Skip to content

Instantly share code, notes, and snippets.

View mdsnins's full-sized avatar

Jihwan Kim mdsnins

71 followers · 41 following
  • ENKI
  • Seoul, Korea
View GitHub Profile
@mdsnins
mdsnins / py-universe-sample-01.py
Created December 22, 2021 09:41
Sample code to load VOD / FNS feed using py-universe
from universe import *
from universe import config
sess = UserSession(access_token = config.TEST_ACCESS_TOKEN)
vod_mod = VODModule(sess)
fns_mod = FNSModule(sess)
print("\n\nLoad VODs")
# Load all VODs
vod_mod.LoadSeries(9) #IZ*ONE
@mdsnins
mdsnins / linectf2021_me7ball.md
Created March 26, 2022 23:19
[LINE CTF 2021] Haribote-Secure-Note

Me7-ball

LINECTF 2021 - Web
Writeup by Payload as Super HexaGoN

Free list

When the chunk is deleted or updated with larger size, it frees the chunk and add to empty list with the original size.

Size Confusion

@mdsnins
mdsnins / linectf2021_haribote.md
Created March 26, 2022 23:09
[LINE CTF 2021] Haribote-Secure-Note

Haribote-Secure-Note

LINECTF 2021 - Web
Writeup by Payload as Super HexaGoN

CSP

This page, CSP was applied. Since nonce- directive is given, we should reuse exisitng valid-nonce script tags.

Two Injection Point

@mdsnins
mdsnins / linectf2021_bb.md
Last active March 27, 2022 06:13
[LINE CTF 2021] bb

bb

LINECTF 2021 - Web
Writeup by Payload as Super HexaGoN

BASH_ENV envrionment

We can inject some bash command line using environment BASH_ENV.

BASH_ENV=touch /tmp /bin/bash will execute touch.