關於 how to be like a hacker ，我們在網路上蒐集到這些相關的討論、資訊與評價

++++🔥 ความปลอดภัยกับการโค้ดดิ่ง 🔥+++
การเขียนหน้าเว็บ ที่มีแบบฟอร์มให้กดอัพโหลดไฟล์
...พอกด upload
...ไฟล์นั้นจะถูกนำไปวางบน server ปั๊บ
.
ถ้าเราเขียนโค้ดฝั่ง server ไม่ระมัดระวัง ตัวละก็ ...ฮึๆๆๆ
ก็จะมีรูรั่ว เมื่อhacker เห็น
ก็จะยิ้มหน้าบานเป็นจานดาวเทียม
เขาสามารถโจมตีช่องโหว่ได้ไม่ยากเย็นอะไรนัก
.
ซึ่งจะขอยกตัวอย่างภาษา PHP มาเป็นกรณีศึกษาแล้วกัน
:
😉 สำหรับวิธีโจมตีนี้
อาศัยความง่ายของ php ที่แค่วางไฟล์บน server ในทันใด
เราก็สามารถเรียกไฟล์นั้น ผ่าน url ให้ทำงานได้เลย ในทันที
...ดูง่ายมั๊ยละ!!!!!
.
*** หมายเหตุ แต่ถ้าเป็นภาษาโปรแกรมมิ่งบางภาษา
ที่เข้มงวดความปลอดภัย
การโจมตีแบบนี้จะยาก
เพราะโปรแกรมเมอร์ต้อง config ไฟล์สคริปต์ก่อน
สคริปต์นั้นถึงจะประมวลผลได้
:
:
แต่ในโพสต์นี้จะขอยกตัวอย่างโค้ด PHP ที่มีช่องโหว่นะครับ
ก็ตามรูปที่โพสต์ จะประกอบไปด้วย
:
1) หน้าฟอร์ม HTML (index.html) เอาไว้ให้อัพโหลดไฟล์ (ฝั่ง browser)
2) เมื่อ user กดอัพโหลดไฟล์ ...ไฟล์นั้นจะถูกส่งไปยัง server
3) ฝั่ง server จะใช้ภาษา PHP ง่ายๆ (upload.php) รับไฟล์ที่ส่งเข้ามา แล้วนำไปวางไว้ที่โฟล์เดอร์ใดที่หนึ่งในเครื่อง เช่น uploads
:
😱 ซึ่งการเขียนโค้ดที่ง่ายเกิ๊นไปเช่นนี้
จะเป็นช่องโหว่ให้ hacker
สามารถอัพโหลดไฟล์อันตรายขึ้นไปวางบน server ได้ชิวๆๆ
:
🤔 ดังนั้นเราต้องป้องกันการโจมตีด้วยวิธีนี้ อาทิ
- ต้องเข้มงวดเรื่องนามสกุลไฟล์ว่า ไฟล์ชนิดอะไรที่ห้าม upload (เช่น .php ห้ามทำเด็ดขาด)
- หรือจะใช้ API หรือไลบรารี่ ทำการเชคไฟล์ให้ดีๆ ว่ามีชนิดถูกต้อง
- เชค contet-type ใน header request
- จำกัดขนาดไฟล์ รวมทั้งตรวจสอบชื่อไฟล์ดีๆ
- ไดเรคทอรี่ที่จะอัพโหลดไฟล์ขึ้นไปวาง ควรไม่มีสิทธิในการรันสคริปต์ใดๆ
- ฝั่ง server ควรติดตั้งซอฟต์แวร์ scanner เอาไว้สแกนหาไฟล์แปลกปลอมของ hacker ที่หลอกเข้ามาฝั่งตัว
- ในหน้าฟอร์ม (HTML) เปลี่ยนวิธีส่ง request จากเดิม ที่ใช้ put หรือ get ให้หันมาใช้วิธี post แทน
- และวิธีการอื่นๆ ที่ไม่ได้กล่าวถึง

+++++++++++++++
เขียนโดย โปรแกรมเมอร์ไทย thai programmer
รักกันก็กระทืบ like ชังกันอย่าด่าเยอะมันเจ็บ
.
รายละเอียดเพิ่มเติม
https://www.defensecode.com/…/web_vul…/form-file-upload.html
.
++++ ++++ Safety with the code 🔥 +++
Writing pages with forms to upload files
... Poke upload
... That file will be put on a pump server
.
If we write server side code, I'm not careful. I'm not careful. Haha.
There will be a leak when hacker sees it
I'll smile on my face as a satellite dish
He can attack the loophole. It's not that difficult.
.
Which one would like to sample PHP language as a case study.
:
😉 for how to attack this
Live the simplicity of php that just puts a file on server instantly.
We can call that file through url to work instantly.
... How easy is it!!!!!
.
*** note but if it's some programming language
Safety strictly
This kind of attack will be hard.
Because the programmer has to config the script file first.
That script is processed.
:
:
But in this post, I will give you an example of a PHP code that has a loophole.
As photos posted will include.
:
1) HTML (index. html) to upload file (browser side)
2) When user presses upload file... that file will be sent to server.
3) server side will use PHP language simply (upload. php) Receive the file sent in and put it on a folder of any of the devices such as uploads.
:
😱 Which one of these simple code writing goes like this?
Gonna be a loophole for hacker
Can upload a dangerous file to place on server. Chilling.
:
🤔 So we need to prevent attack this way. This week.
- Must be strict on file extensions. What type of file that cannot upload (e.g.. php don't do it.)
- or use API or Library to check your file correctly.
- contet-type shake in header request
- limit file size and check good file name
- Directory to upload file over to lay should not have any script running rights.
- server side should install scanner software to scan for foreign file of hacker who has tricked into his side.
- In the form (HTML), change the way to send request from the original put or get, turn to the post method instead.
- And other ways not mentioned

+++++++++++++++
Written by Thai programmer thai coder
If you love each other, stomp like each other. Don't scold too much. It hurts.
.
More details.
https://www.defensecode.com/public/web_vulns/form-file-upload.html
.Translated

[7 ways to acquire your first 1,000 users - pt.1]

Last time I wrote about a common early stage startup’s acquisition dilemma - “optimizing an acquisition channel v.s finding a new acquisition channel.” This time I'm going to dive into different ways of finding new acquisition channels.

Having one method work for your startup doesn’t mean you should disqualify the others, but it also doesn’t mean that every method will work for your startup either. It’s about testing and finding the right channel fit for your business.
Essentially every major consumer app acquired their early users using these methods, including Netflix, Instagram, Uber, Tinder, TikTok, and many more.

1. Find your users, offline
Once you identify who your target users could be, go find them in real life and get them to try your product! If they are not interested in what you have made, your product either doesn’t solve their problem or you have got the wrong target users.
To kickstart Uber’s growth in new cities, they often went to airports and downloaded the Uber app for taxi drivers and handed out coupons to riders. Tinder’s co-founder ran around college campuses handing out flyers and pitched to fraternities. Identifying your target user is important, if you know where they would conjugate, you want to be there too.
2. Find your users, online
Your target user could conjugate online too, and if they do, find them, and get them to them try your product! The same rule applies here, if the online users are not interested in what you have made, iterate on the product or the target users. Dropbox did exactly this, launching on Hacker News with only a video, even without a functional product.
You want to infiltrate your target user’s community, fit in, use their language, and even befriend them. The advantage in interacting with users online is that you have the option to remain anonymous, but the disadvantage is that gaining their trust could take a longer period of time, but this is exactly how Netflix launched their product across America, slowing turning pockets of online movie enthusiast and cinephiles into Netflix users.
3. Invite your friends to kickstart a positive network effect
To successfully launch a product through your own network you need to leverage referral programs. Products which works well with this method generates value for its users by acquiring more users, thus creating incentive for both the inviter and invitee. Reid Hoffman launched LinkedIn into his network of founders and entrepreneurs, marking the platform really attractive for job seekers, thus creating a positive network effect which attracts more employers, which then again attracts more employees.

Two takeaways that are fundamental in getting your first 1,000 users is to “do things that don’t scale” and to narrowly define your target users. By doing both, you validate your product's problem/solution fit and product/market fit.

I’ll cover the other 4 methods of acquiring your first 1,000 users in my next post, but in the meantime, if you got some value out of this post, please like and share!

Lastly, if you are a founder working on a startup in SEA, or working with AI / blockchain, apply to AppWorks Accelerator #21 to join the largest founder community in Greater Southeast Asia today >>> https://bit.ly/2NcjYGV
---
by Jack An
Analyst, AppWorks

Image credit: Lenny Rachitsky

📜 [專欄新文章] Reason Why You Should Use EIP1167 Proxy Contract. (With Tutorial)
✍️ Ping Chen
📥 歡迎投稿： https://medium.com/taipei-ethereum-meetup #徵技術分享文 #使用心得 #教學文 #medium

EIP1167 minimal proxy contract is a standardized, gas-efficient way to deploy a bunch of contract clones from a factory.

1. Who may consider using EIP1167

For some DApp that are creating clones of a contract for its users, a “factory pattern” is usually introduced. Users simply interact with the factory to get a copy. For example, Gnosis Multisig Wallet has a factory. So, instead of copy-and-paste the source code to Remix, compile, key in some parameters, and deploy it by yourself, you can just ask the factory to create a wallet for you since the contract code has already been on-chain.

The problem is: we need standalone contract instances for each user, but then we’ll have many copies of the same bytecode on the blockchain, which seems redundant. Take multisig wallet as an example, different multisig wallet instances have separate addresses to receive assets and store the wallet’s owners’ addresses, but they can share the same program logic by referring to the same library. We call them ‘proxy contracts’.

One of the most famous proxy contract users is Uniswap. It also has a factory pattern to create exchanges for each ERC20 tokens. Different from Gnosis Multisig, Uniswap only has one exchange instance that contains full bytecode as the program logic, and the remainders are all proxies. So, when you go to Etherscan to check out the code, you’ll see a short bytecode, which is unlikely an implementation of an exchange.

0x3660006000376110006000366000732157a7894439191e520825fe9399ab8655e0f7085af41558576110006000f3

What it does is blindly relay every incoming transaction to the reference contract 0x2157a7894439191e520825fe9399ab8655e0f708by delegatecall.
Every proxy is a 100% replica of that contract but serving for different tokens.

The length of the creation code of Uniswap exchange implementation is 12468 bytes. A proxy contract, however, has only 46 bytes, which is much more gas efficient. So, if your DApp is in a scenario of creating copies of a contract, no matter for each user, each token, or what else, you may consider using proxy contracts to save gas.

2. Why use EIP1167

According to the proposal, EIP is a “minimal proxy contract”. It is currently the known shortest(in bytecode) and lowest gas consumption overhead implementation of proxy contract. Though most ERCs are protocols or interfaces, EIP1167 is the “best practice” of a proxy contract. It uses some EVM black magic to optimize performance.

EIP1167 not only minimizes length, but it is also literally a “minimal” proxy that does nothing but proxying. It minimizes trust. Unlike other upgradable proxy contracts that rely on the honesty of their administrator (who can change the implementation), address in EIP1167 is hardcoded in bytecode and remain unchangeable.

That brings convenience to the community.

Etherscan automatically displays code for EIP1167 proxies.

When you see an EIP1167 proxy, you can definitely regard it as the contract that it points to. For instance, if Etherscan finds a contract meets the format of EIP1167, and the reference implementation’s code has been published, it will automatically use that code for the proxy contract. Unfortunately, non-standard EIP1167 proxies like Uniswap will not benefit from this kind of network effect.

3. How to upgrade a contract to EIP1167 compatible

*Please read all the steps before use, otherwise there might have problems.

A. Build a clone factory

For Vyper, there’s a function create_with_code_of(address)that creates a proxy and returns its address. For Solidity, you may find a reference implementation here.

function createClone(address target) internal returns (address result){ bytes20 targetBytes = bytes20(target); assembly { let clone := mload(0x40) mstore(clone, 0x3d602d80600a3d3981f3363d3d373d3d3d363d73000000000000000000000000) mstore(add(clone, 0x14), targetBytes) mstore(add(clone, 0x28), 0x5af43d82803e903d91602b57fd5bf30000000000000000000000000000000000) result := create(0, clone, 0x37) }}

You can either deploy the implementation contract first or deploy it with the factory’s constructor. I’ll suggest the former, so you can optimize it with higher runs.

contract WalletFactory is CloneFactory { address Template = "0xc0ffee"; function createWallet() external returns (address newWallet) { newWallet = createClone(Template); }}

B. Replace constructor with initializer

When it comes to a contract, there are two kinds of code: creation code and runtime code. Runtime code is the actual business logic stored in the contract’s code slot. Creation code, on the other hand, is runtime code plus an initialization process. When you compile a solidity source code, the output bytecode you get is creation code. And the permanent bytecode you can find on the blockchain is runtime code.

For EIP1167 proxies, we say it ‘clones’ a contract. It actually clones a contract’s runtime code. But if the contract that it is cloning has a constructor, the clone is not 100% precise. So, we need to slightly modify our implementation contract. Replace the constructor with an ‘initializer’, which is part of the permanent code but can only be called once.

// constructorconstructor(address _owner) external { owner = _owner;}// initializerfunction set(address _owner) external { require(owner == address(0)); owner = _owner;}

Mind that initializer is not a constructor, so theoretically it can be called multiple times. You need to maintain the edge case by yourself. Take the code above as an example, when the contract is initialized, the owner must never be set to 0, or anyone can modify it.

C. Don’t assign value outside a function

As mentioned, a creation code contains runtime code and initialization process. A so-called “initialization process” is not only a constructor but also all the variable assignments outside a function. If an EIP1167 proxy points to a contract that assigns value outside a function, it will again have different behavior. We need to remove them.

There are two approaches to solve this problem. The first one is to turn all the variables that need to be assigned to constant. By doing so, they are no longer a variable written in the contract’s storage, but a constant value that hardcoded everywhere it is used.

bytes32 public constant symbol = "4441490000000000000000000000000000000000000000000000000000000000";uint256 public constant decimals = 18;

Second, if you really want to assign a non-constant variable while initializing, then just add it to the initializer.

mapping(address => bool) public isOwner;uint public dailyWithdrawLimit;uint public signaturesRequired;

function set(address[] _owner, uint limit, uint required) external { require(dailyWithdrawLimit == 0 && signaturesRequired == 0); dailyWithdrawLimit = limit; signaturesRequired = required; //DO SOMETHING ELSE}

Our ultimate goal is to eliminate the difference between runtime code and creation code, so EIP1167 proxy can 100% imitate its implementation.

D. Put them all together

A proxy contract pattern splits the deployment process into two. But the factory can combine two steps into one, so users won’t feel different.

contract multisigWallet { //wallet interfaces function set(address[] owners, uint required, uint limit) external;}contract walletFactory is cloneFactory { address constant template = "0xdeadbeef"; function create(address[] owners, uint required, uint limit) external returns (address) { address wallet = createClone(template); multisigWallet(wallet).set(owners, required, limit); return wallet; }}

Since both the factory and the clone/proxy has exactly the same interface, no modification is required for all the existing DApp, webpage, and tools, just enjoy the benefit of proxy contracts!

4. Drawbacks

Though proxy contract can lower the storage fee of deploying multiple clones, it will slightly increase the gas cost of each operation in the future due to the usage of delegatecall. So, if the contract is not so long(in bytes), and you expect it’ll be called millions of times, it’ll eventually be more efficient to not use EIP1167 proxies.

In addition, proxy pattern also introduces a different attack vector to the system. For EIP1167 proxies, trust is minimized since the address they point to is hardcoded in bytecode. But, if the reference contract is not permanent, some problems may happen.

You might ever hear of parity multisig wallet hack. There are multiple proxies(not EIP1167) that refer to the same implementation. However, the wallet has a self-destruct function, which empties both the storage and the code of a contract. Unfortunately, there was a bug in Parity wallet’s access control and someone accidentally gained the ownership of the original implementation. That did not directly steal assets from other parity wallets, but then the hacker deleted the original implementation, making all the remaining wallets a shell without functionality, and lock assets in it forever.

https://cointelegraph.com/news/parity-multisig-wallet-hacked-or-how-come

Conclusion

In brief, the proxy factory pattern helps you to deploy a bunch of contract clones with a considerably lower gas cost. EIP1167 defines a bytecode format standard for minimal proxy and it is supported by Etherscan.

To upgrade a contract to EIP1167 compatible, you have to remove both constructor and variable assignment outside a function. So that runtime code will contain all business logic that proxies may need.

Here’s a use case of EIP1167 proxy contract: create adapters for ERC1155 tokens to support ERC20 interface.

pelith/erc-1155-adapter

References

https://eips.ethereum.org/EIPS/eip-1167
https://blog.openzeppelin.com/on-the-parity-wallet-multisig-hack-405a8c12e8f7/

Donation:
pingchen.eth
0xc1F9BB72216E5ecDc97e248F65E14df1fE46600a

Reason Why You Should Use EIP1167 Proxy Contract. (With Tutorial) was originally published in Taipei Ethereum Meetup on Medium, where people are continuing the conversation by highlighting and responding to this story.

👏 歡迎轉載分享鼓掌

I thought my last original I wrote was personal... this one is much personal and detailed.. Tell me what you think and stay tuned for more compositions and covers :)

LYRICS:

I'm walking on this road
I don't know where to go
I lost my heart, I lost my soul

Oh God do I deserve
To live on, to walk on this Earth
My efforts only made things worse

Damn it was never like this in the past
I was at my prime, I was at my best
Then it started changing, the tables started turning
When I chose to have you
Girl, so mesmerising
Just like a dream then I woke up sad, I was crying
Why did it end, what did I do?
All I wanted was for you
To be a princess from within
Eventually you'll be my queen

Oh hoo hoo hoo hoo
Nobody really knows how much I tried
You're supposed to be my lady, but look what you have made me
I'm just a bad guy
Oh hoo hoo hoo hoo
You make me feel like I just wanna die
Don't you ever, say you hurt more, you're a liar
But I'm just a bad guy now
In everybody eyes

I gave my all to you
There was nothing I won't do
I guess back then I was a fool

Not only you kept things from me
You made yourself look good, for everyone to see
And now your friends think you're a celebrity

You played it well with your ex
Why were you tryna' hide those messages
Were you having sex with him?
And yes, I referring to my hacker
Who hacked the minister and got caught with his own brother
On the top of his apartment
Was where you tryna' threaten me, just because I question
Why he gave you a kiss?
And why you cutting your wrists?
You hit me one more time and I'll be very pissed now

Oh hoo hoo hoo hoo
Nobody really knows how much I tried
You're supposed to be my lady, but look what you have made me
I'm just a bad guy
Oh hoo hoo hoo hoo
You make me feel like I just wanna die
Don't you ever, say you hurt more, you're a liar
But I'm just a bad guy now
In everybody eyes

I'mm not tryna' bring back the past
But these people, they keep judging till today
But I guess I'll say

Oh hoo hoo hoo hoo
Nobody really knows how much I tried
You're supposed to be my lady, but look what you have made me
I'm just a bad guy
Oh hoo hoo hoo hoo
You make me feel like I just wanna die
Don't you ever, say you hurt more, you're a liar
But I'm just a bad guy now


TWITTER: @RidhwanAzman
INSTAGRAM: @ridhwannabe
BLOG: ridhwannabe.blogspot.com
CONTACT: ridhwannabe@hotmail.com

Facebook fan page: www.facebook.com/henleyhii
WeChat official account ID: henley_hii
Weibo: henley许亮宇

一向来创作demo 多以英文填词的他，这次跟公司反映他想坚持最原版的歌词，主题围绕在Love is in the air; 因为这是他内心最浪漫的一面想要表达的部分；此次追求创作上的突破，Henley 化身爱情绅士浪漫演绎爵式风，同样包办词曲、制作，卸下摇滚奔放骇客包袱，展现内敛柔情的一面，深情演绎这首"见证爱情主打歌"- Time Is Love，定下更成熟、优雅的形象。

TIME IS LOVE

词 /曲 / 制作：许亮宇
编 ：李乃刚

I live my whole life to wait
For the moment you would say I Do
I live my whole life to see
There's no one like you
If this is true
I wanna spend my life together with you
To tell you how i felt for you
Do you feel the same just like i do

I LOVE U
I DO
I need to be true to you
If I'm in a dream
Then I'll pray this moment would be still
If you let me then I'll prove to you that
Time Is Love

If this is true
I wanna spend my life together with you
To tell you how i felt for you
Do you feel the same just like i do

I LOVE U
I DO
I need to be true to you
If I'm in a dream
Then I'll pray this moment would be still
If you let me then I'll prove to you that
I'll always let you know it's true
I hope you'll feel the same way too that
Time Is Love

Please like www.facebook.com/henleyhii for more details
WeChat official account ID: henley_hii
Weibo: henley许亮宇

TIME IS LOVE

词 ：许亮宇
曲 ：许亮宇
编 ：李乃刚
制作：许亮宇


I live my whole life to wait
For the moment you would say I Do
I live my whole life to see
There's no one like you
If this is true
I wanna spend my life together with you
To tell you how i felt for you
Do you feel the same just like i do

I LOVE U
I DO
I need to be true to you
If I'm in a dream
Then I'll pray this moment would be still
If you let me then I'll prove to you that
Time Is Love

If this is true
I wanna spend my life together with you
To tell you how i felt for you
Do you feel the same just like i do

I LOVE U
I DO
I need to be true to you
If I'm in a dream
Then I'll pray this moment would be still
If you let me then I'll prove to you that
I'll always let you know it's true
I hope you'll feel the same way too that
Time Is Love