Alf.nu

I can't recommend "return true to win" (https://alf.nu/ReturnTrue) enough to learn how to golf JS. I think it's more accessible to learn one 10-20 char snippet at a time than a big project like a 1k submission.

My first jobs were heavily focused on parsing data from HTML and regex was (and still is) the most common solution for the majority of cases To learn it, I played a lot of regex golf [1] I also enabled regular expressions in my code editor's Find feature so every search I'd make used regex. Having it enabled in my editor made learning it more immersive and useful, especially when combined with things like find-and-replace. I highly recommend permanently enabling that in your editor as well Also, challenge your coworkers to see who can make the shortest patterns for a variety of cases and see whose is the most versatile. It's always a fun time [1] https://alf.nu/RegexGolf

Also, my favorite collection of JS weirdness, “Return true to win”: https://alf.nu/ReturnTrue?world=true&level=id

I recommend https://alf.nu/RegexGolf for timewasting

Regex, especially non standard (and non regular) extensions can be pretty tricky to grok. http://alf.nu/RegexGolf?world=regex&level=r00

That's far from the ultimate zip bomb. 42.zip has five layers. But you can make a zip file that has an infinite number of layers. See https://research.swtch.com/zip or https://alf.nu/ZipQuine

If you're interested to explore lots of XSS edge cases, I've found this CTF to be enjoyable. https://alf.nu/alert1

How about a .zip that stores a copy of itself? https://alf.nu/ZipQuine

Remember, collisions can be reused[1] to create lots of pairs of files with the matching hashes. [1] https://alf.nu/SHA1

Play regex golf: https://alf.nu/RegexGolf Since many people are not good at them, whenever I use a regex in code, I add a comment with at least one example of the text that is to be matched, and note what the regex is also attempting to avoid. This is also a learning activity. There is also the "Mastering Regular Expressions" book.

SHA-1 (and SHA-256 and many other hash functions) are subject to length extension, which is how the 2017 shattered attack works: find a pair of short prefixes that work as PDF headers and that have colliding hashes; then append a common suffix such that the different headers display different parts of the suffixes. Once the collision has been found you can easily make your own colliding PDFs - https://alf.nu/SHA1 This breaks anything that dedups on just the SHA-1 hashes of raw files

Good one. Reminds me of the Regex Golf: https://alf.nu/RegexGolf

Nice! When done, go to http://alf.nu/RegexGolf to sharpen up your skill!

There is an option to limit the maximum archive recursion `--rga-max-archive-recursion=` which defaults to 4. That is also needed to handle droste.zip [1] which is a zip file that contains itself. So for huge archives it will simply take a fairly long time, unless you limit recursion more. [1]: https://alf.nu/ZipQuine

For some people Regex Golf [1] might be an interesting way to learn. You are actually building increasingly complex regex as you go, and can just look up bits of syntax you don't know as needed. [1] https://alf.nu/RegexGolf

If you are smart, you craft your compressed files to be infinite by making them Quines: https://alf.nu/ZipQuine

Might be this one? https://alf.nu/ReturnTrue

This was pretty enjoyable. It reminds me a bit of "return true to win" (https://alf.nu/ReturnTrue). I think I cheated a bit on Level 7. I just copy-pasted the code that wrote to epochComms and changed it to write to interceptComms instead. I'm not quite sure what the intended solution is. On Level 12, does Secret.extHash serve any purpose? It never gets read. I was doing this on mobile (Chrome on Android) and I ran into a few odd problems. If you have two opening curly braces in a row and try to backspace to delete the first one, it instead inserts a newline and duplicates the rest of the line. That is, if you have "{{foo" with the cursor after the first curly brace and you press backspace you end up with two lines each saying "{foo". This doesn't happen for me on desktop. Copy-paste also seems to be broken on mobile. You can't select anything and trying to paste is just ignored. It would be nice if you go go back and view the hint after you've completed a level. Or even if you could try different solutions to a level after you've finished it. You may not always be happy with the first thing that works.

>I'm also sure that SHA-1 remains pervasive in many codebases I've done a lot of security reviews of backup solutions over the years and nearly universally they use SHA1 for de-duplication. Security professionals have been providing warnings about this practice, but when you are dealing with a cloud backup solution as an example, speed and low compute requirements are a must and it's hard to win the argument when someone tosses "theoretical" onto the table. Well, we are now past "theoretical" and that's what matters. I just tried out the SHA1 collider: https://alf.nu/SHA1 and created two PDFs containing entirely different bits of text in JPGs. It took seconds and indeed the output of the files were SHA1 identical. This is no longer nation-state level stuff and computing colliding documents to upload to cloud backup providers who de-dupe across the file system and not just restricted within the boundaries of each account could result in the ability to wipe out and change other people's data. At a minimum that could be an annoyance. At worst, it could result in the intentional change of someone's content to cause significant financial or physical harm.

Make your own colliding PDFs: https://alf.nu/SHA1

W3C: "Service workers create the opportunity for a bad actor to turn a bad day into a bad eternity."[1] With service workers, cross-site scripting vulnerabilities are forever. Service workers install by drive-by, which is troubling. In Firefox, check "about:serviceworkers" to see what you have installed. Take a look. You probably have far more service workers active than you thought. There are supposed to be enough cross-site scripting restrictions to keep service workers contained to their origin domain, but some holes have been found. There was a successful service worker attack on Dropbox, since fixed. "If you run a site that serves user files with secret URLs from a shared domain, you need to look out for the Service-Worker: script HTTP header; if you see it, run for the hills."[2] If an attacker can get one page loaded from a site being attacked, they then own all traffic between the user and the site. This has lots of attack potential. [1] https://www.w3.org/TR/service-workers/#security-considerations [2] https://alf.nu/ServiceWorker

https://xss-game.appspot.com/ (this has a lot of overlap with gruyere) https://github.com/cure53/XSSChallengeWiki/wiki https://sites.google.com/site/infosecrocks/ (this links to some of the other stuff I mentioned) https://www.hacking-lab.com There's also these 2 advanced XSS challenges: https://alf.nu/alert1 https://prompt.ml/0 I'm not sure if they're still functional, I think some of their solutions require functionality that browsers have since changed. You might also want to check out the Youtube channel Live Overflow: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w