moloch

9 ms·

31.
by moloch 10y ago
I had a similar disappointment when first setting up the Vive, but after playing with it for an hour all was forgiven. It's certainly got some quirks but I'm very happy with it as a whole, and it will only get better.
32.
by moloch 10y ago
`` can invoke subshells
33.
by moloch 11y ago
Well the lack of SOP is by design, since it's not a browser visiting multiple sites the idea of an "origin" doesn't always make sense. This is part of a larger body of work we've been researching, we found much more
34.
by moloch 11y ago
It gets even scarier with frameworks like nw.js where you can just execute native code directly from the DOM.
35.
by moloch 11y ago
We used JSConsole and Weinre JSConsole - http://jsconsole.com/ Weinre - https://people.apache.org/~pmuellr/weinre/docs/1.x/1.5.0/
36.
by moloch 11y ago
Ah okay, we have a few other vulns (that have been patched) in various other messaging apps, some required the full pattern others not.
37.
by moloch 11y ago
Yes it surprised us too, we didn't even think about looking into Messages until Shubs jokingly started sending payloads to me using it.
38.
by moloch 11y ago
You need the full a://a.a/%0a to match the URL pattern, but that's the jist of it.
39.
by moloch 11y ago
Sorry about the mix up, the code available here: https://github.com/moloch--/cve-2016-1764 and here: https://github.com/BishopFox/cve-2016-1764
40.
by moloch 11y ago
nw.js is somewhat concerning from a security standpoint, you're always one XSS vulnerability away for arbitrary code execution.
41.
by moloch 11y ago
Yes.
42.
by moloch 11y ago
It can affect what domain you end up at though, for example: http://foo:bar.com\@example.com Chrome/Webkit browsers will go to `bar.com` but Firefox will end up at `example.com` for the same URL! There's a fantastic bo
43.
by moloch 11y ago
It's not difficult to intercept this type of encrypted communication, since it's coming from your computer you can just hook the functions responsible for sending the data, or for encrypting it in the first place. Many times it&#x
44.
CrashFirefox.com(crashfirefox.com)
21 points by moloch 11y ago|28 comments
45.
OneRNG: Open Source Hardware Random Number Generator(kickstarter.com)
3 points by moloch 12y ago|0 comments
46.
by moloch 12y ago
It's the same security model as downloading a binary and running it.
47.
by moloch 12y ago
Only a few hundred million more and they'll be close to Facebook's user-base!
48.
by moloch 12y ago
PoC floating around: rm -f echo && env -i X='() { (a)=>\' bash -c 'echo date'; cat echo
49.
Rickroll Innocent Televisions With This Google Chromecast Hack(wired.com)
2 points by moloch 12y ago|0 comments
50.
by moloch 12y ago
Not a great idea to just leave your phpinfo() out there in the open.
51.
by moloch 12y ago
...and still only 4Gb of memory.
52.
by moloch 12y ago
Here you go "CodeSearchDiggity": http://www.bishopfox.com/resources/tools/google-hacking-digg...
53.
by moloch 12y ago
'rm -rf /*' should do the trick; kind enough to leave them with a '/' directory.
54.
by moloch 13y ago
I've been using cycript for a while now for reverse engineering iOS applications, and it's absolute witchcraft! You can tab-complete your way through objects, call arbitrary functions, -- it's a fantastic tool for any pen-te
55.
by moloch 13y ago
It's open source: http://svn.saurik.com/repos/cycript/trunk/
56.
by moloch 13y ago
Direct link: https://www.youtube.com/watch?v=xEJIR0-KJu0
57.
An Open Letter to the Makers of The Wolf of Wall Street, and the Wolf Himself(blogs.laweekly.com)
1 points by moloch 13y ago|0 comments
58.
by moloch 13y ago
You can also just use Cycript http://www.cycript.org/
59.
by moloch 13y ago
Or just not confessed; him using TOR around the same time is not going to be enough to convict him.
60.
by moloch 13y ago
Even if you're in the US there's only a very very small chance you'll be able to participate in the beta.

More ›