Discover gists

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

hi, i'm daniel. i'm a 15-year-old with some programming experience and i do a little bug hunting in my free time. here's the insane story of how I found a single bug that affected over half of all Fortune 500 companies:

say hello to zendesk

If you've spent some time online, you’ve probably come across Zendesk.

Zendesk is a customer service tool used by some of the world’s top companies. It’s easy to set up: you link it to your company’s support email (like [email protected]), and Zendesk starts managing incoming emails and creating tickets. You can handle these tickets yourself or have a support team do it for you. Zendesk is a billion-dollar company, trusted by big names like Cloudflare.

Personally, I’ve always found it surprising that these massive companies, worth billions, rely on third-party tools like Zendesk instead of building their own in-house ticketing systems.

your weakest link

Each of these commands will run an ad hoc http static server in your current (or specified) directory, available at http://localhost:8000. Use this power wisely.

Discussion on reddit.

Python 2.x

$ python -m SimpleHTTPServer 8000

Micro Editor

https://github.com/zyedidia/micro/blob/master/runtime/help/defaultkeys.md https://github.com/zyedidia/micro/blob/master/runtime/help/commands.md https://github.com/zyedidia/micro/blob/master/runtime/help/keybindings.md

Commands

Ctrl+E to open command panel

	use Doctrine\Common\Collections\ArrayCollection;
	use Doctrine\Common\Collections\Collection;
	use Doctrine\Common\Inflector\Inflector;
	use Doctrine\Common\Persistence\Mapping\AbstractClassMetadataFactory;
	use Doctrine\ORM\EntityManager;
	use Doctrine\ORM\Mapping\ClassMetadata;
	use Doctrine\ORM\Mapping\ClassMetadataInfo;
	use Doctrine\ORM\Mapping\MappingException;
	use Doctrine\ORM\PersistentCollection;
	use Foodity\CoreBundle\Helper\EntityHelper;

	// Provide a uint8array of image data and set MIME type.
	// Bluesky only supports jpg and png at the moment.
	const testUpload = await agent.uploadBlob(testPng, {encoding: "image/png"})

	// The response contains a BlobRef object, which is what
	// agent.post expects.
	const result = await agent.post({
	text: 'Post Text',
	reply: {
	parent: {