Skip to content

Instantly share code, notes, and snippets.

View spaze's full-sized avatar
🔒
https://localhost/?bbq="omg">'wtf'

Michal Špaček spaze

🔒
https://localhost/?bbq="omg">'wtf'
297 followers · 0 following
View GitHub Profile
@spaze
spaze / haveibeencaffeinated.php
Last active May 9, 2019 19:04
https://www.michalspacek.com/top-10-coffee-brands-according-to-have-i-been-pwned
<?php
// https://en.wikipedia.org/wiki/Category:Coffee_brands
$covfefes = [
'alterracoffeeroasters',
'angiangcoffee',
'angelinus',
'autocrat',
'barcaffe',
'batdorfbronson',
'bewleys',
@spaze
spaze / cz-stripped-subdomains.txt
Last active March 3, 2020 18:16 — forked from kokes/cz.txt
.cz domains *potentially* affected by this CAA problem https://letsencrypt.org/caaproblem/ - test at https://unboundtest.com/caaproblem.html
# Stripped subdomains (foo.example.com => example.com, doesn't mean example.com was in the original list)
# regex [a-z*0-9\-]+\.cz(?=[ \]])
05.cz
0e.cz
0oo.cz
1000miglia.cz
1000oken.cz
1000zkh.cz
1001.cz
1001hry.cz
@spaze
spaze / get.txt
Last active April 21, 2020 14:52
X-XSS-Protection sample report POST request
POST http://test.local/foo HTTP/1.1
Host: test.local
Connection: keep-alive
Content-Length: 116
Pragma: no-cache
Cache-Control: no-cache
Origin: http://test.local
X-FirePHP-Version: 0.0.6
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Content-Type: application/json
@spaze
spaze / index.php
Created April 10, 2021 16:22
xsssk sources snippet
<?php
function index()
{
echo ascii('xsssk');
}
function rick()
{
header('Location: https://media.giphy.com/media/Vuw9m5wXviFIQ/giphy.gif', true, 301);
}
@spaze
spaze / find-cve-2020-15227.sh
Last active May 20, 2021 16:34
CVE-2020-15227 nette/application RCE in-place patch
#!/bin/bash
# Find files in CVE-2020-15227 nette/application issue
# by @spazef0rze
# Run with `bash find-cve-2020-15227.sh`, works on Linux, FreeBSD, tested on Ubuntu 18.04, FreeBSD 11.4
# This is a universal finder for all affected versions.
# Requirements: find, grep, bash (might work with your default shell but YMMV)
# The fixes:
@spaze
spaze / cert.pem
Created June 5, 2021 21:14
Self signed cert expiring in one day
-----BEGIN CERTIFICATE-----
MIIDoTCCAomgAwIBAgIUHaHTeqKOXVJAuOJtLu3vqYfgVaAwDQYJKoZIhvcNAQEL
BQAwYDELMAkGA1UEBhMCQ1oxDDAKBgNVBAgMA0ZvbzEMMAoGA1UEBwwDQmFyMQww
CgYDVQQKDANCYXoxDjAMBgNVBAsMBVdhbGRvMRcwFQYDVQQDDA5zZWxmLnNpZ25l
ZC5jejAeFw0yMTA2MDUyMTExMjRaFw0yMTA2MDYyMTExMjRaMGAxCzAJBgNVBAYT
AkNaMQwwCgYDVQQIDANGb28xDDAKBgNVBAcMA0JhcjEMMAoGA1UECgwDQmF6MQ4w
DAYDVQQLDAVXYWxkbzEXMBUGA1UEAwwOc2VsZi5zaWduZWQuY3owggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUYp5WfN2Btdd1bg7uMP7nlUO5l4AXZXFq
XIM/Vdv+1tZMaMeKMW9mwYJoXySUNJS5/ix8pPdZL7szGZ8tqMMAisdjmNMfvg0e
mZu9/9yMh7vRDe/KU4u2rKPw4gvZNVx42ptIa1hAecjBwoVxysumBJh9HPo3z1d7
@spaze
spaze / README-azure-storage-php-patches.md
Last active March 24, 2022 17:45
azure-storage-php composer patches for cweagans/composer-patches
  1. Install composer-patches plugin
composer require cweagans/composer-patches

  1. Download all the files (*.diff & *.json) to patches subdirectory of your project

  2. Add the following to your composer.json:

	"extra": {
@spaze
spaze / optimg.sh
Created June 21, 2022 05:58
Optimize images in the current dir with Zopfli (for PNGs), Guetzli (for JPEGs), WebP (for both lossy and lossless conversions). Keeps the smaller file of those.
#!/bin/bash
# Optimize images for talk slides
# Run in directory with images, it does the following:
# 1. runs zopfli on all PNGs
# 2. runs guetzli on all JPEGs
# 3. creates lossy and lossless WebP, keeps the smaller one
# 4. keeps the WebP if smaller than original
GREEN=$(tput setaf 2)
@spaze
spaze / opera-vpn.md
Last active April 20, 2024 02:14
Opera VPN behind the curtains is just a proxy, here's how it works

2023 update

ℹ️ Please note this research is from 2016 when Opera has first added their browser "VPN", even before the "Chinese deal" was closed. They have since introduced some real VPN apps but this below is not about them.

🕵️ Some folks also like to use this article to show a proof that the Opera browser is a spyware or that Opera sells all your data to 3rd parties or something like that. This article here doesn't say anything like that.

When setting up (that's immediately when user enables it in settings) Opera VPN sends few API requests to https://api.surfeasy.com to obtain credentials and proxy IPs, see below, also see The Oprah Proxy.

The browser then talks to a proxy de0.opera-proxy.net (when VPN location is set to Germany), it's IP address can only be resolved from within Opera when VPN is on, it's 185.108.219.42 (or similar, see below). It's an HTTP/S proxy which requires auth.