teleren/devto huggingface dataset:
0x00SEC CTF - Exercise #3
Tags: security, ctf, codenewbie
Published: 2020-03-09 18:00:34

This weekend I took a dive into 0x00Sec's new bi-monthly CTF. 

Note::: NO, I won't be posting the found flag{}, but I will be posting the methods I used. 

<hr>

- CTF Name: Exercise #3
- Resource: [0x00SEC](https://ctf.0x00sec.org/)
- Difficulty: Easy
- Number of Flags: 1


### Flag0
- Hint: Note in the Source Code of 
``<!-- TODO: -->
  <!-- * Implement secure object references -->``

- Acquired By: 
 - First thing to do is to just to look at the source code. This shows nothing specific except the hint. All scripts are bootstrap that are being used and nothing looks custom.![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/wyatnb4jz27rlnrjv5xl.png)
 - Second thing is to see what it happening when a login is attempted with a "test:test" username:password combo. This showed that there was a "Cookie: PHPSESSID" that was being passed to the application but unlike the previous exercise, this appeared to be a random number and not holding any user information like "admin" or "login=true".
 - Third: I actually played around a bit with looking up information on "Information disclosure" as there didn't seem to be any way to register or login without knowing the log in and I didn't want to just keep trying random things. Sadly this didn't really give me any hints so I consulted my bf.
 - After talking to my bf I stumbled on trying the "admin:admin" for the "username: password" and that logged me right in... ![](https://media.giphy.com/media/12eMaBeKcVBg9G/source.gif)
 - So after that I was able to see the "admin" was actually user_id=5.![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/7nwb87dgbqo0696t4ysn.png)
 - Now that I tested out different user_id numbers to see if one of them had the flag and after a few different id numbers there it was. ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/eykhuw93h4l02iwikjt0.png)


### Thoughts
This was easy once I got the admin:admin login. I'm a bit irritated that I didn't think of trying that combo as I had been trying admin username with other passwords, but I did get it.
Once logged in this allowed me to find the insecure object references of the user_ids and find the code.




### Learned
This CTF taught me a tad about secure object references but more so about trying admin:admin for the username and password on these CTFs... 
¯\_(ツ)_/¯ 





<hr>

Happy Hacking
![](https://media.giphy.com/media/l3vRmVv5P01I5NDAA/giphy.gif)

### Resources
1. https://ctf.0x00sec.org/

###### Please Note that I am still learning. If something that I have stated is incorrect please let me know. I would love to learn more about what I may not understand fully.
404 status code! Really?
Tags: discuss
Published: 2020-03-09 17:47:21

Hi, guys! This is my first post on Dev.to.

I come to share with you a thought that intrigues me a little. Maybe, a little strange one at first sight.

Well... I have built a REST API for a personal project and worked on a endpoint that retrives a single resource. For instance:

```
GET /books/8c2ba535-5523-47a5-8a72-281c316d5fc4
```

As you can see, the resource can be found by an UUID. This URI is mapped as `GET /books/:id`.

The thing is this UUID does not represent any record in the *books* table in the database. So, it returns nothing.

It is common to deal with this situation returning a `404 (not_found)` status code that indicates an error from the client as specified on [RFC 7231 section 6.5.4](https://tools.ietf.org/html/rfc7231#section-6.5.4)

> The 404 (Not Found) status code indicates that the origin server did not find a current representation for the target resource or is not willing to disclose that one exists.

I have dealt with it as an untouchable law until reading what is specified on [RFC 7231 section 6.3.1](https://tools.ietf.org/html/rfc7231#section-6.3.1):

> The 200 (OK) status code indicates that the request has succeeded. The payload sent in a 200 response depends on the request method. For the methods defined by this specification, the intended meaning of the payload can be summarized as:
> GET  a representation of the target resource;

This definition for `200` status code makes me believe that returning a payload with `null` is correct because it is what exactly the client requested! The client just sent an ID that does not represent any record, the structure of the URI is fine though. Thus, the client gets a success response, but with a `null` as a resource.

According to this logic, the payload would be like:

```
{
  "data": {
    "book": null
  }
}
```

For the status code to be `404`, the request would be like:

```
GET /boocs/8c2ba535-5523-47a5-8a72-281c316d5fc4
```

**boocs** really does not exist.

All of this makes me think the way we handle this situation depends on how we deal with the role of the database in the application.

Does the database have an active participation on the application interfering in the business rule? Go for `404` status code. Eg.: a private repository hosted on Github being accessed by an unauthorized user.

Is the database just a data repository? I tend to believe the response would have a success payload with `null`. Eg.: the majority of the APIs worldwide.

Summing up:

"If you have nothing to give, give nothing. If you do, decide if you want to give something, (don't) give it and communicate."

Crazy, uh?

I know there already are some talks about this on the internet, but I think it worths sharing my thoughts with you and I'd like to know about your opinion.

What do you think about?
I Know I'm Technical Enough
Tags: career, community, wecoded
Published: 2020-03-09 17:45:18

## Community is my chosen lane 

I am a software developer, period.

I am also a Black woman. I am a full-time, single mother of two. I care about the social impact of tech. I am an artist. I care about the aesthetics of user interfaces. All of these things are true at once. Not one of those statements negates my first point. I am a software developer.

I know an awful reality of presenting as a Black woman in this field is that my skills, my intelligence, and my competency will be underestimated. I know at least some people will assume I'm "not technical" just based on appearances and attempt to steer my career path accordingly.

I'm writing today to announce that I don't care. I don't need anyone to validate that I'm technical enough to be here. I am a software developer and I am choosing to make my work about building community, equity, and inclusion.

At this point, I've submitted talks to a handful of conferences. I've been approached about speaking opportunities in the future. Not one of my talk proposals has been a technical talk. That is on purpose. When I talk, I want to tell my story.

I want to tell the story of a mom CEO who doesn't have a partner, in-laws, or a nanny to tag in for help with the kids while I build my company.

I want to tell the story of a 37-year-old parent with no career to return to. I want to express that that doesn't make my grown-ass a "junior" with no transferable skills.

I want to expose the lies folks like me are being told about how to get into tech. I want to create viable pathways into careers and skip the trend of exploiting people with few resources to speak of.

I can code and I can adapt. I know how to learn. "Hard" tech doesn't fucking scare me at all. I've dealt with harder things in life than programming languages and CLIs.

The point is, time is precious. I have a unique and valuable perspective that is not often represented or acknowledged. I happen to think that the time allotted to my career is better spent telling this story and amplifying the voices of others than pushing pixels and slinging code.

*Side note: Pushing pixels and slinging code is fun. I'll always be down but it's a big relief to recognize that I don't have to do this as a career.*

Supporting me in my work as a community and [ecosystem builder](https://popschools.co) is not an insult to my intelligence. It's what I want. Expecting me to do this work for free is.

Do feel free to approach me with (paid) non-technical speaking gigs and (paid) opportunities that take advantage of my social skills and connections.
Next.js API Routes using SQL Database
Tags: typescript, react, database, javascript
Published: 2020-03-09 17:40:49

New video about Next.js API Routes using SQL Database
This is a good starting point for beginners!

If you want to follow along, there's no need to install any external dependency, just "git clone" and "npm install"!

Repository: https://github.com/bmvantunes/youtube-2020-march-nextjs-part4

I hope you find the video helpful :)

{% youtube PxiQDo0CmDE %}
Nevertheless, Aayushi Gupta Coded
Tags: wecoded
Published: 2020-03-09 17:39:36

Getting down in the field of tech was of so much fun started up with the competitive coding and then it gave me a power boost to do something more innovative. So got into the development track and started up . After sometime I became core member of Developer Student Club and then not stopping feel arised many consequences I faced but the support of my family and friends helped me to get through everything. Then chosen as a representative of GirlScript Pune and just trying more harder to fulfill all my dreams so that it can come true.
SSH to an EC2 instance from VS Code
Tags: vscode, ec2, ssh, aws
Published: 2020-03-09 17:25:50

---
title: SSH to an EC2 instance from VS Code
published: true
description: Connect to a remote server using VS Code to easily work on files if nano or vim is not convenient.
tags: VSCode, EC2,  SSH, AWS
---

Requirements: 

1) You must have <a href="https://code.visualstudio.com/">VSCode</a> or <a href="https://code.visualstudio.com/insiders/">VSCode Insider </a> installed.

2) A running <a href="https://code.visualstudio.com/docs/remote/troubleshooting#_installing-a-supported-ssh-server">SSH server </a> preferrable a linux server running on an EC2 instance.

3) An <a href="https://code.visualstudio.com/docs/remote/troubleshooting#_installing-a-supported-ssh-client"> SSH Client </a> on your local system.

Steps to SSH on VSCode

a) Install the <a href="https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.vscode-remote-extensionpack">Remote extension pack</a> on your vscode.

b) In VSCode, press **F1** to open the command palette, and type connect.

<img src="https://dev-to-uploads.s3.amazonaws.com/i/u6d7yw8mqpdfptqbu763.png">

c) Select Remote-SSH: Connect to Host. This will bring out options for you to add or configure SSH Hosts.

<img src="https://dev-to-uploads.s3.amazonaws.com/i/bqst7wqv4q75x9c2y6js.png">

d) Select configure SSH Hosts. This will give you options to create a config file. For mine I selected the first option /Users/username/.ssh/config.

<img src="https://dev-to-uploads.s3.amazonaws.com/i/2ungbq3suq0h5i2uxjii.png">

This will open a new file for you were you can create an ssh config.
<img src="https://dev-to-uploads.s3.amazonaws.com/i/bmvcrnsd68ndloton5zq.png">

The **Host** is any name you want VSCode to use to recognize your file.
The **HostName** is the public dns of your EC2 instance or public ip address of your server.
The **User** is the username of your server.
The **IdentityFile** is the path to your ssh key which you got when you created your EC2 instance.

Press **F1** again to open the command palette. Select Remote-SSH and this time, you should see the **Host** you just created. As you can see in the image below, mine is the **personal** that appears.
<img src="https://dev-to-uploads.s3.amazonaws.com/i/9coq72krq3x4jzyq7jhg.png">

Select yours, and it will attempt connecting to it. When it has successfully connected, you will see something like this in the bottom left corner of your VSCode.
<img src="https://dev-to-uploads.s3.amazonaws.com/i/xxbh52tzvnmjqdgjojd3.png">

Congrats!! 🥳  You have successfully connected your remote server to VSCode. Now you can start working on those files you want.

If it didn't connect, don't despair, it will output some messages in the VSCode debug console. From there, you can see what's wrong.


Please leave your questions and comments below. I will be happy to answer them.
Nevertheless, Angelfirenze Coded
Tags: wecoded
Published: 2020-03-09 17:20:49

---
title: Nevertheless, Angelfirenze Coded 
published: true
tags: shecoded
---
<!-- ✨This template is only meant to get your ideas going, so please feel free to write your own title & narrative! ✨ -->

## Equality in tech looks like the first episode of Blackish that I ever saw.  Before people started ramming all their opinions and biases onto the show and its characters, I remember thinking 'This is something I would have written'.  

I can't remember the name of the episode, but the constant infringing upon other people's personal space and the complete obliviousness of the dude trying to befriend Dre was absolutely hilarious.

For me, this sort of thing happens online CONSTANTLY, which is why I bring it up.

I've had to apologize and retract posts on Livejournal and other places in the world so often I can't keep count.  I have had to learn what others' boundaries are, which is still an ongoing project, but when I look back to even a couple of years ago, much less high school, the difference is very stark.

Equality in tech is being able to study from both male and female tutors, which is always great.  My idea of it isn't having a woman or a man sitting in front of a team of the opposite gender.  

To me, it's having samples of every race, religion, cis, trans, gay, straight, asexual, aromantic, romantic, demisexual employees and superiors alike and having them work together in a harmonious workflow that is free from strife most of the time.

## I’m an expert at…research and Git, though I'm always finding more to learn, like from @TimBerglund; I'm also an expert at pronouncing medical jargon, which is just fun research into infectious disease (the specialty, not a singular mention of a singular disease) that I did way back in high school, for example.  

When I start watching a show like DaVinci's Demons or Mr. Robot, I seem to research it to death and then get kind of annoyed because they can't mention it all, even in passing...which is me kind of paraphrasing [the character] Leo's words about the lack of memories he has of his mother.  Anyway.

## My advice for allies to support self-identifying women and non-binary folks who code is...start with something simple -- don't go jumping off the deep end because you'll find you've come to a halt rather quickly.  Always search for the easiest way forward because you will be glad you got to the harder stuff without all the confusion.

<!-- Once your post is published, it will not appear on the /t/shecoded page until an admin approves it. This is an extra step to ensure there is no abuse on this important tag. -->
How do you decide to read an article on dev.to?
Tags: discuss
Published: 2020-03-09 17:15:51

It is no doubt that dev.to is a great platform for one to share their learning and inspire others to learn. If you have been reading articles here, how do you decide if you want to read an article posted by an author?

For example, there might be 10 articles on the same subject covered by 10 different authors. What will you do?

1. Do you end up reading all 10 articles from 10 different authors?
2. Do you read an article which gets displayed in your dev.to feed?
3. Do you read an article which is published by an author whom you follow?
4. Do you end up reading an article which has got most number of comments and interactions from the community?
5. Do you end up reading an article which gets featured in email from Dev Team - " 6 more must-reads"?


Share your thoughts on what is important to you before reading an article?
Year of ARM64 on the desktop
Tags: linux, arm64, porting, go
Published: 2020-03-09 17:14:04

After getting [my first exposure](https://www.honeycomb.io/blog/observations-on-arm64-awss-amazon-ec2-m6g-instances/) to aarch64/ARMv8/ARM64 at work the past few weeks, I'm curious to not just use it in the cloud, but also under my desk! We are cross-compiling from AMD64 to create ARM64 binaries for use in a subset of our canary environment, but it's started feeling weird to me that I cannot locally test my changes before they go out to production.

So, yesterday I ordered a [Honeycomb LX2K Mini-ITX board](https://www.solid-run.com/nxp-lx2160a-family/honeycomb-workstation/), no relation to my employer [honeycomb.io](honeycomb.io), and I'll have it up and running ~~sometime next week~~in May due to lack of stock! This post will be updated with my build and findings! and [I've written up the install instructions](https://dev.to/lizthegrey/first-experiences-with-honeycomb-lx2k-26be)

Part list (with the help of [/r/sffpc](https://www.reddit.com/r/sffpc/)):

* Lone Industries L5 case
* Minibox 160 XT PSU
* Radeon Pro WX 3200 half-height GPU
* Honeycomb LX2K Mini-ITX board
* ~~Any old DDR4 RAM~~ G.SKILL Ripjaws Series 16GB (2 x 8GB) 260-Pin DDR4 SO-DIMM
* 512GB M.2 SSD

I'm excited to try:

* Native builds of Debian/Ubuntu packages, with my own GPG keys available
* [Wine Hangover for x86_64 games](https://github.com/AndreRH/hangover)
* Seeing if I can get Zoom, Chrome, etc. to work given they're built for ChromeOS aarch64 which is Linux under the hood
Auto Layout, Constraints & Stack Views Overview
Tags: swift, constraints, autolayout, stackviews
Published: 2020-03-09 16:59:21

I was taking an in depth look at Auto Layout, constraints and stack views. 

Auto Layout is a tool used to build adaptive user interfaces. With Auto Layout, you can set up rules or constraints to define how views will be laid out. Auto Layout should be used by developers when making applications to make their app responsive. 
For example, to ensure the display is centered, horizontal and vertical constraints, best thought of as rules, should be set. 

Stack views, keeps views arranged either vertically or horizontally. Once this is done, constraints can be set up on the stack view to make it centered. The proper use of these will facilitate the adaptability of your app, as far as how it is viewed, to every device.
Announcing my upcoming Gatsby book
Tags: javascript, gatsby, netlify, books
Published: 2020-03-09 16:45:10

I recently built a site using Gatsby and Netlify CMS. I am working on adapting that experience into my very first book, "Using Gatsby and Netlify CMS", that I am publishing on Leanpub.

Writing the book has been hard but fun, and I'm looking forward to finishing it!

If you're interested, you can sign up to be notified when the book is completed here: https://leanpub.com/using-gatsby-and-netlify-cms

Also, if you have any suggestions for topics I should cover in the book, please let me know! I want this book to be as helpful as possible.
Delayed function execution in setInterval()
Tags: javascript
Published: 2020-03-09 04:25:29

##Introduction
This article is about delayed execution for a function that we can have in setInterval.

We all know, if we want to execute a function or run a task after certain interval of time then we can schedule a call. This can be done in two ways:

1. *setTimeout* which allows us to run a function once after the interval of time.
2. *setInterval* which allows us to run a function repeatedly, starting after the interval of time, then repeating continuously at that interval.

Here, we will look into how we can delay a function execution in setInterval() and see how it behaves.

###setInterval
The setInterval method has the same syntax as setTimeout:
```javascript
let timerId = setInterval(func|code, [delay], [arg1], [arg2], ...)
```

All arguments have the same meaning. But unlike setTimeout it runs the function not only once, but regularly after the given interval of time.

Let us consider this snippet:
```javascript
let i = 1;
function test(value){
 console.log("received value is : ",value);
}
setInterval(function() {
  test(i++);
}, 2000);
```
Observe the output:
```javascript
//Output:
received value is :  1
received value is :  2
received value is :  3  and so on...
```
It prints the message after 2 seconds continuously.

It is possible that execution of test function turns out to be longer than we expected and takes more than 2000ms.

### what will happen in such case?

```javascript
let i = 1;
function test(value){
  setTimeout(function(){
    console.log("received value is : ",value)
  },5000);
}

setInterval(function(){
 test(i++)
},2000);
```
I am adding a setTimeout() with a delay of 5000ms which exceeds the interval specified in setInterval().

If you notice the output in your browser console, you would notice the output
```javascript
received value is :  1
```
after a delay of 7000ms.

And then you could see the following in an interval of 2000ms
received value is :  2
received value is :  3
received value is :  4

In this case the engine waits for test function to complete, then checks the scheduler and if the time is up, runs it again immediately.

#####In the edge case, if the function always executes longer than delay ms, then the calls will happen without a pause at all.

Such a case might appear while making an API call inside the function/callback mentioned in setTimeinterval().

Yeah that's about delay in setInterval. Hope this was helpful.

Cheers !!!
I have a infinite loading Dev.To index on my Android app.. why?
Tags: help, android
Published: 2020-03-09 16:00:25

A few days ago I began to notice that the Dev.To Index in my Android app does not fully load, it stays there forever. I even checked that I had internet at a good speed. If I leave my account everything goes normal, I already uninstalled it several times and it does the same. Does anyone have any idea?

![Broken Dev.To Index](https://i.ibb.co/XszVCP5/Screenshot-20200309-110347.jpg)
This Dot Labs Announces Free Training Courses for Developers
Tags: training
Published: 2020-03-09 18:17:44

---
title: This Dot Labs Announces Free Training Courses for Developers
published: true
date: 2020-03-09 16:00:07 UTC
tags: training 
canonical_url: https://www.thisdot.co/blog/this-dot-labs-announces-free-training-courses-for-developers
---

Today, This Dot Labs is proud to announce the release of a collection of free training video resources for developers.

The first batch of this growing library includes five courses on contemporary web development subjects, all taught by working software engineers.

Topics include:

![Creating an Enterprise Angular Application (2) (1)](//images.ctfassets.net/zojzzdop0fzx/3b6wuKWQxA9Csf5BmzJQ1v/acbd0594e51521bfb45f2eee5fa6be00/Creating_an_Enterprise_Angular_Application__2___1_.png)
[“Creating an Enterprise Angular Application”](https://labs.thisdot.co/resources/CreatingAnEnterpriseAngularApplication) by Pato Vargas

![Google Cloud Functions and Firebase Scaling your apps for your needs (1)](//images.ctfassets.net/zojzzdop0fzx/3Z1BifBuZbEn2CqUUKmfuU/1f3ced1a0660c5e5ce2bf433609e92a8/Google_Cloud_Functions_and_Firebase__Scaling_your_apps_for_your_needs__1_.png)
[“Google Cloud Functions and Firebase: Scaling your apps for your needs”](https://labs.thisdot.co/resources/googlecloudfunctionsandfirebase) by Katerina Skroumpelou 

![Authenticating Angular Applications using Auth0](http://images.ctfassets.net/zojzzdop0fzx/4qS1D48KoYA9RZZPBopO6o/4ad1305215ba0b9d7bfc094c2bc6e201/Authenticating_Angular_Applications_using_Auth0__1_.png)[“Authenticating Angular Applications using Auth0”](https://labs.thisdot.co/resources/AuthenticatingAngularApplicationsusingAuth0) by Frederik Prijck

![Introduction to Machine Learning](http://images.ctfassets.net/zojzzdop0fzx/6VDnSXYgA48mINyyPhvF6k/7d47a5dee46967edf9764d9af9357ea9/Introduction_to_Machine_Learning__1_.png)[“Introduction to Machine Learning”](https://labs.thisdot.co/resources/IntroductionToMachineLearning) by Tracy King

![Unit Testing NGRX](http://images.ctfassets.net/zojzzdop0fzx/3pLYNwBsQWTNb4p6yD6NK0/7e00d605d13ce17e83315ea6372a9019/Unit_Testing_NGRX__1_.png)[“Unit Testing NGRX”](https://labs.thisdot.co/resources/UnitTestingNGRX) by Frederik Prijck

_This Dot is a company which focuses on keeping developers up to date with advancements in the web platform and providing teams with web platform expertise, using methods such as mentoring and training._