XSS and bypassing an Imperva WAF with JSFuck
As it is mental health awareness week I decided to write my first ever LinkedIn article on a subject very close to my heart!
I hope some of you take the time to read it and it will also explain why I have been so quiet on the blogging front. Something I hope to rectify this year!
The article can be found on my LinkedIn here also I have added it here for those that don’t use LinkedIn.
As this is mental health awareness week I thought my first ever linkedin article would be appropriate on this subject. I should probably start like all people do with an introduction. My name is Dale and I started life in N.Ireland where I was born 41 years ago in the hazy past. I had a very normal and happy childhood, well as normal as it gets for us geeks of the world. I managed to mix time in front of computers, dismantling all my toys to see how they worked, reading and the like with playing sports and getting up to no good until the street lights came on.
If I am honest I always wanted to be a ‘Real’ policeman but was told I was too young, the next best thing for me was The Royal Air Force Police and back in 1997, as a young, naive 18 year old I started my journey into adulthood. I enjoyed much of my 22 year career seeing many parts of the world, Kuwait, Iraq, Falkland Islands, N. Ireland (again) and Germany with NATO. The experiences are some of my most cherished memories as also are many of the friendships I made along the way.
The last 8 years of my RAF career were where I believed I belonged and had spent my entire career aiming towards. I was now a Digital Forensics & Incident Response analyst helping to protect the MOD network from threats of all skill levels, including the user! What I was not aware of until I arrived was that the investigation of criminal and inappropriate web browsing would be carried out by us. Over the course of 6 years I often asked about the provision of counselling, apparently there were no resources. I learned very quickly how to wear a mask and still appear as that happy, cheeky chappy so I wouldn’t lose my job for being weak. I won’t labour that point but if you are a manager of people conducting these kind of tasks, do the right thing! Some of you may have noticed at the start of this paragraph I said 8 years, where are the other 2 years? Unfortunately after 6 years I broke and was officially diagnosed with PTSD.
This paragraph contains things I find very difficult to even write so please feel free to skip to the next. This started 2 years of being trapped in my home, but actually trapped in my own head. It didn’t just affect me though it affected my wife, who had to live with me and also many of the friends I once had. I estimate I viewed in excess of 1 million inappropriate images with at least 1/4 of those being criminal across all levels. I was a typical man though and the ‘Bravado effect’, yes its real and mentioned within ACPO guidelines kicked in, plus in the military the stigma attached to mental illness is one that was linked to weakness. Those images floated around in my head and morphed into images of my nephew, neighbours kids and other family member’s kids. You truly can’t imagine the torture that causes, but when I tell you I would not wish it on my very worst enemy then you might start to realise. I also now have somniphobia, a genuine fear of sleep, where I lose all control. I don’t generally sleep anymore, I nap when my body needs it and I have tablets should it need more.
My wife dealt with my thrashing, screaming and crying at night, my drastic mood swings and my self imposed isolation yet she still stuck by my side like the Rock she has always been to me. But the day she turned to me in the car after one of my many road rage incidents and said “I don’t feel safe in the car with you” it was like my heart stopped beating and the very next day I sought a referral to the Defence Centre for Mental Health. That started 2 years of therapy and medication. The therapy has not improved my mind substantially as I still have a very large distrust of humans and still feel safest at home where I control my environment. The medication has stabilised me and also helps me to leave the house when I really need to and have also prevented any further fits of anger. I have nothing but love for those members of the DCMH, within the MOD who tried to help me, the job broke me but the angels at DCMH did all they could to try and fix what they could.
About the time I was diagnosed, the other addition to our lives was our dog who I called Leffe and until that point I never understood the bond between people and their dogs, but I also hadn’t realised how important he would become for me. I called my wife My Rock, but she would have to go to work so Leffe became My Pebble and got me through many rough moments. I couldn’t and wouldn’t talk to my wife about my experiences and also didn’t like to talk to the therapist about them, to me it felt like I was almost distributing the abuse and torture and I wanted to protect people from that!
That is Leffe and yes he is picking my pocket! Leffe listened to many of my issues, he was a great listener, useless at advice but always knew when I needed a hug or a lick on the face. He isn’t an official support dog but he is my support dog!
I am still medicated and stable as far as mood swings and anger go, but I will never be able to remove the images from my head, what has been seen cannot be unseen and I will probably never be the happy cheeky chappy I once was but I have a wife I love more than words can say, a dog I couldn’t be without and a small circle of friends who stuck with me even at my worst. On that front I am blessed.
I also take great solace from the fact that I unmasked evil people and also protected children from further abuse, I hold onto those facts dearly as they are a large factor in why I have never had any self harm or suicidal thoughts, the other fact being Colleen my amazing wife and my true friends.
Thanks to one of those friends Martin Heyde, I also currently have a career for as long as I can manage it, or as long as Deloitte will have me! I started with them just before the Covid19 lockdown came into full effect, the environment was completely different and I immediately felt at ease, enough to tell people about my PTSD but also to offer an ear to anybody who might need it. I feel as a manager I always want to be approachable for people to come and seek advice or even just talk through having a bad day. I think in the current climate it is more important than ever before. I may have had 2 years experience of Lockdown, but I realise many people are finding it tough. If my openness helps even one person then it’s worth telling people.
I truly believe that the stigma that once surrounded mental health is something that is starting to fade, especially so in Deloitte where you are respected for what you can do and not what you might be carrying in your mental baggage.
I will always be here to offer a shoulder and an ear if somebody needs it and I believe that makes me a decent human being, the world has much evil in it so stand up, be there for your fellow human being and remember to be kind as you never know what somebody is struggling with behind the mask they are wearing.