Liran Tal lirantal

On Runpod with latest PyTorch image (2.4.0) with a GPU > 32GB VRAM (e.g. NVIDIA A100 80GB PCIe).

ssh in and:

apt update -y
apt install -y nano screen git
pip install git+https://github.com/huggingface/trl.git accelerate transformers datasets peft wandb tqdm ninja flash-attn

Important

Run with deno run --allow-run=deno main.ts (this allows us to run deno instead of node in scripts, but prevents any other nefarious scripts)

With NPM

npm run start

> [email protected] start
> node evil.js

Chat GPT "DAN" (and other "Jailbreaks")

CVE-2022-23812

RIAEvangelist/node-ipc is malware / protestware

The RIAEvangelist/node-ipc module contains protestware peacenotwar.

Excerpt from RIAEvangelist/node-ipc:

as of v11.0.0 & v9.2.2 this module uses the peacenotwar module.

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

A TL;DR solution to Security Driven by @terjanq

For this year's Google CTF, I prepared a challenge that is based on a real-world vulnerability. The challenge wasn't solved by any team during the competition so here is the proof that the challenge was in fact solvable! :)

Link to the challenge: https://capturetheflag.withgoogle.com/challenges/web-security-driven
Link to the PoC: https://github.com/google/google-ctf/tree/master/2021/quals/web-security-driven/solution

The goal of the challenge was to send a malicious file to the admin and leak their file with a flag. The ID of the file was embedded into the challenge description (/file?id=133711377731) and only admin had access to it, because the file was private.

Disclamer: The write-up is written on airplane therefore the quality of it is poor, mostly to showcase the required steps to solve the challenge

Learn Go in ~5mins

This is inspired by A half-hour to learn Rust and Zig in 30 minutes.

Basics

Your first Go program as a classical "Hello World" is pretty simple:

First we create a workspace for our project:

	[V1]

	You are a powerful agentic AI coding assistant, powered by [Claude 3.7 Sonnet]. You operate exclusively in Cursor, the world's best IDE.

	Your main goal is to follow the USER's instructions at each message.

	# Additional context
	Each time the USER sends a message, we may automatically attach some information about their current state, such as what files they have open, where their cursor is, recently viewed files, edit history in their session so far, linter errors, and more.
	Some information may be summarized or truncated.
	This information may or may not be relevant to the coding task, it is up for you to decide.

	(() => {
	let gadgets = [];

	if (typeof _satellite !== 'undefined') {
	gadgets.push('Adobe Dynamic Tag Management');
	}

	if (typeof BOOMR !== 'undefined') {
	gadgets.push('Akamai Boomerang');
	}

 {
   "token": "[token]",
   "job": "notifySlack",
   "ref": "refs/pull/4/merge",
   "sha": "[shad]",
   "repository": "colbyfayock/demo-github-actions",
   "repository_owner": "colbyfayock",
   "repositoryUrl": "git://github.com/colbyfayock/demo-github-actions.git",
   "run_id": 120667610,
   "run_number": "2",