Richard Metzler rmetzler

WordPress Flash XSS in flashmediaelement.swf

Intro
Background
Affected Systems
Mitigation

Quick Overview

OTF+SVG allows to read info character by character with only a STYLE injection through XEE & timing

Intro

Mozilla Firefox supports a feature that allows to define SVG images inside an OTF font to represent characters. This is useful if we for example want to work with colorful characters, Emoji, animated characters and so on. Firefox is currently the only relevant browser supporting this technology.

The general technology and its advantages are described here:

https://hacks.mozilla.org/2014/10/svg-colors-in-opentype-fonts/

Processing JSON using jq

jq is useful to slice, filter, map and transform structured json data.

Installing jq

On Mac OS

brew install jq

The issue:

..mobile browsers will wait approximately 300ms from the time that you tap the button to fire the click event. The reason for this is that the browser is waiting to see if you are actually performing a double tap.

(from a new defunct https://developers.google.com/mobile/articles/fast_buttons article)

touch-action CSS property can be used to disable this behaviour.

touch-action: manipulation The user agent may consider touches that begin on the element only for the purposes of scrolling and continuous zooming. Any additional behaviors supported by auto are out of scope for this specification.

Nginx Cheat Sheet

(from Understanding Nginx Server and Location Block Selection Algorithms - https://goo.gl/YyzshP)

server {

~/vim/colors/miscolores.vim

highlight DiffAdd    cterm=bold ctermfg=10 ctermbg=17 gui=none guifg=bg guibg=Red
highlight DiffDelete cterm=bold ctermfg=10 ctermbg=17 gui=none guifg=bg guibg=Red
highlight DiffChange cterm=bold ctermfg=10 ctermbg=17 gui=none guifg=bg guibg=Red
highlight DiffText   cterm=bold ctermfg=10 ctermbg=88 gui=none guifg=bg guibg=Red

~/.vimrc

README

Create a template service file at /etc/systemd/system/secure-tunnel@.service. The template parameter will correspond to the name of target host:

[Unit]
Description=Setup a secure tunnel to %I
After=network.target

Don't use VPN services.

No, seriously, don't. You're probably reading this because you've asked what VPN service to use, and this is the answer.

Note: The content in this post does not apply to using VPN for their intended purpose; that is, as a virtual private (internal) network. It only applies to using it as a glorified proxy, which is what every third-party "VPN provider" does.

A Russian translation of this article can be found here, contributed by Timur Demin.
A Turkish translation can be found here, contributed by agyild.
There's also this article about VPN services, which is honestly better written (and has more cat pictures!) than my article.

	#!/usr/bin/python

	DOCUMENTATION = '''
	---
	module: github_repo
	short_description: Manage your repos on Github
	'''

	EXAMPLES = '''
	- name: Create a github Repo

	#include <SPI.h>
	#include <Wire.h>
	#include <DHT.h>
	#include <Adafruit_GFX.h>
	#include <Adafruit_SSD1306.h>

	#define OLED_RESET 4 // not used / nicht genutzt bei diesem Display
	Adafruit_SSD1306 display(OLED_RESET);