play page 2 - Dave's Blog


laughingsquid: Everybody Wants to Kill Bruce Willis, An Action...

2013 Mar 26, 7:47


Everybody Wants to Kill Bruce Willis, An Action Movie Mashup

PermalinkCommentshumor video bruce-willis

Zelda Starring Zelda (by Kenna W) Original NES Legend of Zelda...

2013 Mar 18, 2:17

Zelda Starring Zelda (by Kenna W)

Original NES Legend of Zelda ROM modified to swap Zelda and Link: play as Zelda saving Link.

PermalinkCommentsNintendo rom hack programming Zelda legend-of-zelda

The best cosplay of all time (by RayLiehm) Awesome car...

2012 Nov 14, 5:16

The best cosplay of all time (by RayLiehm)

Awesome car dealership wavy tube thingy costume.

PermalinkCommentshumor costume wavy video

A Slower Speed of Light Official Trailer — MIT Game Lab (by...

2012 Nov 13, 7:41

A Slower Speed of Light Official Trailer — MIT Game Lab (by Steven Schirra)

“A Slower Speed of Light is a first-person game in which players navigate a 3D space while picking up orbs that reduce the speed of light in increments. A custom-built, open-source relativistic graphics engine allows the speed of light in the game to approach the player’s own maximum walking speed. Visual effects of special relativity gradually become apparent to the player, increasing the challenge of gameplay. These effects, rendered in realtime to vertex accuracy, include the Doppler effect; the searchlight effect; time dilation; Lorentz transformation; and the runtime effect.

A production of the MIT Game Lab.

Play now for Mac and PC!

PermalinkCommentsscience game video-game mit 3d light-speed

 “The disc itself is about 5 inches in diameter. It can record...

2012 Oct 1, 8:21

 “The disc itself is about 5 inches in diameter. It can record one hour of stereo music on one side — and it is only a one-sided disc, it’s not meant to be played on two sides…”

Sony demos the CD at TED in 1984 (by TEDBlogVideo)

PermalinkCommentsvideo cd ted music

DSL modem hack used to infect millions with banking fraud malware | Ars Technica

2012 Oct 1, 6:33

According to the links within this article, although the root URI of the router requires authentication, the /password.cgi URI doesn’t and the resulting returned HTML contains (but does not display) the plaintext of the password, as well as an HTML FORM to modify the password that is exploitable by CSRF.

The attack… infected more than 4.5 million DSL modems… The CSRF (cross-site request forgery) vulnerability allowed attackers to use a simple script to steal passwords required to remotely log in to and control the devices. The attackers then configured the modems to use malicious domain name system servers that caused users trying to visit popular websites to instead connect to booby-trapped imposter sites.

PermalinkCommentstechnical security html router web dns csrf

Ben Goldacre’s TED talk on publication bias, drug...

2012 Sep 28, 3:55

drug companies hiding the results of clinical trials.

(via I did a new talk at TED, on drug companies and hidden data.)

PermalinkCommentsscience video ted

Nathan Barnatt makes awesome videos. This is a playlist of my...

2012 Sep 26, 2:21

Nathan Barnatt makes awesome videos. This is a playlist of my favorites of his. (via

PermalinkCommentsNathan-barnatt video music dance humor

Stripe CTF - Level 7

2012 Sep 13, 5:00

Level 7 of the Stripe CTF involved running a length extension attack on the level 7 server's custom crypto code.


def logs(id):
rows = get_logs(id)
return render_template('logs.html', logs=rows)


def verify_signature(user_id, sig, raw_params):
# get secret token for user_id
row = g.db.select_one('users', {'id': user_id})
except db.NotFound:
raise BadSignature('no such user_id')
secret = str(row['secret'])

h = hashlib.sha1()
h.update(secret + raw_params)
print 'computed signature', h.hexdigest(), 'for body', repr(raw_params)
if h.hexdigest() != sig:
raise BadSignature('signature does not match')
return True


The level 7 web app is a web API in which clients submit signed RESTful requests and some actions are restricted to particular clients. The goal is to view the response to one of the restricted actions. The first issue is that there is a logs path to display the previous requests for a user and although the logs path requires the client to be authenticatd, it doesn't restrict the logs you view to be for the user for which you are authenticated. So you can manually change the number in the '/logs/[#]' to '/logs/1' to view the logs for the user ID 1 who can make restricted requests. The level 7 web app can be exploited with replay attacks but you won't find in the logs any of the restricted requests we need to run for our goal. And we can't just modify the requests because they are signed.

However they are signed using their own custom signing code which can be exploited by a length extension attack. All Merkle–Damgård hash algorithms (which includes MD5, and SHA) have the property that if you hash data of the form (secret + data) where data is known and the length but not content of secret is known you can construct the hash for a new message (secret + data + padding + newdata) where newdata is whatever you like and padding is determined using newdata, data, and the length of secret. You can find a script on VNSecurity blog that will tell you the new hash and padding per the above. With that I produced my new restricted request based on another user's previous request. The original request was the following.

The new request with padding and my new content was the following.
My new data in the new request is able to overwrite the waffle parameter because their parser fills in a map without checking if the parameter existed previously.


Code review red flags included custom crypto looking code. However I am not a crypto expert and it was difficult for me to find the solution to this level.

PermalinkCommentshash internet length-extension security sha1 stripe-ctf technical web

Stripe CTF - XSS, CSRF (Levels 4 & 6)

2012 Sep 10, 4:43

Level 4 and level 6 of the Stripe CTF had solutions around XSS.

Level 4


> Registered Users 

  • <% @registered_users.each do |user| %>
    <% last_active = user[:last_active].strftime('%H:%M:%S UTC') %>
    <% if @trusts_me.include?(user[:username]) %>

  • <%= user[:username] %>
    (password: <%= user[:password] %>, last active <%= last_active %>)
  • Issue

    The level 4 web application lets you transfer karma to another user and in doing so you are also forced to expose your password to that user. The main user page displays a list of users who have transfered karma to you along with their password. The password is not HTML encoded so we can inject HTML into that user's browser. For instance, we could create an account with the following HTML as the password which will result in XSS with that HTML:

    This HTML runs script that uses jQuery to post to the transfer URI resulting in a transfer of karma from the attacked user to the attacker user, and also the attacked user's password.


    Code review red flags in this case included lack of encoding when using user controlled content to create HTML content, storing passwords in plain text in the database, and displaying passwords generally. By design the web app shows users passwords which is a very bad idea.

    Level 6



    def self.safe_insert(table, key_values)
    key_values.each do |key, value|
    # Just in case people try to exfiltrate
    # level07-password-holder's password
    if value.kind_of?(String) &&
    (value.include?('"') || value.include?("'"))
    raise "Value has unsafe characters"



    This web app does a much better job than the level 4 app with HTML injection. They use encoding whenever creating HTML using user controlled data, however they don't use encoding when injecting JSON data into script (see post_data initialization above). This JSON data is the last five most recent messages sent on the app so we get to inject script directly. However, the system also ensures that no strings we write contains single or double quotes so we can't get out of the string in the JSON data directly. As it turns out, HTML lets you jump out of a script block using no matter where you are in script. For instance, in the middle of a value in some JSON data we can jump out of script. But we still want to run script, so we can jump right back in. So the frame so far for the message we're going to post is the following:

PermalinkCommentscsrf encoding html internet javascript percent-encoding script security stripe-ctf technical web xss

Natural Selection

2012 Sep 6, 6:45

Classic 2d space shooter except you are fighting the ghosts of previous players. Your play through is replayed as an enemy against future players. Also, written in HTML/JS

PermalinkCommentsgame video-game neat html justin-rogers

Stripe CTF - Input validation (Levels 1 & 2)

2012 Sep 6, 5:00

Stripe's web security CTF's Level 1 and level 2 of the Stripe CTF had issues with missing input validation solutions described below.

Level 1


          $filename = 'secret-combination.txt';
if (isset($attempt)) {
$combination = trim(file_get_contents($filename));
if ($attempt === $combination) {


The issue here is the usage of the extract php method which extracts name value pairs from the map input parameter and creates corresponding local variables. However this code uses $_GET which contains a map of name value pairs passed in the query of the URI. The expected behavior is to get an attempt variable out, but since no input validation is done I can provide a filename variable and overwrite the value of $filename. Providing an empty string gives an empty string $combination which I can match with an empty string $attempt. So without knowing the combination I can get past the combination check.


Code review red flag in this case was the direct use of $_GET with no validation. Instead of using extract the developer could try to extract specifically the attempt variable manually without using extract.

Level 2


    $dest_dir = "uploads/";
$dest = $dest_dir . basename($_FILES["dispic"]["name"]);
$src = $_FILES["dispic"]["tmp_name"];
if (move_uploaded_file($src, $dest)) {
$_SESSION["dispic_url"] = $dest;
chmod($dest, 0644);
echo "

Successfully uploaded your display picture.



This code accepts POST uploads of images but with no validation to ensure it is not an arbitrary file. And even though it uses chmod to ensure the file is not executable, things like PHP don't require a file to be executable in order to run them. Accordingly, one can upload a PHP script, then navigate to that script to run it. My PHP script dumped out the contents of the file we're interested in for this level:


Code review red flags include manual file management, chmod, and use of file and filename inputs without any kind of validation. If this code controlled the filename and ensured that the extension was one of a set of image extensions, this would solve this issue. Due to browser mime sniffing its additionally a good idea to serve a content-type that starts with "image/" for these uploads to ensure browsers treat these as images and not sniff for script or HTML.

PermalinkCommentsinput-validation php security technical

Stripe Web Security CTF Summary

2012 Aug 30, 5:00

I was the 546th person to complete Stripe's web security CTF and again had a ton of fun applying my theoretical knowledge of web security issues to the (semi-)real world. As I went through the levels I thought about what red flags jumped out at me (or should have) that I could apply to future code reviews:

Level Issue Code Review Red Flags
0 Simple SQL injection No encoding when constructing SQL command strings. Constructing SQL command strings instead of SQL API
1 extract($_GET); No input validation.
2 Arbitrary PHP execution No input validation. Allow file uploads. File permissions modification.
3 Advanced SQL injection Constructing SQL command strings instead of SQL API.
4 HTML injection, XSS and CSRF No encoding when constructing HTML. No CSRF counter measures. Passwords stored in plain text. Password displayed on site.
5 Pingback server doesn't need to opt-in n/a - By design protocol issue.
6 Script injection and XSS No encoding while constructing script. Deny list (of dangerous characters). Passwords stored in plain text. Password displayed on site.
7 Length extension attack Custom crypto code. Constructing SQL command string instead of SQL API.
8 Side channel attack Password handling code. Timing attack mitigation too clever.

More about each level in the future.

PermalinkCommentscode-review coding csrf html internet programming script security sql stripe technical web xss

Eyeo2012 - Robert Hodgin Robert Hodgin presents various 3D...

2012 Jul 18, 8:39

Eyeo2012 - Robert Hodgin

Robert Hodgin presents various 3D animation projects in a humorous fashion.

PermalinkComments3d animation humor video programming

wired: cnet: Mp3 playing retainer transmits music through your...

2012 Jul 3, 2:31



Mp3 playing retainer transmits music through your teeth:

Bone conduction audio, retainers, and shiny hip-hop teeth grills aren’t new inventions, but tech hacker Aisen Caro Chacin had the clever idea to put them all together.

The Play-A-Grill MP3 player prototype fits in your mouth like a retainer, shines on the outside like a precious metal rap grill, and plays music through bone conduction through your teeth.

Read more

Oh man, this would have made puberty just a touch cooler. Maybe. 

PermalinkCommentshumor mp3 tech

ifc: This week on Comedy Bang! Bang! - Michael Cera!

2012 Jun 27, 3:38


This week on Comedy Bang! Bang! - Michael Cera!

PermalinkCommentshumor comedy-bang-bang michael-cera video

“Fuck You, Pay Me” is a talk on contracts, payments,...

2012 Jun 25, 2:06

Fuck You, Pay Me” is a talk on contracts, payments, etc. for free-lance designers.

PermalinkCommentsbusiness web-desgin video technical

Microsoft Surface: a gentle kick in the teeth of the OEMs | Ars Technica

2012 Jun 25, 12:59

But if Surface is aimed at the OEMs—telling them “we can do this just as well as you can, if we have to”—and setting them a challenge—”your tablets have to be at least this good”—then the limited availability isn’t necessarily such a big deal. As long as the OEMs heed the warning and raise their game, so that Redmond can be assured that bad hardware won’t jeopardized Windows 8’s success, Microsoft could safely keep Surface operating as a small-scale operation, playing the Nexus role without upsetting the PC market.

PermalinkCommentstechnical surface win8 windows windows8 business

“Hey Pass Me a Beer” in the same vein as the...

2012 Jun 21, 2:55

“Hey Pass Me a Beer” in the same vein as the HIGH-FIVE! montages.

PermalinkCommentshumor video beer

The amazing powers of CSS

2012 Jun 20, 3:32

Some fun CSS things including the following:

head { display: block; border-bottom: 5px solid red; }

script, style, link { display: block; white-space: pre; font-family: monospace; }

script:before { content: “”; }

PermalinkCommentscss technical html
Older EntriesNewer Entries Creative Commons License Some rights reserved.