[The Life List]

same for a man too

Ice doesn't cool your water, the water heats up your ice (second law of thermodynamics in which the total entropy of an isolated system can never decrease over time)

The average of millionaires age in the US is 57. It is quite doable to achieve that if we hustle hard and put in the work. We don't have to urge stuffs if we are seeking a long term success. Especially if your 20s is a race to the millionaires club, it is highly possible that might not work. Wealth comes from experience and wisdom. The longer you are in the game, the more you know how to play it. If your plan of becoming millionaire in your 20s is working out, well, that's good; but be cautious not to go bankrupt and build up your financial understandings. For the rest of us, let us not caught up and get distracted by aesthetics that last shorter. Eyes should be on the plan with a proper execution of actions. You might trip over but that's when you level up.

Lots of hot takes on his recent uploads. John Hammond even commented on one of his vid. But take everything with a grain of salt.

Run, Forrest, Run!

Sometimes the secrets you have held in your heart are harder to hide than you thought

March Recap

March was kinda chaotic and beautiful at the same time. Probably the longest one yet. Well, to kick off, got two of my phones stolen last month. On the flip side, I got the time to read many technical books and some of them were a real gem. Speaking of, there is a chance you might make a change on your career direction by just reading technical books. I want to venture in various books if I will get to have a spare time. Overall, March was nice, and made me realise lots of stuffs. Oh, I saw a camel too lol

The Forthcoming April

Kinda pausing all my cybersec activities for 7 weeks. It's hard for me, and I am pretty aware that will cost me so much. But, my schedule is really tight and I have to sort out a lot of stuffs. I was even thinking to get a mic and start streaming or YouTube content since it's really rare to find Ethiopian cybersec content creators on YouTube. I guess I am gonna leave the streaming for next year. When I'm back to my usual activities, we will rock it.

Ernest Hemingway once wrote, 'The world is a fine place and worth fighting for.' I agree with the second part.

[Seven]

#movie

You start thinkin' about the things you can't forget, and those are the things you can't forgive.

[The Little Things]

#movie

Since I finished mid exam, I was binging. Have a goodnight

lol
Got this achievement on GitHub recently. Literally been a while since I last committed too. Profile readme last updated in 2023 🙂 Lowkey wanted to get back to coding. I mean I do code now too but it's just me slapping some scripts or modifying it to my own need.

Wrote "I saw a camel" in Ocaml

let () = print_endline "I saw a camel"

Speaking of Ocaml, I kinda liked Hyperapp back then for an FP language based on Elm architecture to be used on the Frontend. I guess I made some random task manager inspired by the book I was reading. Zoomie, one of my projects made a longtime ago (opensourced it a year before or so), was also intended to be made with Hyperapp. I don't remember how I ended up using express js. Use this recent blog for a quick tour of Hyperapp if you're interested in functional programming with js.

This was Zoomie, a video chat app built with simple WebRTC and runs on express server. UI built with plain CSS and jQuery (I really sucked at UI)

For my final yapping session, I noticed that Zoomie used handlebars as a templating engine. Lately, I was checking the Server Side Template Injection (SSTI) vulnerability. So... The concept of Server-Side Template Injection (SSTI) was first publicly introduced by PortSwigger researchers in 2015. It is basically when user input is unsafely embedded into server-side templates. These templates are used by web applications to generate dynamic content by combining user data with predefined structures. For example,

Hello {{ username }}

If 'username' contains an expression that's evaluated (say something like {{3*5}}), it will lead to a malicious code execution. Every server side language has its own template engine like for PHP: Smarty, Twig and for Python: Jinja2, Mako and for Java: Freemarker, Velocity. I personally used pug in node js for other projects and handlebars for zoomie. If a site uses a template engine, you can determine its type by running the following payload:

Jinja2 (Python Flask/Django): {{ 7*7 }}  
Freemarker (Java): ${7*7}  
Velocity (Java): #set($a = 7*7)${a}  
Thymeleaf (Java): ${7*7}  
Twig (PHP Symfony): {{ 7*7 }}  
Smarty (PHP): {$7*7}  
Mako (Python): <% print 7*7 %>

The exploitation flow goes like: inject crafted payloads into vulnerable fields, and execute arbitrary commands or access sensitive server data, and then escalate privileges for full server control. Let us say for example the site uses Jinja2. If you get a response by running the identification payload, you can then execute commands like whoami on the server.

{{self._TemplateReference__context.cycler.__init__.__globals__.os.popen('whoami').read()}}

You can basically run commands you want directly on the server. This shit has medium or high severity impact since it leads to RCE and stuff. You can just avoid this by validating the user input at the first place.

can't relate with bros today

feeling drained
unusual on Saturdays.