Nguyễn Anh Khoa nganhkhoa

WinDbg cheatsheet

source: https://github.com/hugsy/defcon_27_windbg_workshop/blob/master/windbg_cheatsheet.md

Content

WinDbg cheatsheet
- Content
- Setup
Symbol Path

Stop using JWTs!

TLDR: JWTs should not be used for keeping your user logged in. They are not designed for this purpose, they are not secure, and there is a much better tool which is designed for it: regular cookie sessions.

If you've got a bit of time to watch a presentation on it, I highly recommend this talk: https://www.youtube.com/watch?v=pYeekwv3vC4 (Note that other topics are largely skimmed over, such as CSRF protection. You should learn about other topics from other sources. Also note that "valid" usecases for JWTs at the end of the video can also be easily handled by other, better, and more secure tools. Specifically, PASETO.)

A related topic: Don't use localStorage (or sessionStorage) for authentication credentials, including JWT tokens: https://www.rdegges.com/2018/please-stop-using-local-storage/

The reason to avoid JWTs comes down to a couple different points:

The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions

Quick start

Prepare

Put theme in data/wordpress/wp-content/themes.
Put plugin in data/wordpress/wp-content/plugins.
Copy your old wp-content/uploads to data/wordpress/wp-content/uploads.
Search every string in mysql/wordpress.sql for the link of the server and replace it with your server.
Change the username and password of database, and database of wordpress, in docker-compose.yml.

openssl

Install

Install the OpenSSL on Debian based systems

sudo apt-get install openssl

	import lldb
	import struct

	class Header():
	def __init__(self, b):
	fmt = "<IIIIIIII"
	fields = struct.unpack(fmt, b)
	( self.magic
	, self.cputype
	, self.cpusubtype

	import binaryninja as bn

	def endianness(bv: bn.BinaryView):
	if bv.endianness.value == 0:
	return "little"
	else:
	return "big"

	def read_pointer(bv: bn.BinaryView, addr):
	buffer = bv.read(addr, bv.address_size)

	from z3 import *

	flag = [BitVec(f'flag_{i:02}', 8) for i in range()]

	s = Solver()

	s.add()

	s.check()
	m = s.model()

	/*
	* Copyright (c) 1996, 1998, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*

	###########################################################################
	# THIS IS A PERSONAL BASHRC AND SHOULD BE SOURCED BY THE ORIGINAL .BASHRC #
	###########################################################################

	export PRE_PATH=`echo $PATH`

	# Predefiend {{{
	# source $HOME/z.sh # use z.lue instead, see below
	export APP_DIR="$HOME/APP"
	export SECURITY_DIR="$HOME/SECURITY"

	require "bit_array"

	IP_table = [
	[58, 50, 42, 34, 26, 18, 10, 2],
	[60, 52, 44, 36, 28, 20, 12, 4],
	[62, 54, 46, 38, 30, 22, 14, 6],
	[64, 56, 48, 40, 32, 24, 16, 8],
	[57, 49, 41, 33, 25, 17, 9 , 1],
	[59, 51, 43, 35, 27, 19, 11, 3],
	[61, 53, 45, 37, 29, 21, 13, 5],