text:
# Shortcode

Shortcode is a ruby gem for parsing Wordpress style shortcodes, I created it while building a CMS for a client through [my ruby consultancy, Kernow Soul](http://kernowsoul.com). The gem uses a [PEG](http://en.wikipedia.org/wiki/Parsing_expression_grammar) (Parsing Expression Grammar) parser rather than using regular expressions so its easier to understand, test and extend.

[![Gem Version](https://badge.fury.io/rb/shortcode.svg)](http://badge.fury.io/rb/shortcode)
[![Build Status](https://travis-ci.org/kernow/shortcode.png?branch=master)](https://travis-ci.org/kernow/shortcode)
[![Code Climate](https://codeclimate.com/github/kernow/shortcode.png)](https://codeclimate.com/github/kernow/shortcode)
[![Coverage Status](https://coveralls.io/repos/kernow/shortcode/badge.png)](https://coveralls.io/r/kernow/shortcode)

## Installation

Add this line to your application's Gemfile:

```ruby
gem 'shortcode'
```

And then execute:

```
$ bundle
```

Or install it yourself as:

```
$ gem install shortcode
```

Shortcode is tested against ruby version 2.5, and 2.6 as well as jruby (2.x compatible), it is not tested against ruby 2.4 or lower. Shortcode rails integration is tested against
Rails versions 5.1 and 5.2.

## Usage

### Example

Shortcode is very simple to use, simply call the `process` method and pass it a string containing shortcode markup.

You can create multiple instances of `Shortcode` with separate configurations for each.

```ruby
shortcode = Shortcode.new
shortcode.process("[quote]Hello World[/quote]")
```

In a Rails app, you can create helper methods to handle your shortcoded content and use them in your views with something similar to `<%= content_html @page.content %>`. Those two helper method can be used if your content contains html to be escaped or not.

```ruby
module PagesHelper
  def content(c)
    Shortcode.process(c)
  end

  def content_html(c)
    raw content(c)
  end
end
```

### Tags

Any tags you wish to use with Shortcode need to be configured in the setup block, there are 2 types of tag, `block_tags` and `self_closing_tags`. Block tags have a matching open and close tag such as `[quote]A quote[/quote]`, self closing tags have no close tag, for example `[gallery]`. To define the tags Shortcode should parse do so in the configuration (in a Rails initializer for example) as follows:

```ruby
shortcode = Shortcode.new
shortcode.setup do |config|
  config.block_tags = [:quote, :list]
  config.self_closing_tags = [:gallery, :widget]
end
```

Note that you can call the setup block multiple times if need be and add to it.

For example:

```ruby
shortcode.setup do |config|
  config.block_tags << :other_tag
end
```

### Templates

Each shortcode tag needs a template in order to translate the shortcode into html (or other output). Templates can be written in erb, haml or slim and work in
a similar way to views in Rails. The main content of a tag is passed via the instance variable `@content`. Any attributes defined on a tag are passed in via an `@attributes` hash, shortcodes can have any number of attributes. For instance a quote shortcode might look like this:

    [quote author="Homer Simpson"]Doh![/quote]

And the erb template to render the shortcode

```erb
<blockquote>
  <p class='quotation'>
    <%= @content %>
  </p>
  <% if @attributes[:author] %>
    <p class='citation'>
      <span class='author'>
        <%= @attributes[:author] %>
      </span>
    </p>
  <% end %>
</blockquote>
```

If using the gem within a Rails project you can use the Rails helper methods within templates.

Shortcodes can be nested inside other shortcodes, there are no limits imposed on the nesting depth. This can be useful when creating complex content such as a collapsible list that can have any content inside each element. We could have the following shortcodes

    [collapsible_list]
      [item]
        [youtube id="12345"]
      [/item]
      [item]Hellow World[/item]
    [/collapsible_list]

Three templates would be required to support the above content, `[:collapsible_list, :item, :youtube]`. Each template is rendered in isolation and has no knowledge of parent or child elements.

There are 2 ways templates can be used with Shortcode, the default it to load templates from the file system, an alternative approach is to pass templates to the setup
block as strings.

#### Templates loaded from the file system

Simply create files with the extension or .erb, .haml, or .slim with a filename the same as the shortcode tag, e.g. gallery.html.erb would render a [gallery] shortcode tag. The default
location for template files is `app/views/shortcode_templates`, if you want to load templates from a different location use the `template_path` config option.

Note: only 1 template parser is supported at a time, if using haml for instance all templates must be haml.

#### Templates set as configuration options

The alternative way to define templates is to set them using the `templates` config option, this option can take a hash with keys of the same name as the shortcode tags and
values containing a template string. For instance:

```ruby
shortcode = Shortcode.new

shortcode.setup do |config|
  config.templates = { gallery: 'template code' }
end
```

Note: Templates can be loaded from either the file system or the configuration templates.  If `check_config_templates_first` is set to true (the default value) on the configuration then it will check configuration templates first, and file system templates if it doesn't find one.  If `check_config_templates_first` is set to false on the configuration it will check for a file system template first, and then configuration templates if it doesn't find one.  If it doesn't find a template in either spot then it will raise an error.

### Custom Helpers

If you wish to use custom helper modules in templates you can do so by specifying the helpers in a setup block which should be an array. Methods in the helper modules will then become available within all templates.

```ruby
shortcode = Shortcode.new

shortcode.setup do |config|
  config.helpers = [CustomHelper, AnotherCustomHelper]
end
```

### Presenters

Sometimes the data passed to the template from the shortcode it not enough. Lets say you want to render a gallery of images using id numbers of images stored in a database, e.g. `[gallery ids="1,2,3,4"]`. This is where presenters can help, they allow you to modify the `@content` and `@attributes` variables before they are sent to the template for rendering. Presenters are simple classes that define four methods. The class method `for` should return the name of the shortcode (as a symbol) it should be applied to, the `for` method can also return an array of symbols if the presenter is to be used for multiple shortcodes. The classes `initialize` method received the `attributes`, `content` and `additional_attributes` variables. Finally the class should define `content` and `attributes` methods.

In a rails app you could return image records to the template using something like this:

```ruby
class GalleryPresenter

  def self.for
    # An array can also be returned if the presenter should be applied
    # to multiple shortcodes, e.g. [:gallery, :enhanced_gallery]
    :gallery
  end

  def initialize(attributes, content, additional_attributes)
    @content = content
  end

  def content
    @content
  end

  def attributes
    { images: images }
  end

  private

  def images
    Image.where("id IN (?)", @attributes[:ids])
  end
end
```

#### Using additional attributes

At times you may want to pass through additional attributes to a presenter, for instance if you have a [gallery] shortcode tag and you want to pull out all images for a post, this can be achieved using additional attributes with a presenter.

```ruby
class GalleryPresenter

  def self.for
    :gallery
  end

  def initialize(attributes, content, additional_attributes)
    @content = content
    @additional_attributes = additional_attributes
  end

  def content
    @content
  end

  def attributes
    { images: images }
  end

  private

  def images
    @additional_attributes[:images].map &:url
  end
end
```

The hash containing the images attribute is passed through to the presenter as the additional_attributes argument to the `process` method.

```ruby
shortcode = Shortcode.new
shortcode.process('[gallery]', { images: @post.images })
```

#### Registering presenters

To register a presenter simply call `register_presenter` passing the presenter class e.g.

```ruby
shortcode = Shortcode.new

# A single presenter
shortcode.register_presenter(CustomPresenter)

# Or multiple presenters in one call
shortcode.register_presenter(CustomPresenter, AnotherPresenter)
```

### Configuration

```ruby
shortcode = Shortcode.new

shortcode.setup do |config|

  # the template parser to use
  config.template_parser = :erb # :erb, :haml, :slim supported, :erb is default

  # location of the template files, default is "app/views/shortcode_templates"
  config.template_path = "support/templates/erb"

  # a hash of templates passed as strings.
  config.templates = { gallery: 'template code' }

  # a boolean option to set whether configuration templates are checked first or file system templates
  config.check_config_templates_first = true

  # an array of helper modules to make available within templates
  config.helpers = [CustomerHelper]

  # a list of block tags to support e.g. [quote]Hello World[/quote]
  config.block_tags = [:quote]

  # a list of self closing tags to support e.g. [youtube id="12345"]
  config.self_closing_tags = [:youtube]

  # the type of quotes to use for attribute values, default is double quotes (")
  config.attribute_quote_type = '"'

  # Allows quotes around attributes to be omitted
  # Defaults to true, quotes must be present around attribute values
  config.use_attribute_quotes = true
end
```

## Contributing

1. Fork it
2. Create your feature branch (`git checkout -b my-new-feature`)
3. Commit your changes (`git commit -am 'Add some feature'`)
4. Push to the branch (`git push origin my-new-feature`)
5. Create new Pull Request


text:
---
layout: post
title: On Rooms' Backend Architecture
published: true
---
Following the advice of a friend I realized that I could have more fun learning a completely new paradigm of backend development - serverless. More specifically, *Serverless*... Framework.

I decided on AWS Lambda to:
- Save money for my team
- Enable easy Alexa integration
- Challenge myself to think around a new paradigm of backend architecture
- Create a needlessly scalable service (for similar reasons to above)

At this point in time I realize that by using Serverless to abstract away API Gateway and Cloudformation defeats some of the purpose but I'm having fun learning about the underlying tech anyways!

I'm using DDB because it fits easily with AWS and Cloudformation/Serverless Resources without much config and I haven't used it in a prod env yet.

<!-- talk about vandium, classes, structure and lengevity plans -->

One of my main goals for this project is to decouple the infrustructure and business logic from the WSQ campus and the existing locations here - meaning I want this to be extensible easily for future devs here and for devs at the other NYU campuses if needed. It's also a challenge in software design to be as modular and future proof as possible.

I'm using Webpack+Babel to transpile from es7 to es5. I find it weird that I've become used to the (syntactically) hacky nature of promises to handle async functions so I welcome async/await as a way to return to more conventional try/catch logic. I am otherwise dependent on => functions and Classes so in conclusion, the future is now with Babel!

I'm using [Vandium](https://github.com/vandium-io/vandium-node) which is a handy "framework" (but feels more like a lib) for simplifying some of the more boilerplate Lambda NodeJS logic.

### Class structures

Essentially all locations need to provide the exact same functionality as far as I'm concerned - I just need to reconcile the differences in their APIs and their responses. This is naturally conducive to an OOP structure. There are no interfaces in JS and I'm not using TS. Why? I don't know it and haven't bothered to learn yet.

We can consider that every location must comply to the following requirements:

- We can list available rooms/roomTimes
- We can search for specific rooms
- We can reserve rooms

All this requires standardizing the following (or creating Models for):

- Rooms
- RoomTimes
- Reservation Requests
- Reservations (there's a way to combine this and the above)
- Locations

***What is a roomTime?***

Since we're concerned with reserving rooms for a temporary period our concerns are both temporal and spatial - this necessitates a model that represents a room during a specific time period. Thus each room has many roomTimes associated with it.

**We face a problem** - not every location requires the same reservation request parameters. For example, some of the schools require a minimum of 2 occupants and their email addresses in addition to the reserver's. LaGuardia Coop's reservation system requires full name, current year standing, email address, NetID and how the reserver found out about the Coop.

> A somewhat interesting aside, the Coop actually uses Google Calendars for each room under the hood to manage actual occupancies - meaning we can circumvent the scheduling system (*ScheduleOnce*) and directly modify the underlying GCal, with permission. In fact, we *are* doing this. I will detail this shortly.

Anyways, Bobst doesn't require that info. But Bobst *does* requires the user to be logged in to view or reserve rooms whereas the Coop doesn't.

To implement this stuff the service can return the fields required + descriptions when the location endpoint is hit and the client can dynamically create the appropriate form fields (or Alexa prompts) in turn. To reduce the number of questions the user is asked everytime they reserve I'm considering a *post-first-login* questionnaire that asks certain common questions that remain static between reservations (email address, full name, etc). This questionnaire is reduced by grabbing info from our auth server (**Shibboleth**) which provides a lot of good stuff like year standing, school (within NYU), diploma (postgrad vs. grad vs. undergrad) etc. It may even make said questionnaire irrelevant, but this I will find out once I can see the questions asked and the details offered by Shibboleth.

On the topic of the Calendar based scheduling systems, my boss at STIT tells me there are apparently many GCal-based study room reservation systems. Even if this were incorrect, the rooms at the Coop (one GCal per room) suffice as motivation to create a class for GCal based rooms. From my experience with the Coop's GCal (which I was graciously allowed Read access to for research) I found that only occupations were listed, in 1 hour multiples. That means I have to create *virtual* roomTimes starting from the opening hours till closing for each day starting from "now" to 2 weeks on from then. This necessitates a VirtualRoomTime child class from the RoomTime with builtin methods for handling this emulation logic.

### Database

Our schemas revolve around the models detailed above. The exception being that we're not interested in past or existing reservations as data but rather only for metrics. We do keep individual user's reservations under their entries for the User views.

Our Location classes will contain information about their corresponding DB entries but we can assume the default corresponding entry PrimaryKey will be the shortcode.

As I started writing the DB interface I was being overly enthused about dependency injections for unit tests so I created a few layers of classes to abstract the DB completely, in case we decide to change our db of choice later. Why would we do such a thing and how likely is it? I don't know, and probably not at all. But I already went thru all the trouble so I'll take care of the superfluous code later. Famous last words?

### Authentication

NYU offers OIDC and SAML for auth but I need stateless session so OIDC it is. Also as an apparent benefit, OIDC doesn't require MFA - at least for the time being - so I can do automated endpoint testing.

license: MIT

branch_name: refs/heads/master

extension: md

license_type: permissive


text:
# network-remix
An interface to represent / discover relationships in text through network graph

### Credits
A project by [Eduardo Navas](https://github.com/navasse) with [Owen Mundy](https://github.com/omundy)

### License
MIT

![img](assets/img/2017-network-remix-moby-dick.png)

repository: omundy/network-remix

branch_name: refs/heads/main

repo_name: omundy/network-remix


text:
---
layout: post
title: [Delivery - Linux]
subtitle: HackTheBox
thumbnail-img: /assets/img/deliveryhtb.jpg
tags: [red]
---

This is my solution to the HackTheBox Delivery Linux box, another easy HTB box!

# Passage - Linux - <IP_ADDRESS>

## Enumeration:

We start off with an nmap:

`nmap -sC -sV <IP_ADDRESS>`

Results:

```
tarting Nmap 7.80 ( https://nmap.org ) at 2021-01-20 23:14 EST
Nmap scan report for <IP_ADDRESS>
Host is up (0.032s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 9c:40:fa:85:9b:01:ac:ac:0e:bc:0c:19:51:8a:ee:27 (RSA)
|   256 5a:0c:c0:3b:9b:76:55:2e:6e:c4:f4:b9:5d:76:17:09 (ECDSA)
|_  256 b7:9d:f7:48:9d:a2:f2:76:30:fd:42:d3:35:3a:80:8c (ED25519)
80/tcp open  http    nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: Welcome
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.56 seconds
```

We see an open port on port 80, so we access the site in a web browser with the ip address. We then add delivery.htb and helpdesk.delivery.htb to /etc/hosts under the ip.

Here, we see what appears to be a homepage with a "Helpdesk" link and a "Contact Us" link. Additionally, we see the site is being run on HTML5 UP.

## Getting In:

Clicking the two links, we find an osTicket support center along with mention of a MatterMost server that can be accessed with a @delivery.htb email. This information provides hints for gaining the foothold, possibly finding some credentials through the osTicket center and using them for the MatterMost server.

After submitting a random ticket as a guest user the support center provides a message with the ticket id and an email (possible credentials).

We then go to the MatterMost server and create an account with the provided email. It asks for email verification, and the link to verification can be accessed by using our ticket number and email entered in the ticket process with the search ticket option.

This verification provides access to the MatterMost server, where user "root" provides the following server credentials:

```
User: maildeliver
Pass: Youve_G0t_Mail!
```

With an open ssh port in the nmap scan, we can now ssh in with these creds, and cat the user flag.

## Root:

The root user provides some more hints in the MatterMost chat:

```
Also please create a program to help us stop re-using the same passwords everywhere.... Especially those that are a variant of "PleaseSubscribe!"

PleaseSubscribe may not be in RockYou but if any hacker manages to get our hashes, they can use hashcat rules to easily crack all variations of common words or phrases.
```

There are also a few more users in the chat that could serve as possible credentials.

Now we want to search for the hashes mentioned by the root user on the ssh.

```
find / name "mattermost" > hits.txt
```

```
cat hits.txt | grep "mattermost"
```

Here, we find the directory "/opt/mattermost", and in that directory "/opt/mattermost/config", we find "config.json".

After opening config.json, under SQLSettings we find: "mmuser:Crack_The_MM_Admin_PW", which are creds for the SQL server.

We can then login to mysql:

`mysql -h localhost -u mmuser -p Crack_The_MM_Admin_PW`

```
show databases;
use mattermost;
show tables;
select * from users;
select Username,Password from Users;
```

This gives us the root hash.

We now locate the hashcat rule we want to use (I used best64.rule), and we also put the hash and "PleaseSubscribe!" into text files.

hashcat -r /usr/share/hashcat/rules/best64.rule --stdout word > best64wordlist.txt

Since the hash starts with $2a$10$, we know that the hash is BCrypt, so let's get to cracking!

```
hashcat -m 3200 -a 0 hash best64wordlist.txt --show
```

We then get the password "PleaseSubscribe!21"!

From maildeliverer, we `su root` with our password and gain root access!

We find the root flag in the root directory and win!


text:
# Weekly Programmer

Weekly programming challenges for all programmers to practice programming using simple problems.

## The Challenges

* [Week 1 - The Baum-Sweet Sequence](https://accaliadeelementia.github.io/weekly_programmer/Week1/Challenge)
* [Week 2 - Sum of Many Primes](https://accaliadeelementia.github.io/weekly_programmer/Week2/Challenge)
* [Week 3 - Making Change](https://accaliadeelementia.github.io/weekly_programmer/Week3/)
* [Week 4 - Haven't I Seen You Before?](https://accaliadeelementia.github.io/weekly_programmer/Week4/)
* [Week 5 - The Mystery of the Polish Notation](https://accaliadeelementia.github.io/weekly_programmer/Week5/)


text:
# CryptoMomo

Buy and Sell Blockchain tokens using CryptoMomo. The safest and fastest way to buy and sell Bitcoin, Ethereum, Litecoin & BitcoinCash using your mobile money wallet. Choose a token, input your receiving address or mobile money number, & send your funds.  Minimal fees, and a simple process. You don’t need an account to use CryptoMomo. This means your funds and information don’t suffer custodial risk.

## Official Documentation

## Security Vulnerabilities

## License

The Lumen framework is open-sourced software licensed under the [MIT license](http://opensource.org/licenses/MIT)

repository: kyambaddesimon/CryptoMomo

repo_name: kyambaddesimon/CryptoMomo