> cat learning_journal.log
extra info.
a collection of concepts, reverse engineering notes, and q&a snippets i've picked up.
q&a notes
> How do you bypass cloudflare tls fingerprinting in scrapy?
Standard Python requests or Scrapy HTTP clients send predictable TLS signatures. You need to use HTTP/2 client middleware or browser impersonation libraries like curl_cffi to spoof legitimate browser TLS fingerprints.
> What is the difference between asynchronous I/O and multithreading?
Async I/O runs on a single thread using an event loop to switch between non-blocking tasks while waiting for network responses. Multithreading spawns multiple OS threads, which adds memory overhead and potential race conditions in Python due to the GIL.
> How i exploited file upload vulnerability in my friend's web app to gain remote code execution?
I initially tested, if the site accepts all kind of files. And guess what? It didn't accept .py file straight up, but it accepted .svg file.
After uploading a malicious SVG file, I was able to execute arbitrary code on the server. I added Ip grabber on his site using the uploaded SVG file. I also managed to extract cookies and other important admin credentials.