This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.
On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that
| Day | Title | link |
|---|---|---|
| 1 | Apple Source code | https://www.youtube.com/watch?v=WxOZgr0Ld9o |
| 2 | Mach-O Binaries | https://www.youtube.com/watch?v=G_bDl5hv8kY |
| 3 | PAC (Pointer Authentication Codes) | https://www.youtube.com/watch?v=9neXmcwtCF8 |
| 4 | dyld_shared_cache | https://www.youtube.com/watch?v=I1ZkONfyHG4 |
| 5 | Userspace Memory Layout | https://www.youtube.com/watch?v=MUr7qg7iqKE |
| 6 | SIP | https://www.youtube.com/watch?v=HeOVKe0xpW0 |
| 7 | Kernel Boot Arguments | https://www.youtube.com/watch?v=gjOKlBpJWoc |
| 8 | XNU Source Code Overview | https://www.youtube.c |
| // I'm tired of extensions that automatically: | |
| // - show welcome pages / walkthroughs | |
| // - show release notes | |
| // - send telemetry | |
| // - recommend things | |
| // | |
| // This disables all of that stuff. | |
| // If you have more config, leave a comment so I can add it!! | |
| { |
Yesterday I posted a little quiz on Twitter about HTML parsing.
The question was: what element is going to be the parent of the final <s> in the following snippet of HTML:
<div><table><svg><foreignObject><select><table><s>The final answers are:
Quick write up on extracting a GraphQL schema when introspection is disabled. Bits and pieces sourced from various sources. Successfully tested on an Apollo instance.
TLDR: Some GraphQL instances provide name autocomplete suggestions. Some peeps have written tools to automate the extraction process. (ref https://youtu.be/nPB8o0cSnvM).
First step is using a tool called clairvoyance by @nikitastupin (https://github.com/nikitastupin/clairvoyance). I found the main repo to lack error handling and support for additional features such as proxy.
| # This is a proof-of-concept for a security bug in GitHub Actions which has since been fixed. | |
| # See https://blog.teddykatz.com/2021/03/17/github-actions-write-access.html for more information. | |
| # The proof-of-concept was only ever used in a test environment to validate the existence of the | |
| # vulnerability, and is shown here for educational purposes. | |
| # | |
| # The proof-of-concept would have the effect of creating a `vandalism.md` file, containing vandalism, | |
| # on the default branch of a victim repository. | |
| # | |
| # To use the proof-of-concept, the steps would have been: | |
| # 1. Fork the victim repository |
| #!/usr/bin/env ruby | |
| # gem install active_support | |
| require 'active_support/inflector' | |
| require 'active_support/core_ext/string' | |
| # gem install webrick (only ruby3) | |
| require 'webrick' | |
| # gem install mechanize |
This is inspired by A half-hour to learn Rust and Zig in 30 minutes.
Your first Go program as a classical "Hello World" is pretty simple:
First we create a workspace for our project:
