From a6a75b643b362cb5cffe50330f1f6b636366f4b8 Mon Sep 17 00:00:00 2001 From: Tait Hoyem Date: Tue, 18 Aug 2020 23:05:10 +0000 Subject: [PATCH] Gunicorn post --- 2020-04-27-quiz-your-friends-xss.md | 81 ++++++++++++ _data/proffedu.yml | 6 + _data/projects.yml | 3 - _includes/links.md | 17 +++ _posts/2020-08-18-django-deployment.md | 122 ++++++++++++++++++ _sass/main.scss | 9 ++ _site/2020/08/16/django-deployment.html | 163 ++++++++++++++++++++++++ _site/assets/css/style.css | 2 + _site/assets/css/style.css.map | 4 +- _site/blog/index.html | 12 ++ _site/feed.xml | 140 +++++++++++++++++--- _site/sitemap.xml | 4 + about/index.md | 52 ++++++++ contact/index.md | 7 + resume/index.md | 7 + 15 files changed, 606 insertions(+), 23 deletions(-) create mode 100644 2020-04-27-quiz-your-friends-xss.md create mode 100644 _data/proffedu.yml create mode 100644 _includes/links.md create mode 100644 _posts/2020-08-18-django-deployment.md create mode 100644 _site/2020/08/16/django-deployment.html create mode 100644 about/index.md create mode 100644 contact/index.md diff --git a/2020-04-27-quiz-your-friends-xss.md b/2020-04-27-quiz-your-friends-xss.md new file mode 100644 index 0000000..b06f20c --- /dev/null +++ b/2020-04-27-quiz-your-friends-xss.md @@ -0,0 +1,81 @@ +--- +title: "The \"Quiz Your Friends\" XSS Exploit" +layout: post +--- + +## TODO write intro + +## How I Found This Exploit + +While filling in one of my friend's surveys I thought it would be +funny for them to know it is me without anyone else knowing. +We were young and had `Inspect Element`ed a few things together, +so it was a safe bet that an HTML joke would let them know. + +So I typed in my name like so: + +`BOLD_STEVE.JPG` + +Now in theory this should have shown in in the leaderboard as: "<b>Bold Steve</b>" +However, to my horror and excitement, I saw this in the leaderboard: + +`BOLD_STEVE_LEADERBOARD.JPG` + +The text "Bold Steve" showed up **in bold** on the leaderboard. +This told me all I needed to know. To add a `