 someone else too.
Visualizations
- FiveThirtyEight
- Flowing Data
- The Upshot
- Information is Beautiful Awards
- /r/dataisbeautiful
- The Pudding
Data Sets
- Google's Dataset Search
- List of Public APIs
- BuzzFeed News Data
- FiveThirtyEight Data
- Government Data
- Data is Plural
- /r/datasets
- ProPublica Political data sets
- Awesome Public Datasets
- Kaggle
- The Pudding
I asked about new ones on twitter a while ago, and got some of these from there! I linked the Tweet if you're interested in seeing more!
I'm teaching a intro to Python and data science class right now, and here are some resources I shared for finding data sets.
reddit.com/r/datasets/top…
tinyletter.com/data-is-plural
data.gov
github.com/BuzzFeedNews
data.fivethirtyeight.com
Any other faves?12:11 PM - 20 Mar 2019
Discussion (6)
A while back I stumbled upon Sheetsee.js which allows you to connect Google Sheets to a website and use the data in there for Visualization.
Link: jlord.us/sheetsee.js/
It worked pretty well with D3.js
I really like observable tool for visualizing data.
For example:
What Part of Your Body Will Kill You at Every Age
A* search
The most populous cities in the world
Thanks @aspittel!
Another great source of datasets and visualizations is the weekly Tidy Tuesday challenge by R for Data Science.
Read more at github.com/rfordatascience/tidytue... and browse past visualizations at tidytuesday.rocks.
Happy plotting!
Well gotta add some to my list now! Thanks for the dataset resources! :)
Nice!
I was just looking for datasets (ecommerce/products, business intelligence, customer rel, etc.) to try some visual stuff.
Thanks so much! You da bawsss 🤜🤛And bedrock is technically broken due to mob spawning, inconsistent redstone, laggy combat compared to java 1.8 (and modern versions with server mods), and a lot of community created servers are on Java.  Also there’s basically complete games as mods.  The bedrock codebase is from 2011, and is meant to run on phones from that time, so everything technical is stripped out, such as having very basic mob AI compared to Java.

Both versions are developed at the same time since Update Aquatic.  Java just gets snapshots because the code is more complicated, the community cares more about technical bugs, and it’s easier to release snapshots on Java, which has its own launcher.  Bedrock versions are mostly untested when released, so lots of technical things break on that version.

Also Java is the original version.For our final writeup for this event, we have Slippy, the easy-rated web challenge. I was really struggling with this one until the last day (the high solve count did not help), not because it was technically challenging, but because it required a couple of moving parts to be true. After an initial code review, we’ll take the name as a clue and do some research into the “Zip Slip” archetype of vulnerability. Knowing that the Flask app is in debug mode, we can leverage the “zip slip” vulnerability to overwrite routes.py to include our SSTI vulnerability, which we can use to get RCE and grab the flag.
The webpage looks like this. Unfortunately, nothing to do with Melee.
If we do what it says, and upload a valid tar.gz archive, we can see that our files are uploaded to a directory on the webserver.
Clicking the file simply brings us to the file. It appears that each time we upload an archive, we get put into a new directory with a random string of letters.
As we could tell from the web page, things are pretty sparse. The file structure of the source code folder looks like this.
The Dockerfile and build-docker.sh files don’t really clue us into anything. The config.py file tells us that the webserver is in debug mode, which will be useful for later. The main file of focus isutil.py.
We’re using the tarfile library to untar the archive that is submitted. Based on the code, it’s likely that trying to mess with the file signature or extension to allow us to upload whatever we want won’t work, because the program will throw an error. Other than that, nothing really seems out of the order.
What is interesting is that the file itself, or the files themselves are not explicitly vetted. There’s no checks for anything abnormal, meaning we do have full control over what gets put on the server, it’s just a matter of figuring out what we can put on the server to really cause some damage.
This is where I was stumped for most of my time working on this one. Most of my experience exploiting tar is the stuff that you’d find on GTFOBins, and all of those have to do with creating archives, not extracting. My initial research led me to “tarbombs”, where you have a tar archive with a huge file in it. If the webserver doesn’t check the file size, this can easily be used for denial of service. However, this wouldn’t get me any closer to a flag.
Then, as any rational CTF player would do, I looked for similar scenarios online. I tried experimenting with the --to-command=bash flag, which would pipe the contents of the file I unzip into bash, allowing for code execution. However, since the tar archive needed to be compressed as well, this was not an option. I then started using the name as a hint and found the “Zip Slip” vulnerability.
Zip Slip is a widespread critical archive extraction vulnerability, allowing attackers to write arbitrary files on the system, typically resulting in remote command execution […] The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g.../../evil.sh).
I can’t craft a name that looks like that from the command line, because it resolves the directories immediately.
What file would I need to overwrite if there’s no SSH, and I can only go in scope of the webroot?
To solve problem 1, I found entries in Hacktricks and PayloadsAllTheThings (they just have everything don’t they?). These link me to evilarc.py a script by ptoomey3.
The next problem that needed to be solved was finding what file to overwrite, and with what. At this time, I found a CTF writeup for another challenge that was very close to being, if not exactly, the same challenge. I’ll summarize how it works here.
On my host machine, I craft the payload like so.
My file uploads successfully, but clicking on it gives me a “Not found” error.
However, if I navigate to /exec, I see the following.
We can modify the SSTI payload we used in GoodGames to get code execution.
This was my first Hack The Box-powered CTF, and I had a really good time. For being on my own, making it to 78th feels pretty good, especially after reading some of the solutions to other challenges (the hardest web one involved an unpatched 0day in a library that hasn’t been touched in 7 years???). I’ve done writeups on everything that I’ve completed thus far, except for the user flag on Object, the hard-rated “Full Pwn” machine. Since I didn’t finish the machine, I didn’t see the point in doing a full writeup for it.Just had my birthday a couple days ago. Know what that means... now I am a MAN. I, Lyle Bennet, have just turned 18. Oh yes. So, if someone could point me in the direction of some pretty ladies, or better yet send them to me? Because that would be really awesome. It really would.Zach Andalman, ‘23, who has done research in the Strontium Lab with Assistant Professor Nir Navon, was featured in the September 8th (volume 1) issue of the Yale Society of Physics Students’ newsletter. This was the first in a regular series of articles spotlighting an undergraduate student. See below for full interview.
I am a rising sophomore and physics major in TD (the best res college). I’m from Evanston, IL and I have two little brothers and a German shepherd mutt. I’m the treasurer of the Yale Triathlon club and a project leader for YUAA, Yale’s aerospace club. I love endurance sports, the outdoors, Settlers of Catan, Monty Python, and science fiction.
Since spring of 2019, I’ve been working in professor Nir Navon’s Strontium lab. The goal of our lab is to cool Strontium atoms down to nanoKelvin temperatures to study quantum many-body systems. Specifically, we’re hoping to study quantum cellular automata and quantum gates for use in quantum computers. The lab is still in its infancy, so I’ve been working on designing a lot of the electronics and optics. I’m also working on creating a new experimental control software for AMO physics