teleren/devto huggingface dataset:
Hacker101 CTF - BugDB v2
Tags: codenewbie, security, ctf, hackerone
Published: 2020-03-13 23:23:34

- CTF Name: BugDB v2
- Resource: Hacker101 CTF
- Difficulty: Easy
- Number of Flags: 1

Note::: NO, I won't be posting my found FLAGS, but I will be posting the methods I used. 

<hr>



### Flag0
- Hint: 
 1. What has changed since last version?
 2. What do the queries tell you?
 3. Have you tried a mutation?
- Acquired By: 
 - This starts out the same a v1 so I first wanted to just poke around again and see if the same queries would work. The final script from the last challenge didn't work but working backwards from the errors I did get some information to show.![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/k2o25rscw1bqphv5mamv.png) This allowed me to see that there was an "admin" and "victim" user but how to exploit this?
 - Now I wanted to play with the Bugs reports as I am guessing that that is where the flag is again. After some relocating of the "allBugs" query I noticed that it was missing a report from the victim. I bet it is set to private so how do I get it? ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/pa0ydgi0s8i22ejo8doh.png)
 - Based on the third hint I need to learn more about GraphQL mutations. Mutations involve its own query where you mutate the Bugs private field. This will involve a mutation function that will change the private field to false and then re-running the previous query to view all the bug texts. ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/swk8vhuea7alprrkyhte.png)



### Thoughts/Learned
I learned a bit more about GraphQL and manipulating them but I have a gap as to the practical application of this. I am venturing to guess that because of the nature of GraphQL to give a LOT of information that it is a matter of manipulating the shown image blindly (or based off a known user) to find information that might be there but not directly viewable, yet.


<hr>

Happy Hacking
![](https://media.giphy.com/media/l3vRmVv5P01I5NDAA/giphy.gif)

###### Please Note that I am still learning and if something that I have stated is incorrect please let me know. I would love to learn more about what I may not understand fully.
Introduction to Http4k
Published: 2020-01-28 11:57:39

---
title: Introduction to Http4k
published: true
date: 2020-01-27 00:00:00 UTC
tags: 
canonical_url: https://amolvyawhare.com/introduction-to-http4
---

Couple of weeks ago, I was looking for very simple way to create web server. I found [http4k](https://www.http4k.org/) which is a lightweight but fully-featured HTTP toolkit written in pure Kotlin that enables the serving and consuming of HTTP services in a functional and consistent way.

#### Some of Features of http4k

- small, written in functional kotlin with zero dependencies.
- very simple, no magic, no reflections.
- immutable http model, which make it very easy to test/debug.
- serverless / server independent

## WebServer as Function

http4k is designed as application as function. Web server can be looked as one big function which handles requests.so it’s literally represented as typealias

```kotlin 
typealias HttpHandler = (HttpRequest) -> HttpResponse
```

An endpoint which echos request body can be created just by 2 simple lines.

```kotlin
val app: HttpHandler = { 
    request: Request -> Response(OK).body(request.body) 
}
val server = app.asServer(SunHttp(8000)).start()
```

Request and Response are immutable objects. SunHttp is container which only meant for development. For production use Netty, Jetty, ApacheServer etc.Because `app` is just kotlin function, it can be composed very easily.

## Filters

http4k provides a Filter function which is basically intercept the Request/Response pipeline and

```kotlin
typealias Filter = (HttpHandler) -> HttpHandler
```

Below code snippet shows typical composition of HttpHandlers.

```kotlin
val setContentType = Filter { nextHandler -> 
        { request -> nextHandler(request)
            .header("Content-Type", "text/plain")
        }
    }

val composedApp = setContentType.then(app)
```

## Routing and composition

http4k provides some high level functions which helps to compose application which handles each request differently depending upon url, method etc. These functions accepts multiple httpHandlers and return one handler which is composed of them.

```kotlin
val app : HttpHandler = routes(
    "/api" bind GET to apiApp
    "/other" bind routes(
        "/get" bind GET to {_:Request -> Response(OK)}
        "/post" bind POST to otherPostHandlerFn
    )
) 
```

## Conclusion

http4k really stands with the promises they made. API from http4 are written very thoughtfully and are not opinionated. They are easy to reason and work with. Only downside can be no support for coroutine.

To know more about http4k rationale visit [http4k/rationale](https://www.http4k.org/rationale/)

> PS: This is my very first post. For correction please raise pull request at [gitlab](https://gitlab.com/amolrv/amolrv.gitlab.io).
Pushing Left, Like a Boss
Published: 2020-03-13 23:06:56

---
title: Pushing Left, Like a Boss
published: true
description: With incident response and penetration testing currently receiving most of our application security dollars, it would appear that industry has decided to treat the symptom instead of the disease.  “Pushing left” refers to starting security earlier in the SDLC; addressing the problem throughout the process.  From scanning your code with a vulnerability scanner to red team exercises, developer education programs and bug bounties, this talk will show you how to ‘push left', like a boss.
tags: 
---

As promised in [my newsletter](https://newsletter.shehackspurpleca), I did a stream of my talk **'Pushing Left, Like a Boss'** today. The cut video is available now [on YouTube](https://youtu.be/Q5Nt8VhXg-0).

![Many thanks.](https://dev-to-uploads.s3.amazonaws.com/i/agi7ofpmlomhh0z1mo1g.png)

Talk Description:
With incident response and penetration testing currently receiving most of our application security dollars, it would appear that industry has decided to treat the symptom instead of the disease.  “Pushing left” refers to starting security earlier in the SDLC; addressing the problem throughout the process.  From scanning your code with a vulnerability scanner to red team exercises, developer education programs and bug bounties, this talk will show you how to ‘push left', like a boss.

---
**For this and more, check out my book, [Alice and Bob Learn Application Security](https://aliceandboblearn.com/) and my online training academy, [We Hack Purple](https://academy.wehackpurple.com)!**
---
Keycloak (Red Hat Single Sign On) Walkthrough Demo
Tags: opensource, oauth, oidc, jwt
Published: 2020-03-13 23:06:02

In this [demo](https://github.com/vinicius-martinez/rhsso-walkthrough), we're trying to showcase a step-by-step Walkthrough demo guide covering basic capabilities from [Red Hat Single Sign ON](https://access.redhat.com/products/red-hat-single-sign-on). You won't need to install anything since we're providing docker images for both [Red Hat SSO 7.3](https://hub.docker.com/repository/docker/viniciusmartinez/rhsso73) and [SSO Console App](https://hub.docker.com/repository/docker/viniciusmartinez/sso-console-app) to facilitate the learning experience.

The following features will be covered:

1. Starting RHSSO and JS Console App
2. Create RHSSO Realm
3. Create RHSSO Client APP
4. Create RHSSO Roles
5. Create RHSSO User
6. Enable SignUp
7. Change Themes
8. User Required Actions
9. Social Login
10. Two Factor with OTP
11. End User Account Management

Suggestions/feedbacks are much welcome!

Best regards
Hacker101 CTF - BugDB v1
Tags: codenewbie, security, ctf, hackerone
Published: 2020-03-13 22:53:33

- CTF Name: BugDB v1
- Resource: Hacker101 CTF
- Difficulty: Easy
- Number of Flags: 1

Note::: NO, I won't be posting my found FLAGS, but I will be posting the methods I used. 

<hr>




### Flag0
- Hint: 
 1. What can you see? What can you not see?
 2. What data types are involved?
 3. Have you tried querying different endpoints?
- Acquired By: 
 - This was a big odd of a hint so I started out just looking at the super blank page and looking at its code.![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/86pjkgy95f8iux42vsow.png)
 - Now that I've looked over it all I will poke around at the GraphQL tool that it is. ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/xz3anna20wem39q8zgax.png)
 - With this CTF the left side of the page is the query and the right side is the output. This required knowing what queries GraphQL will accept soooo let's try some things. ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/tk5otik2qua36jit11ta.png)![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/4tktp35w4m1tkpwgcay1.png)
 - Now I need to find the specific pattern to get alllllll of the information. Time to try some more things![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/1ptl0q8o76iya0e2f4hn.png)
 - After some research and adding lots of things to the query I was able to get all the information to show up. ![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/qm5kt1fivn282tel29a5.png)If you look in the bugs of the second node ID there is a "text" field that has the flag.![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/brg53dgsfauzdj1ta17g.png)



### Thoughts/Learned
I have not played around with graphQL much so this was an interesting CTF to get me to research it more. I am looking forward to the second on and seeing how this will change.
I don't _really_ know what I learned outside of more about GraphQL as this environment was set up for this. 


<hr>

Happy Hacking
![](https://media.giphy.com/media/l3vRmVv5P01I5NDAA/giphy.gif)

###### Please Note that I am still learning and if something that I have stated is incorrect please let me know. I would love to learn more about what I may not understand fully.
How You can Fight Corona
Tags: life, watercooler
Published: 2020-03-13 22:27:57

---
title: How You can Fight Corona
published: true
description: 
tags: #life, #discuss, #watercooler
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/tokkhapimintfpt11yck.jpg
---

I live in Istanbul (Turkey), a very crowded city that I am afraid the virus is already all around and just nobody is reporting any case.

Every single day, the amount of people using masks in public is just increasing and this just reflects the amount of increasing fear 😨

Just 2 cases have been confirmed positive here, and directly you see this happening:

![Empty-Shelves](https://dev-to-uploads.s3.amazonaws.com/i/sups6req4e1j2nzyjg2n.jpg)
*source: cumhuriyet.com.tr*

## Mild

This is the main problem of the outbreak... yes, you heard that right: the majority of the Corona cases are mild!

You might say that the virus being mild is a good thing... not quite actually, **people with mild or no symptoms are travelling around and spreading the virus to a level that it became pandemic.**

The problem gets even worse when every country is hiding the actual numbers fearing that it will affect the economy 😕

## Things Getting Ugly

Let's look at the numbers:

* The mortality rate initial estimate by the World Health Organization (WHO) is 2%
* The world population is 7.7 billion which is 7,700,000,000
* Suppose that 30% of the world population gets infected that is 2,31 billion people or 2,310,000,000
* Now with 2% mortality rate, **it means that 46 million people or 46,200,000 are gonna be dead by this virus!**

Now I think you can see why you shouldn't treat this virus as the seasonal flu, and remember that loved ones might be included within these numbers.

{% youtube H62nidxxWA8 %}

## What Developers Can Do

Here are stuff you can do:

* **Engage with any contribution to find a cure using DataScience/AI.**
* Adopt remote working culture in your company/organization.
* Encourage and help people from other industries to adopt remote working culture.

I hope there was some better data than the [2019 Wuhan Coronavirus data in this link](https://github.com/globalcitizen/2019-wuhan-coronavirus-data), because that would let everyone contribute...

I am sure with the right set of data and AI techniques we would be able to answer to questions like:

* What characteristics make kids less than 10 years old not being affected by this virus?
* What characteristics make some people get recovered and some others dead?

Actually, what human beings need now is not a fancy dashboard to track the virus, we need a fu**** cure!
JavaScript - Array Execution Speed
Tags: javascript, typescript, tutorial, beginners
Published: 2020-03-13 21:32:33

Did you ever wonder about execution speed of JavaScript arrays? Neither do I. So let's find out what is going on when using different approaches for array creation.

To create an array in JavaScript we can use array literal like this:

```javascript
let testArray = [1, 2, 3];
```
or we can use the keyword `new` like this:

```javascript
let testArray = new Array(1, 2, 3);
```

The two examples above do exactly the same, create new array with values. But what is the difference, which approach we should use and why?

To find out let's test the first snippet [here](https://repl.it/@bogi7/Array1).

After each code execution I refreshed the page
and results varied between `~93ms` and `~99ms`.

So, let's do the same with second code snippet [here](https://repl.it/@bogi7/Array2).

For some reason, results variations are more common, so I had results from `~1500ms` to even `~7500ms`.

So, the outcome of this simple post is kinda obvious:

**For simplicity, readability and execution speed, use the first one (the array literal method)**.

Thanks for reading!
A Simple Rule for Better Variable Naming
Tags: architecture, refactoring
Published: 2020-03-13 21:13:15

Variable naming is simultaneously one of the most trivial and complex aspects of writing code. Variables names are largely irrelevant to the computer running your code after it's been compiled, but they can make a world of difference for a human who has to read and maintain code.

There's a few general rules of thumb:
* Keep names as short and simple as possible while still being descriptive
* Follow naming conventions of the system you're coding in

But in addition, here's a more concrete one I've found to be a helpful guideline:

> Make booleans affirmative

Think about the following line of code:

```
var disabled = true;
```

There's nothing inherently unreadable about that line of code, but when it comes time to use it, we probably are thinking about whether something is enabled and have to invert it. As complexity builds up, this mental flipping can take a toll on comprehensibility of your code.

```
if (!disabled) {
  doStuff();
}
```

Instead, we can rename `disabled` to `enabled` and reason about it without needing to mentally invert it.

```
if (enabled) {
  doStuff();
}
```

This way, we're using true to represent an "on" state and false to represent an "off" state which is considerably more natural to read. Although this seems trivial, it can have a big impact on overall readability of code. If you're not convinced yet, think back to the worst multiple choice test you've ever taken. The question probably looked something like this:

> Which of the following is not true?
> 
> a) two plus two is not three
> b) two minus two is not one
> c) two divided by two is not one
> d) two times two is not five

If you're like me, your internal dialog just went something like "So if it's not not true then that means... wait..." as you try to flip the logic in your head.

By writing it as an affirmative question, it becomes much easier to comprehend:

> Which of the following is true?
>
> a) two plus two is three
> b) two minus two is one
> c) two divided by two is one
> d) two times two is five

Although these two representations are logically equivalent, it's much more human friendly. Just flipping a few logical statements in your head takes a noticeable toll even when the underlying logic is simple. When the underlying logic becomes complex, it can make it completely unintelligible.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/phap5nnq8ndtsefuv2oe.jpg)

Although there's no rule without exceptions, checking to make sure you're not flipping your bits is always a good thing to have in the back of your mind. It's often a simple refactor and can make for much more straightforward code.
What I have been doing and What would you like to learn from it?
Published: 2020-03-13 20:45:37

Hello Readers,

![Air Patrol](https://dev-to-uploads.s3.amazonaws.com/i/iptkijr1y7gr9qhjhctd.jpg)

Long time, Been busy with a personal project becoming a company. In short, I am making an Air Quality Monitor and Purifier connected to the Cloud.

The Following Skills I have worked and achieved;

- ESP32 Using Arduino and ESP-IDF
- PCB Design Using Eagle
- Autodesk Fusion 360 Enclosure Design
- Arduino to AWS Cloud
- Docker Containerization Using AWS ECS for Stateless Service
- Angular Dashboarding
- Ionic Framework Mobile App Android and IOS
- AWS Elastic Beanstalk NodeJS
- MariaDB DB and Redis Memory Storage

was wondering what would you guys be interested in, thinking about sharing what I have done and how.
What Did you Learn this week --March 13?
Tags: todayilearned, discuss
Published: 2020-03-13 20:37:49

---
title: What Did you Learn this week --March 13?
cover_image: https://res.cloudinary.com/practicaldev/image/fetch/s--_6fMlgC4--/c_imagga_scale,f_auto,fl_progressive,h_420,q_auto,w_1000/https://dev-to-uploads.s3.amazonaws.com/i/dceqdvz7zxa6wvnw19al.png
tags: todayilearned, discuss
series: this-week-i-learned
---
Help with Google Sheets Script for Parsing JavaScript Objects
Tags: javascript, googlesheets, help
Published: 2020-03-13 20:08:41

I have thousands of rows of data in a Google Sheets File in a column that looks something like 
```
[{"amountMax":49.99,"amountMin":49.99,"availability":"true","color":"Brown","currency":"USD","dateSeen":["2019-04-11T08:00:00Z"],"isSale":"false","offer":"Online only","sourceURLs":["https://www.walmart.com/ip/SadoTech-Model-CXR-Wireless-Doorbell-1-Remote-Button-2-Plugin-Receivers-Operating-500-feet-Range-50-Chimes-Batteries-Required-Receivers-Beige-Fixed-C/463989633"]}]
```

I would like to be able to return the max value, the currency, the color attributes. How can I do that in Google Sheets. Ideally would like to do something like being able to retrieve the data attributes how I would normally in javascript like in this link here https://repl.it/@alexhoy/WetSlateblueDribbleware

However this does not seem to work for me when creating a function in script.google.com

For example, here is a slugify function which takes an input (cell) and turns it into a slug/handle without the need for looping. In Google Sheets I can then call =slugify(b2) and turn that value into slug form
```
/**
* Converts value to slug
* @customfunction
*/
function slugify(value) {
  /*
   * Convert the the vs in a range of cells into slugs.
   * @customfunction
   */
  let slug = '';

  slug = value.substring(0, 100).toLowerCase();
  slug = slug.replace(/[^\w\s-]/g, '');
  slug = slug.replace(/\s+/g, '-');
  Logger.log(slug);

  return slug;
}

```

I want to do the same thing without looping to parse the object data above or declaring a range of values and what not.

Any suggestions on how I can do this in a simple way like shown above without the need for declaring active spreadsheet, range values and looping.
Mini Solutions Series #1: Broken Media Queries
Tags: chrome, responsive, css, design
Published: 2020-03-13 19:43:53

*This is the first installment of what I intend to be a collection of short summaries of the solutions that I found to some bug in my code. I want to document some of these solutions for my own sanity (so I can remember challenges that I've overcome in the past) and in the hopes that someone googling for their answer in the future will find their own solution more quickly this way. I'm also going to try writing out a variety of the ways that I think I or another programmer might phrase their searches.*

##BUG: 

"media queries not working on device toolbar" or "responsive breaks not working in chrome dev tools" or "chrome dev tools devices not changing with media queries" or "why media queries no effect in chrome tools"

##Detailed Description: 

I designed a website (desktop first instead of [mobile first](https://designshack.net/articles/mobile/mobilefirst/), bad habit) and started adding media queries for responsive design. When I resized the screen in the developer tools I saw my changes (small header, fewer grid columns, etc), but when I clicked on the "Toggle Device Toolbar" button to use Chrome's built in devices, none of my responsive design was reflected.

###Experiments:

First, I re-read about media queries, and remembered to add "only screen" after the "@media" bit, and I got excited because I thought that would fix it...but it didn't. No change.

![fail](https://media2.giphy.com/media/nKN7E76a27Uek/giphy.gif?cid=790b76116667df982aa9eb92805324a2aaf48f8612078f7b&rid=giphy.gif)

Second, I added a big ugly border to the header under 'max-width: 599px', and determined for certain that I wasn't crazy, because the header just wasn't showing up on the mobile views.

##Solution:

[Quick answer](https://stackoverflow.com/questions/26888751/chrome-device-mode-emulation-media-queries-not-working). 

###Thorough Explanation:

{% youtube ykgQosTbeSQ %}

##Takeaway:

I ran into this problem because I never really understood why that meta tag is in most boilerplate HTML. __Now I understand a little better, and will probably remember if something like this happens again.__ I ran into the problem because I made a local copy of one of a [CodePen](https://codepen.io/gunderodd/pen/GVKgRg) of mine and forgot to include that tag. 

So, 
```
content="width=device-width..."
```
 is the line that fixed my problem.
Code Line Daily widget
Tags: codepen, showdev, beginners
Published: 2020-03-13 19:41:10

Here's a Code Line Daily widget: a component that displays a line of code of the day.

{% codepen https://codepen.io/CiTA/pen/eYNMvOa %}

Here's how I built it.

- Get data from [localStorage]: 

```js
const cldData = localStorage.getItem('cldData');
```

- Parse data if available: 

```js
const parsedData = cldData && JSON.parse(cldData);
```

- If parsed data available, call function for building HTML code:

```js
if(cldData) {
  buildCLD(parsedData);
}

const buildCLD = (data) => {
  $ide.innerHTML = `<div class="ide__inner">
  <div class="ide__header">
    <p><a href="https://cld.silvestar.codes/line/${data.date}/">${data.date}.${ext(data.language)}</a></p>
  </div>
  <div class="ide__body">
    <p class="ide__line">...</p>
    <p class="ide__line">${data.line}</p>
    <p class="ide__line">...</p>
  </div>
  <div class="ide__footer">
    <p>Author: ${data.author}</p>
    <p>${data.language}</p>
    <p><a href="${data.link}">Details</a></p>
  </div>
</div>
<div class="ide__details">
  <p>What does this line do? </p>
  <p>${data.note}</p>
</div>`;
}
```
 
- If no data from localStorage available, call function for fetching new data from [Code Line Daily], outputting HTML code and saving data to localStorage: 

```js
if(!cldData) {
  getCLD(); 
}

const getCLD = () => {
  fetch('https://cld.silvestar.codes/api/get-random-line')
    .then((response) => {
      return response.json();  
    })
    .then((data) => {
      buildCLD(data);
      localStorage.setItem('cldData', JSON.stringify(data));
    });
}
```

-  Add function for clearing the localStorage and fetching fresh data from [Code Line Daily API]:

```js
$reset.addEventListener('click', () => {
  localStorage.removeItem('cldData');
  getCLD();
});
```

Why localStorage part, you ask? Because I am trying to save you and me some bandwidth. :)

P.S. The widget is now visible on my homepage: [https://www.silvestar.codes](https://www.silvestar.codes). 

[localStorage]: https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage
[Code Line Daily]: https://cld.silvestar.codes/
[Code Line Daily API]: https://github.com/maliMirkec/code-line-daily#api