Alex santaklouse

create segfault server configuration (details: https://www.thc.org/segfault/)

$ ssh [email protected] # The password is 'segfault'

~/.ssh/config

Unicode XSS via Combining Characters

Most application security practitioners are familiar with Unicode XSS, which typically arises from the Unicode character fullwidth-less-than-sign. It’s not a common vulnerability but does occasionally appear in applications that otherwise have good XSS protection. In this blog I describe another variant of Unicode XSS that I have identified, using combining characters. I’ve not observed this in the wild, so it’s primarily of theoretical concern. But the scenario is not entirely implausible and I’ve not otherwise seen this technique discussed, so I hope this is useful.

Recap of Unicode XSS

Lab: https://4t64ubva.xssy.uk/

A quick investigation of the lab shows that it is echoing the name parameter, and performing HTML escaping:

Image

resource: [GitHub Pages](https://imagebin.ca/)

add alias imgbin to ~/.bashrc

imgbin() { curl -F file="@${1}" 'https://imagebin.ca/upload.php'; }

example

Create patch

create raw binary git patch file for untracked files only (exclude: zip archives/files/ directory/*.patch files)

$ { for next in $( git ls-files --others --exclude-standard --exclude=*.zip --exclude=files/* -x '*.patch') ; do git --no-pager diff -p --ignore-space-change --ignore-cr-at-eol --raw --binary -b -w --no-index /dev/null $next; done; } > untracked.patch

Apply patch

show information about changes that will be applied

	on vps (proxy.wrtc.pp.ua):
	$ chisel server --proxy https://proxy-seller.com/ --auth foo:bazz -v --socks5 --port 8080 --reverse

	on target machines:

	(inside container)
	limactl start \
	--containerd=user \
	--name=default \
	--cpus=4 \

	FROM php:8.2-fpm

	WORKDIR /var/www

	RUN apt-get update && apt-get install -y \
	build-essential \
	libpng-dev \
	libjpeg-dev \
	libfreetype6-dev \
	libonig-dev \

	import socket
	import os
	import logging
	import psutil

	WOL_PORT = 9
	INTERFACE_NAME = 'Ethernet 4'

	logging.basicConfig(format='%(levelname)s: %(asctime)s %(message)s', level=logging.INFO)
	logger = logging.getLogger(__name__)

	version: '3'
	services:
	socks5:
	image: serjs/go-socks5-proxy
	restart: always
	depends_on:
	- zerotier-one
	ports:
	- 1080:1080
	zerotier-one:

	function log2syslog
	{
	declare COMMAND
	COMMAND=$(fc -ln -0)
	logger -p local1.notice -t bash -i -- "${USER}:${SUDO_USER}:${COMMAND}"
	}
	trap log2syslog DEBUG