Chris Tarquini's blog on technology, security, and personal projects
This is a quick demo of a project I've been working on to bring Spritely Goblins and OCapN to Rust. If aren't familiar with these technologies, you can learn more about them on their respective websites. The 10000 foot view is OCapN is a protocol that allows you to interact with objects remotely. Think of it like a fancy RPC. Some of the star features of OCapN (and it's implementation in Goblins)…
Action Relay gained a few features this week: It can directly run unsigned shortcut files It can compile workflows using cherri-lang This effectively gives us a code mode for shortcuts. Combined with claude code remote control, you get a pretty solid remote assistant for every day tasks. Example Here I'm invoking the newly created /cherri-run skill which will decompose the users requests into…
Flagging Without Feature Flags Every feature flag you ship is a promise you'll clean it up later. You won't. Six months from now that flag is still there serving true to everyone. One fateful day a butterfly flaps its wings and your application fails to load flags, the fallback value is still false. Surprise revert for everybody! Flag cleanup is the tax nobody budgets for. You pay it in cognitive…
One of the things I've always loved about macOS is how friendly it is to automation. Back in the day, I was a serious user of tools like Keyboard Maestro and AppleScript to automate my workflows. These days most new apps favor Shortcuts / AppIntents but the core capability remains: a generally supported way for applications to expose methods and data. When Apple Intelligence was announced, I…
This is first entry in a series I'm calling "Fish of the Week", where I publish a nifty fish function I'm using in my local setup Overview Browse through GitHub releases using an interactive picker and choose a file to install into ~/.local/bin Usage ghinstall owner/repo Dependencies fzf jq GitHub cli Download ghinstall.fish Install curl - L…
Using Cursor from the CLI is a handy way to automate some tasks. For example, I have an script that detects changes since the readme was last updated and uses cursor to determine if any changes need to be made. The one bugbear of mine is that the command just sits there saying nothing until it's complete even with --output-format text . It can stream messages as JSON which is better but hard to…
If you've used Cursor, you've probably heard of the infamous "YOLO Mode". This is a feature that allows the AI agent to execute commands without asking for permission. You can enable for all commands if you're feeling brave but the more cautious of us prefer to whitelist only a subset of commands. I was curious where exactly these settings are stored since they don't appear in any user-editable…
Just over a week ago, I took the plunge and acquired the Apple Vision Pro, a decision that was somewhat spur-of-the-moment. Initially, I, like many others, was utterly captivated by the experience. However, as the days passed, the initial thrill began to diminish—until I encountered Blackbox . This ingenious puzzle game perfectly leverages the hardware, marking the first time I truly grasped the…
Feature flags are decision points in an application that change it's behavior based on context and a set of rules. This is a fun little project that implements Conway's Game of Life using feature flag rules, a raspberry pi, and a neopixel matrix. Surprisingly complex and fascinating behavior emerges from having the cells follow just 3 simple rules Infinite complexity from simple rules The hardware…
A highly public data breach is one of the most commonly realized nightmare scenarios of a compromise. As you can imagine, this is a very stressful experience. But as with many of life's unpleasant surprises, there are lessons to be learned from them. Setting the scene Day 0, 8:00 AM It all starts as just another morning in the office, as incidents often do. You're settling down for the day ahead,…
After reading about NPM Advisory 755 in Mahmoud Gamal's blog post, I decided to poke around a bit and see if there are other ways to trick handlebars into letting us escape the sandbox. Exploit {{! js payload. you can spawn a shell by calling process.binding("spawn_sync") with the correct arguments to bypass not having access to require }} {{# with " console.log(JSON.stringify(process.env,null,…
Background MaxScale is a MySQL proxy developed by MariaDB. Think of it as a MySQL-aware HAProxy. Today we're going to be looking at two of its many filter modules: Database Firewall : Allows you to block queries with a flexible set of rules beyond what the grant system can accomplish Masking : Allows you to return fake/masked data for certain columns (for example, hiding PII from certain clients).…
Here's a neat trick you can use to detect every time Chrome-Dev tools is opened. function onDevToolsOpen ( fn ) { var beacon = new Error ( ) ; Object . defineProperty ( beacon , " message " , { get : fn } ) ; console . log ( " %c " , beacon ) ; } onDevToolsOpen ( function ( ) { document . body . innerHTML += " Detected dev tools open<br /> " ; } ) ; Sometimes you'll get duplicate events but…
In this article, we're going to mitigate tab-nabbing attacks in a cross-browser way that only requires adding a single JS file/function to your application. Tab nabbing an attack where a page linked from the target page is able to rewrite that page, for example to replace it with a phishing site. OWASP First things first, if you aren't familiar with tab-nabbing, I highly reccomend checking out…
VestaCP currently has a bug that allows root privilege escalation using PHP. Background: Even with stats disabled, the following line is found in /home/<user>/conf/web/nginx.conf : include /home/<user>/web/<domain>/stats/auth.conf*; /home/<user>/web/<domain>/stats/ is owned by <user> but isn't writable. Since we own it, we can simply change the permissions so we can put anything we want in there.…
Using a combination of named locations along with the error_page directive, we can make it so nginx automatically serves error pages from a directory structure with support for wildcard/catch-all files. For example the handler for status code 503 will check for /errors/error_503.html /errors/error_50x.html /errors/error_5xx.html /errors/error.html Creating the helper maps First off, we'll need to…
I've been working on a project with rust that requires creating a pseudo-terminal and like many others, I've run into a lot of problems with the functions available to get a pair of master/slave fds for my PTY. openpty int openpty ( int * amaster , int * aslave , char * name , const struct termios * termp , const struct winsize * winp ) ; This function seems like a good fit at first glance but the…
mysqldump is a common utility used to create logical backups of MySQL databases. By default, it generates a .sql file containing the queries to create/drop tables and insert your data. By crafting malicious table name, an attacker can execute arbitrary SQL queries and shell commands if the dump file is imported. If we are still giving cute names to vulnerabilities, my vote is for "Bad Dump". For…
mysqldump is a common utility used to create logical backups of MySQL databases and one of the SST methods used by Galera to bring out-of-sync nodes back into the cluster. Using an evil database name, an attacker can gain remote command execution on all nodes in the cluster or backdoor MySQL backups in a similar attack to my previous post. Of course, this method requires the CREATE DATABASE…
Several guides for integrating everybody's favorite caching plugin for Wordpress with Nginx tell you to include something like this in your nginx configuration: location / { include /var/www/wordpress/nginx.conf; } At the time of writing, this suggestion is currently in the guide ranked #2 for the search terms "w3tc nginx". If you don't know already, generally this conf is writable by W3TC (and…
Although it is documented that the default binary distributions of MySQL/MariaDB/Percona all seem to be compiled with allow local infile enabled, the warning is misleading: The transfer of the file from the client host to the server host is initiated by the MySQL server. In theory, a patched server could be built that would tell the client program to transfer a file of the server's choosing rather…
The Node HTTP Client checks for invalid characters such as new lines that can be used to perform HTTP Smuggling attacks, however, the rules for the path option are quite relaxed . By combining the fact that we can inject new lines and tabs in the path , we can force multiple arbitrary HTTP requests to made. This only works if the target HTTP server has a relaxed HTTP parser that allows tabs…