https://0xedward.io/Recent content on 0xEdwardHugo -- gohugo.ioen-usFri, 10 May 2019 00:00:00 +0000https://0xedward.io/nonce-based-csp-in-rails/Fri, 10 May 2019 00:00:00 +0000https://0xedward.io/nonce-based-csp-in-rails/Introduction During my time at Gusto as a part of the Application Security team, I’ve been exploring ways to improve defense against Cross-Site Scripting (XSS) in modern web applications. At Gusto, we primarily use Ruby on Rails and React. Individually each framework comes with some XSS protections out of the box, but sharing information between frameworks makes contextual output escaping or encoding more difficult. In other words, the what, when, where and how for escaping user input questions become more difficult to answer.https://0xedward.io/hackerone-h1-702-ctf-2018/Sun, 12 Aug 2018 00:00:00 +0000https://0xedward.io/hackerone-h1-702-ctf-2018/Disclaimer I did not solve this puzzle. This writeup will go over what I tried and the flow of my thoughts throughout the process. Introduction Since my recent interest in Bug Bounties, while I was at DEFCON 26, I wanted to meet HackerOne staff. I saw a tweet from HackerOne and I was determined to try to meet someone from HackerOne! I decided to hang around the Packing Hacking Village to see if I could catch one of the staff members.https://0xedward.io/hacker101-introduction-notes/Thu, 26 Jul 2018 00:00:00 +0000https://0xedward.io/hacker101-introduction-notes/Disclaimer These notes are not comprehensive. I only jotted down what was useful for me and I may include other research I’ve done while going through the video. Attacker Mindset “Pushing a button is the fastest way to discover what it does” Seek to understand first - in order to break things or get things to behave in a way it was not intended to, you need to understand it What does each “button” do?https://0xedward.io/hack-the-box-poison-writeup/Tue, 24 Jul 2018 00:00:00 +0000https://0xedward.io/hack-the-box-poison-writeup/Scope Tools nmap Walkthrough Let’s do a port scan to find if there are any services running. nmap -sC -sV -oA nmap/initial 10.10.10.84 -vvv We found Apache 2.4.29 with http is running on port 80, so let’s check what is being served at 10.10.10.84:80. If we put listfiles.php into the form and hit submit, we are greeted with some lovely information.https://0xedward.io/hack-the-box-jerry-writeup/Sat, 14 Jul 2018 00:00:00 +0000https://0xedward.io/hack-the-box-jerry-writeup/Scope Tools nmap msfvenom netcat Walkthrough Let’s do a port scan to find if there are any services running. nmap -sC -sV -oA nmap/initial -vvv 10.10.10.95 We found Apache Tomcat with http is running on port 8080, so let’s check what is being served at 10.10.10.95:8080. Manager App looks interesting. Upon clicking on it, we are greeted with a login prompt.https://0xedward.io/thoughts-on-moral-letters-to-lucilius-letter-3-on-true-and-false-friendship/Wed, 17 Jan 2018 00:00:00 +0000https://0xedward.io/thoughts-on-moral-letters-to-lucilius-letter-3-on-true-and-false-friendship/Introduction The structure of the following post will be a series of quotes from the letter followed by my notes. The letter can be found here for reference (Credits to Tim Ferriss). An audiobook version of the letters can be found here. The citations are in the format (Letter.Paragraph.Sentence). I hope you find my notes useful! Thoughts “But if you consider any man a friend whom you do not trust as you trust yourself, you are mightily mistaken and you do not sufficiently understand what true friendship means.https://0xedward.io/thoughts-on-moral-letters-to-lucilius-letter-1-on-saving-time/Fri, 15 Dec 2017 00:00:00 +0000https://0xedward.io/thoughts-on-moral-letters-to-lucilius-letter-1-on-saving-time/Introduction The structure of the following post will be a series of quotes from the letter followed by my notes. The letter can be found here for reference (Credits to Tim Ferriss). An audiobook version of the letters can be found here. The citations are in the format (Letter.Paragraph.Sentence). I hope you find my notes useful! Thoughts “The most disgraceful kind of loss, however, is that due to carelessness.” (I.