x1d
SET __fish_init_2_3_0:\x1d
SET fish_color_autosuggestion:FFC473
SET fish_color_command:FF9400
SET fish_color_comment:A63100
SET fish_color_cwd:green

huijari

const Just = value => ({
  bind: f => f(value)
});
const Nothing = () => ({
  bind: Nothing
});

const getUser = name => Just({
  getPicture: () => Nothing()
});

huijari

import {
  from,
  just,
} from 'comea'

const log = label => value => console.log(label, value)
const range = x => from(Array(x).fill(0).map((_, k) => k + 1))

const bind = (base, f) => next
  base(data => f(data)(next))

huijari

Keybase proof

I hereby claim:

• I am huijari on github.
• I am huijari (https://keybase.io/huijari) on keybase.
• I have a public key whose fingerprint is 3826 B8CC 68A4 D55D E151 2F32 D6CE 7B24 3D0E C5D4

To claim this, I am signing this object: