moAliased retweetledi
Everything is a conspiracy when you don’t understand how anything works.
English
moAliased
666 posts
moAliased
@bierellow
Be quiet, sunset is shining! Degree in EE, minor in details
Bedroom Katılım Nisan 2018
289 Takip Edilen176 Takipçiler
@AmirMSafari I was looking for a complex approach, but seems like case-sensitivity is missing in the ct validation. Funny one, nice!
English
moAliased retweetledi
Exact same approach as before.
Not following the usual path last time paid off :))
YS@YShahinzadeh
Yousef (@samm0uda) gave me a challenge few days ago, it's a redesign of Amir's recent challenge, the solution is quite interesting, I was able to solve it in 10 minutes as I'd previously debugged QS library it, I highly RECOMMEND it, the source code: gist.github.com/samm0uda/91efe…
English
@Riazi_Cafe_en = (e^(j*pi/2))^(e^(j*pi/2)) = e^((j*pi/2)*(e^(j*pi/2)))
= e^((pi/2)*(e^(j*pi))) = e^((pi/2)*(e^(j*pi)))
= e^((pi/2)*(-1)) = e^(-pi/2) ≈ 0.2
It looks complicated, but it’s actually simple on paper :)
HT
Calculate the value of the imaginary unit raised to the power of itself.
Math Cafe@Riazi_Cafe_en
Alice and Bob are tossing coins simultaneously. After each round of tosses, they compare their results. If their cumulative number of heads is equal, they stop; otherwise, they continue to the next round. On average, how many rounds will they play before the game ends?
English
@mimbele_ @YShahinzadeh @AmirMSafari well done. there’s actually another way to get to the second point(thing) i mentioned earlier. amirmohammad explained it in his recent blog.
English
@bierellow @YShahinzadeh @AmirMSafari I DID IT TOO! :D
You're right about backend vs browser.
More specifically: qs lib has a weird rule for parsing key/value, it prioritizes "]=" for split point to "=" if it sees one. At least that's how I did it, maybe it has other answers too. Now I can die (sleep) in peace.
English
3 hours yesterday. Halfway there. Gave up.
Today I saw @YShahinzadeh call it the best challenge of 2026 so far. So I gave it 2 more hours. It worked.
Lesson: dig deeper.
Big shoutout to @AmirMSafari
AmirMohammad Safari@AmirMSafari
Can you spot the XSS vulnerability? 👀 Test it out live at: pwnbox.xyz
English
moAliased retweetledi
Thanks for participating in this challenge! I analyzed the qs parser source code and wrote about the inconsistency between the backend and frontend query parsers, along with two possible solutions. Hope you enjoy it!
blog.voorivex.team/when-two-parse…
AmirMohammad Safari@AmirMSafari
Can you spot the XSS vulnerability? 👀 Test it out live at: pwnbox.xyz
English
English
@bierellow @YShahinzadeh @AmirMSafari ok been at it for 2 hrs so far and I have exhausted my knowledge on bypasses I know its something to do with the extended parser discrepancies and parameter pollution but I have hit a wall (so to speak)
fomo is killing me
English
@6173687561646d6 @mimbele_ @YShahinzadeh @AmirMSafari code is code, doesn’t matter if it runs client-side (browser) or back-end.
focus on the concepts first, trying to learn everything at once can get distracting.
btw i’m also a newcomer, didn’t even know “express” exists before this challenge :)
English
@bierellow @mimbele_ @YShahinzadeh @AmirMSafari but about starting into source code review is hardest path !! and i love that its my dream to be in client side hacking !!! and more !>! but am feeling m in wrong dir !
English
@mimbele_ @YShahinzadeh @AmirMSafari btw, if you’re a newbie like me, i highly recommend running the code yourself(if you haven’t already) and inspecting req.query, especially req.query.redirect_uri, to see how it behaves with different input parameters.
English
@mimbele_ @YShahinzadeh @AmirMSafari i had found the first one but was stuck on the second.
for me, the key was digging deeper into how back-end parsing actually behaves.
i suggest focusing on parser behavior, especially on the back-end side. that’s more suspicious.
English
@seyedhadikasaei این کصخلا آلردی نه عقل دارن، نه هوشمندی و نه شرافت. در واقع چیزی نقض نشده الان
فارسی
رسایی: هر کس در هر لباسی؛ هر مقامی و هر جایگاهی با آمریکا مذاکره کرد بی شرف و بی عقل است. (( الان با این سخنرانی چکار کنیم؟ حذف کنیم؟ )) #مسقط
فارسی
@saeed_fard ۳ تا اینترنت ، ۴ تا متد مختلف. از جایگشتهاش سعی میکنم یچیزی در بیارم و وصل بمونم.
فارسی
این چیزی که به اسم اینترنت دارن به ما میدن هر آشغالی هست جز اینترنت. دوستان شما چطوری به کارهاتون میرسید؟ چه کانکشن و راهی برای یک ارتباط ثابت با سرعت مناسب دارید؟
من واقعا دارم روانی میشم از این شرایط
فارسی
@simplerfan الان فقط فحش جوابه، بقول دکتر سکویی: خفه خون بگیرید سیاه بازا... ما تو جنگیم، چاقو گذاشتن رو رگمون دارن شرفمون رو میبرن!
فارسی
