wowkin2

import base64

from Crypto.Cipher import AES


class AESCipher(object):
    BS = 16

    def __init__(self, key):
        self.key = key

wowkin2

#-*- coding: utf-8 -*-

# Python 3.4
# author: http://blog.dokenzy.com/
# date: 2015. 4. 8

# References
# http://www.imcore.net/encrypt-decrypt-aes256-c-objective-ios-iphone-ipad-php-java-android-perl-javascript/
# http://stackoverflow.com/questions/12562021/aes-decryption-padding-with-pkcs5-python
# http://stackoverflow.com/questions/12524994/encrypt-decrypt-using-pycrypto-aes-256

wowkin2

import time
import asyncio
import concurrent.futures
import requests


URL_SESSION = 'http://localhost:8061/session'
URL_REQUESTS = 'http://localhost:8061/requests'
URL_REQUESTS_EXECUTOR = 'http://localhost:8061/requests_executor'

wowkin2

Setup a Local Only Email Server (Windows Only)

1 - Install hMailServer

Download hMailServer from here: http://www.hmailserver.com/index.php?page=background_download_file&downloadid=207.

• In setup, select internal db engine.
• Now you have a service called hMailServer and an administration program on the Windows start menu (hMailServer Administrator).

2 - Create a domain

wowkin2

import httplib2
from apiclient.discovery import build
from oauth2client.client import AccessTokenCredentials

def connect_helper(user):
    c = user.social_auth.get(provider='google-oauth2')
    access_token = c.tokens['access_token']
 
    credentials = AccessTokenCredentials(access_token, 'my-user-agent/1.0')
    http = httplib2.Http()

wowkin2

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import hashlib as hasher
import datetime as date


class Block:
    def __init__(self, index, timestamp, data, previous_hash):
        self.index = index
        self.timestamp = timestamp

wowkin2

The following attack will display a "you've been signed out" page for GMail, and attempt to steal your account credentials.

DO NOT PUT ANY ACCOUNT CREDENTIALS INTO ANY TABS CREATED AFTER VISITING THESE LINKS :)

I received an email in my GMail inbox with a fake attachment image, styled to look like the real GMail attachment UI:

This linked to a page that ended up displaying a fake "you've been signed out" link, via the data:text/html... URL feature of Chrome:

wowkin2

"""
To update users to human-readable form
"""

from django.contrib.auth.models import User

from faker import Faker


def update_users():

wowkin2

'''Provides utility functions for encoding and decoding linestrings using the 
Google encoded polyline algorithm.
'''

def encode_coords(coords):
    '''Encodes a polyline using Google's polyline algorithm
    
    See http://code.google.com/apis/maps/documentation/polylinealgorithm.html 
    for more information.
    

wowkin2

function getLocale() {
  var lang;

  if (navigator.languages) {
    // chrome does not currently set navigator.language correctly https://code.google.com/p/chromium/issues/detail?id=101138
    // but it does set the first element of navigator.languages correctly
    lang = navigator.languages[0];
  } else if (navigator.userLanguage) {
    // IE only
    lang = navigator.userLanguage;