BC FOR LATER READ
Saved by @CodyyyGardner

#Learn365 Day-6: Cross-Site Leaks

Goldmine to Learn: https://t.co/TsqGRWxPq7

Cross-Site Leaks/XS-Leaks is a less explored security issue that usually comes from Side-Channel Attacks. I found this an interesting vector but unusual.

(1/n)

#BugBountyTips #infosec #AppSec

 (2/n)
This basically utilizes the web's core principle of composability in order to determine & extract useful information.

XS-Leaks take advantage of small pieces of information that are exposed during interactions between websites.
(3/n)
Cross-Site Oracle.

This can be considered as a querying mechanism. The information used for this attack is of binary form and called Oracles. It usually has an answer of "Yes" or "No". You can say True or False.
(4/n)
For Example: Does User Harsh Exists in the Application. Yes, means that the user is there in the application.
- An attacker requires to smartly form queries in order to successfully execute this attack and gain hold of sensitive information.
(5/n)
Some of the Attacks using Cross-Site leaks are:

1. XS-Search: An attacker try to abuse the query mechanism such as search functionality to leak and get hold of the user's information.

Remediation
- Same Site Lax Cookies
(6/n)
Usual Exploitation Workflow:

1. Define a timeline when there is a Hit vs Miss
2. Start attacking the Querying Endpoint.
3. For Example: ?search=h (Throws a Hit)
search for the next word appended to `h` i.e. ?search=ha otherwise change the word i.e. ?search=b
(7/n)
2. Error Events

Based on the Error Message returned by the application, it may be possible to enumerate sensitive information. This is similar to user enumeration techniques.

Reference: https://t.co/2iIVT0xei2
(8/n)
3. Frame Counting
The window.length provides the number of frames in the window. This attribute can provide valuable information about a page to an attacker.

References: https://t.co/XjOZL3yiZF
(9/n)
3. Navigation Attacks
Reference: https://t.co/lS3LT80Foa

4. Cache Probing
- Workes based on detecting whether the web page was cached or not.
Ref: https://t.co/ejAdOHaIFG

5. ID Attribute
Ref: https://t.co/11lwLzE2DD
(10/n)

6. Post Message Broadcasts
a. Sharing Sensitive message with untrusted origins
b. Leaking information based on varying content or on the presence of a broadcast

7. Abusing Browser Features
- CORB (Cross-Origin Read Blocking)
- CORP (Cross-Origin Resource Policy)
(n/n)

8. Timing Attacks
- Clock Based
- Network Timing
- Execution Timing
- Hybrid Timing
- Connection Pool

# Referneces
1. https://t.co/byryqh3bql
2. https://t.co/khunvHYDga
3. https://t.co/ssQ39okO55

I'll revisit this attack in near future & will try to find.

More from For later read

Roland Baker
Roland Baker
@RolandBakerIII
Moderna's mRNA-1273 & Pfizer's BNT162b2 consist of mRNA 3821 nucleotides long encoding *all* 1273 amino acids of the Spike including a 2 Proline-stabilized RBD. This is a plain English Description of the code:
https://t.co/w7koHyMJjL

The article mentions a “10 nucleotide linker” (GCAUAUGACU) in the poly-A tail. This is described in the patent link below (Modification of RNA, producing an increased transcript stability and translation

Here is a link to the full mRNA code if you wish to download it, blast it or make up a batch in your garage


An overview of the encoded spike


Initial mouse
FOR LATER READ
Vigilant AFA
Vigilant AFA
@AfaVigilant
One fascist to watch in 2021 is Joseph Charles "Oakman" Golinske of SE MI. He's been a Proud Boy for a couple years, but took a break recently from the group and promotes himself through the "Oak Nation" channel on Telegram.


Most people may be familiar with him as the tall guy in the Proud Boys bridge shot, from their August 17, 2019 attack on Portland, which featured an American Guard bus trying (and failing) to bludgeon antifascists with hammers.


He was also with his g/f at the time (Dominique Tota, left of Tarrio), and that's definitely a twitter account folks will want to block/report because he posts on it.


He's been plenty active at the pro-Covid/anti-mask/ReOpen protests in Lansing MI, seen here with Jerry Wayne and an effigy of Gretchen Whitmer, who his militia friends tried to kidnap and publicly execute.


Outside of the Proud Boys, his solo "career" with Oak Nation features the same misogyny, classism and gateway to far-right domestic terrorism the Proud Boys themselves feature. Here's him peddling oxychlorinque and bragging about harassing service workers.
FOR LATER READ
Advertisement
IAM...BROWNING
IAM...BROWNING
@VVission123
You wanna know the real reason WHY the "Old Guard" (Evil Powers that once ruled this world) wanted all of you dumbed down?
Your brains are supposed to work like mine does. You All are supposed to be able to see into the future etc. They poison all of you with foods that keep

you asleep.
Certain Daily products that all of you use like toothpaste,Deodorant,soaps etc do harm to you without you even knowing that harm is being done. Those who don't know these things are just so used to being the way they are and think it's all "Normal" when it's really

not. Your minds are designed for so much more and they know/knew this. THEY want all of you dumbed to so you just fall in line to what they say. They want you to follow all the latest Trends, They want you to follow the "Stars". Most of the stars advertise products but I

guarantee you that they themselves don't use 90% of what they are advertising on the market today.
They are being used as puppets, thinking all of you will just follow them blindly falling into all the traps they have had set out for you ALL THESE YEARS..

Look at Portland for

example, They are legalizing all recreational drugs. Allowing Young adults who's brains aren't fully developed to just poison themselves. What happens in 5-10-15 years from now? Our entire youth is poisoned more than they already are? All our adults that the children look up too
FOR LATER READ
Daniel Finn
Daniel Finn
@DanFinn95
Some familiar figures are pushing the absurd and defamatory claim that Ken Loach supports Holocaust denial. The story of this bogus talking-point, which relies upon multiple layers of falsehood and guilt-by-association, makes for a revealing case-study. 1/

It dates back to the 2017 Labour conference. In a NYT op-ed, Howard Jacobson claimed that “a motion to question the truth of the Holocaust was proposed” from the conference floor—a crude fabrication, which the NYT sanctioned in its pages. 2/


If you follow the link supplied by Jacobson or his editors, you’ll see that he was wrong on 3 counts: it wasn’t a motion, it wasn’t at the conference, and it wasn’t in favour of Holocaust denial. Quite the hat-trick! 3/

At a fringe meeting, granted no official status by Labour, an Israeli-Jewish speaker, Miko Peled, had said that he didn’t think Holocaust denial should be a criminal offense (which it is in some European countries). 4/

This is a perfectly reasonable position to hold—that opinions, no matter how wrong-headed or morally objectionable, should not be a matter for the criminal law—and of course it does not mean that Peled himself questions the truth of the Holocaust. 5/
FOR LATER READ
Scott Hechinger
Scott Hechinger
@ScottHech
Every single public defender. Every single day.


Bail arguments, motions, oral arguments, hearings. Judges don’t know, follow, or care about the law. Prosecutors are willing to take advantage of it. And mandatory minimums, withheld evidence, & pretrial detention coerces people to plead before trial. When theres a jury. A shot.

But defenders still fight. And still win. Most times wins aren’t “Justice.” It’s power of repetition of argument in front of same judges. Introducing those in power to the people they oppress. Not just a RAP sheet or words on a page. Defenders make it harder to be brutal & cruel.

I worked as a public defender at an office as well resourced as any in the country. Social workers, team of investigators, a reentry team, support staff, specialist attorneys in immigration, housing, education, family. Relatively low caseloads (80-100). And yet still injustice.

Most think that balancing the scales of justice means more funding for defenders. Thats part of it. Enough a attorneys to actually be at bail hearings. Wrap around services to be able to help people trapped in the system end up better off in their communities. Lower caseloads.
FOR LATER READ

You May Also Like

Andrew Chen
Andrew Chen
@andrewchen
👇 Thread. New deck getting published this week: "Consumer startups are awesome, and here's what I'm looking to invest in at Andreessen Horowitz." If you want to read it, subscribe to my newsletter here: https://t.co/262t8eh0wf


1/ A lot of new consumer technologies have been introduced to US households in the last 100 years. But it's taken many of them - like the telephone - more than 50 years to get to the majority of the US. Why is that?


2/ We had to literally teach people how to use phone. Which end goes to your mouth, which goes to your ear. Say "hello" when people call. The motivation of consumers to talk to their friends has always been there, but we had to teach the behavior


3/ If you compare phones to the latest technologies, there's been a huge shift. Things are being picked up much faster.


4/ Even while there's been all this innovation recently, physically speaking, we are still the same human beings from 100,000 years ago.
STARTUPS
\u092c\u094d\u0930\u093e\u0939\u094d\u092e\u0923\u094b\u0902 \u0915\u093e \u0907\u0924\u093f\u0939\u093e\u0938\U0001f441\ufe0f\U0001f441\ufe0f
ब्राह्मणों का इतिहास👁️...
@BRAHMIN_0052
MOHIYAL_BRAHMIN_KING
RAJA_PORUS
King_Porus_History

1)King Porus was a famous Indian king, his real name was #Purushotama. He belonged to PURU tribe mentioned in #RIG_VEDA, the Ancient books of India.


2) Porus ruled the Punjab region and expanded his kingdom between the Jhelum River and Chenab River in the Indian Subcontinent. He was a legendary warrior and more war skills. He made the army most powerful with war skills. Even Alexander had also made difficulty to defeat Porus.

3)Word of Mouth Oral tradition in #Mohyal_Brahmin families since ancient times has kept the Great Saga of their Great Elder known to them as Maharaja “ #Puru” alive.

4) When #Alexander the Great invaded India in 326 BC he was challenged near Taxila by a mere chieftain of the Area. He was King #Porus, a #Vaid_Mohyal. After his encounter with Porus, Alexander met with more resistance near Multan where the forces were predominantly #Mohyal.

5)The Bali rulers of Multan fiercely engaged with Alexander's army in skirmishes in which many senior Generals died. Later during the long and bitter fighting in #Multan, Alexander got hurt by an arrow which pierced his chest ,
RELIGION
Advertisement
KrishnaLeela
KrishnaLeela
@Talesofkrishna
🌿𝑻𝒉𝒆 𝒔𝒕𝒐𝒓𝒚 𝒐𝒇 𝒂 𝑺𝒕𝒂𝒓 : 𝑫𝒉𝒓𝒖𝒗𝒂 & 𝑽𝒊𝒔𝒉𝒏𝒖

Once upon a time there was a Raja named Uttānapāda born of Svayambhuva Manu,1st man on earth.He had 2 beautiful wives - Suniti & Suruchi & two sons were born of them Dhruva & Uttama respectively.
#talesofkrishna https://t.co/E85MTPkF9W


Now Suniti was the daughter of a tribal chief while Suruchi was the daughter of a rich king. Hence Suruchi was always favored the most by Raja while Suniti was ignored. But while Suniti was gentle & kind hearted by nature Suruchi was venomous inside.
#KrishnaLeela


The story is of a time when ideally the eldest son of the king becomes the heir to the throne. Hence the sinhasan of the Raja belonged to Dhruva.This is why Suruchi who was the 2nd wife nourished poison in her heart for Dhruva as she knew her son will never get the throne.


One day when Dhruva was just 5 years old he went on to sit on his father's lap. Suruchi, the jealous queen, got enraged and shoved him away from Raja as she never wanted Raja to shower Dhruva with his fatherly affection.


Dhruva protested questioning his step mother "why can't i sit on my own father's lap?" A furious Suruchi berated him saying "only God can allow him that privilege. Go ask him"
RELIGION
STEALTH JEFF
STEALTH JEFF
@drawandstrike
THIS.

Russia hasn't been a willing partner in this treaty for almost 3 decades. We should have ended the pretense long ago.

Naturally, Rand Paul is telling anyone who will listen to him that Trump is making a HUGE MISTAKE here.


Rand is just like his dad, Ron. 100% isolationist.

They've never grasped that 100% isolationist is not 'America First' when you examine it. It really means 'America Alone'.

The consistent grousing of pursuing military alliances with allies - like Trump is doing now with Saudi Arabia.

So of course Rand has also spent the last 2 days loudly calling for Trump to kill the arms deal with Saudi Arabia and end our alliance with them.

What Obama was engineering with his foreign policy was de facto isolationism: pull all the troops out of the ME, abandon the region to Iranian control as a client state of Russia.

Obama wasn't building an alliance with Iran; he was facilitating abandoning the ME to Iran.

Obama wouldn't even leave behind a token security force, so of course what happened was the rise of ISIS. He also pumped billions of dollars into the Iranian coffers, which the Mullah's used to fund destabilizing activity [wars/terrorism] & criminal enterprises all over the globe
ALL
Quinn Cummings
Quinn Cummings
@quinncy
Gather round, Gentle Readers. It is time I tell the story of the worst decision I ever made in an office. Some of you have heard this. Some have not. Whatever you do in your office today, this week, the rest of this year, you can console yourself by recalling this tale.

A long time ago, I was a talent agent. I worked for a woman named Susan Smith, who had her own small boutique agency. She was known for three things:

1. She had fantastic taste in clients. If there is someone you admire, odds are good that at some point, she was their agent,

2. She could negotiate a deal like few who have ever trod the earth. Casting would give her all the money they had budgeted for that part, plus a little more, plus promising to get her dog Barnaby groomed. She was magnificent to watch.

3. She was insane.

I'm sure you're thinking, "Quinn, it's the entertainment industry, they are all insane." Yes, many are. So consider this; if you told someone you worked for Susan, people who worked for insane people would look and you and whisper, "I hear she's insane."
LIFE