teleren/devto huggingface dataset:
File upload bypass using MIME-type
Tags: kali, hackthebox, php, mimetype
Published: 2022-05-20 10:37:43

There are many methods web developers incorporate in their applications in order to allow only certain file types to be uploaded. In the case of a slideshow of a photo booth web application, developers mostly check for a correct file extension (.jpg , .png , etc.) as well as its mime-type `Content-type: image/jpeg` in order to ensure that the file uploaded is indeed allowed and only an image.

Bypassing the file extension to upload a payload is straightforward and easy. We just change the file extension from **payload.php** to **payload.php.gif**

The mime-type check bypass is again relatively simple but most penetration testers tend to make it seem more complicated than it really is. A good example of that is when we try to incorporate a PHP script in a regular image, which in most cases is very difficult to achieve, and it doesn’t guarantee that the payload will indeed work. This happens because in some cases the server does not recognize the file to contain executable code and it simply tries to display it as an image.

The easy way is to trick the mime-type security check in order to think that the file we’ve uploaded is an image but in reality the web server is going to recognize it as a PHP script file.

To do so we only need to add one line at the start of our script: **GIF89a;**

GIF89a is a GIF file header. When the file gets reviewed by `mime_content_type("myfile");` it gets fooled in order to think that it is an image instead of a PHP shell.

```
GIF89a;
<?php
  system('whoami'); # shellcode goes here
?>
```
Fast nmap scanning
Tags: enumeration, nmap, kali, portscanning
Published: 2022-05-20 10:35:21

Most of the time we need `nmap` to just do its job and present us with any available ports that may find in its default configuration, which is usually the 1000 most popular ports. Other times though, we need to scan fast and efficiently to list only open ports in the whole spectrum without any blows and whistles.

You can use any of the commands below depending on your needs.

`nmap -sC -sV <TARGET_IP_ADDRESS>` **Type: Normal**
Scan the top 1000 most popular ports with the default nmap scripts (**-sC**) and with version detection (**-sV**) active.

`nmap -Pn -T4 -v1 -p- <TARGET_IP_ADDRESS>` **Type: Ultra Fast**
Scan all ports (-p-) (0-65535) without ping (**-Pn**) which helps treat all hosts as online and thus reduce the overall execution time.  We also specify the verbose mode (-v1) in order for nmap to list any open ports as soon as  it finds them and **-T4** to set a higher timing template which speeds ups the process even more. For further information regarding the -T flag you can review the [nmap man page](https://linux.die.net/man/1/nmap).

`nmap -nvv -Pn -sS --open <TARGET_IP_ADDRESS>` **Type: Fast**
Scan without DNS resolving (**-n**), without ping (**-Pn**) while using the TCP SYN scan type (**-sS**) and listing only open ports (**–open**).
How to use Leetcode more efficiently
Tags: programming, codenewbie, career, computerscience
Published: 2022-05-20 00:32:58

**tldr;** Stop doing random LC problems and make a study plan. Layout all of the topics, rate yourself from 1-10, solve problems until each topic is at a 9 or a 10. Then teach

## The Problem

Too many people are doing random Leetcode problems without any framework for choosing which problem to solve. They either follow a pre-canned list of problems off Leetcode, or just pick a problem at random every day. This method might be ok to start, but you will soon need to start adding more structure to your studying if you want to grow. Everyone digests different concepts at different rates. You need a tailored study plan to use your time more efficiently.

## Create a plan

It is important to select practice problems with intention, and to track yourself as you progress. Layout all of the relevant topics for your interview, from strings to DP and rate yourself 1-10 on them. Your goal is to get your self-rating in all of these topics to a 9 or 10. Example, if linked lists are rated at a 4, you should be reading up on the concept and solving problems until they are at 9 or a 10.

## How to confirm you’ve mastered a concept?

Teach others! There is nothing that will help you find the gaps in your knowledge faster than teaching that concept to someone who is trying to learn. You will be forced to articulate all of the thoughts in your head, and simplify them so they are digestible. As you are explaining different concepts, and attempting to answer your student’s questions, the gaps in your knowledge will be come clear.

When you are able to teach others the ins and outs of a particular topic, you will be in a good place and can move on to mastering another topic.

## When should I start doing “random” leetcode questions?

Taking on random questions has its place, after you’ve gotten the different concepts to a rating of 9 or 10. Grabbing a random question and learning how to categorize and solve it is an important skill in itself to master. The problem is that too many people are trying to skip diving deep into the fundamentals of the different topics before simulating the interview environment.

(Shoutout to Ching#4264 in the discord for raising this point)

## Join the community

I run a private study group for engineers who are serious about getting jobs in Big Tech, [apply here](https://www.hackpack.io/)

Need advice on how to break into Big Tech? [Join the discord](https://discord.gg/M8944Xz26m)

[Big Tech Interview Tips Newsletter](https://fangprep.substack.com/)
I made a VSCode extension
Tags: javascript, webdev, vscode, typescript
Published: 2022-05-20 10:34:00

Last week [I asked you guys to give me stupid app ideas to make](https://dev.to/virejdasani/tell-me-a-stupid-app-idea-and-ill-make-it-1a9f)

@bennycode gave me an amazing idea for a VSCode extension and I made it!

{% youtube SGFNhz91yNQ %}

"In Your Face" shows you Doom 'Ouch Faces' that correlate to the number of errors in your code!

I published the extension on the Visual Studio Marketplace!

➤ Download "In Your Face": https://marketplace.visualstudio.com/items?itemName=VirejDasani.in-your-face

➤ In Your Face on Github: Github: https://github.com/virejdasani/InYourFace

Consider giving the video a Like, and Subscribe!



## Edit: I made some more of your app ideas 👇
{% youtube gheeg-5sxDQ %}
Mac keyboard shortcuts for arranging app windows
Tags: productivity, macos, keyboardshortcuts, windowsmanagement
Published: 2022-05-20 10:22:21

When I started using Mac as my main machine two years ago, I had a hard time arranging app windows in macOS.

While Microsoft Windows provides shortcuts to move them by default, on macOS you have to:

- Either hover over the green button in the upper-left corner of an app (Hold ⎇ while hovering for more options)

![https://miro.medium.com/max/700/1*wiGmWEt4DYV1aSEa8YNCSA.png](https://miro.medium.com/max/700/1*wiGmWEt4DYV1aSEa8YNCSA.png)

- Or open an app’s Window menu (Hold ⎇ for more options)

![https://miro.medium.com/max/700/1*YJzYCgDZhRQV9paP7a2chw.png](https://miro.medium.com/max/700/1*YJzYCgDZhRQV9paP7a2chw.png)

and select the option you want, for example:

- Move Window to Left/Right Side of Screen
- Zoom
- Move to [another monitor name]

[Third-Party Tools](https://techpp.com/2021/02/16/window-manager-apps-for-macos/) can replicate the Microsoft Windows behavior.

But the good news is that there is a native and free solution.

We can assign system-wide keyboard shortcuts to the commands mentioned above.

To do so you can do the following:

1. Open System Preferences > Keyboard > Shortcuts.

2. On the left pane select ‘App Shortcuts’.

3. Press the “+” button to create a new shortcut.

![https://miro.medium.com/max/700/1*tcuggFqWti-RlCrYdVzqKQ.png](https://miro.medium.com/max/700/1*tcuggFqWti-RlCrYdVzqKQ.png)

4. There are three inputs in the dialog box:

- Application:You can add app-specific shortcuts or shortcuts that you want available for all apps.
- Menu Title:Enter the title of the menu command as it appears when hovering over the green button. for example: Move Window to Left Side of Screen.Bear in mind that it has to match letter by letter.
- Keyboard Shortcut:Pick a keyboard shortcut. For example: ⌃⌥⌘←Be mindful that the shortcut you select doesn’t interfere with existing shortcuts.

![https://miro.medium.com/max/700/1*PngfxAjsSVqzF6qK0HlXgQ.png](https://miro.medium.com/max/700/1*PngfxAjsSVqzF6qK0HlXgQ.png)

Here are my shortcuts:

- Zoom: ⌃⌥⌘↑
- Move Window to Left Side of Screen: ⌃⌥⌘←
- Move Window to Right Side of Screen: ⌃⌥⌘→

I have a dual monitor setup. So other than the one listed above, I have also set the shortcut to move a window to another monitor:

- Move to Built-in Retina Display: ⌃⌥⇧⌘←
- Move to C49RG9x: ⌃⌥⇧⌘→C49RG9x is the name of my external monitor, yours may be different.

![https://miro.medium.com/max/700/1*WwN8emGaN8VOk_Rp16Sw5Q.png](https://miro.medium.com/max/700/1*WwN8emGaN8VOk_Rp16Sw5Q.png)

To remember the shortcuts, notice that all the keys are next to each other. All you do is use different arrow keys. Also Moving to another monitor has one more key than putting the windows in split view on the same monitor.

Each App may have different default shortcuts. That’s why I used 4 and 5 keys for these shortcuts so that they do not interfere with them.

I hope it helps you to work more productive.
net6 API Prometheus Metrics
Tags: dotnet, kubernetes
Published: 2022-05-20 10:11:20

If you're creating a dotnet API to run in Kubernetes, chances are you'll be wanting to use Prometheus to gather metrics about your application. 

A library that makes this really easy for us is [prometheus-net](https://github.com/prometheus-net/prometheus-net) - we can create a minimal API that exposes metrics quickly and demonstrate a few different ways of creating metric data

The source for this is in github at https://github.com/dylanmorley/dotnet-api-prometheus-metrics-reference

## Metrics Configuration

The majority of the work for this is done in the [Program](https://github.com/dylanmorley/dotnet-api-prometheus-metrics-reference/blob/main/src/PrometheusMetrics.Api.Reference/Program.cs) startup class, let's look at a few of the important points

`EventCounterAdapter` - listens for any dotnet [event counters](https://docs.microsoft.com/en-us/dotnet/core/diagnostics/event-counters) and converts them into Prometheus format at the exporter endpoint

`MeterAdapter` - listens for dotnet metrics created via [System.Diagnostics.Metrics Meter](https://docs.microsoft.com/en-us/dotnet/core/diagnostics/metrics-instrumentation)

`app.UseHttpMetrics` - we want the application to expose metrics about each one of our endpoints, such as number of requests, request durations

`app.UseEndpoints` -> `MapMetrics` - we'll expose the `/metrics` endpoint as part of the application

That's pretty much it, not many things to configure and our app is up and running

## Controller usage

In the [weather forecast controller](https://github.com/dylanmorley/dotnet-api-prometheus-metrics-reference/blob/main/src/PrometheusMetrics.Api.Reference/Controllers/WeatherForecastController.cs) there are a couple of examples of how metrics can now be created. 

If you execute the `WeatherForecast/Get` endpoint, you'll be incrementing a metric created by a `System.Diagnostics.Metrics` Meter instance, and if you hit `WeatherForecast/PredictStorm` you'll be using a Histogram from the prometheus-net library. 

After executing either of these methods, you can check the `/metrics` endpoint and will see various event counters, custom counters & http controller endpoint metrics, all converted into Prometheus format and ready for scraping. 

A docker file is included in the repo, to demonstrate creating an image that could then be run alongside a Prometheus instance on a kubernetes cluster. 

That's it - a super simple reference solution for getting metrics up and running
What is your go to coding playlist/youtube video?
Tags: discuss, productivity, programming
Published: 2022-05-20 10:09:24

Some people **love** it, some people **do not**!

However I am a fan of listening to music while coding. For me it really makes my brain work better.

So, drop your go-to Spotify playlist, Apple Music playlist, Youtube video, website etc and let's get our brains working!

Here's what I normally switch between :

- https://www.youtube.com/watch?v=f02mOEt11OQ
- https://musicforprogramming.net/latest/
- https://open.spotify.com/playlist/37i9dQZF1DX5trt9i14X7j?si=f659dd493fd3413c

_Credit to [Lofi Ghostie](https://www.youtube.com/watch?v=BPVu5xaZk-4) for the cover image._
How to get & build full URLs in Rails
Tags: ruby, rails, webdev
Published: 2022-05-20 09:52:49

There are some cases when you want to get a current request absolute URL. Thankfully, Rails got you covered on this one and provides a simple way for that: 
```ruby
request.original_url
```
This'll return an absolute full URL including schema, host, port, path, and query string, but without anchor though.

So, for a request to `https://example.com/resource?q=first`:

```ruby
request.original_url # => https://example.com/resource?q=first
request.fullpath # => /resource?q=first
request.path # => /resource
```

## Building full URL
When you need to build a full URL in controller views you can simply use the URL helpers provided by Rails:
```ruby
post_url(@post)
```

But it's not that easy outside the request(controller/view) scope. For example, if you need to build a full URL inside a background job, Rails can't simply get the host for that from a request, since there's no request.

#### To make it work we need two things:

First, include URL helpers.
```ruby
class MyJob < ApplicationJob
  include Rails.application.routes.url_helpers
  
  def perform(user)
    user_url(user)
    ...
  end
end
```
And then, set url options in app configuration:
```ruby
# config/environments/production.rb
Rails.application.routes.default_url_options[:host] =  "example.com"
# And for email views
Rails.application.config.action_mailer[:host] = "example.com"
```

If you need to generate URLs for assets (for example images/icons in emails) you'll need to set `asset_host` as well:
```ruby
# Need only if host is other than the one 
# that handles requests
config.action_controller.asset_host = 'example.com'

# Required since mailer has no request context 
# to get host address from
config.action_mailer.asset_host = 'example.com'
```
Guide to Career Paths in Software Testing (QA)
Tags: career, testing, beginners, programming
Published: 2022-05-20 09:40:00


Wondering how to become a QA professional? And what skills are required for a QA specialist?

In this [article](https://blog.getace.io/all-posts/career-paths-in-software-testing), you will find Software Testing levels descriptions, what skills you need to be a QA specialist and what is the career path of QA?

### Career Path of QA

Click on the role & get the list of career path of QA specialist and top QA skills on each level.

- [QA Tester (Manual Testing)](https://www.getace.io/templates?category=QA#skill-matrices)
- [QA Developer](https://www.getace.io/)

- [Test Automator / QA Automator](https://www.getace.io/templates?category=QA#skill-matrices)

## 50+ tech roles
Need more roles? Go to [Ace’s career path templates](https://www.getace.io/templates)for 50+ tech roles.

You’ll find career paths for Backend Developer, Front End Developer, Game Development, Data Science, Design, and more.
block user days doesn't work
Tags: laravel, php, help, beginners
Published: 2022-05-20 09:31:48

Hi amazing people,


i had a question. i got a message that the days doesn't work for my login page. does somebody know what is wrong.

i will upload my code also here!
<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Response;

class CheckBanned
{
    /**
     * Handle an incoming request.
     *
     * @param Request $request
     * @param Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
     * @return Response|RedirectResponse
     */
    public function handle($request, Closure $next)
    {
        if (auth()->check() && auth()->user()->banned_until && now()->lessThan(auth()->user()->banned_until)) {
            $banned_days = now()->diffInDays(auth()->user()->banned_until);
            auth()->guard('web')->logout();

            if ($banned_days > 14) {
                $message = 'Your account has been suspended ,Please contact administrator.';
            } else {
                $message = 'Your account has been suspended for '.$banned_days . $this->str_plural('days', $banned_days) .'. Please contact administrator.';
            }

            return redirect()->route('login')->withMessage($message);
        }

        return $next($request);
    }


this is the error Your account has been suspended for 2. Please contact administrator.
Start Your NFT Gaming Platform With Readymade Axie Infinity Clone Script
Tags: axieinfinityclone, programming, blockchain, discuss
Published: 2022-05-20 09:12:36

Do you want to buy Readymade **[Axie infinity clone script](https://www.dappsfirm.com/axie-infinity-clone-script)** to start an NFT gaming platform? Feel Free to click here Axie Infinity Clone.

If you begin to start your Readymade Axie Infinity clone Script, NFT gaming business is always a preferable and profitable choice in the current gaming market. While using the Axie Infinity clone script, You can launch your NFT gaming platform like Axie Infinity and  get popular in short span of time. Dappsfirm provides you bug-free and multi-tested Axie Infinity clone script with advanced gaming P2E features. We developed it for all the gaming entrepreneurs.

**Best Axie Infinity Clone Script 2022**

Axie Infinity Clone script are readymade NFT gaming website script or software of a successful pre-existing NFT gaming platform like Axie Infinity. These bespoke script help replicate the base of the Axie infinity with few needed customizations and are ready for instant launch. 

Axie Infinity Clone script is the easiest and cost-effective way of developing an NFT gaming platform. It also helps avoid the hassle of developing an NFT game from scratch, building a program by secure coding, testing the marketplace rigorously, and much more. 

Axie Infinity clone script is popularly sought after by startups and why not even major enterprises. There are many NFT game development companies that offer Axie infinity clone development. Few NFT game clone script accessible in the market is Zedrun clone, Sorare clone, Decentraland clone, sandbox clone and much more.

Our Axie infinity clone script should be highly customizable, white-labeled, scalable, and ready for deployment on multi- blockchain networks. Contact us to know more.

Are you searching for the best **[Axie Infinity clone script](https://www.dappsfirm.com/axie-infinity-clone-script)** development company? Right away, head to Dappsfirm’s support and consult with them regarding the script.
Ошибка обновления GitLab из-за ошибки обновления Let’s Encrypt
Tags: gitlab, linux, debian, russian
Published: 2022-05-20 08:55:07

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k00a45jocfv16yhxifqy.png)

Столкнулся недавно с проблемой обновления GitLab до версии 12.6 из-за ошибки реконфигурации, вызываемой попыткой обновления сертификата Let’s Encrypt. Так получилось, что обновление пришлось на день, когда был просрочен сертификат. Не беда! Отключаем использование сертификата в **/etc/gitlab/gitlab.rb** и запускаем реконфигурацию вручную:

```bash
nano /etc/gitlab/gitlab.rb
// Находим это строку и выставляем значение false
letsencrypt['enable'] = false
// Сохраняем файл и выполняем реконфигурацию
gitlab-ctl reconfigure
```

Теперь GitLab успешно применит новые параметры и сможет обновиться. После завершения обновления возвращаем использование Let’s Encrypt в **/etc/gitlab/gitlab.rb**, снова реконфигурируем GitLab и… снова получаем прежнюю ошибку!

```bash
Running handlers:
There was an error running gitlab-ctl reconfigure:
letsencrypt_certificate[git.hostname.com] (letsencrypt::http_authorization line 5) had an error: RuntimeError: acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 25) had an error: RuntimeError: ruby_block[create certificate for git.lapaygroup.ru] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/resources/certificate.rb line 108) had an error: RuntimeError: [git.hostname.com] Validation failed, unable to request certificate
```

Огорченный полез гуглить. Оказалось, проблема не только у меня, но четкого решения проблемы нет. После пары часов изучения баг-трекера GitLab и тщетных попыток устранить проблему мой рецепт решения был найден, и он очень простой:

1. проверить, что порты **80** и **443** открыты;
2. проверить домен на [сайте Let’s Encrypt](https://letsdebug.net/);
3. установить параметры в **/etc/gitlab/gitlab.rb**:
`
    nginx[‘redirect_http_to_https’] = true 
    nginx[‘redirect_http_to_https_port’] = 80
`
4. удалить файлы проблемного сертификата из папки **/etc/gitlab/ssl**;
5. запросить новый сертификат: **gitlab-ctl renew-le-certs**. 

В моем случае оказался закрыт 80 порт и что-то случилось с правами на файлы сертификата в **/etc/gitlab/ssl** — при обновлении GitLab не мог их заменить.

Надеюсь, мой рецепт поможет решить проблему и вам!
Dynamic Angular Blog Without Writing Any API
Tags: angular, webdev, programming
Published: 2022-05-20 08:50:55

I created this Angular project which is a blog application without writing a single line of API.

You might have seen applications talking to backend APIs trying to do CRUD operations and fetch their data.

This is great and gives you a lot of flexibility, but what if you want to create a simple application like a blog where you just need data for your Angular application and all you are worried about is the SEO and the presentation of this Angular project.

Well here is where a headless CMS like Contentful comes into picture.

Contentful is a headless cms and is a content management platform to create, manage and publish content on any digital channel.
So in simpler terms, we will not be creating any backend service to save content for our application in databases, instead we will use contentful which will do this job for us. 

This will save us a lot of effort and we don't have to manage the backend api.

I have this video tutorial for you in which I create a Angular website from scratch using Contentful.

{% youtube Z5QRCctfcLI %}
Удаление Checkpoint Endpoint Security client on Mac (Uninstall)
Tags: checkpoint, vpn, macos, russian
Published: 2022-05-20 08:45:02

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ti6wrxzcgur7ykenlhxe.jpeg)

Для удаление **Checkpoint Endpoint Security client on Mac** на MacOS необходимо выполнить shell скрипт в терминале.

```bash
#bash
sh /Library/Application Support/Checkpoint/Endpoint Security/uninstall
Или (зависит от установленной версии)
sh /Library/Application Support/Checkpoint/Endpoint Security/uninstall.sh
```