rainb3rry

XML Vulnerabilities

XML processing modules may be not secure against maliciously constructed data. An attacker could abuse XML features to carry out denial of service attacks, access logical files, generate network connections to other machines, or circumvent firewalls.

The penetration tester running XML tests against application will have to determine which XML parser is in use, and then to what kinds of below listed attacks that parser will be vulnerable.

Multipart-POST Request Using Node.js

Here, I introduce 2 scripts for uploading files to Slack using Node.js as samples. These 2 sample scripts are for uploading files to Slack.

Sample script 1:

You can upload the zip file by converting byte array as follows.
- At first, it builds form-data.
- Adds the zip file converted to byte array and boundary using Buffer.concat().
- This is used as body in request.

How to get parent of parent in Sass

You can just get it from cached &. Here is a simple BEM example:

HTML

<ul class="pagination">
  <li class="pagination__item">
    <a class="pagination__link" href="#">
      Page 1

Common Options

-#, --progress-bar Make curl display a simple progress bar instead of the more informational standard meter.

-b, --cookie <name=data> Supply cookie with request. If no =, then specifies the cookie file to use (see -c).

-c, --cookie-jar <file name> File to save response cookies to.

Tired of entering passwords again and again ?

Run this command to remember your password:

git config --global credential.helper 'cache --timeout 28800'

Above command will tell git to cache your password for 8 hours.

	# Get SHA256 of a text
	# Usage: sha256 password
	# output: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
	function sha256() {
	echo -n $1 \| shasum -a 256
	# Source: http://albertech.blogspot.fr/2015/02/generate-sha-256-hash-from-command-line.html
	}

	1 - Install Home Brew.
	/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

	2 - Install aircrack-ng:
	brew install aircrack-ng

	3 - Install the latest Xcode, with the Command Line Tools.
	//Create the following symlink:
	sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport//Figure out which channel you need to sniff:

	// Simulates try/catch statements wrapping async functions in (nested) object
	// Returns copy of original object with basic promise-rejection handling for async functions using .catch
	// Saves the time of writing try/catch statements in every single async function

	const trycatch = obj => Object.keys(obj)
	.reduce((acc, curr) => ({ ...acc, [curr]: obj[curr] instanceof Function
	? (...args) => obj[curr](...args).catch(::console.error)
	: trycatch(obj[curr]) }), {})

	brew tap homebrew/versions
	brew install v8-315

	gem install libv8 -v '3.16.14.13' -- --with-system-v8
	gem install therubyracer -- --with-v8-dir=/usr/local/opt/v8-315

	bundle install

	ŞEN
	KANDEMİR
	ÇEVİK
	ERKURAN
	TÜTEN
	ÖZTÜRK
	YÜZBAŞIOĞLU
	VURAL
	YÜCEL
	SÖNMEZ