Hi everyone,
Here is a small article on how I successfully deployed my Django application through Github actions. Basically, what I needed was pretty simple, as soon as I push a new commit (on master), I want to:
cfptime service (which will do all the magic)My cfptime.org project is something like ~3 years old and at the beginning, I was deploying by hand and I created a bash script in order to ease this part and this is what it looked like:
... ➦Hi everyone!
Here is a small article on some experiments I came across with the development of the new cfptime.org version. Goal: I needed to limit (anonymous) visitors on specific API endpoints (especially when creating/posting new Call For Papers to avoid flooding).
It turns out someone had similar thoughts and his blog post was pretty interested and helped me a lot. You can find the blog post here: https://www.pedaldrivenprogramming.com/2017/05/throttling-django-rest-framwork-viewsets/.
As the author states:
... ➦Hello everyone,
Here is a small article in order to explain you how I’ve deployed my Angular front-end to a server with Github actions.
Context: You might know that I am the developer behind cfptime.org and I’ve had the chance during the holidays to start re-developing the front-end using Angular. If you want to check what it looks like: https://beta.cfptime.org.
I’ve longer been a CircleCI user but it seems that the free plan is not enough in order to build my Angular project (and trust me, it’s nothing ground-breaking, just couple of API calls and that’s it).
... ➦Time to relieve this blog and I think that a review of the Corelan Bootcamp training is the perfect occasion! I had in mind to try the OSCE certification and I felt I needed to go beyond just basic buffer overflows that you might come by with OSCP for example.
I’ve had the chance to attend this training at Hack in Paris in June 2018 and I will try to give as much insights as I can without telling too much (because of NDA). The overall training is exclusively dealing with the Windows Stack and associated vulnerabilities so nothing about heap exploitation (check the Advanced training for that).
... ➦Hey there,
Following my serie of write-ups for the BSidesCBR challs, I will discuss the DerpChat one.
The instructions for this challenge were:
This web-based challenge was worth 275 points.
Run docker-compose up and then browse to https://web.shell.dance:4443/.
After browsing to https://web.shell.dance:4443/, I arrived on a registration/login page. I registered the account test/test and I finally got a page with two inputs: – One too search some messages I suppose – And one in the middle of the page stating: “Hello, could you please send me the link I was after?”.
Hello everyone!
Such a long time since I didn’t post any article. Here is a quick write-up for the BSidesCBR Cryto challenge for “needleinahaystack”.
Before diving in the challenge, huge props to all the organizers and OJ for making those challs available to everyone with Docker containers and stuff (more write-ups coming soon).
If you guys want to give it a shot, here you go, all challs are available here. The challenge we will discuss in this post (needleinahaystack) is located here.
... ➦After analyzing the HTTP Security Headers from the top 10k Alexa websites, I decided looking at the SSL Ciphers used on those websites.
... ➦This post deals with recent observations regarding UPnP (Universal Plug and Play) protocol & Routers. In few words, thanks to this protocol, devices (such as file sharing services, games, ..) can be easily connected/deployed.
First, I started to do research on my box to find relevant UPnP functionalities by hand, found some but I had trouble to exploit them. Few days ago, David Middlehurst released a tool called “UPnP Pentest Toolkit”.
... ➦This has been some long time I haven’t written another write-up. This one’s for Kioptrix 3 that you can find here.
$ nmap -sP 192.168.56.1/24
and we got the IP address : 192.168.56.101.
As it was explained, you need to add 192.168.56.101 kioptrix3.com in your /etc/hosts.
Then, let’s find what kind of services are running on the host machine.
$ nmap 192.168.56.101 -sV -A
Starting Nmap 6.46 ( http://nmap.org ) at 2014-06-12 20:15 CEST
Nmap scan report for malicious (192.168.56.101)
Host is up (0.00034s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1.2 (protocol 2.0)
| ssh-hostkey:
| 1024 30:e3:f6:dc:2e:22:5d:17:ac:46:02:39:ad:71:cb:49 (DSA)
|_ 2048 9a:82:e6:96:e4:7e:d6:a6:d7:45:44:cb:19:aa:ec:dd (RSA)
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch)
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
title = "kioptrix 3 write up"
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.59 seconds
Quite obvious, let’s check this Web server !
... ➦Hi there, this post deals with the game released by Google few days ago about XSS vulnerabilities that you can find here.
I’ll enumerate some of the solution I found on the Internet which were (in my opnion) interesting/fun. This post contains the solutions for all levels. Big spoil.
Well, this one was obvious:
<script>alert(1);</script>
For this one, you had different options:
... ➦