gehaxelt

7 ms·

1. 31.▲
   Jinja2 template injection filter bypasses(0day.work)

   3 points by gehaxelt 9y ago|0 comments
2. 32.▲
   Some examples obscure the problems instead of securing them(github.com)

   1 points by gehaxelt 9y ago|0 comments
3. 33.▲
   by gehaxelt 9y ago

   Hi, I just rechecked with [1] and you seem to be right. I'll update the blogpost in a second. Thanks for the hint! [1] https://httpd.apache.org/docs/current/upgrading.html
4. 34.▲
   by gehaxelt 9y ago

   Hello HN, here's one of the blogpost's authors. Although it has been a while since we published the blogpost, I'll try to answer any questions or listen to any suggestions.
5. 35.▲
   by gehaxelt 9y ago

   Hi, one of the authors here. I knew about dvcs-ripper, but thought that implementing another variant might be fun and let me learn about git internals. Does a simple `git clone` really work? I just tested it and it failed: ``` $> git cl
6. 36.▲
   by gehaxelt 9y ago

   Nice catch :) I thought the the amount of forks and stars warrants a short writeup.
7. 37.▲
   by gehaxelt 9y ago

   The script seems to ship with a rundimentary webserver by default, so I don't see a reason to wrap gunicorn et al. around it? However, you're right that overwriting the source is a possible attack vector.
8. 38.▲
   by gehaxelt 9y ago

   Hi, I asssumed that the script would not be restarted, but you're totally right. Thanks for the comment :)