Useful payloads for security testing of web applications

This article (in Russian) lists a number of useful payloads (and some tools that work with them) for security testing of web applications.  Below is the list of handy GitHub repositories for web server path testing, cross-site scripting, SQL injection, and several other common types of vulnerabilities.  These payloads are much richer than basic hand-made tests and can help improve the security of the web application a great deal:

Building for the Blockchain

Building for the Blockchain” is a nice article some of the challenges and paradigm shifts that software developers that jump into Blockchain technology need to know about.  Apart from the usual suspects – networking, Etherium, cryptocurrencies and smart contracts – this article is full of useful links to helpful resources.

If you are considering the Blockchain or if you are already getting your feet wet in this new technology, have a look – I’m sure you’ll find something useful.

Service Workers

A List Apart runs an excellent article “Going Offline“.  In it, among other things, there’s one of the simplest explanations of the Service Workers technology that I’ve seen so far:

A service worker is like a cookie. Cookies are downloaded from a web server and installed in a browser. You can go to your browser’s preferences and see all the cookies that have been installed by sites you’ve visited. Cookies are very small and very simple little text files. A website can set a cookie, read a cookie, and update a cookie. A service worker script is much more powerful. It contains a set of instructions that the browser will consult before making any requests to the site that originally installed the service worker.

A service worker is like a virus. When you visit a website, a service worker is surreptitiously installed in the background. Afterwards, whenever you make a request to that website, your request will be intercepted by the service worker first. Your computer or phone becomes the home for service workers lurking in wait, ready to perform man-in-the-middle attacks. Don’t panic. A service worker can only handle requests for the site that originally installed that service worker. When you write a service worker, you can only use it to perform man-in-the-middle attacks on your own website.

A service worker is like a toolbox. By itself, a service worker can’t do much. But it allows you to access some very powerful browser features, like the Fetch API, the Cache API, and even notifications. API stands for Application Programming Interface, which sounds very fancy but really just means a tool that you can program however you want. You can write a set of instructions in your service worker to take advantage of these tools. Most of your instructions will be written as “when this happens, reach for this tool.” If, for instance, the network connection fails, you can instruct the service worker to retrieve a backup file using the Cache API.

Zulip – Open Source team chat with threads

Zulip is yet another Open Source team chat solution (much like Rocket.Chat).  It has a number of cool features, including Markdown support for messages and drag-n-drop uploads, numerous integrations, and can be used as a self-hosted solution or as a SaaS.

Mailtrain – self-hosted Open Source alternative to MailChimp

Mailtrain is a self-hosted Open Source alternative to MailChimp and other similar mass-mailing and newsletter services.  Of course, being self-hosted, it can go only so far – you’ll still need to deal with mail delivery, SPAM filtering, and other modern days “benefits” of delivering mass mailings.  But it looks pretty complete in terms of features, so if you want to have full control and don’t mind investing a bit of time in setting up, check it out – you might get a better or at least cheaper alternative.