masatokinugawa

0CTF/TCTF 2018 Quals h4x0rs.space Writeup (Web 1000)

問題

I've made a blog platform let you write your secret. 
Nobody can know it since I enabled all of modern web security mechanism, is it cool, huh?

Get `document. cookie` of the admin.

h4x0rs.space

voluntas

React コトハジメ

日時

2017-01-02

作

@voluntas

バージョン

2.1.0

URL

https://voluntas.githu.io/

突っ込みは Twitter @voluntas まで。

harlow

Golang Workers / Job Queue

A running example of the code from:

• http://marcio.io/2015/07/handling-1-million-requests-per-minute-with-golang
• http://nesv.github.io/golang/2014/02/25/worker-queues-in-go.html

This gist creates a working example from blog post, and a alternate example using simple worker pool.

TLDR: if you want simple and controlled concurrency use a worker pool.

mathisonian

The final result: require() any module on npm in your browser console with browserify

This article is written to explain how the above gif works in the chrome (and other) browser consoles. A quick disclaimer: this whole thing is a huge hack, it shouldn't be used for anything seriously, and there are probably much better ways of accomplishing the same.

Update: There are much better ways of accomplishing the same, and the script has been updated to use a much simpler method pulling directly from browserify-cdn. See this thread for details: mathisonian/requirify#5

inspiration

ybenjo

agqr.rb

これは何

AGQR の放送を保存するスクリプト．

fork 元との違いは

yagays / agqr.rb には

• 31日まである月に翌日の指定が失敗する

というバグが存在する．

rxaviers

People

:bowtie:	😄 :smile:	😆 :laughing:
😊 :blush:	😃 :smiley:	☺️ :relaxed:
😏 :smirk:	😍 :heart_eyes:	😘 :kissing_heart:
😚 :kissing_closed_eyes:	😳 :flushed:	😌 :relieved:
😆 :satisfied:	😁 :grin:	😉 :wink:
😜 :stuck_out_tongue_winking_eye:	😝 :stuck_out_tongue_closed_eyes:	😀 :grinning:
😗 :kissing:	😙 :kissing_smiling_eyes:	😛 :stuck_out_tongue:

mathiasbynens

List of features that are supported by Opera 12 but not by Opera 15 due to the switch to Blink/Chromium:

• xhr.responseType = 'json' fixed as of August 19, 2013
• Link HTTP header
• Link HTTP header for stylesheets specifically
• Pressing Enter when an element with tabindex has focus should trigger a click
• Fragment identifiers in data: URIs should be handled correctly
• CSS gradients with transparency
• Accurate SVG rendering
• [`` where foo.svg is an SVG file that contains text looks terrible](https://code.google.com/p/chromium/issues/detail?id=33

gerardpaapu

(function () {
    var apply = Function.prototype.apply;
    var flatten = apply.bind(Array.prototype.concat, []);

    Array.prototype.selectMany = function (fn) {
        return flatten(this.map(fn));
    };
}());

// usage

makotom

<?php
define("RDIR", (isset($_SERVER["HTTPS"]) ? "http://" : "https://") . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"] . "?t");

header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: x-prototype-version,x-requested-with");

if(isset($_GET["r"])){
	header("Location: " . RDIR);
	exit();
}

h2oota

NAME		"ARIB-B24-SI"
ENCODING	"ISO2022"
# ARIB TR-B14
# G0 KANJI
# G1 EISU
# G2 HIRAKANA
# G3 KATAKANA
# VARIABLE	"8BIT MAX3 INIT0=94$9 0=94B 0=94J 0=940 0=941 0=94I 0=94$B 0=94$9 0=94$: 0=94$; INIT1=94I 1=94B 1=94J 1=940 1=941 1=94I 1=94$B 1=94$9 1=94$: 1=94$; INIT2=940  2=94B 2=94J 2=940 2=941 2=94I 2=94$B 2=94$9 2=94$: 2=94$; INIT3=941 3=94B 3=94J 3=940 3=941 3=94I 3=94$B 3=94$9 3=94$: 3=94$; NOOLD LS0 LS1 LS2 LS2 LS1R LS2R LS3R SS2 SS3"
VARIABLE	"8BIT MAX3 INIT0=94$9 INIT1=94J INIT2=940 INIT3=941 NOOLD LS0 LS1 LS2 LS2 LS1R LS2R LS3R SS2 SS3 ARIB-B24"
DEFCSID		"ISO646-US"		0