matt-’s gists

matt- / tagKnowBe4Messages.js

Created April 1, 2026 00:09

A google script for gmail to tag KnowBe4 phishing attempts.

	/**
	* Looks for messages whose Received header contains:
	* "from psm.knowbe4.com"
	* In Apps Script, enable Advanced Google services:
	* Services > Gmail API > On
	**/

	function tagKnowBe4Messages() {
	const label = getOrCreateLabel_('KnowBe4');
	let pageToken;

matt- / escape.js

Created June 28, 2024 17:49 — forked from jcreedcmu/escape.js

Escaping nodejs vm

	////////
	// The vm module lets you run a string containing javascript code 'in
	// a sandbox', where you specify a context of global variables that
	// exist for the duration of its execution. This works more or less
	// well, and if you're in control of the code that's running, and you
	// have a reasonable protocol in mind// for how it expects a certain
	// context to exist and interacts with it --- like, maybe a plug-in
	// API for a program, with some endpoints defined for it that do
	// useful domain-specific things --- your life can go smoothly.

matt- / rce_for_rce.html

Last active January 31, 2022 00:05

An RCE in the POC by Jonathan Scott for the RCE V1.0 PoC iOS 15.0.1 https://twitter.com/mattaustin/status/1447787504837398530

	<!doctype html>
	<html lang="en" class="h-100">
	<head>
	<!-- Required meta tags -->
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<!-- Bootstrap CSS -->
	<link href="https://getbootstrap.com/docs/5.0/dist/css/bootstrap.min.css" rel="stylesheet" crossorigin="anonymous">

matt- / hacker_hot_key.ino

Created April 29, 2021 17:57

	#include <Keyboard.h>
	#include <Bounce2.h>

	#define NUM_BUTTONS 8
	const uint8_t BUTTON_PINS[NUM_BUTTONS] = {13, 5, 10, 9, 8, 6, 12, 4};
	Bounce2::Button * buttons = new Bounce2::Button[NUM_BUTTONS];
	extern void openUrl(String url);

	// array of function pointers
	void (*keyActions []) () = {

matt- / index.html

Last active June 22, 2025 18:44

Electron contextIsolation POC

	<!DOCTYPE html>
	<html>
	<head>
	<script>

	var proc = false;
	Function.prototype.call= new Proxy(Function.prototype.call, {
	apply: function(target, thisArg, argumentsList) {
	console.log(thisArg)
	if(!proc){

matt- / index.html

Created September 4, 2018 21:49

Electron Fiddle Gist

	<!DOCTYPE html>
	<html>
	<head>
	<meta charset="UTF-8">
	<title>Hello World!</title>
	</head>
	<body>
	<h1>Hello ASD!</h1>
	<p>This window does not have access to node bindings.</p>
	<pre>process: <script>//document.write(process)</script></pre>

matt- / unb.js

Created December 18, 2017 08:58

Embedded Javascript from Southwest Flight



	var r44_btime = r44_btime \|\| new Date();
	var r44_btimems = r44_btime.getTime()/1000;
	var r44_smu_time = r44_smu_time \|\| new Date().getTime();
	var r44_is_cached = r44_is_cached \|\| false;
	var r44_retime, r44_retimems, r44_letime;
	var r44_enable = (window.location != window.parent.location) ? false : true;
	var R44 = R44 \|\| {};
	R44.domain = R44.domain \|\| '';

matt- / md5quine.js

Last active October 5, 2017 20:44

Node MD5Quine

x="q=String.fromCharCode(34);console.log(require('crypto').createHash('md5').update(`x=${q+x+q};${x}`).digest('hex'))";q=String.fromCharCode(34);console.log(require('crypto').createHash('md5').update(`x=${q+x+q};${x}`).digest('hex'))

matt- / native_module.js

Created February 14, 2017 19:45

NativeModule

	var Module = require('module');
	var old_wrap_zero = Module.wrapper[0];

	// some code to inject into a module load.
	var code = '\n(' + (function (){
	process.NativeModule = require('native_module');
	}) + ')();\n';

	Module.wrapper[0] += code;

matt- / main-r.min.js

Last active November 3, 2016 00:59

Wix XSS Update

	var startRender = function() {
	"use strict";
	startRender = function () {};
	/eslint strict:0/
	var isSuspectedBot = false;
	if (!Function.prototype.bind) {
	isSuspectedBot = true;
	Function.prototype.bind = function (object) { //eslint-disable-line no-extend-native
	var self = this,
	slice = Array.prototype.slice,



	var r44_btime = r44_btime \|\| new Date();
	var r44_btimems = r44_btime.getTime()/1000;
	var r44_smu_time = r44_smu_time \|\| new Date().getTime();
	var r44_is_cached = r44_is_cached \|\| false;
	var r44_retime, r44_retimems, r44_letime;
	var r44_enable = (window.location != window.parent.location) ? false : true;
	var R44 = R44 \|\| {};
	R44.domain = R44.domain \|\| '';

Matt Austin matt-