Useful payloads for security testing of web applications

This article (in Russian) lists a number of useful payloads (and some tools that work with them) for security testing of web applications.  Below is the list of handy GitHub repositories for web server path testing, cross-site scripting, SQL injection, and several other common types of vulnerabilities.  These payloads are much richer than basic hand-made tests and can help improve the security of the web application a great deal:

Building for the Blockchain

Building for the Blockchain” is a nice article some of the challenges and paradigm shifts that software developers that jump into Blockchain technology need to know about.  Apart from the usual suspects – networking, Etherium, cryptocurrencies and smart contracts – this article is full of useful links to helpful resources.

If you are considering the Blockchain or if you are already getting your feet wet in this new technology, have a look – I’m sure you’ll find something useful.

Service Workers

A List Apart runs an excellent article “Going Offline“.  In it, among other things, there’s one of the simplest explanations of the Service Workers technology that I’ve seen so far:

A service worker is like a cookie. Cookies are downloaded from a web server and installed in a browser. You can go to your browser’s preferences and see all the cookies that have been installed by sites you’ve visited. Cookies are very small and very simple little text files. A website can set a cookie, read a cookie, and update a cookie. A service worker script is much more powerful. It contains a set of instructions that the browser will consult before making any requests to the site that originally installed the service worker.

A service worker is like a virus. When you visit a website, a service worker is surreptitiously installed in the background. Afterwards, whenever you make a request to that website, your request will be intercepted by the service worker first. Your computer or phone becomes the home for service workers lurking in wait, ready to perform man-in-the-middle attacks. Don’t panic. A service worker can only handle requests for the site that originally installed that service worker. When you write a service worker, you can only use it to perform man-in-the-middle attacks on your own website.

A service worker is like a toolbox. By itself, a service worker can’t do much. But it allows you to access some very powerful browser features, like the Fetch API, the Cache API, and even notifications. API stands for Application Programming Interface, which sounds very fancy but really just means a tool that you can program however you want. You can write a set of instructions in your service worker to take advantage of these tools. Most of your instructions will be written as “when this happens, reach for this tool.” If, for instance, the network connection fails, you can instruct the service worker to retrieve a backup file using the Cache API.

RIP Ronald Lee Ermey

This is one of the best scenes in the whole movies history.  And that’s because of the brilliant performance by Ronald Lee Ermey.  Unfortunately, Ronald Lee Ermey has passed away on April 15, 2018, at the age of 74.  He played a few more roles in other movies, but I think this is by far his best contribution to the cinema.  Probably, because he was a drill instructor in the United States Marine Corps in real life.

Thank you, Ronald.  Rest in peace.

 

Zulip – Open Source team chat with threads

Zulip is yet another Open Source team chat solution (much like Rocket.Chat).  It has a number of cool features, including Markdown support for messages and drag-n-drop uploads, numerous integrations, and can be used as a self-hosted solution or as a SaaS.