T1T4N

Preview on macOS 10.14.6 Mojave can remove PDF owner password

T1T4N

// Restores old tab bar in Safari 15.0 (16612.1.29.41.4, 16612)
// clang -fmodules -shared -Wall -Os -o libsafariinject.dylib safariinject.m
//
// If SIP off:
// DYLD_INSERT_LIBRARIES=$PWD/libsafariinject.dylib /Applications/Safari.app/Contents/MacOS/Safari
//
// If SIP on, you can demo this by manually removing Safari's code signing signature, but many
// features (eg saved logins) won't be readable by the resigned app:
// cp -a /Applications/Safari.app ./
// codesign --remove Safari.app/Contents/MacOS/Safari

T1T4N

/*
Written By Pan ZhenPeng(@peterpan980927) of Alibaba Security Pandora Lab
use it on macOS: cc poc.c -o poc while True; do ./poc ; done
*/

#include <errno.h>
#include <signal.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>

T1T4N

/usr/bin/sandbox-exec
-p
'(version 1) (allow default) (deny network-outbound (remote ip)) (allow network-outbound (remote ip "localhost:*"))'
/Library/Developer/XcodeServer/CurrentXcodeSymlink/Contents/Developer/usr/share/xcs/Node/bin/node
/Library/Developer/XcodeServer/CurrentXcodeSymlink/Contents/Developer/usr/share/xcs/xcsd/worker.js

T1T4N

swift build --configuration release --disable-sandbox

T1T4N

Client -> Server

C: ssh -L 10666:localhost:10667 user@hostname
S: nc -l 10667
C: echo 1 | netcat localhost 10666

T1T4N

// Navigate to: https://twitter.com/{username}/with_replies
// In the developer console, paste the following code
// Repeat a few times as some tweets might be missed

const sleep = ms => new Promise(res => setTimeout(res, ms));

const performWhileScrolling = async (asyncFn) => {
    let oldOffset = window.pageYOffset;
    let newOffset = oldOffset;

T1T4N

// Navigate to: https://twitter.com/{username}/likes
// In the developer console, paste the following code
// Repeat a few times as some tweets might be missed

const sleep = (milliseconds) => {
    return new Promise(resolve => setTimeout(resolve, milliseconds))
}

const performWhileScrolling = async (asyncFn) => {
    let oldOffset = window.pageYOffset;

T1T4N

typedef NS_ENUM(NSUInteger, ExampleMouseActionCode) {
    ExampleMouseActionCodeLeftClick = 0,
    ExampleMouseActionCodeMove = 1,
};

typedef NS_ENUM(NSUInteger, ExampleMouseActionEnum) {
    ExampleMAE_LMBClick = ExampleMouseActionCodeLeftClick,
    ExampleMAE_Move = ExampleMouseActionCodeMove,
} DEPRECATED_MSG_ATTRIBUTE("Use ExampleMouseActionCode instead.");

T1T4N

extension Collection {
    /// Returns the element at the specified index if it is within bounds, otherwise nil.
    subscript(safe index: Index) -> Element? {
        return indices.contains(index) ? self[index] : nil
    }

    subscript(safe index: Index, default defaultValue: @autoclosure () -> Element) -> Element {
        return self[safe: index] ?? defaultValue()
    }
}