maple3142

6 ms·

1.
by maple3142 2mo ago
If you are given a shell with `docker run -it --rm alpine:3 sh`, can you read the /etc/shadow on the host without kernel exploit? Assuming the docker and kernel are sufficiently update-to-date (e.g. latest Docker on Debian Stable)
2.
by maple3142 4mo ago
Is this a correct understanding of UB in C? A program P has a set of inputs A that do not trigger UB, and a complementary set of inputs B that do trigger UB. A correct compiler compiles P into an executable P'. For all inputs in A, P&
3.
by maple3142 6mo ago
Will third party apps like bank apps be able to detect whether advanced mode is enabled or not, like how they currently detect if developer options is enabled?
4.
by maple3142 8mo ago
I think the problem is simply that css is too restricted that you can style a fixed piece of html in any way you want. In practice, achieving some desired layout require changing the html structure. The missing layer would be something that
5.
by maple3142 8mo ago
This wouldn't work if the script is meant to be sourced (to set environment variables) isn't it?
6.
by maple3142 8mo ago
I think `zsh -l` start a login shell, which does not load zshrc so oh-my-zsh don't get initialized. Try `zsh -ic exit` and it should load zshrc before executing exit. That said, the time of `zsh -ic exit` isn't really meaningful m
7.
by maple3142 8mo ago
I don't think it is generally possible to escape from a docker container in default configuration (e.g. `docker run --rm -it alpine:3 sh`) if you have a reasonably update-to-date kernel from your distro. AFAIK a lot of kernel lpe use f
8.
by maple3142 10mo ago
To be honest, there are two ways to solve the problem of xkcd 2347, either putting efforts into the very small library or just stop depending on it. Both solutions are fine to me and Google apparent just choose the latter one here.
9.
by maple3142 1y ago
If being used in a CTF counts, then running latest docker with no extra privilege and non-root user on a reasonably up-to-date kernel meets the definition of secure I think. At least for what I have seen, this kind of infrastructure is pret
10.
by maple3142 1y ago
For python specifically, the uuid4 function does use the randomness from os.urandom, which is supposed to be cryptographically random on most platforms.
11.
by maple3142 1y ago
I think the problem is that some local server are not really designed to be as secure as a public server. For example, a local server having a stupid unauthenticated endpoint like "GET /exec?cmd=rm+-rf+/*", which is obvi
12.
by maple3142 1y ago
Isn't it the same for passkeys? I can put passkeys in password managers like Bitwarden, 1password, ...
13.
by maple3142 1y ago
I think the reason is that MCP also works over a pipe (stdio), which does not need authentication.
14.
by maple3142 1y ago
I think many people are just not really good at dealing with "imperfect" tools. Different tools can have different success probability, let's call that probability p here. People typically use tool that have p=100%, or at lea
15.
by maple3142 1y ago
I really wonder how can use escape a container given a root shell created by `docker run --rm -it alpine:3 sh` without using a 0day? Using latest Docker and a reasonably up-to-date Linux kernel of course. With the command above it is still
16.
by maple3142 2y ago
Couldn't screen readers apply unicode normalization based some heuristics, like seeing the continuous presence of those special bold/italic characters? To improve accuracy, it can even check if the normalized text resembles to som
17.
by maple3142 2y ago
It is still a problem if you want caddy to run outside of docker (e.g. for getting real remote addr).
18.
How (not) to sign a JSON object (2019)(latacora.com)
54 points by maple3142 2y ago|42 comments
19.
by maple3142 2y ago
Similar project: PARI/GP on WASM https://pari.math.u-bordeaux.fr/gpexpwasm.html
20.
by maple3142 2y ago
From my experience, it is obviously not all the packages in Kali Repo will be in Ubuntu (or other regular distro) Repl. Lots of specific pentesting tool can be installed with just `apt install ...` in Kali, which make it a lot more convenie
21.
by maple3142 2y ago
I don't understand how can it really prevents exporting passkeys if it can be implemented by open source implementations like keepass. For example, if keepass do follow the guideline of FIDO Alliance to not implement exporting, but it
22.
by maple3142 2y ago
I think it is probably because a lot of things are deemed as acceptable. For example, the stream filter chain one is only exploitable if the input to some php IO functions like file_get_contents are attacker-controlled, and those things are
23.
by maple3142 2y ago
I think this is what @jitl means: node -e "process.stdout.write('@'.repeat(128 * 1024)); process.stdout.write('',()=>process.exit(0)); " | wc -c It writes an empty string and use its callback to detec
24.
by maple3142 2y ago
Termux can definitely run for a long time even on Android 12 I think. I tried to put a web server to a Termux running on Chromecast (Android 12), and it is still running after months.
25.
by maple3142 2y ago
Isn't Python's functions are just objects with a __call__ method, and such objects has a syntax sugar allowed them to be called like a function.
26.
by maple3142 2y ago
It is a part of browser's settings (for Chrome and Firefox at least), and it is default to system's default language I think.
27.
by maple3142 2y ago
I don't think it is a big problem given functions like fs.readFileSync already exists. It doesn't have to be a JS standard but be a server-side JS runtime specific function, which can be used when hacks are needed.
28.
by maple3142 2y ago
Hmm, there was an article about Java's BigDecimal behaves differently for equals and compareTo: https://igorstechnoclub.com/java-bigdecimal/
29.
by maple3142 2y ago
Not sure if this is a bit off topic or not, but I recently encountered a problem where my program are continuously calling write to a socket in a loop that loops N times, with each of them sending about a few hundred bytes of data represent
30.
by maple3142 2y ago
The example given by parent does not need eval to trigger though. Just create a function and replace its code object then call it, it will easily segfault.

More ›