amotmot

#! /bin/bash
## --proxy-server=socks://127.0.0.1:11080
## --proxy-pac-url="http://zap/proxy.pac"
## --proxy-bypass-list="local" \
if [[ -n "$FRESH" ]]; then
    UDD="$TMPDIR/chromium-$RANDOM"
    ARGS="$ARGS --user-data-dir=$UDD"
fi
ARGS="$ARGS --no-default-browser-check"
ARGS="$ARGS --no-first-run"

amotmot

#!/bin/sh
exec rg -i -e 'md2|md4|md5|sha1|rc2|rc4|mersenne|mt19937|ecb|3des|getpid|srand|oee|crc|rot13' $1

amotmot

import sqlite3
import tldextract

history_domains = set()
cf_domains = None

print("Loading domains from Chrome browsing history...")

# Copy history from ~/Library/Application Support/Google/Chrome/Default/History
conn = sqlite3.connect('History')

amotmot

alias disable_forward_secrecy_haproxy="sed -i \"s/ciphers 'AES128+EECDH:AES128+EDH'/ciphers 'AES128-SHA'/\" /path/to/haproxy.conf"
alias enable_forward_secrecy_haproxy="sed -i \"s/ciphers 'AES128-SHA'/ciphers 'AES128+EECDH:AES128+EDH'/\" /path/to/haproxy.conf"

amotmot

VBoxManage modifyhd /path/to/<vm_name>/<disk_name>.vdi –resize <size in MB>

VBoxManage clonehd dynamic.vdi static.vdi --format VDI --variant Fixed

amotmot

function validateReDoS( string ) {
        var expression = /(.|..){999}/;

    return expression.test( string );
}

start = process.hrtime();
console.log(validateReDoS('foo@bar.com'));
console.log(process.hrtime(start));

amotmot

Firefox

• https://addons.mozilla.org/en-US/firefox/addon/newusercspdesign/

Chrome

• https://www.oxdef.info/csp-tester/
• https://chrome.google.com/webstore/detail/caspr-enforcer/fekcdjkhlbjngkimekikebfegbijjafd
• https://github.com/crypto/noCSP

Fiddler

• https://github.com/david-risney/CSP-Fiddler-Extension

amotmot

Java

• https://github.com/sourceclear/headlines

Rails / Sinatra / Padrino / Ruby

• https://github.com/twitter/secureheaders

Go

• https://github.com/kr/secureheader

Node / Connect / Express

amotmot

Keybase proof

I hereby claim:

• I am gellerb on github.
• I am gellerb (https://keybase.io/gellerb) on keybase.
• I have a public key whose fingerprint is 6C4D A8FB 4D61 F21A 39AB 9A94 9C73 FD3A 197B 11BE

To claim this, I am signing this object:

amotmot

The Web Application Hacker's Handbook

Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file

Contents

• Recon and analysis
• Test handling of access
• Test handling of input
• Test application logic
• Assess application hosting
• Miscellaneous tests