yonjah

TL;DR - jump to the challenge at the end

====ON BLOCKING EVIL BOTS=====
On a resent job interview I had for "Incapsula" a few days ago I was put to the challenge to break
their bot protection mechanism. Apparently node.js is not that common among bot writes and most bots
are not able to run javascript.
The challenge had two parts -
1. find what the code does.
2. implement a bot that will break the code without using js.
3. think how to make this code unbreakable

mwunsch

/**
 *
 * Here's a thing that will look through all the text nodes of a document, and
 * upon encountering an emoji codepoint, will replace it with an image.
 * For now, those images are pulled from GitHub, which isn't very nice, so I
 * need to find a more suitable host.
 *
 * Much of this code was gleaned from staring at the minified GitHub JS.
 *
 * Copyright (c) 2013 Mark Wunsch. Licensed under the MIT License.

gist:4702627

 public class NodeContent
    {
        public NodeContent(int n)
        {
            this.Contenuto = n;
        }
        public int Contenuto { get; set; }
     }
     class DoubleLinkedListNode
    {

JangoSteve

#!/usr/bin/env ruby
#
# Proof-of-Concept exploit for Rails Remote Code Execution (CVE-2013-0333)
#
# ## Advisory
#
#   https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo
#
# ## Caveats
#

andreapavoni

module SimpleStateMachine
  extend ActiveSupport::Concern

  # instance methods
  included do
    def current_step
      # model that includes this module must have a field called 'current_step'
      super || steps.first
    end

postmodern

#!/usr/bin/env ruby
#
# Proof-of-Concept exploit for Rails Remote Code Execution (CVE-2013-0333)
#
# ## Advisory
#
#   https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo
#
# ## Caveats
#

App.js

// Todoapp using Localstorage


/*global window */
/*global document */

(function () {
	"use strict";
	window.todoApp = {
		addTodoBtn: document.getElementById("addTodo"),

freegenie

after_fork do |server, worker|
  log_path = Rails.root.join('log',"#{Rails.env}.#{worker.nr}.log")

  new_logger = Logger.new(log_path)
  new_logger.level = Logger::INFO

  Rails.logger.flush
  Rails.logger.close
  Rails.logger = Rails.application.config.logger = ActiveSupport::TaggedLogging.new(new_logger)

ryanfitz

package main

import (
	"fmt"
	"time"
)

// Suggestions from golang-nuts
// http://play.golang.org/p/Ctg3_AQisl

jasonroelofs

] wc -l domains.txt 
     783 domains.txt

] time go run domain_lookup_parallel.go

real	0m5.743s
user	0m0.359s
sys	0m0.355s

] time go run domain_lookup_sequential.go