own2pwn

static void dispatch_repeated_internal(dispatch_time_t firstPopTime, double intervalInSeconds, dispatch_queue_t queue, void(^work)(BOOL *stop))
{    
    __block BOOL shouldStop = NO;
    dispatch_time_t nextPopTime = dispatch_time(firstPopTime, (int64_t)(intervalInSeconds * NSEC_PER_SEC));
    dispatch_after(nextPopTime, queue, ^{
        work(&shouldStop);
        if(!shouldStop)
        {
            dispatch_repeated_internal(nextPopTime, intervalInSeconds, queue, work);
        }

own2pwn

##Creating a timer with Grand Central Dispatch

At the following is the implementation file of a sample class that shows, how to make a timer with the help of Grand Central Dispatch. The timer fires on a global queue, just change the queue to the main queue or any custom queue and the timer fires on this queue and not on the global queue anymore.

#import <Foundation/Foundation.h>

@interface SampleClass : NSObject
- (void)startTimer;

own2pwn

##Creating a timer with Grand Central Dispatch

At the following is the implementation file of a sample class that shows, how to make a timer with the help of Grand Central Dispatch. The timer fires on a global queue, just change the queue to the main queue or any custom queue and the timer fires on this queue and not on the global queue anymore.

#import <Foundation/Foundation.h>

@interface SampleClass : NSObject
- (void)startTimer;

own2pwn

1. XSS in feedback form. Got access to moderator account. Nothing useful here though, except the list of approved accounts.
2. Trying to register own team - got password to email. Password is 4 digits, so can be easily bruteforced.
3. Login form is protected with simple captcha. Wrote simple script using pytesseract https://github.com/madmaze/pytesseract to recognize captcha and bruteforce login form. After 10 minutes got password for one of approved team account.

import sys                                                                 
import io                   
import re                     
import requests                     
import pytesseract            

own2pwn

Twitter Official Consumer Key

Twitter for Android

type:            PIN
Consumer key:    3nVuSoBZnx6U4vzUxf5w
Consumer secret: Bcs59EFbbsdF6Sl9Ng71smgStWEGwXXKSjYvPVt7qys

Twitter for iPhone

type:            PIN

Consumer key: IQKbtAYlXLripLGPWd0HUA

own2pwn

Last updated: 2017-03-18

Searching for Files

Find images in a directory that don't have a DateTimeOriginal

exiftool -filename -filemodifydate -createdate -r -if '(not $datetimeoriginal) and $filetype eq "JPEG"' .

###Output photos that don't have datetimeoriginal to a CSV### Note this can take a long time if you have a lot of jpgs

own2pwn

import exifread

# based on https://gist.github.com/erans/983821

def _get_if_exist(data, key):
    if key in data:
        return data[key]

    return None

own2pwn

import PIL.Image

get_float = lambda x: float(x[0]) / float(x[1])
def convert_to_degrees(value):
    d = get_float(value[0])
    m = get_float(value[1])
    s = get_float(value[2])
    return d + (m / 60.0) + (s / 3600.0)

def get_lat_lon(info):

own2pwn

from PIL import Image
from PIL.ExifTags import TAGS, GPSTAGS

def get_exif_data(image):
    """Returns a dictionary from the exif data of an PIL Image item. Also converts the GPS Tags"""
    exif_data = {}
    info = image._getexif()
    if info:
        for tag, value in info.items():
            decoded = TAGS.get(tag, tag)

own2pwn

"""
	test_exif.py

	This module tests various third-party libraries for their ability to extract
	metadata from a test JPG file.

	Python 3.4 used on Windows 10.

	This code accompanies the article:
		http://www.theatreofnoise.com/2016/10/how-to-retrieve-photo-metadata-in-python.html