Practical man-in-the-middle attack on pip

I got an interesting article that warns installing packages using pip
in an untrusted environment

You can  intercept and manipulate packages downloaded by PyPi
using the below python code

https://gist.github.com/4698537

yeah~ poc time~

Proof Of Concept

1. run a proxy to see all HTTP traffic through the proxy
2. redirect traffic over your local machine
3. intercepts all traffic
4. use the python script to manipulate downloads by PyPi

cx_Oracle...

#1
Problem
ORA-12705: Cannot access NLS data files or invalid environment specified in

ORA-12705: "invalid or unknown NLS parameter value specified"
Cause: There are two possible causes:
- An attempt was made to issue an ALTER SESSION statement with an invalid NLS parameter or value.
- The NLS_LANG environment variable contains an invalid language, territory, or character set.

Solution
putenv("NLS_LANG=KOREAN_KOREA.KO16KSC5601");
putenv("ORACLE_SID=oracle9");
putenv("ORACLE_HOME=D:\oracle\ora92");
putenv("ORA_NLS33=D:\oracle\ora92\ocommon\nls\admin\data");
putenv("TNS_ADMIN=D:\oracle\ora92\network\ADMIN");

linux: export NLS_LANG=KOREAN_KOREA.KO16KSC5601
Windows console : set NLS_LANG=KOREAN_KOREA.KO16KSC5601
LINUX(UTF-8) 시스템 : NLS_LANG=KOREAN_KOREA.AL32UTF8



#2
Problem
UTF-8 Encoding

Solution
# -*- coding: utf-8 -*-

import os
os.environ['NLS_LANG'] = '.UTF8'
con=connet('user/password@ip:port/UID')
con.encoding

 

[python] spidermonkey #1

Hi,

Have you used [SpiderMonkey] which  is Mozilla's JavaScript engine?

[SpiderMonkey]

https://developer.mozilla.org/en/docs/SpiderMonkey

[python-spidermonkey]

http://pypi.python.org/pypi/python-spidermonkey

[ref]

http://pydermonkey.googlecode.com/hg/docs/rendered/pydermonkey.html
http://code.google.com/p/python-spidermonkey/

[Code Snippet]

# -------------------------------

# run a JavaScript file

# -------------------------------

import spidermonkey

runtime = spidermonkey.Runtime()

context = runtime.new_context()

f = open("path",'r')

script = f.read()

context.eval_script(script)