Skip to content

Instantly share code, notes, and snippets.

View mkropat's full-sized avatar
📚
Learning

Michael Kropat mkropat

📚
Learning
49 followers · 0 following
View GitHub Profile
@mkropat
mkropat / Android-Apps.md
Created September 3, 2018 19:23
@mkropat
mkropat / boilerplate.html
Created June 23, 2018 22:45
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>PAGE TITLE</title>
</head>
<body>
@mkropat
mkropat / imapsync-ubuntu-howto.md
Last active June 23, 2018 22:39

Some (possibly incomplete) notes on how to install and use imapsync.

Installation

Pre-requisites

sudo apt install -y build-essential cpanimus libperl-dev libssl-dev
@mkropat
mkropat / Clean-LocalBranches.ps1
Last active August 20, 2018 16:20
git branch --merged | foreach Trim | sls -NotMatch -Pattern '^[*]|\bmaster$' | foreach { git branch -d $_ }
@mkropat
mkropat / Async-Processing-Nomenclature.md
Last active April 25, 2018 17:59

When your API returns a 202 Accepted, what do you call the endpoint URL that lets consumers query the status of the request?

URL Examples
/job/ID [[1]][restalk]
/ENTITY/jobs/ID [[1]][rapis]
/monitor/ID [[1]][james-snell]
/operations/ID [[1]][microsoft]
/queue/ID [[1]][restcookbook] [[2]][victor-farazdagi]
/queue/requests/ID [[1]][paypal]
@mkropat
mkropat / Attacking-OpenIDConnect.md
Last active November 11, 2021 02:44

How to exploit vulnerable implementations

  • Doesn't validate signature? → Forge arbitrary JWTs
  • Acts on data in payload before validating signature? → Forge arbitrary JWTs
  • Doesn't validate signature algorithm? → Forge JWT with algorithm "none"
  • Doesn't validate key↔algorithm match? → Create HS256 signature signed with expected public key
  • Doesn't validate audience? → Trick victim to sign in to evil app, then use creds to auth to vulnerable app as victim
  • Doesn't validate issuer? → Use JWT for one tenant to authenticate to a different tenant
  • Doesn't validate nonce? → Replay attack
  • Doesn't validate nonce/state against original sent value? → CSRF
@mkropat
mkropat / TimeSpan-Parse-Study.linq
Created February 20, 2018 20:00
<Query Kind="Program" />
void Main()
{
Format("00:00:00");
Format("00:00:01");
Format("23:59:00");
Format("24:00:00");
Format("24:00:01");
Format("1.00:00:00");
@mkropat
mkropat / Chrome-Setup.md
Last active September 2, 2018 20:52

Search Engine

Go to duckduckgo.com and install the add-on.

chrome://settings/

  • Disable AutoFill
  • Disable Password saving

Extensions

@mkropat
mkropat / .vimrc
Last active September 2, 2018 20:49
; Moved to https://github.com/mkropat/dotfiles/blob/master/.vimrc
@mkropat
mkropat / signed-vs-unsigned.linq
Created January 21, 2018 22:17
<Query Kind="Program" />
void Main()
{
Console.WriteLine($" {"value"} {"short",cs} {"ushort->short",cs} {"short->int",cs} {"ushort",cs} {"short->ushort",cs} {"ushort->int",cs} notes");
PrintShort(new byte[] { 0x00, 0x00 });
PrintShort(new byte[] { 0x00, 0x01 });
PrintShort(new byte[] { 0x7f, 0xfe });
PrintShort(new byte[] { 0x7f, 0xff });
PrintShort(new byte[] { 0x80, 0x00 });