Thomas van der Berg

Christmas Kitty

Wed, 24 Dec 2025 21:51:11 +0100

Merry Christmas and happy new year! Thanks Hao Tian (田好) for making this Christmas Kitty:

Web pentesting with Firefox Containers and Container Proxy

Tue, 23 Dec 2025 21:13:54 +0100

I thought I’d share my workflow for web pentesting with Firefox containers. It has advantages by allowing you to be logged in to multiple accounts at the same time, which helps with authorization testing, and also makes it easy to separate traffic sent to the intercepting proxy and other traffic without configuring Foxyproxy patterns. I’ve been using it for years but I haven’t really seen it used much by other testers, so I thought I’d write about it as it can be useful for others.

When performing web pentests we usually use an intercepting proxy such as Burp Suite to investigate the traffic of the web application. One of the problems with using an intercepting proxy is choosing which traffic to intercept and which to ignore, as you may want to use the same browser for other things as well. The traditional solution for this is to use Foxyproxy, but I never really liked this solution as it depends on configuring URL regexes, which is manual, error-prone and might cause you to miss traffic especially background traffic and redirects. Of course it’s also possible to use a different browser (like the Burp Browser) for testing, but this means you can’t use Firefox specific functionality in your test, such as Firefox containers.

I’ve been using Firefox Containers for a while, it allows you to have separate site storage for the same websites, which is great for pentesting. For example I might get four or more accounts for a pentest, such as admin and regular user accounts for different organizations in the webapp. And I also want to test anonymous access. Using containers, I can make different containers for each account and be logged in with every account at the same time as I test. This really makes the test easier and allows you to find more stuff.

What really made me happy was when I found Container Proxy. This addon allows you to configure a proxy differently for each Firefox container. By making a bunch of Burp Suite containers, I can easily separate testing traffic from other traffic in the same browser! No more foxyproxy patterns needed!

Containers also works well with another extension I use during pentesting, Cookie Quick Manager. With this it’s possible to copy cookies from one container to another and edit them. Copying cookies is sometimes useful for example when the login flow doesn’t work well with Burp, one possible bypass is to log in without Burp and copy the cookie (of course you can also temporarily disable proxying during the login).

That’s it! Just thought I’d finally document it as I think it’s a really effective way to test.

So apparently it’s been one and a half year since my last blog post. I’m still here, just don’t always have much to say. Wish every reader a happy christmas and a nice 2026!

Fix CJK font order on Linux (Ubuntu)

Sat, 27 Jul 2024 12:37:43 +0200

A short post for something I’ll probably need to remember in the future. In Unicode, Chinese simplified, traditional, and Japanese style characters all use the same glyphs. Font rendering is used to turn the glyph into a simplified, traditional, or Japanese style character. Today I found my Ubuntu system was using Japanese style characters while I wanted it to use Chinese simplified (since I’m learning that). Sadly changing this wasn’t as simple as a toggle in a menu, so here I write down what I did to fix it.

For an illustration of the problem, see Wikipedia: Examples of language-dependent glyphs.

Ubuntu’s font configuration is stored in /etc/fonts/conf.d. In this directory there’s a lot of files. Eventually I found that 64-language-selector-prefer.conf contained the configuration needed to change the default rendering of CJK (Chinese, Japanese, Korean) characters. In this file, you can simply change the order:

The default ordering seems to be Japanese first.

To refresh the font config cache, you can run: FC_DEBUG=1024 fc-cache (FC_DEBUG will make it so you can see which files are being read)

This should fix the font rendering! Happy hacking.

Note that Firefox ignores this configuration and instead uses its own font configuration under about:config key font.cjk_pref_fallback_order.

avoiding RSI and improving computer ergonomics with some scripting and a dmenu hack called kbmenu

Tue, 16 Aug 2022 19:48:46 +0200

RSI issues

A few months ago I got some beginning RSI symptoms: pain and tingling sensations throughout the lower arms and hands. The direct cause was an intense weekend writing a large pentest report, combined with programming scripts to ease the reporting in the future. At the same time I was configuring my new laptop and using a new windowing system which relied heavily on key combinations (win+this, alt+that, …). All in all I was hurting my hands heavily and they needed rest.

I took the symptoms seriously and took a number of steps. I bought a new much more ergonomic desk and an ergonomic keyboard. I started taking frequent typing breaks and more and longer breaks in general. And I read online about methods to decrease strain on my hands while using my computer. After a few weeks, the symptoms subsided and currently I feel like I’m back to normal.

Single key shortcuts

While reading about computing ergonomics, I found a provocative article from Xah Lee called Why Tiling Window Manager Sucks. I encourage you to read it even if you disagree with his conclusion, because he writes an interesting challenge to those who use tiling window managers in the article:

Try the following workflow for a week. I’d be interested to know if you still think tiling windows great.

Remove tiling manager. Use a basic, normal, one, such as xfce.

Set workspace/virtual-screen to just 1. (and remove the tens of related keybindings)

Set up 3 function keys to switch to 3 of your most used app. For example, {F8, F9, F10} for {emacs, browser, terminal}. [see How to Set Key to Switch to Browser]

Set up 1 key to cycle windows within a app. F3. (trivial to do in xfce. Harder in lxde/openbox.)

Set up 1 key to switch to last window, such as F4. (this is normally Alt+Tab. In xfce, can be done easily. In lxde/openbox, the problem is that it requires pressing Enter to “exit” the switch, similar to releasing Alt.)

Set up 1 key to toggle max/restore window size. F1

Set up 1 key to close window. For example, F6 (must be 1 single key. Alt+F4 is not good.)

Set up 1 key to switch prev tab, and 1 key to switch next tab. (i use {F11, F12})

Set up 1 key to close tab. For example, the Pause/Break key. [see Print Screen, SysRq, ScrLk, Pause, Break Keys] (note: the prev/next tab key, and close tab key, should be next to each other. If you are using a full-sized IBM PC keyboard with numberpad, best to use / * - for {close, prev, next} tab, in that order. [see How to Program Number Keypad as Function Keys] )

Turn on mouse hover auto-raise window. (not just focus, but raise.) [see Linux: Mouse Hover to Raise Window]

Ban double-click. [see Linux: Set Mouse Single-Click to Open File]

As a heavy user of workspaces and having over time learned many keyboard shortcuts, I did feel like typing a lot of awkward combinations caused me a lot of awkward hand movements. I was intrigued by the idea of creating single key shortcuts using rarely used keys, an idea I had not thought of before.

Since then I’ve setup my system to use a bunch of Xah Lee’s suggestions, and they’ve been working great. I’ve made my own changes though. Currently both my personal Linux system and my work Windows system have the following shortcuts configured:

F2 - Copy
F3 - Paste
F4 - Switch to previous window (Alt+Tab)
F6 - Close window (Alt+F4)

In addition, I’ve configured F8 to F10 for my most used apps on both systems. On Windows I reconfigured printscreen to be the same as ctrl+shift+s (select a region and make a screenshot) as I used it way more often. On Linux I set printscreen to the following script, which makes a screenshots and copies it to the clipboard:

#!/bin/sh
file=/tmp/screenshot-$(date +%s).png
maim --select "$file"
xclip -selection clipboard -t image/png "$file"

I’m really happy with the new shortcuts as they save me from needing to make awkward hand combos for my most commonly used tasks. For Windows I used PowerToys to configured they keys. On Linux I used Autokey as well as regular Xfce key bindings.

Another interesting article I found from Xah Lee was Ban Key Chords where he talks about key chords versus key sequences. Key chords require you to type multiple keys together, such as ctrl+shift+s, while key sequences let you type them like a text, for example alt, then e, then c to copy. I thought the idea of key sequences to be smart and I’m surprised they seem to be rarely used on Linux. In fact I couldn’t find a way to configure my own sequences in any way.

At this time I thought it would be great to use a single rarely used key, such as F12, to show a menu where every key would lead to a specific action defined by me. I did some research, and couldn’t find any software that let me create such a menu easily. Eventually I decided I could take dmenu which comes close, and edit it so it would select an option as soon as it is no longer ambiguous. dmenu turned out to be easy to hack, and so I created my own kbmenu, which can be used in scripts such as the following:

#!/bin/bash
run=$(<$HOME/Documents/keymenu.txt kbmenu -l 20 -b | cut -d' ' -f 2-)
bash <<< "$run"

Where keymenu.txt contains the following sequences:

c tcopydb cwe.csv
r tradio*
s select-window-kb
m sleep 0.1s && xdotool type ik@thomasvanderberg.nl
v tcopydb vuln-nl.csv

* (See also tradio)

The effect is that I can type F12, then any of the keys to run a command I’ve created. For example F12,m will write my full email address into any selected field. A number of other commands link to other scripts I’ve created, and it’s easy to add anything new to it.

For ease of access I’ve put kbmenu on Github though it is just a simple change. The only change was in the match function, which was replaced with the following:

static void
match(void)
{
    size_t textsize;
    struct item *item;

    matches = matchend = NULL;
    textsize = strlen(text);
    for (item = items; item && item->text; item++) {
        if (!fstrncmp(text, item->text, textsize))
            appenditem(item, &matches, &matchend);
    }
    curr = sel = matches;
    if (curr == matchend) {
        if (curr && curr->text) {
            puts(curr->text);
            cleanup();
            exit(0);
        } else {
            cleanup();
            exit(1);
        }
    }
    calcoffsets();
}

Hope I gave you some interesting ideas for increasing your own ergonomics or computer efficiency. If you’re feeling pain in your arms and/or tingling, please take rest to let your hands recover and possibly check with a doctor if it takes longer than expected.

Rejoice! You can use KDE filechooser in Firefox and other GTK apps

Thu, 14 Apr 2022 22:27:03 +0200

Today, I found out that it’s possible to use KDE filechooser in Firefox and other GTK applications thanks to the xdg-desktop-portal project.

To take advantage of this, make sure xdg-desktop-portal-kde is running (Starts automatically on Kubuntu. You should be able to run it manually if KDE is installed). Set the environment variable GTK_USE_PORTAL=1, for instance by appending export GTK_USE_PORTAL=1 to your ~/.profile. Since Firefox 98, you can also set Firefox to explicitly use xdg-desktop-portal through the configuration parameters under widget.use-xdg-desktop-portal.* (set them to 1 to always use the portal).

Firefox portal configuration:

Old, GTK filechooser:

New, KDE filechooser, with image previews and other basic usability features:

Life has been improved ✅

Diving into userscripts

Tue, 01 Feb 2022 19:43:14 +0100

Userscripts are something I never really investigated but always intrigued me. Last weekend I decided to finally check out how to make them.

The trigger was the following page:

This nag page has been showing up lately whenever I click on a web link from a YouTube description or comment. Yes YouTube, of course I want to leave the website! It’s the world wide web and I clicked on a link!*

It kind of annoyed me, so I wanted to see if I can get rid of it by writing a user script. Turns out it was pretty easy by checking what existing scripts did and turning it into my own thing. I published my script on Greasy Fork, a website for sharing userscripts. Click here to view my script page.

Installing a user script is as easy as installing the Tamper Monkey extension and then going to Greasy Fork and clicking “install” on a user script. Be sure to check the content of the script first though, as a malicious script could impersonate your session and do bad things on your behalf. Luckily most user scripts are very small and easy to audit manually (that’s rare in software!)

Since it’s easy to include here as well, here’s the full content of the “YouTube outgoing links fix” script as I have it working now:

// ==UserScript==
// @name         YouTube outgoing links fix
// @version      1.0.2
// @description  Replaces outgoing links to avoid the YouTube "are you sure you want to leave" page
// @author       Thomas van der Berg
// @namespace    tmsbrg
// @match        https://www.youtube.com/*
// @grant        none
// @license      GPLv3+
// ==/UserScript==

(function() {
  'use strict';

  // from https://stackoverflow.com/questions/951021/what-is-the-javascript-version-of-sleep
  function sleep(ms) {
    return new Promise(resolve => setTimeout(resolve, ms));
  }

  async function replaceLinks() {
    await sleep(2000); // bit of a hack: seems we need to wait for YouTube to do its stuff before we act
    let outgoing_links = document.querySelectorAll('a[href^="https://www.youtube.com/redirect"]');
    for (let i = 0; i < outgoing_links.length; i++) {
        let original_destination = outgoing_links[i].href;
        let new_destination = decodeURIComponent(original_destination.split("&").filter(arg => arg.startsWith("q="))[0].substring(2));
        outgoing_links[i].href = new_destination;
        outgoing_links[i].data = null; // remove some YouTube specific stuff that tries to open youtube.com/redirect on click
    }
  }

  window.addEventListener('yt-navigate-finish', replaceLinks );

})();

The trickiest thing for me was figuring how to trigger my code whenever you open a new video, as YouTube doesn’t have a page reload when you click a video. I found in other peoples’ scripts that you can hook into the yt-navigate-finish event, so that’s what I did. Another tip: Since you’re just adding JavaScript to the page, you can test every step using the web console easily to see if it’s working as expected.

The script just goes through every link where the target starts with https://www.youtube.com/redirect, and then replaces it with a direct link to where you want to go. I had some fun checking out some JavaScript programming to build it, as it’s been a while.

I hope the script is useful for some others as well who are annoyed by the new YouTube redirect page. And I encourage you if you’re read up to here: The next time a website you’re using has an annoying feature or you’re missing something, see if you can write a simple userscript to make your life better and publish it. Let’s keep users in control of the web ☺

* Oddly enough, while testing out the page on Chromium for this blog, I couldn’t trigger it. It seems this nag page is only triggering for me on my Firefox. Maybe it’s my settings, but maybe it’s also another way for Google to annoy users to force Chrome on them.

makepty: A static executable to upgrade raw shells to PTYs

Tue, 15 Jun 2021 12:46:31 +0200

I’ve recently been spending time creating a static executable that can replace python3 -c 'import pty;pty.spawn("/bin/bash")' for platforms which lack python, inspired by a FreeBSD box I was attacking on HackTheBox.

The result: makepty, a little Rust program that simply creates a PTY and connects it with stdin and stdout. Click on the video above to see it in use.

You can get more information on the makepty Github and you can download it from the static builds release.

I’ve tested it for Linux and FreeBSD and wrote extensive instructions on the Github page.

How Microsoft implemented and then removed a crucial Teams feature on Linux

Thu, 25 Mar 2021 10:34:08 +0100

Microsoft Teams is the most downloaded software of 2020. It is now used by offices, schools, courtrooms, governments, and pretty much every other type of organization. As the lockdown was active in april, I had to download Teams to contact my colleagues, as many others had to. At my current assignment, it is the main communication tool for the company.

One feature Teams lacked at that time is to see more than four people on the same screen. A major shortcoming when compared to competition like zoom, especially in an environment where work events were now all online and could include tens even a hundred people.

“As quickly as it came, the feature was removed for Linux”

A few months later Teams users rejoiced: an update came that allowed everyone to view 9 people at the same time. I remember this feature being quickly available on both Linux and Windows. Then, about a week later, as quickly as it came, the feature was removed for Linux in another update. Though most of my Windows colleagues were able to see 9 participants in video calls, I was left with a view of only 4 people. For me and other Linux users, this was worse than before. Now we were left out. Though others could see something funny or nice a team mate is doing while muted, we saw nothing. Though others could see us, we couldn’t see them. At the time I thought there must have been a temporary bug. I patiently waited, as many others. See this Microsoft forum thread opened on september 2020.

Now it is march 2021, at least half a year after this feature was briefly introduced and then removed for Linux, while remaining active on Windows. Since then, a new view was introduced that allowed windows users to see up to 49 users at the same time, which is great for large team events. However, on Linux we are still stuck with only being able to view four other people.

Stuck on a backlog?

What happened? Microsoft employees in the forum thread I linked above say it’s being worked on and it’s on the backlog. However, one forum user noted that the backlog for Microsoft Teams and Linux is completely empty. Another forum user commented on how Teams is simply implemented as an Electron app, so it would be odd that some major Linux bug is keeping Microsoft from being able to re-implement this feature.

So what’s taking Microsoft so long? Is it really being diligently planned but difficult to return? Is it stuck on a backlog? Or is this a case of the Microsoft’s Embrace, Extend, Extinguish, I’ve heard about a lot in the past?

Linux users are still here

I didn’t write this blog post to demonize Microsoft, but I really hope to be able to create some noise and make Microsoft realize Linux users are still here. We’re using Azure and other Microsoft products, and we just want to be able to interact with our colleagues as they are able to interact with us. So Microsoft, please re-enable large gallery view in Linux!

Fastest fix for responsible disclosure I've seen

Tue, 09 Mar 2021 10:41:11 +0100

Last week I was trying to buy something to fix a bicycle tire.

I ended up on BikeBudget and while looking around found a security vulnerability.

After reporting it on friday their response was the fastest and nicest I’ve seen! Within an hour the vulnerability was fixed and they mailed me.

In the end they offered to send me the tire fixing set for free, and they sent me a whole box of swag! Thanks! That’s really nice.

Picture of the swag and thank you note:

I created a webapp to help me learn simplified Chinese characters

Tue, 20 Oct 2020 14:56:10 +0200

Find common Chinese characters using pinyin.

Click the image to try it now:

What

It’s a tool that allows you to enter pinyin and optionally a tone number and shows only the commonly used Chinese characters with this pronunciation.

It allows you to switch between the top 3500 character list (frequently used) or the top 6500 (relatively common),

Some other features include showing or hiding all pinyin pronunciations for the characters, and showing or searching by the index of the character from the source Table of General Standard Chinese Characters.

It currently only deals with simplified characters, because that’s what the source deals with and what I’m trying to learn.

Note that this is not a comprehensive Chinese learning tool. To learn Chinese you need to learn words, not just characters. Characters are just one layer in the Chinese language, and even full understanding of all Chinese characters would not mean you’ve learned the language.

Why I made this

While learning Chinese, I wanted to get an understanding of which Chinese characters are actually in common use. If you look in a dictionary for a list of Chinese characters, you will get a bewildering amount of characters. Dictionaries try to be comprehensive. Fortunately, most of these are only in historic use.

I wanted to remove the forest of irrelevant (for my purposes) characters and find get a list of ones actually worth investing time into.

I made this to get an overview and easily be able to answer questions like “how many common characters share this pronunciation?”.

I also wanted it to work without having to wait for a web page to load for each query. I made it work using a fully offline search (you download the data when loading the page itself).

Sources and data

During my search I found this official list of Table of General Standard Chinese Characters made by the Chinese government.

Sadly, this list is a rasterized PDF which does not even contain the pronunciation of these characters.

Still, it seemed like a good authoritative reference of commonly used characters. I started searching around and found a text version of it on this Chinese webpage. While checking the data I found it had some mistakes around characters 3649 to 3668, which I had to fix manually.

To combine this with pronunciation data I found the Unicode Pinyin Table. I’ve added numerouos pronunciations manually, when I found them missing from that source. I’ve logged my manual edits in edits-to-hanzi-pinyin.txt. Note that since I’m only a basic Chinese speaker myself, I can’t exclude that there’s likely more mistakes. I’m open to using a more reliable source for pronunciation data if one is available.

Using this data I created the hanzi-pinyin.6500.csv and hanzi-pinyin.3500.csv files which are the source of the Hanzi search tool.

How did I make this

Originally I just used grep to search the hanzi-pinyin CSV files, but found it to become cumbersome due to the need to write regular expressions when I just wanted to think about pinyin.

I created the cnhz python script for myself, originally as a simple wrapper to build the grep regexes for me so I could just write pinyin. I then added more features around it.

As it got more useful I thought about how I could make it more accessible for other Chinese learners too. Most of them do not use Linux or have Python installed. I thought of rewriting it in Go to make it a single executable - but found the command line format would be awkward for most people. Also Windows cmd.exe does not support Chinese characters.

I eventually decided to turn it into a webpage. the CSV files were sufficiently small that the entire database could be loaded into the browser’s memory so you could do a completely client side search - making the experience much smoother than loading an online dictionary entry.

Also, because I can easily host it on my own web page, which I pay for anyway, I don’t have any need to add advertisements or anything to make the experience worse.

Furthermore, the page can easily be downloaded and used offline by any learner in case my site goes down or for when you don’t have internet.

I tried to support offline working more by making the site into a progressive web app. However, while adding a manifest was easy, I found that to add a service worker (which allows offline caching) - I would have to move all assets including a copy of my main CSS file to /cn/hanzi/. Not having time to figure this out at the moment, I decided to not add service workers for now.

By the way, the hanzi_list.js file was generated from the CSV sources using an awk script:

< ../files/hanzi-pinyin-full.csv \
    awk \
    'NR==1 { printf "const hanzi_3500 = \"" }
     NR==3501 { printf "\"; const hanzi_6500 = hanzi_3500 + \"" }
     { print NR","$0"\\n\\" }
     END { print "\";\nconst hanzi_6500_split = hanzi_6500.split(\"\\n\");" }' \
 > ../js/hanzi_list.js

I hope you find my Chinese hanzi tool useful. If you have any questions or want to contact me, see my details below.