mango.pdf.zone

I also recommend the developer's blog. Very detailed and hilarious articles https://mango.pdf.zone/ I laughed myself to tears reading Operation Luigi: How I hacked my friend without her noticing[1] 1: https://mango.pdf.zone/operation-luigi-how-i-hacked-my-friend-without-…

This was really a delight to read. I wonder if the author was raised on 2600. Fantastic stuff. Also visited his page. Does not disappoint: https://mango.pdf.zone/

Great post, thoroughly enjoyed reading it. BTW, on a side note, when you try and visit the blog's homepage[0] and scroll down to the bottom, you find a link to an actual (password protected) PDF file called Mango.pdf[1]. The author 'Alex' says the password for the PDF has been embedded in the page and it didn't take me a lot of time to figure the password out from the HTML source[2]. But when I opened the PDF, I was hit with this random string of characters: cGJhdGVuZ2h5bmd2YmFmLCBsYmggZmJ5aXJxIHpsIHlodnR2IGNobW15ci4gQCB6ci BiYSBnanZnZ3JlIGp2Z3UgbGJoZSBzbmliaGV2Z3IgcXJmZnJlZyBnYiB0cmcgbGJo ZSBlcmpuZXEuIFZnJ2YgeXZ4ciwgYWJnIG4gaXJlbCB0YmJxIGVyam5lcSBmYiBodQ o= I tried to decode this using every available decoder, but it only throws up random result. Was wondering if any of you smart people here had any idea about this code. [0] https://mango.pdf.zone/ [1] https://mango.pdf.zone/mango.pdf [2] view-source:https://mango.pdf.zone/ EDIT: SOLVED IT! As the commenters who replied to me mentioned, this puzzle is double-encoded. I think the trick is to figure out which decoder to use first.

Not that it's a real issue, but the 2nd page on the popular tab is actually not a pdf at all. I assume it appears because the url (https://mango.pdf.zone) contains ".pdf" within it?

https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a… Security researcher finds the Australian prime minister’s personal info. Very much a love it or hate it writing style, but as someone who’s lived in Australia for a while I found it hilarious.

Whooa did you see this guy's website: http://sakibccr.com/ This is awesome! (Just kidding. It doesn't contain anything yet.) But this is a really nice website: https://mango.pdf.zone/ Especially this post: https://mango.pdf.zone/operation-luigi-how-i-hacked-my-friend-without-…

On the site (https://mango.pdf.zone/), the above link is called 'Salty Hacker News comments'

A famous demonstration of how easy it is to use a photo of a boarding pass to get a prime minister's passport info and personal phone number via the PNR: https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a…

Sure: - https://www.myid.gov.au/verifying-your-id-in-myid#myid-Australianpassp… - https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointChecklist-1… - https://www.equifax.com.au/personal/identity-verification-100-point-ch… The blog post has more use case examples: https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a…

> Then again, I do recall a famous post on here about australian politician and someone jusing using view source to verify a quantas ticket. https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a… No "view source" level hackery, but presumably what you're referring to.

What I want next is for FireFox to do something to protect my cookies on disk. Chrome at least encrypts them using a key backed by the system keychain (although Chrome allows remote debugging from any other process, negating any benefits). https://mango.pdf.zone/stealing-chrome-cookies-without-a-password

> Eg when an airline had a public API where you could get someone's passport number and details just from their boarding pass https://mango.pdf.zone/finding-former-australian-prime-minis... Underneath all the garbage, good story. But Holy Hell, why do bloggers write so terribly and self-indulgently? That's a half hour of my life I'll never get back that shouldn't have been more than 10 minutes. Don't they have Ritalin in Australia? They really should.

As a software engineer even I sometimes can't help romanticising hacking in my imagination. But so many times it turns out to be just like some company left the front gate wide open and the "hacker" walked in and took a look around. Eg when an airline had a public API where you could get someone's passport number and details just from their boarding pass https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a…

Reminds of me of Tony Abbott getting hacked https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a…

I like this blog post but I also happen to quite like long forms like these, too: https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a… / https://apenwarr.ca/log/20201227

Associated blog post https://mango.pdf.zone/operation-luigi-how-i-hacked-my-friend-without-… and salty hacker news comments (his words) https://news.ycombinator.com/item?id=14919845

I use uMatrix with very restrictive default settings. These[0]: https://smichel.me/hn/umatrix-global.png When a page doesn't work, and I care enough to un-break it, I will first try enabling just js. If that doesn't work, I'll add XHRs, too. So, I can say with confidence that there are a good deal of sites that fall into both camps. I cannot say the ratio with confidence, but there are enough sites that work enough with just js that I choose not to enable XHRs. Here are a few examples: - Kotlin documentation gets collapsing menus and nicer code formatting: https://kotlinlang.org/docs/reference/visibility-modifiers.html - This person's blog gets inline/popup footnotes and, er, a functional "hard mode" (top right): https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a… - https://represent.us/ renders about halfway without js. The final example is the most relevant to this conversation, I think. Especially, there is a phenomenon, common enough that I've noticed it as a pattern of sites that display images with js (and sometimes content), and don't require XHRs to do so. ---------- Looking through my history to find these examples, two things become clear (about the sites I visit; I don't claim my browsing is representative): 1. Regardless of whether they also need XHRs, sites that require JS fall overwhelmingly into one of two categories: either I use them regularly and they're already on my saved whitelist (eg,…

Try five: - https://www.thedailybeast.com/i-dropped-acid-and-saw-into-the-future-m… - https://slatestarcodex.com/2014/09/30/i-can-tolerate-anything-except-t… - https://www.usenix.org/system/files/1311_05-08_mickens.pdf - https://aphyr.com/posts/341-hexing-the-technical-interview - https://mango.pdf.zone/finding-former-australian-prime-minister-tony-a…