Finding in @fluxfingers' hack.lu CTF: node.js' http client translates hostname "localhost.xn--" (internationalized domain name / IDN) into "localhost.". So the hostname may bypass some filter/WAF to get better SSRF.

Interesting interaction of scoping rules and exec in Python 3.8.2: a = 2 def f(): exec('a = 1; print([ x for x in [ a ] ])') def g(): exec('a = 1; print([ a for x in [ a ] ])') f() # prints [1] g() # prints [2]

OCaml code 'let r = (let x = 1 and y = 2 in x + y);;' may be represented in Python very well abusing decorators: @ apply def r(): x = 1 y = 2 return x + y

Some binaries have __libc_csu_init embedded. On x86-64, it has 2 gadgets (G1 & G2) to invoke slots with ROP: G1: mov rdx,r13 mov rsi,r14 mov edi,r15d call QWORD PTR [r12+rbx*8] add rbx,0x1 cmp rbx,rbp jne G1 add rsp,0x8 G2: pop rbx pop rbp pop r12 pop r13 pop r14 pop r15 ret

#PHDays 8 is coming on (May 15-16, Russia, Moscow). Meanwhile I posted a follow-up email for my talk about john-devkit given at @PHDays VI (2016). openwall.com/lists/john-dev/…