Discover gists

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

GitHub Search Syntax for Finding API Keys/Secrets/Tokens

As a security professional, it is important to conduct a thorough reconnaissance. With the increasing use of APIs nowadays, it has become paramount to keep access tokens and other API-related secrets secure in order to prevent leaks. However, despite technological advances, human error remains a factor, and many developers still unknowingly hardcode their API secrets into source code and commit them to public repositories. GitHub, being a widely popular platform for public code repositories, may inadvertently host such leaked secrets. To help identify these vulnerabilities, I have created a comprehensive search list using powerful search syntax that enables the search of thousands of leaked keys and secrets in a single search.

Search Syntax:

(path:*.{File_extension1} OR path:*.{File_extension-N}) AND ({Keyname1} OR {Keyname-N}) AND (({Signature/pattern1} OR {Signature/pattern-N}) AND ({PlatformTag1} OR {PlatformTag-N}))

Examples:

**1.

Proxmox

Find the proper driver at the NVidia website.

Note: Make sure to select "Linux 64-bit" as your OS

Hit the "Search" button.

	// Reference: https://www.reddit.com/r/golang/comments/apf6l5/multiple_files_upload_using_gos_standard_library/
	//
	// Original author: https://www.reddit.com/user/teizz
	//
	// handles multiple files being uploaded
	// reads them in blocks of 4K
	// writes them to a temporary file in $TMPDIR
	// calculates and logs the SHA256 sum
	// proceeds to remove the temporary file through a defer statement
	package main

	#include <iostream>
	#include <vector>
	#include <string>
	#include <sstream>

	class Game {
	public:
	std::string title;
	std::string serial;
	std::vector<std::string> distribution_ids;

	class SonyPlayStation {
	constructor() {
	// Predefined list of games with title, serial, and distribution IDs
	this.games = [
	{ title: "Crash Bandicoot", serial: "SCES-00344", distribution_ids: ["711719627623"] },
	{ title: "Crash Bandicoot 2 - Cortex Strikes Back", serial: "SCES-00967", distribution_ids: ["711719699224", "711719699125"] },
	{ title: "Crash Bandicoot 3 - Warped", serial: "SCES-01420", distribution_ids: ["711719758525", "711719758921"] }
	];
	}

	class SonyPlayStation:
	def __init__(self):
	# Predefined game list with title, serial, and distribution IDs
	self.games = [
	{"title": "Crash Bandicoot", "serial": "SCES-00344", "distribution_ids": ["711719627623"]},
	{"title": "Crash Bandicoot 2 - Cortex Strikes Back", "serial": "SCES-00967", "distribution_ids": ["711719699224", "711719699125"]},
	{"title": "Crash Bandicoot 3 - Warped", "serial": "SCES-01420", "distribution_ids": ["711719758525", "711719758921"]}
	]

	def add_game(self, title, serial, distribution_ids):

	/**
	* This is added to your `main.js` file, the one that imports and runs Async Alpine. Make sure that
	* it runs before any `import()` functions by putting as high as possible. That may mean adding it to
	* a static import if your other static imports dynamically import immediately.
	*/
	__webpack_public_path__ = window.assetsPath;

	/**
	* If you want to automatically register all components within a certain directory as async, you can do
	* that with `require.context()` and the fourth param as 'weak'. Add this to your main.js file and

	// Copyright (c) 2021 Pieter Wuille
	// Distributed under the MIT software license, see the accompanying
	// file COPYING or http://www.opensource.org/licenses/mit-license.php.
	// Revised and converted to Javascript by Christopher Scott.

	function bytesToBigInt(bytes) {
	let num = 0n
	for (let i = bytes.length - 1; i >= 0; i--) {
	num = (num * 256n) + BigInt(bytes[i])
	}

	import Control.Monad (ap, forM_)
	import qualified Data.Map as M

	-- The Collapse Monad
	-- ------------------
	-- The Collapse Monad allows collapsing a value with labelled superpositions
	-- into a flat list of superposition-free values. It is like the List Monad,
	-- except that, instead of always doing a cartesian product, it will perform
	-- pairwise merges of distant parts of your program that are "entangled"
	-- under the same label. Examples: